Windows Analysis Report
NetSpot.exe

Overview

General Information

Sample name: NetSpot.exe
Analysis ID: 1522643
MD5: 8ce5f5b39cd7ab4a9b227068d3f3b12a
SHA1: 7559b2c5c2d1bfad6b22107caed801e456a152b4
SHA256: 758c7a88d4c1b5332ad90ad057858bf67d9846400913c1c1a2bd52f187482e28
Infos:

Detection

Score: 4
Range: 0 - 100
Whitelisted: false
Confidence: 0%

Signatures

Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Uses 32bit PE files

Classification

Source: NetSpot.exe, 00000004.00000002.4434209002.00007FFDF00AC000.00000002.00000001.01000000.00000012.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_079fa015-f
Uses 32bit PE files
Source: NetSpot.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\unins000.dat Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-M74L2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-OQL12.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-V7Q4A.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-CIROQ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-24KKF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-5VC90.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-R0J2V.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-5BG51.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-U2GGI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-N15GE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-42MF6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-HQR54.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-5AA03.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-8UH95.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-9GF1O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-CTAKS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-3TUDR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-C3Q8S.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-PLA7C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-4GPK1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-MACOH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-O8J9C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-JOU0Q.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-NKE6A.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-T7BIU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-6E58C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-NNF2R.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-B1NJF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-3JV3P.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-4ET7L.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-LEMM7.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-SEC79.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-S0F5R.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-TEQCU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-5G8NL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-377HG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x64 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x64\is-2KT7S.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x64\is-QSS20.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x64\is-S8PNU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x64\is-MK85Q.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x64\is-Q4QCI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x64\is-9LFKI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x86 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x86\is-HC4RP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x86\is-OLDS2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x86\is-VVTAO.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x86\is-MLUMD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x86\is-SMHRU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x86\is-D8NFU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x86\is-UFOD4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-arm64 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-arm64\native Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-arm64\native\is-UGST8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-x64 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-x64\native Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-x64\native\is-IIR56.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-x86 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-x86\native Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-x86\native\is-D9116.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\de Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\de\is-9IFIE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\en Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\en\is-JJM2S.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\es Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\es\is-GLJO9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\fr Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\fr\is-CM1JJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\it Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\it\is-S2EDF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\ja Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\ja\is-6CS50.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\pt Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\pt\is-KTD9U.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\ru Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\ru\is-JL9ET.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-IQU4U.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-33L5D.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-07U2U.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-HRVUR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-B9RJK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\Resources Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\Resources\Sounds Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\Resources\Sounds\is-0G99Q.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\Resources\Sounds\is-EC700.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\unins000.msg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NetSpot_is1 Jump to behavior
Source: NetSpot.exe Static PE information: certificate valid
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: NetSpot.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: \NetSpot 3 (github)\NetSpotPredictivePart\NetSpot.Infrastructure.PredictiveProjectFormat\obj\Release\NetSpot.Infrastructure.PredictiveProjectFormat.pdb source: NetSpot.exe, 00000004.00000002.4214752799.00000257DC902000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpotCommon\NetSpot.Base\obj\Release\NetSpot.Base.pdb1[ source: NetSpot.exe, 00000004.00000002.4256324129.00000257E15AE000.00000002.00000001.01000000.00000025.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpotCommon\NetSpot.Infrastructure.WiFi\obj\Release\NetSpot.Infrastructure.WiFi.pdb source: NetSpot.exe, 00000004.00000002.4172935845.00000257C4092000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: D:\a\_work\e\src\out\Release_x64\WebView2Loader.dll.pdb source: is-IIR56.tmp.1.dr
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Core.Discover\obj\Release\NetSpot.Core.Discover.pdb source: NetSpot.exe, 00000004.00000002.4172785960.00000257C28D2000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: NetSpot.exe, 00000004.00000002.4253313240.00000257DE4E2000.00000002.00000001.01000000.00000024.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Discover\obj\Release\NetSpot.Discover.pdb source: NetSpot.exe, 00000004.00000002.4173803791.00000257C4182000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: NetSpot.exe, 00000004.00000002.4253313240.00000257DE4E2000.00000002.00000001.01000000.00000024.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpotPredictivePart\NetSpot.Infrastructure.Engine\obj\Release\NetSpot.Infrastructure.Engine.pdb source: NetSpot.exe, 00000004.00000002.4173626112.00000257C4142000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Core.Survey\obj\Release\NetSpot.Core.Survey.pdb source: NetSpot.exe, 00000004.00000002.4173177175.00000257C40D2000.00000002.00000001.01000000.00000019.sdmp
Source: Binary string: \NetSpotActivator (github)\ActivatorProject\bin\x64\Release\Act.pdb source: NetSpot.exe, 00000004.00000002.4434209002.00007FFDF00AC000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot\obj\Release\NetSpot.pdb source: NetSpot.exe, 00000004.00000000.1892323190.00000257C2372000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: symbols\dll\WindowsBase.pdbJsonS` source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Infrastructure.SurveyLegacyProjectFormat\obj\Release\NetSpot.Infrastructure.SurveyLegacyProjectFormat.pdb source: NetSpot.exe, 00000004.00000002.4173067023.00000257C40C2000.00000002.00000001.01000000.00000018.sdmp, is-42MF6.tmp.1.dr
Source: Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.pdb source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpotCommon\NetSpot.Core.Base\obj\Release\NetSpot.Core.Base.pdb source: NetSpot.exe, 00000004.00000002.4173391825.00000257C4102000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpotCommon\NetSpot.Base\obj\Release\NetSpot.Base.pdb source: NetSpot.exe, 00000004.00000002.4256324129.00000257E15AE000.00000002.00000001.01000000.00000025.sdmp
Source: Binary string: tive.pdb source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: indoC:\Windows\WindowsBase.pdb source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: WindowsBase.pdb02pot 3 (gitk source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \NetSpotPredictive (github)\predictive\x64\Release\Predictive.Interop.pdb source: NetSpot.exe, 00000004.00000002.4440309517.00007FFE1024F000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Survey\obj\Release\NetSpot.Survey.pdb source: NetSpot.exe, 00000004.00000002.4217689065.00000257DCCB2000.00000002.00000001.01000000.00000021.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpotPredictivePart\NetSpot.Core.Predictive\obj\Release\NetSpot.Core.Predictive.pdb source: NetSpot.exe, 00000004.00000002.4214523327.00000257DC8D2000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: WindowsBase.pdb source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\e\src\out\Release_x64\WebView2Loader.dll.pdbOGP source: is-IIR56.tmp.1.dr
Source: Binary string: \NetSpot 3 (github)\NetSpotPredictivePart\NetSpot.Predictive\obj\Release\NetSpot.Predictive.pdb source: NetSpot.exe, 00000004.00000002.4218797950.00000257DCD52000.00000002.00000001.01000000.00000022.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpotCommon\NetSpot.Infrastructure.Polices\obj\Release\NetSpot.Infrastructure.Polices.pdb source: NetSpot.exe, 00000004.00000002.4172742636.00000257C28C2000.00000002.00000001.01000000.00000014.sdmp, is-U2GGI.tmp.1.dr
Source: Binary string: \NetSpot 3 (github)\NetSpotCommon\NetSpot.Infrastructure.Polices\obj\Release\NetSpot.Infrastructure.Polices.pdbu3 source: NetSpot.exe, 00000004.00000002.4172742636.00000257C28C2000.00000002.00000001.01000000.00000014.sdmp, is-U2GGI.tmp.1.dr
Source: Binary string: .pdbW source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: 8C:\Windows\WindowsBase.pdb source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\dev\sqlite\dotnet-private\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: is-9LFKI.tmp.1.dr
Source: Binary string: WindowsBase.pdbwsBase.pdbpdbase.pdbSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.pdb source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpotPredictivePart\NetSpot.Infrastructure.JsonServices\obj\Release\NetSpot.Infrastructure.JsonServices.pdb source: NetSpot.exe, 00000004.00000002.4220089186.00000257DCE22000.00000002.00000001.01000000.00000023.sdmp
Source: Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: is-5G8NL.tmp.1.dr
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Survey\obj\Release\NetSpot.Survey.pdbG source: NetSpot.exe, 00000004.00000002.4217689065.00000257DCCB2000.00000002.00000001.01000000.00000021.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Infrastructure.SurveyLegacyProjectFormat\obj\Release\NetSpot.Infrastructure.SurveyLegacyProjectFormat.pdb{ source: NetSpot.exe, 00000004.00000002.4173067023.00000257C40C2000.00000002.00000001.01000000.00000018.sdmp, is-42MF6.tmp.1.dr
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Infrastructure.SurveyProjectFormat\obj\Release\NetSpot.Infrastructure.SurveyProjectFormat.pdb source: NetSpot.exe, 00000004.00000002.4214295776.00000257DC8BB000.00000002.00000001.01000000.0000001D.sdmp
Source: Binary string: C:\dev\sqlite\dotnet-private\bin\2015\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Infrastructure.IperfServices\obj\Release\NetSpot.Infrastructure.IperfServices.pdb source: NetSpot.exe, 00000004.00000002.4173020119.00000257C40B2000.00000002.00000001.01000000.00000017.sdmp
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /pjf/JsonVersions.json HTTP/1.1Host: www.netspotapp.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /pjf/RouterModels.json HTTP/1.1Host: www.netspotapp.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /pjf/WallMaterials.json HTTP/1.1Host: www.netspotapp.comConnection: Keep-Alive
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /pjf/JsonVersions.json HTTP/1.1Host: www.netspotapp.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /pjf/RouterModels.json HTTP/1.1Host: www.netspotapp.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /pjf/WallMaterials.json HTTP/1.1Host: www.netspotapp.comConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: www.netspotapp.com
Source: global traffic DNS traffic detected: DNS query: updates.netspotapp.com
Source: unknown HTTP traffic detected: POST /activator/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: activatorContent-Length: 128Host: updates.netspotapp.com
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: NetSpot.exe, 00000004.00000002.4215739116.00000257DCADA000.00000004.00000020.00020000.00000000.sdmp, NetSpot.exe, 00000004.00000002.4386028136.00000257E59D0000.00000004.00000020.00020000.00000000.sdmp, NetSpot.exe, 00000004.00000002.4230479179.00000257DDB2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: NetSpot.exe, 00000004.00000002.4174046261.00000257C5929000.00000004.00000800.00020000.00000000.sdmp, NetSpot.exe, 00000004.00000002.4174046261.00000257C5DBE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://defaultcontainer/NetSpot;component/views/promowindow.xaml
Source: NetSpot.exe, 00000004.00000002.4253313240.00000257DE4E2000.00000002.00000001.01000000.00000024.sdmp String found in binary or memory: http://james.newtonking.com/projects/json
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: http://ocsp.sectigo.com0
Source: NetSpot.exe, 00000004.00000002.4174046261.00000257C4797000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: NetSpot.exe, 00000004.00000002.4174046261.00000257C41E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: NetSpot.exe, 00000004.00000002.4256324129.00000257E15AE000.00000002.00000001.01000000.00000025.sdmp String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFL
Source: NetSpot.exe, 00000004.00000002.4256324129.00000257E15AE000.00000002.00000001.01000000.00000025.sdmp String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLNunito
Source: is-S8PNU.tmp.1.dr String found in binary or memory: http://software.es.net/iperf/
Source: NetSpot.exe, 00000000.00000003.1720520051.0000000002640000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1913304682.00000000022F9000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1904111836.000000000381C000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1725051883.00000000034F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.dk-soft.org/
Source: NetSpot.exe, 00000004.00000002.4438110439.00007FFDF0198000.00000008.00000001.01000000.00000012.sdmp String found in binary or memory: http://www.openssl.org/support/faq.html
Source: NetSpot.exe, 00000004.00000002.4438110439.00007FFDF0198000.00000008.00000001.01000000.00000012.sdmp String found in binary or memory: http://www.openssl.org/support/faq.html.
Source: NetSpot.exe, 00000004.00000002.4256324129.00000257E15AE000.00000002.00000001.01000000.00000025.sdmp String found in binary or memory: http://www.sansoxygen.comThis
Source: NetSpot.exe, 00000000.00000003.1913304682.0000000002379000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1720520051.0000000002640000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1908033263.0000000000BE0000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1904111836.000000000376E000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1904111836.00000000036F6000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1725051883.00000000034F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exe
Source: NetSpot.exe, 00000000.00000003.1913304682.0000000002379000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1720520051.0000000002640000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1908033263.0000000000BE0000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1904111836.000000000376E000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1904111836.00000000036F6000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1725051883.00000000034F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x86.exe
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://cdn.netspotapp.com/download/NetSpotForWindows/3/UpdateManifest.xml
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://cdn.netspotapp.com/download/Win/updater/updateManifest3.xml
Source: NetSpot.exe, 00000004.00000002.4174046261.00000257C41E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.netspotapp.com/download/Win/updater/updateManifest3.xml8
Source: NetSpot.exe, 00000004.00000002.4256324129.00000257E15AE000.00000002.00000001.01000000.00000025.sdmp String found in binary or memory: https://github.com/Fonthausen/NunitoSans)Nunito
Source: NetSpot.exe, 00000004.00000002.4253313240.00000257DE4E2000.00000002.00000001.01000000.00000024.sdmp String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: is-5G8NL.tmp.1.dr String found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf
Source: is-5G8NL.tmp.1.dr String found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf8
Source: is-S8PNU.tmp.1.dr String found in binary or memory: https://github.com/esnet/iperf
Source: NetSpot.exe String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-IIR56.tmp.1.dr, is-U2GGI.tmp.1.dr, is-S8PNU.tmp.1.dr, is-9LFKI.tmp.1.dr, is-42MF6.tmp.1.dr, is-5G8NL.tmp.1.dr String found in binary or memory: https://sectigo.com/CPS0
Source: NetSpot.exe, 00000004.00000002.4256324129.00000257DF4F2000.00000002.00000001.01000000.00000025.sdmp, NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp, NetSpot.exe, 00000004.00000002.4174046261.00000257C41E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://speedtest.netspotapp.com
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://updates.netspotapp.com
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://updates.netspotapp.com/
Source: NetSpot.exe, 00000004.00000002.4434209002.00007FFDF00AC000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: https://updates.netspotapp.com/activator/
Source: NetSpot.exe, 00000004.00000002.4434209002.00007FFDF00AC000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: https://updates.netspotapp.com/activator/getKeyInfo
Source: NetSpot.exe, 00000004.00000002.4434209002.00007FFDF00AC000.00000002.00000001.01000000.00000012.sdmp String found in binary or memory: https://updates.netspotapp.com/activator/graceBlockeddemoOvergracePeriodSecondsgraceStartedTimegrace
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://updates.netspotapp.com/changehid/?mp-translate=en
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://updates.netspotapp.com/recover/?mp-translate=en
Source: NetSpot.exe, 00000004.00000002.4240085998.00000257DDF0D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://updates.netspotapp.com/s
Source: NetSpot.exe, 00000004.00000002.4395625013.00000257E5C9F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://updates.netspotapp.com:443/activator/;
Source: NetSpot.exe, 00000000.00000003.1721639152.0000000002780000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FB30000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000000.1723569734.0000000000401000.00000020.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.innosetup.com/
Source: NetSpot.exe, 00000004.00000002.4174046261.00000257C5338000.00000004.00000800.00020000.00000000.sdmp, NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp, NetSpot.exe, 00000004.00000002.4174046261.00000257C4797000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.netspotapp.com
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/?utm_nooverride=1
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/features.html?utm_source=app_activator&utm_medium=win&utm_campaign=app_ac
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp, NetSpot.exe, 00000004.00000002.4174046261.00000257C4797000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.netspotapp.com/help/?utm_source=appmenu&utm_medium=win&utm_id=app
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/noise-level/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/phy-mode-coverage/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/quantity-of-access-points/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/signal-level/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/signal-to-interference-ratio/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/troubleshooting-download-rate/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/troubleshooting-noise/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/troubleshooting-signal-level/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/troubleshooting-sir/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/troubleshooting-snr/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/troubleshooting-upload-rate/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/what-is-download-speed/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/what-is-the-frequency-band-coverage-pro/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/what-is-the-signal-to-noise/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/what-is-upload-speed/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/help/wireless-transmit-rate/
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/netspot-enterprise.html
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/netspot-enterprise.htmlBSJB
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp, NetSpot.exe, 00000004.00000002.4174046261.00000257C4797000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.netspotapp.com/pjf/JsonVersions.json
Source: NetSpot.exe, 00000004.00000002.4174046261.00000257C5338000.00000004.00000800.00020000.00000000.sdmp, NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/pjf/RouterModels.json
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/pjf/WallMaterials.json
Source: NetSpot.exe, 00000004.00000002.4174046261.00000257C5338000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.netspotapp.com/pjf/WallMaterials.json8
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/upgrade-netspot-win.html
Source: NetSpot.exe, 00000004.00000002.4174046261.00000257C5338000.00000004.00000800.00020000.00000000.sdmp, NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/uploads/feedback/submit.php?project=NetSpotWin&utm_nooverride=1
Source: NetSpot.exe, 00000004.00000002.4174046261.00000257C41E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.netspotapp.com/uploads/feedback/submit.php?project=NetSpotWin&utm_nooverride=1n=b77a5c56
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/win-purchase-netspot.html
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/win-upgrade-to-netspot3.html?utm_source=app_win_activator_upgrade2to3&utm
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp String found in binary or memory: https://www.netspotapp.com/win-upgrade-to-netspot3.html?utm_source=app_win_upgradewindow_upgrade2to3
Source: NetSpot.exe, 00000004.00000002.4253313240.00000257DE4E2000.00000002.00000001.01000000.00000024.sdmp String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: NetSpot.exe, 00000004.00000002.4253313240.00000257DE4E2000.00000002.00000001.01000000.00000024.sdmp String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: NetSpot.exe, 00000000.00000003.1721639152.0000000002780000.00000004.00001000.00020000.00000000.sdmp, NetSpot.exe, 00000000.00000003.1722004161.000000007FB30000.00000004.00001000.00020000.00000000.sdmp, NetSpot.tmp, 00000001.00000000.1723569734.0000000000401000.00000020.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.remobjects.com/ps
Source: NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-9LFKI.tmp.1.dr String found in binary or memory: https://www.sqlite.org/copyright.html2
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown HTTPS traffic detected: 66.135.20.63:443 -> 192.168.2.4:49762 version: TLS 1.2
PE file contains executable resources (Code or Archives)
Source: NetSpot.tmp.0.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Sample file is different than original file name gathered from version info
Source: NetSpot.exe, 00000000.00000003.1721639152.000000000288D000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs NetSpot.exe
Source: NetSpot.exe, 00000000.00000003.1722004161.000000007FE39000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs NetSpot.exe
Source: NetSpot.exe, 00000000.00000003.1913304682.00000000023A8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamekernel32j% vs NetSpot.exe
Source: NetSpot.exe, 00000000.00000000.1720157715.00000000004C6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFileName vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4220035426.00000257DCE12000.00000002.00000001.01000000.00000022.sdmp Binary or memory string: OriginalFilenameNetSpot.Predictive.dll8 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4172742636.00000257C28C2000.00000002.00000001.01000000.00000014.sdmp Binary or memory string: OriginalFilenameNetSpot.Infrastructure.Polices.dll8 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4220570685.00000257DCE66000.00000002.00000001.01000000.00000023.sdmp Binary or memory string: OriginalFilenameNetSpot.Infrastructure.JsonServices.dll8 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4173270532.00000257C40E6000.00000002.00000001.01000000.00000019.sdmp Binary or memory string: OriginalFilenameNetSpot.Core.Survey.dll8 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4214752799.00000257DC902000.00000002.00000001.01000000.0000001F.sdmp Binary or memory string: OriginalFilenameNetSpot.Infrastructure.PredictiveProjectFormat.dll8 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4173020119.00000257C40B2000.00000002.00000001.01000000.00000017.sdmp Binary or memory string: OriginalFilenameNetSpot.Infrastructure.IperfServices.dll8 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4173653228.00000257C4146000.00000002.00000001.01000000.0000001B.sdmp Binary or memory string: OriginalFilenameNetSpot.Infrastructure.Engine.dll8 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4215160966.00000257DC932000.00000002.00000001.01000000.00000020.sdmp Binary or memory string: OriginalFilenameNetSpot.Base.resources.dll8 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4254728667.00000257DE58E000.00000002.00000001.01000000.00000024.sdmp Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4256324129.00000257E15AE000.00000002.00000001.01000000.00000025.sdmp Binary or memory string: OriginalFilenameNetSpot.Base.dll8 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4173101120.00000257C40CA000.00000002.00000001.01000000.00000018.sdmp Binary or memory string: OriginalFilenameNetSpot.Infrastructure.SurveyLegacyProjectFormat.dll8 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4172785960.00000257C28DC000.00000002.00000001.01000000.00000015.sdmp Binary or memory string: OriginalFilenameNetSpot.Core.Discover.dll8 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4218747832.00000257DCD4A000.00000002.00000001.01000000.00000021.sdmp Binary or memory string: OriginalFilenameNetSpot.Survey.dll8 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4173803791.00000257C4182000.00000002.00000001.01000000.0000001C.sdmp Binary or memory string: OriginalFilenameNetSpot.Discover.dll8 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4172982214.00000257C409E000.00000002.00000001.01000000.00000016.sdmp Binary or memory string: OriginalFilenameNetSpot.Infrastructure.WiFi.dll8 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4214295776.00000257DC8BB000.00000002.00000001.01000000.0000001D.sdmp Binary or memory string: OriginalFilenameNetSpot.Infrastructure.SurveyProjectFormat.dll8 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4173545561.00000257C4134000.00000002.00000001.01000000.0000001A.sdmp Binary or memory string: OriginalFilenameNetSpot.Core.Base.dll8 vs NetSpot.exe
Source: NetSpot.exe, 00000004.00000002.4214523327.00000257DC8D2000.00000002.00000001.01000000.0000001E.sdmp Binary or memory string: OriginalFilenameNetSpot.Core.Predictive.dll8 vs NetSpot.exe
Source: NetSpot.exe Binary or memory string: OriginalFileName vs NetSpot.exe
Uses 32bit PE files
Source: NetSpot.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: classification engine Classification label: clean4.winEXE@5/160@2/1
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Mutant created: NULL
Source: C:\Users\user\Desktop\NetSpot.exe File created: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp Jump to behavior
Source: C:\Users\user\Desktop\NetSpot.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\NetSpot.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File read: C:\Program Files\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\NetSpot.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization Jump to behavior
Source: NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-9LFKI.tmp.1.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-9LFKI.tmp.1.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-9LFKI.tmp.1.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-9LFKI.tmp.1.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-9LFKI.tmp.1.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-9LFKI.tmp.1.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, is-9LFKI.tmp.1.dr Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: NetSpot.exe String found in binary or memory: /LOADINF="filename"
Source: C:\Users\user\Desktop\NetSpot.exe File read: C:\Users\user\Desktop\NetSpot.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\NetSpot.exe "C:\Users\user\Desktop\NetSpot.exe"
Source: C:\Users\user\Desktop\NetSpot.exe Process created: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp "C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp" /SL5="$1042E,82973157,925184,C:\Users\user\Desktop\NetSpot.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Process created: C:\Program Files\NetSpot\NetSpot.exe "C:\Program Files\NetSpot\NetSpot.exe" -firstrun
Source: C:\Users\user\Desktop\NetSpot.exe Process created: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp "C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp" /SL5="$1042E,82973157,925184,C:\Users\user\Desktop\NetSpot.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Process created: C:\Program Files\NetSpot\NetSpot.exe "C:\Program Files\NetSpot\NetSpot.exe" -firstrun Jump to behavior
Source: C:\Users\user\Desktop\NetSpot.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\NetSpot.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\NetSpot.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\NetSpot.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\NetSpot.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: msvcp140_clr0400.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: windowscodecsext.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: icm32.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: msctfui.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: d3dcompiler_47.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Window found: window name: TMainForm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Automated click: Next
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\NetSpot\NetSpot.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\unins000.dat Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-M74L2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-OQL12.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-V7Q4A.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-CIROQ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-24KKF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-5VC90.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-R0J2V.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-5BG51.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-U2GGI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-N15GE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-42MF6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-HQR54.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-5AA03.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-8UH95.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-9GF1O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-CTAKS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-3TUDR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-C3Q8S.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-PLA7C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-4GPK1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-MACOH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-O8J9C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-JOU0Q.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-NKE6A.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-T7BIU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-6E58C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-NNF2R.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-B1NJF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-3JV3P.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-4ET7L.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-LEMM7.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-SEC79.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-S0F5R.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-TEQCU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-5G8NL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-377HG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x64 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x64\is-2KT7S.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x64\is-QSS20.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x64\is-S8PNU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x64\is-MK85Q.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x64\is-Q4QCI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x64\is-9LFKI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x86 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x86\is-HC4RP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x86\is-OLDS2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x86\is-VVTAO.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x86\is-MLUMD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x86\is-SMHRU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x86\is-D8NFU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\x86\is-UFOD4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-arm64 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-arm64\native Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-arm64\native\is-UGST8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-x64 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-x64\native Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-x64\native\is-IIR56.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-x86 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-x86\native Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\runtimes\win-x86\native\is-D9116.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\de Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\de\is-9IFIE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\en Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\en\is-JJM2S.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\es Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\es\is-GLJO9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\fr Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\fr\is-CM1JJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\it Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\it\is-S2EDF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\ja Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\ja\is-6CS50.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\pt Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\pt\is-KTD9U.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\ru Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\ru\is-JL9ET.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-IQU4U.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-33L5D.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-07U2U.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-HRVUR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\is-B9RJK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\Resources Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\Resources\Sounds Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\Resources\Sounds\is-0G99Q.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\Resources\Sounds\is-EC700.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Directory created: C:\Program Files\NetSpot\unins000.msg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NetSpot_is1 Jump to behavior
Source: NetSpot.exe Static PE information: certificate valid
Source: NetSpot.exe Static file information: File size 83966680 > 1048576
Source: NetSpot.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: \NetSpot 3 (github)\NetSpotPredictivePart\NetSpot.Infrastructure.PredictiveProjectFormat\obj\Release\NetSpot.Infrastructure.PredictiveProjectFormat.pdb source: NetSpot.exe, 00000004.00000002.4214752799.00000257DC902000.00000002.00000001.01000000.0000001F.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpotCommon\NetSpot.Base\obj\Release\NetSpot.Base.pdb1[ source: NetSpot.exe, 00000004.00000002.4256324129.00000257E15AE000.00000002.00000001.01000000.00000025.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpotCommon\NetSpot.Infrastructure.WiFi\obj\Release\NetSpot.Infrastructure.WiFi.pdb source: NetSpot.exe, 00000004.00000002.4172935845.00000257C4092000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: D:\a\_work\e\src\out\Release_x64\WebView2Loader.dll.pdb source: is-IIR56.tmp.1.dr
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Core.Discover\obj\Release\NetSpot.Core.Discover.pdb source: NetSpot.exe, 00000004.00000002.4172785960.00000257C28D2000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: NetSpot.exe, 00000004.00000002.4253313240.00000257DE4E2000.00000002.00000001.01000000.00000024.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Discover\obj\Release\NetSpot.Discover.pdb source: NetSpot.exe, 00000004.00000002.4173803791.00000257C4182000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: NetSpot.exe, 00000004.00000002.4253313240.00000257DE4E2000.00000002.00000001.01000000.00000024.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpotPredictivePart\NetSpot.Infrastructure.Engine\obj\Release\NetSpot.Infrastructure.Engine.pdb source: NetSpot.exe, 00000004.00000002.4173626112.00000257C4142000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Core.Survey\obj\Release\NetSpot.Core.Survey.pdb source: NetSpot.exe, 00000004.00000002.4173177175.00000257C40D2000.00000002.00000001.01000000.00000019.sdmp
Source: Binary string: \NetSpotActivator (github)\ActivatorProject\bin\x64\Release\Act.pdb source: NetSpot.exe, 00000004.00000002.4434209002.00007FFDF00AC000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot\obj\Release\NetSpot.pdb source: NetSpot.exe, 00000004.00000000.1892323190.00000257C2372000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: symbols\dll\WindowsBase.pdbJsonS` source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Infrastructure.SurveyLegacyProjectFormat\obj\Release\NetSpot.Infrastructure.SurveyLegacyProjectFormat.pdb source: NetSpot.exe, 00000004.00000002.4173067023.00000257C40C2000.00000002.00000001.01000000.00000018.sdmp, is-42MF6.tmp.1.dr
Source: Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.pdb source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpotCommon\NetSpot.Core.Base\obj\Release\NetSpot.Core.Base.pdb source: NetSpot.exe, 00000004.00000002.4173391825.00000257C4102000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpotCommon\NetSpot.Base\obj\Release\NetSpot.Base.pdb source: NetSpot.exe, 00000004.00000002.4256324129.00000257E15AE000.00000002.00000001.01000000.00000025.sdmp
Source: Binary string: tive.pdb source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: indoC:\Windows\WindowsBase.pdb source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: WindowsBase.pdb02pot 3 (gitk source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \NetSpotPredictive (github)\predictive\x64\Release\Predictive.Interop.pdb source: NetSpot.exe, 00000004.00000002.4440309517.00007FFE1024F000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Survey\obj\Release\NetSpot.Survey.pdb source: NetSpot.exe, 00000004.00000002.4217689065.00000257DCCB2000.00000002.00000001.01000000.00000021.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpotPredictivePart\NetSpot.Core.Predictive\obj\Release\NetSpot.Core.Predictive.pdb source: NetSpot.exe, 00000004.00000002.4214523327.00000257DC8D2000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: WindowsBase.pdb source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\e\src\out\Release_x64\WebView2Loader.dll.pdbOGP source: is-IIR56.tmp.1.dr
Source: Binary string: \NetSpot 3 (github)\NetSpotPredictivePart\NetSpot.Predictive\obj\Release\NetSpot.Predictive.pdb source: NetSpot.exe, 00000004.00000002.4218797950.00000257DCD52000.00000002.00000001.01000000.00000022.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpotCommon\NetSpot.Infrastructure.Polices\obj\Release\NetSpot.Infrastructure.Polices.pdb source: NetSpot.exe, 00000004.00000002.4172742636.00000257C28C2000.00000002.00000001.01000000.00000014.sdmp, is-U2GGI.tmp.1.dr
Source: Binary string: \NetSpot 3 (github)\NetSpotCommon\NetSpot.Infrastructure.Polices\obj\Release\NetSpot.Infrastructure.Polices.pdbu3 source: NetSpot.exe, 00000004.00000002.4172742636.00000257C28C2000.00000002.00000001.01000000.00000014.sdmp, is-U2GGI.tmp.1.dr
Source: Binary string: .pdbW source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: 8C:\Windows\WindowsBase.pdb source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\dev\sqlite\dotnet-private\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: is-9LFKI.tmp.1.dr
Source: Binary string: WindowsBase.pdbwsBase.pdbpdbase.pdbSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.pdb source: NetSpot.exe, 00000004.00000002.4170709898.0000008B32039000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpotPredictivePart\NetSpot.Infrastructure.JsonServices\obj\Release\NetSpot.Infrastructure.JsonServices.pdb source: NetSpot.exe, 00000004.00000002.4220089186.00000257DCE22000.00000002.00000001.01000000.00000023.sdmp
Source: Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: is-5G8NL.tmp.1.dr
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Survey\obj\Release\NetSpot.Survey.pdbG source: NetSpot.exe, 00000004.00000002.4217689065.00000257DCCB2000.00000002.00000001.01000000.00000021.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Infrastructure.SurveyLegacyProjectFormat\obj\Release\NetSpot.Infrastructure.SurveyLegacyProjectFormat.pdb{ source: NetSpot.exe, 00000004.00000002.4173067023.00000257C40C2000.00000002.00000001.01000000.00000018.sdmp, is-42MF6.tmp.1.dr
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Infrastructure.SurveyProjectFormat\obj\Release\NetSpot.Infrastructure.SurveyProjectFormat.pdb source: NetSpot.exe, 00000004.00000002.4214295776.00000257DC8BB000.00000002.00000001.01000000.0000001D.sdmp
Source: Binary string: C:\dev\sqlite\dotnet-private\bin\2015\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: NetSpot.tmp, 00000001.00000003.1893665830.00000000051E0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: \NetSpot 3 (github)\NetSpot\NetSpot.Infrastructure.IperfServices\obj\Release\NetSpot.Infrastructure.IperfServices.pdb source: NetSpot.exe, 00000004.00000002.4173020119.00000257C40B2000.00000002.00000001.01000000.00000017.sdmp
Binary contains a suspicious time stamp
Source: is-U2GGI.tmp.1.dr Static PE information: 0x9BEA9131 [Thu Nov 21 22:31:13 2052 UTC]
PE file contains sections with non-standard names
Source: NetSpot.exe Static PE information: section name: .didata
Source: NetSpot.tmp.0.dr Static PE information: section name: .didata
Source: is-CTAKS.tmp.1.dr Static PE information: section name: .text entropy: 7.082414513362637
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-SEC79.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x64\is-MK85Q.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x86\is-D8NFU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-O8J9C.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-JOU0Q.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\MuPDFCore.NativeAssets.Win-arm64.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-NNF2R.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Core.Survey.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-HQR54.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\runtimes\win-x64\native\WebView2Loader.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Base.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x86\is-UFOD4.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-6E58C.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\ru\NetSpot.Base.resources.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\en\NetSpot.Base.resources.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-C3Q8S.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-377HG.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x64\SQLite.Interop.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\runtimes\win-x86\native\WebView2Loader.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x86\SQLite.Interop.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x86\cygwin1.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\fr\is-CM1JJ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\MuPDFCore.NativeAssets.Win-x64.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x86\is-VVTAO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Core.Base.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\it\NetSpot.Base.resources.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Core.Predictive.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Infrastructure.Engine.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\Microsoft.Web.WebView2.Wpf.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x64\is-9LFKI.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\System.Data.SQLite.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Users\user\AppData\Local\Temp\is-OUV8N.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x64\MuPDFWrapper.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-B1NJF.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x64\Predictive.Interop.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-3TUDR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-24KKF.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\en\is-JJM2S.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Infrastructure.UniversalProjectFormat.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\ja\NetSpot.Base.resources.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-MACOH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\Microsoft.WindowsAPICodePack.Shell.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x86\iperf3.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\ITextSharp.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x64\Act.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-R0J2V.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Core.Discover.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x86\is-HC4RP.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-NKE6A.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\System.Runtime.CompilerServices.Unsafe.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\ru\is-JL9ET.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\runtimes\win-x64\native\is-IIR56.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Survey.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\it\is-S2EDF.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\pt\NetSpot.Base.resources.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Infrastructure.SurveyProjectFormat.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Infrastructure.JsonServices.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\Microsoft.Web.WebView2.Core.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Infrastructure.SurveyLegacyProjectFormat.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-M74L2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-3JV3P.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-PLA7C.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\MuPDFCore.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\MuPDFCore.NativeAssets.Win-x86.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-OQL12.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-5G8NL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x64\cygwin1.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\Microsoft.Web.WebView2.WinForms.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-N15GE.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x86\MuPDFWrapper.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-T7BIU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\Microsoft.WindowsAPICodePack.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-4GPK1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\es\NetSpot.Base.resources.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x86\is-OLDS2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Infrastructure.PredictiveProjectFormat.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\pt\is-KTD9U.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x86\Act.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-CTAKS.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\Newtonsoft.Json.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\System.Numerics.Vectors.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-LEMM7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x86\is-MLUMD.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x64\iperf3.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-5VC90.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\runtimes\win-arm64\native\WebView2Loader.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\ja\is-6CS50.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\runtimes\win-x86\native\is-D9116.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Infrastructure.Polices.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-42MF6.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x64\is-S8PNU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x64\is-2KT7S.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-TEQCU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\fr\NetSpot.Base.resources.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-9GF1O.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-4ET7L.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-CIROQ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\System.Memory.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Discover.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Infrastructure.WiFi.dll (copy) Jump to dropped file
Source: C:\Users\user\Desktop\NetSpot.exe File created: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x64\is-Q4QCI.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x86\is-SMHRU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x86\cyggcc_s-1.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\System.Buffers.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\de\NetSpot.Base.resources.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x86\Predictive.Interop.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-8UH95.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\de\is-9IFIE.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-5AA03.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-U2GGI.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-S0F5R.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\BouncyCastle.Crypto.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-V7Q4A.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\x64\is-QSS20.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Predictive.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\is-5BG51.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\unins000.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\runtimes\win-arm64\native\is-UGST8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\NetSpot.Infrastructure.IperfServices.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\Program Files\NetSpot\es\is-GLJO9.tmp Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetSpot Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetSpot\NetSpot.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetSpot\Uninstall NetSpot.lnk Jump to behavior
Source: C:\Users\user\Desktop\NetSpot.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Program Files\NetSpot\NetSpot.exe Memory allocated: 257C2710000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Memory allocated: 257DC1E0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Program Files\NetSpot\NetSpot.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Program Files\NetSpot\NetSpot.exe Window / User API: threadDelayed 5465 Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Window / User API: threadDelayed 4318 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-SEC79.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x64\is-MK85Q.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x86\is-D8NFU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-O8J9C.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\MuPDFCore.NativeAssets.Win-arm64.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-JOU0Q.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-NNF2R.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Core.Survey.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-HQR54.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\runtimes\win-x64\native\WebView2Loader.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Base.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x86\is-UFOD4.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-6E58C.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\ru\NetSpot.Base.resources.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\en\NetSpot.Base.resources.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-C3Q8S.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-377HG.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x64\SQLite.Interop.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\runtimes\win-x86\native\WebView2Loader.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x86\SQLite.Interop.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x86\cygwin1.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\fr\is-CM1JJ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\MuPDFCore.NativeAssets.Win-x64.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x86\is-VVTAO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Core.Base.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\it\NetSpot.Base.resources.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Core.Predictive.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Infrastructure.Engine.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\Microsoft.Web.WebView2.Wpf.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x64\is-9LFKI.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\System.Data.SQLite.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x64\MuPDFWrapper.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-OUV8N.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-B1NJF.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x64\Predictive.Interop.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-3TUDR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-24KKF.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\ja\NetSpot.Base.resources.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Infrastructure.UniversalProjectFormat.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\en\is-JJM2S.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\Microsoft.WindowsAPICodePack.Shell.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-MACOH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x86\iperf3.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\ITextSharp.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x64\Act.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-R0J2V.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Core.Discover.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x86\is-HC4RP.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\System.Runtime.CompilerServices.Unsafe.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-NKE6A.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\ru\is-JL9ET.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\runtimes\win-x64\native\is-IIR56.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Survey.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\it\is-S2EDF.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\pt\NetSpot.Base.resources.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Infrastructure.SurveyProjectFormat.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Infrastructure.JsonServices.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\Microsoft.Web.WebView2.Core.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Infrastructure.SurveyLegacyProjectFormat.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-3JV3P.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\MuPDFCore.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\MuPDFCore.NativeAssets.Win-x86.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-OQL12.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-5G8NL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x64\cygwin1.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\Microsoft.Web.WebView2.WinForms.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x86\MuPDFWrapper.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-N15GE.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-T7BIU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\Microsoft.WindowsAPICodePack.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\es\NetSpot.Base.resources.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-4GPK1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x86\is-OLDS2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Infrastructure.PredictiveProjectFormat.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x86\Act.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\pt\is-KTD9U.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\Newtonsoft.Json.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-CTAKS.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\System.Numerics.Vectors.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-LEMM7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x86\is-MLUMD.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x64\iperf3.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-5VC90.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\runtimes\win-arm64\native\WebView2Loader.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\ja\is-6CS50.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Infrastructure.Polices.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\runtimes\win-x86\native\is-D9116.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-42MF6.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x64\is-S8PNU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x64\is-2KT7S.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\fr\NetSpot.Base.resources.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-TEQCU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-9GF1O.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-4ET7L.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-CIROQ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\System.Memory.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Discover.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Infrastructure.WiFi.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x64\is-Q4QCI.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x86\is-SMHRU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x86\cyggcc_s-1.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\System.Buffers.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\de\NetSpot.Base.resources.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x86\Predictive.Interop.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-8UH95.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\de\is-9IFIE.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-5AA03.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-U2GGI.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-S0F5R.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\BouncyCastle.Crypto.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\x64\is-QSS20.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-V7Q4A.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Predictive.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\is-5BG51.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\runtimes\win-arm64\native\is-UGST8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\NetSpot.Infrastructure.IperfServices.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Dropped PE file which has not been started: C:\Program Files\NetSpot\es\is-GLJO9.tmp Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\NetSpot\NetSpot.exe TID: 5324 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe TID: 5440 Thread sleep time: -18446744073709540s >= -30000s Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: NetSpot.tmp, 00000001.00000003.1910204757.0000000000A1F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: NetSpot.exe, 00000004.00000002.4174046261.00000257C41E1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware, Inc.
Source: NetSpot.exe, 00000004.00000002.4386028136.00000257E5940000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: NetSpot.exe, 00000004.00000002.4215739116.00000257DCA70000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWPz
Source: NetSpot.exe, 00000004.00000002.4386028136.00000257E5940000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWyaRegulardv
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Program Files\NetSpot\NetSpot.exe Process token adjusted: Debug Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Memory allocated: page read and write | page guard Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DLR5V.tmp\NetSpot.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\NetSpot.exe VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\NetSpot.Base.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\NetSpot.Core.Base.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\NetSpot.Discover.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\NetSpot.Survey.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\NetSpot.Predictive.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\NetSpot.Infrastructure.WiFi.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\NetSpot.Infrastructure.Polices.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\NetSpot.Core.Discover.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\NetSpot.Core.Survey.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\NetSpot.Infrastructure.IperfServices.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\NetSpot.Infrastructure.SurveyProjectFormat.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\NetSpot.Core.Predictive.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\NetSpot.Infrastructure.Engine.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\NetSpot.Infrastructure.JsonServices.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\en\NetSpot.Base.resources.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Users\user\AppData\Roaming\Etwok\NetSpot 3\Temp\Survey\ZonePreviewImage_1_1.png VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Users\user\AppData\Roaming\Etwok\NetSpot 3\Temp\Survey\ZonePreviewImage_1_2.png VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Users\user\AppData\Roaming\Etwok\NetSpot 3\Temp\Survey\ZonePreviewImage_2_1.png VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Users\user\AppData\Roaming\Etwok\NetSpot 3\Temp\Survey\ZonePreviewImage_2_2.png VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Users\user\AppData\Roaming\Etwok\NetSpot 3\Temp\Survey\ZonePreviewImage_2_3.png VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Users\user\AppData\Roaming\Etwok\NetSpot 3\Temp\Predictive\ZonePreviewImage_1_1.png VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Program Files\NetSpot\Newtonsoft.Json.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemData\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemData.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemCore\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemCore.dll VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\NetSpot\NetSpot.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1522643 Sample: NetSpot.exe Startdate: 30/09/2024 Architecture: WINDOWS Score: 4 26 www.netspotapp.com 2->26 28 updates.netspotapp.com 2->28 7 NetSpot.exe 2 2->7         started        process3 file4 16 C:\Users\user\AppData\Local\...16etSpot.tmp, PE32 7->16 dropped 10 NetSpot.tmp 37 106 7->10         started        process5 file6 18 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 10->18 dropped 20 C:\Program Files20etSpot\x86\is-VVTAO.tmp, PE32 10->20 dropped 22 C:\Program Files22etSpot\x86\is-UFOD4.tmp, PE32 10->22 dropped 24 118 other files (none is malicious) 10->24 dropped 13 NetSpot.exe 15 37 10->13         started        process7 dnsIp8 30 updates.netspotapp.com 66.135.20.63, 443, 49740, 49743 MEGAPATH5-US United States 13->30
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
66.135.20.63
 www.netspotapp.com United States
18566 MEGAPATH5-US false

Contacted Domains

Name IP Active
www.netspotapp.com 66.135.20.63 true
updates.netspotapp.com 66.135.20.63 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.netspotapp.com/pjf/WallMaterials.json false
    		unknown
    https://www.netspotapp.com/pjf/JsonVersions.json false
      		unknown
      https://www.netspotapp.com/pjf/RouterModels.json false
        		unknown
        https://updates.netspotapp.com/activator/ false
          		unknown