ed21b2a650477fca201a1a1a97c388c3a427634f26c82cf6953bfcb688a591ca

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
42s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ndrangheta.exe
Size 73.4MB
Sample260623-e1hrkaaw4x
SHA256 ed21b2a650477fca201a1a1a97c388c3a427634f26c82cf6953bfcb688a591ca
MD5 78524e08c5266583bb3c013134ced71f
SHA1 46aff110b00edcdcc5cf0c01a85b4391f8965def
SHA512 9a13fe9004ccb708bbf45eec2b80d8e1b279ba6673d1dfdde555e4918375e193d0bd35257891f84768c3d30b741ce3e7fba4f088d3e1f5c77cabb95481a3b2ed
SSDEEP 1572864:nxmmctRbAEk5KM0BW84OQf0IM8IZngjMke8QQkJ1SCya7VNMgmylY:nxKn9p9Q86IZnmMp8UkE7VNMrylY
TLSH
T11FF72356E2F900E8D4BBC0B8CA5B4627EBB23455133457EB12A48A692F37FE15E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
48	764	Ndrangheta.exe
26	764	Ndrangheta.exe
37	764	Ndrangheta.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Ndrangheta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	ndrangheta_dotnet10_59549c091a43418cadb6e58824270389.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-10.0.9-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	ndrangheta_fishstrap_9448a93e09d94843844aaaf0bb63c015.exe

Executes dropped EXE 10 IoCs

pid	Process
6116	ndrangheta_dotnet10_59549c091a43418cadb6e58824270389.exe
4668	wixstdba.exe
5868	windowsdesktop-runtime-10.0.9-win-x64.exe
5780	windowsdesktop-runtime-10.0.9-win-x64.exe
5172	windowsdesktop-runtime-10.0.9-win-x64.exe
1252	wixstdba.exe
4044	windowsdesktop-runtime-10.0.9-win-x64.exe
652	ndrangheta_fishstrap_9448a93e09d94843844aaaf0bb63c015.exe
5688	Decompiler.exe
3368	Decompiler.exe

Loads dropped DLL 16 IoCs

pid	Process
764	Ndrangheta.exe
764	Ndrangheta.exe
764	Ndrangheta.exe
4388	MsiExec.exe
4388	MsiExec.exe
5240	MsiExec.exe
5240	MsiExec.exe
872	MsiExec.exe
872	MsiExec.exe
6064	MsiExec.exe
6064	MsiExec.exe
2920	MsiExec.exe
2920	MsiExec.exe
2240	MsiExec.exe
2240	MsiExec.exe
652	ndrangheta_fishstrap_9448a93e09d94843844aaaf0bb63c015.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C} = "\"C:\\ProgramData\\Package Cache\\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\\windowsdesktop-runtime-10.0.9-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C} = "\"C:\\ProgramData\\Package Cache\\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\\windowsdesktop-runtime-10.0.9-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.9-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.IO.FileSystem.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\pt-BR\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ru\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.IO.FileSystem.DriveInfo.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Net.WebHeaderCollection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\Microsoft.Win32.SystemEvents.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\es\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ru\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\zh-Hant\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\it\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Configuration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\clretwrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Collections.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\zh-Hans\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\host\fxr\10.0.9\hostfxr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Threading.Channels.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\cs\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Net.HttpListener.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\PresentationFramework.Royale.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\System.Security.Cryptography.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\it\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Private.CoreLib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ReachFramework.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\System.Windows.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\zh-Hant\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Net.WebSockets.Client.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ja\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ko\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\es\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\it\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\pl\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ru\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\zh-Hant\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\System.Windows.Controls.Ribbon.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ko\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\tr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\msquic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\PresentationCore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\pt-BR\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ru\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\zh-Hans\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\D3DCompiler_47_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\System.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Diagnostics.TextWriterTraceListener.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\fr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\it\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\System.Resources.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\de\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\es\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ja\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\pt-BR\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\tr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Private.Uri.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Runtime.Intrinsics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\netstandard.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\vcruntime140_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ja\System.Windows.Forms.Primitives.resources.dll	msiexec.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIA143.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File created	C:\Windows\Installer\SourceHash{39F1106B-DDD4-4912-9069-D6491D1142BE}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD3D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e588ce9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e588cf0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e588cf5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e588cfd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA6C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI95C4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{946BA18E-2919-4151-B0AF-54F42D8515A3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99BE.tmp	msiexec.exe
File created	C:\Windows\Installer\e588cf5.msi	msiexec.exe
File created	C:\Windows\Installer\e588cf9.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9517.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1BE0093C-57AD-46B8-9781-8437664E9957}	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e588cef.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A9A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E74.tmp	msiexec.exe
File created	C:\Windows\Installer\e588cfd.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e588cf4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD7C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC27.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI974B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAEA6.tmp	msiexec.exe
File created	C:\Windows\Installer\e588d01.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC76.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File opened for modification	C:\Windows\Installer\e588cf0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB38.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B7AC6B1E-81BF-44EB-B1DA-D9F4A255984B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB137.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB82E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB8FA.tmp	msiexec.exe
File created	C:\Windows\Installer\e588ce9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI98F2.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ndrangheta_dotnet10_59549c091a43418cadb6e58824270389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.36.53633_x64\ = "{B7AC6B1E-81BF-44EB-B1DA-D9F4A255984B}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\PackageCode = "6357AFECD0EB89A42B5D3459FDBB34A1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\SourceList\PackageName = "dotnet-host-10.0.9-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E81AB649919215140BFA454FD258513A\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{946BA18E-2919-4151-B0AF-54F42D8515A3}v80.36.53633\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.36.53633_x64\Version = "80.36.53633"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\922561FD73F5E174FCF6848F5B7EB11C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.36.53633_x64\DisplayName = "Microsoft .NET Host FX Resolver - 10.0.9 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\ProductName = "Microsoft .NET Host FX Resolver - 10.0.9 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\roblox\URL Protocol	ndrangheta_fishstrap_9448a93e09d94843844aaaf0bb63c015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\roblox-player\ = "URL: Roblox Protocol"	ndrangheta_fishstrap_9448a93e09d94843844aaaf0bb63c015.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\Dependents	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.36.53633_x64\Dependents\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.36.53633_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\roblox\DefaultIcon	ndrangheta_fishstrap_9448a93e09d94843844aaaf0bb63c015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\DisplayName = "Microsoft .NET Host - 10.0.9 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.36.53633_x64	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FCF16EF4F69552A53562800BB6300BC9\E1B6CA7BFB18BE441BAD9D4F2A5589B4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E81AB649919215140BFA454FD258513A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{946BA18E-2919-4151-B0AF-54F42D8515A3}v80.36.53633\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\roblox-player\shell\open	ndrangheta_fishstrap_9448a93e09d94843844aaaf0bb63c015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\PackageCode = "8A5256E12AB125A47A20C5879AB67446"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\PackageCode = "7449C1950640F524D8B78366F980D622"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Fishstrap\\Fishstrap.exe\" -player \"%1\""	ndrangheta_fishstrap_9448a93e09d94843844aaaf0bb63c015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3900EB1DA758B647918487366E49975\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\ProductName = "Microsoft .NET Runtime - 10.0.9 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.36.53633_x64\Dependents	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FCF16EF4F69552A53562800BB6300BC9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E81AB649919215140BFA454FD258513A\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.36.53633_x64\Version = "80.36.53633"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\roblox\shell\open	ndrangheta_fishstrap_9448a93e09d94843844aaaf0bb63c015.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\roblox-player\shell	ndrangheta_fishstrap_9448a93e09d94843844aaaf0bb63c015.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Version = "80.36.53633"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\SourceList\PackageName = "windowsdesktop-runtime-10.0.9-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.36.53633_x64\Dependents\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Fishstrap\\Fishstrap.exe"	ndrangheta_fishstrap_9448a93e09d94843844aaaf0bb63c015.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\Dependents\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\ProductName = "Microsoft .NET Host - 10.0.9 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{1BE0093C-57AD-46B8-9781-8437664E9957}v80.36.53633\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\roblox\shell\open\command	ndrangheta_fishstrap_9448a93e09d94843844aaaf0bb63c015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.36.53633_x64\ = "{39F1106B-DDD4-4912-9069-D6491D1142BE}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.36.53633_x64\Dependents\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}	windowsdesktop-runtime-10.0.9-win-x64.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1740	msiexec.exe
1740	msiexec.exe
1740	msiexec.exe
1740	msiexec.exe
1740	msiexec.exe
1740	msiexec.exe
1740	msiexec.exe
1740	msiexec.exe
1740	msiexec.exe
1740	msiexec.exe
1740	msiexec.exe
1740	msiexec.exe
764	Ndrangheta.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	764	Ndrangheta.exe
Token: SeShutdownPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSecurityPrivilege	1740	msiexec.exe
Token: SeCreateTokenPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeLockMemoryPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeMachineAccountPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeTcbPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSecurityPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeTakeOwnershipPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeLoadDriverPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSystemProfilePrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSystemtimePrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeProfSingleProcessPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeIncBasePriorityPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeCreatePagefilePrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeCreatePermanentPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeBackupPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeRestorePrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeShutdownPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeDebugPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeAuditPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSystemEnvironmentPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeChangeNotifyPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeRemoteShutdownPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeUndockPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSyncAgentPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeEnableDelegationPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeManageVolumePrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeImpersonatePrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeCreateGlobalPrivilege	5868	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 6116	764	Ndrangheta.exe	92
PID 6116 wrote to memory of 4668	6116	ndrangheta_dotnet10_59549c091a43418cadb6e58824270389.exe	93
PID 6116 wrote to memory of 5868	6116	ndrangheta_dotnet10_59549c091a43418cadb6e58824270389.exe	94
PID 5780 wrote to memory of 5172	5780	windowsdesktop-runtime-10.0.9-win-x64.exe	98
PID 1740 wrote to memory of 4388	1740	msiexec.exe	101
PID 1740 wrote to memory of 5240	1740	msiexec.exe	106
PID 1740 wrote to memory of 872	1740	msiexec.exe	108
PID 5172 wrote to memory of 1252	5172	windowsdesktop-runtime-10.0.9-win-x64.exe	109
PID 5172 wrote to memory of 4044	5172	windowsdesktop-runtime-10.0.9-win-x64.exe	110
PID 1740 wrote to memory of 6064	1740	msiexec.exe	112
PID 1740 wrote to memory of 2920	1740	msiexec.exe	114
PID 1740 wrote to memory of 2240	1740	msiexec.exe	116
PID 764 wrote to memory of 652	764	Ndrangheta.exe	118
PID 764 wrote to memory of 5688	764	Ndrangheta.exe	122
PID 764 wrote to memory of 3368	764	Ndrangheta.exe	123

C:\Users\Admin\AppData\Local\Temp\Ndrangheta.exe
"C:\Users\Admin\AppData\Local\Temp\Ndrangheta.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764
- C:\Users\Admin\AppData\Local\Temp\ndrangheta_dotnet10_59549c091a43418cadb6e58824270389.exe
  "C:\Users\Admin\AppData\Local\Temp\ndrangheta_dotnet10_59549c091a43418cadb6e58824270389.exe" /install /quiet /norestart
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Windows\TEMP\{11D0BA55-9F96-406B-BFE6-75B96182F013}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{11D0BA55-9F96-406B-BFE6-75B96182F013}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{868A4D97-001B-49B6-9837-9E9C386936D0} {FB5CC4A2-EB9A-4D86-A661-FEB850AFE79D}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4668
- - C:\Windows\TEMP\{11D0BA55-9F96-406B-BFE6-75B96182F013}\.be\windowsdesktop-runtime-10.0.9-win-x64.exe
    "C:\Windows\TEMP\{11D0BA55-9F96-406B-BFE6-75B96182F013}\.be\windowsdesktop-runtime-10.0.9-win-x64.exe" -q -burn.elevated BurnPipe.{E52AC99C-1B90-4293-94B6-670AF24705EA} {BE65CA86-A5BC-4829-BA59-DDCFE39D8E6F} 6116
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:5868
- C:\Users\Admin\AppData\Local\Temp\ndrangheta_fishstrap_9448a93e09d94843844aaaf0bb63c015.exe
  "C:\Users\Admin\AppData\Local\Temp\ndrangheta_fishstrap_9448a93e09d94843844aaaf0bb63c015.exe" -quiet
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  PID:652
- C:\Users\Admin\AppData\Local\Ndrangheta\bin\Decompiler.exe
  "C:\Users\Admin\AppData\Local\Ndrangheta\bin\Decompiler.exe"
  2⤵
  - Executes dropped EXE
  PID:5688
- C:\Users\Admin\AppData\Local\Ndrangheta\bin\Decompiler.exe
  "C:\Users\Admin\AppData\Local\Ndrangheta\bin\Decompiler.exe"
  2⤵
  - Executes dropped EXE
  PID:3368

C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe
"C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5780
- C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe
  "C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002549.log" /quiet /install /norestart
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Windows\TEMP\{C3E5CDDD-9B9A-451B-AE35-4AF7003E9E89}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{C3E5CDDD-9B9A-451B-AE35-4AF7003E9E89}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{4E72904A-AA1A-4C61-A0DE-1ED8ADEEEA7D} {5EF42175-2CE9-4278-85FA-7D15E7D06DDC}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1252
- - C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe
    "C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe" -q -burn.elevated BurnPipe.{0FF096D7-543F-4FDA-B710-64D7C2A9FB90} {B27B986D-DD37-433A-800D-78A4680BEC52} 5172
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4044

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 302FEDF8BC83593B2E9F475031DEFD27
  2⤵
  - Loads dropped DLL
  PID:4388
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding FCB9806E9CF78D8A80032747FC9FFB69
  2⤵
  - Loads dropped DLL
  PID:5240
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A5E213FCA9CE23C5B325DC9274C7CF1B
  2⤵
  - Loads dropped DLL
  PID:872
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 3AF323B0BA8DE879E2EDBA0A3E6FCDDB
  2⤵
  - Loads dropped DLL
  PID:6064
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding CBF2C07E57FD5FB3D7C24E0DCD66BD10
  2⤵
  - Loads dropped DLL
  PID:2920
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E8D8C1DCAA01606772401EA3AF1BCD1B
  2⤵
  - Loads dropped DLL
  PID:2240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e588cec.rbs

Path C:\Config.Msi\e588cec.rbs
Size 11KB
SHA256 30e013bacfdc155b270ab4667820874da9bfc9a4d9aa71bd332db64618e9eb00
MD5 03a116946eaa9e6f392aa40c9be81927
SHA1 758b8998c2aba9ce3c77e98027fc0e979dcc938f
SHA512 2fe8faefe25a0707bd9d3baf3d278d1b138eb03f96d40d11530ec072246c85e8996507d207ba61e46113dcd7be7fe11d1d60465606d8e30e35548b87dac4e654
SSDEEP 192:qjLCfIQb3CtJ5HxYe/egOUUIYUUMEEKs9Cdeph:qjLCfIQ+tJ5HmfUYUsk
TLSH
T1503231456304C6C7F9D61734D3172B20B7B7E2D6E318124F00AD92359F0B3A52BAA6D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588cf3.rbs

Path C:\Config.Msi\e588cf3.rbs
Size 9KB
SHA256 6b12dbef7f7f01e56593ea4a008865eff132d4685f89f52e154b56f8e331e615
MD5 d0c0359aac648475f23df639a7c2cdc7
SHA1 454244a7263a27616468f069a1b58c7cdd232831
SHA512 2e4de092c94ea15035df32381f1e69712df515d5ac744430f29d34f4e96475fd3ddd70fae9248404d403a21f85acb7733693e786f1af04076eacc607b4a9a8b2
SSDEEP 96:+mfD1HojC5PrbcweGkZ1UEeD2RhCsTlkUEeD2RhC6jI74UYsTlSYSj7E5Z7P/5L+:3rGjiD1eBOMUIdMUPQ7E/nvSG2uepd
TLSH
T1EE121E01BA0081E2F99F1B39E7577BA137B79297D380639F58EDA0708F4B7C84B94199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588cf8.rbs

Path C:\Config.Msi\e588cf8.rbs
Size 49KB
SHA256 f085f11f54acc491719d9c82f08b7d2f97d6ce843bb014940da88fd005481f5c
MD5 65a1d285624b5db3a904228b39eb672c
SHA1 41e9d37521559b9f785f717dc9f5bbf4e6483d29
SHA512 738af28d2cbb4e160cd91a8768d707b35f3ce85928e1158daadbb5391ba3c3630b25c0e4d7e1d6cfecb14c14e0f0a56ee05008790fd058bd6ab79a432b77f004
SSDEEP 1536:h7EkxpNrxEFzaq0BfH8vjUbjvTyUk9ENNzdoKrCSZOnlFaMd2uuRHCoEzaKQKkDQ:zUtVZ
TLSH
T1CB33EE58FFC8D1D2FA363DB82761DE053345D9CB272058AD65CE429AAEC26C94EFC484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588cfc.rbs

Path C:\Config.Msi\e588cfc.rbs
Size 3KB
SHA256 59860e83f704052cf990216b1f23ec92d790b2d665ab6afde3539004c988ab11
MD5 72b4ba717af7e3f1e36d9df739f2f40a
SHA1 02037243cf05e0e28f2a159e2f06d843891d0e8a
SHA512 0eb491a8f31c0a69aff60a723104e8c9d7f2bc01728c0caebcff0242b19cfaf3cf34e506d96dcace1e7230fd7b1e62dfb0c3f06d8d64f95c5767d0b79e631a7e
TLSH
T1C271AA02EE40E6C3ECAA2F31CE271B513777D6DB9720434B058D91761E177C69EE918A
MD5 SHA1 SHA512 TLSH

Submit Download

e588d00.rbs

Path C:\Config.Msi\e588d00.rbs
Size 71KB
SHA256 6a47de074bf7b44f5385c0195c913294ed818d33c138e46df828acebc279baa0
MD5 58f615c946cc9fe1bd935071655cfa9e
SHA1 1fa3ee47e88c9911bd35c01e74468c7979486b22
SHA512 e7e604b9e688018d3390e38e1485149b19903dbb4b36855d27f10286d5c5eec8d55801091a50fed052c20e626cc1e38726fc1a2b778a91a3d97b8f148542a441
SSDEEP 1536:5CsJtY1z2XlYfypaocNCiOsh18/gd5n9GttC111v7eGHvoOfup2RmRcBi6hhuNWP:c35vym+SeC6GWmiEf+k
TLSH
T12763E0961B00C2E1BC33AD5C1B6BF9C5FE068D96AB61896E02C85039DD925CF6F7C2C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588d04.rbs

Path C:\Config.Msi\e588d04.rbs
Size 3KB
SHA256 3ed33fd7e2c891e6fe5cfd705ec75b3a6dfe5a3e34f43dcacb144236d56b301a
MD5 b0b4161b31936d6255c1f52cc4d4710e
SHA1 e651d38833f167b3b2dc172edefe7b9ace5ad36d
SHA512 8b19a9a8ad096f22b394d8215b4b6b39324221897a6a1e9be40d0db76f761f7a174f506de923c01f93cd7acc0412cf9b1faee0bfc5b2e36baa8519927e362444
TLSH
T19781AC43AB04D6C3ECB21F34CE571BA23777C6DA9725834700CC91750E877DAAEAA285
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 a5ccdc3a41d5e5c6014ff64509aed176db39f4f14caffff3dd1997f8907e94d7
MD5 b497651137eb819839df76f909340d9a
SHA1 549dbe63c781ee26d5ebd2ca8f605ce757b3dc21
SHA512 ed4e6f3556c08b832da992ec329610a0cd4671c51da49a81e1e08075036b46ae1951c5caff14789d5faafef84e88d467343ad400a0810522edadcc31141f18f2
SSDEEP 3072:UGgPzwruvTSBbQ/fp4SbDqIG/sk7l55wKGxvu:UGrrubgbQpDvqIwtQG
TLSH
T152F3F61AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files\dotnet\host\fxr\10.0.9\hostfxr.dll
Size 370KB
SHA256 b41af3ca044a75a77f3bf7883ec586a63e8bd25e74106b21d08131488141581b
MD5 0c6eb37639b34781e9850b11aa9550e3
SHA1 ade8a88164cf883a41297cf7d693db2f74889468
SHA512 3cdb4c929a0ea418cac444390cfa73f74a05f96fe3daec38fa8d31f9f7788bcb718c09d14710b1b74b158e63f54acb04190d109f9172b3cd326dd756693f1b3b
SSDEEP 6144:lal9vjNggqbRudaUzIS64W+/zvZ0UCVvfpdAl0FsGxilKmkRAwBAt/UIQ2CUHFh5:lFuAOOnpa2vDWF9BqW
TLSH
T1FD840816D3E8057CF0B79678DAB29902EB727C494BB0E5DF139088651E73BD09A39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Windows Desktop Runtime 10.0.9 (x64).swidtag

Path C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime 10.0.9 (x64).swidtag
Size 488B
SHA256 e35c7aed7444295aad916a651e8ac6bbee7a7784dc27f9e097d2307362860f0d
MD5 d56d954e744b74c38ed30ff5e43d6f82
SHA1 bbec66a002a988392747ce6d4390544cc9678e34
SHA512 f87f89840dc6065ade6957c8b1d6c0b1d2664daf8be0c37b2b7a89cae24d85768f401267eaac019f70f29354beda3e8a531246d1f3db33f9ab30f4d480eea17f
TLSH
T1DFF09E86F5407A3282B31B64A54EB085F34DB6C3CC8C26C54C99C456019B5EA437B940
MD5 SHA1 SHA512 TLSH

Submit Download

sequence.js

Path C:\ProgramData\Monaco\package\esm\vs\base\common\sequence.js
Size 11B
SHA256 8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881
MD5 e2ebd7ddedcadeeadbf819c35985c768
SHA1 b878c11a77128e74c3cf15c93ef2ceddf2aa0b38
SHA512 4ee1c88f8c3f4e4cd34cb6c00339bf9d6d036ff4ade3af49e871cc8966b84c729d8b75492acc6413c9a664ac00a57958223ac13c4229da8c62ebe6a53e4f783f
MD5 SHA1 SHA512

Submit Download

bat.contribution.d.ts

Path C:\ProgramData\Monaco\package\esm\vs\basic-languages\bat\bat.contribution.d.ts
Size 10B
SHA256 7992a39d6cde5e050eb78461a8bf9ad986175a94826e835c110b3967290bd249
MD5 97b214023a92a133a4df15bdfa51ee47
SHA1 1ebfad438f68fddb4db84d9ef5c0b922b59f895b
SHA512 bbfff7acd12649dcbaa64c9525e49808b3c214609635b0aa22c35e5b21b923a9535c00ecaabbc4bfd4fe5491b158e9f6a227cf1e35c728dd4d606cf6075e9b34
MD5 SHA1 SHA512

Submit Download

dimension.js

Path C:\ProgramData\Monaco\package\esm\vs\editor\common\core\dimension.js
Size 363B
SHA256 09a97316f8af849b49abe77e72e13f0d587c2527dfeaa7f3bc8d0015438eeeab
MD5 dd263e5dbcdedd3493e61d0c57df0f4b
SHA1 128c04e296589029cee7103263a115c68bf04343
SHA512 e22d08f9b3ffc9e9089a11f774f5e0b14a2c89dc1bca715d8190c0173bbd8c76cb53bb8474b381b32254df9986043c4f6fd5c613f823b0ee629a4ffa2e2fdc6a
TLSH
T1FDE0220CAC184623A380C63BAA03A80FF31CC246212E68161D9488081422B50078E601
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\state.rsm
Size 1KB
SHA256 f143e1deed0e31d35617b5b37b832f99c7b025cd5d4003dc01e55d373ea73c0b
MD5 e7fa4e8a8130c59a87c2c2d18c65c4df
SHA1 f5a4535b161edb862b89f546ce3f7f972dc8fb04
SHA512 d8e4c47711a3e9d69a6ba045e92863b5700329770fafa3826cc9969904dc23690b047a116248d8e6f4adf5a32ce230a8df99e82293b644ef8e3225ad3e72bd4b
TLSH
T142218F616FF61528F3F7AB35A9FA1A24997FBC121C20C11E0001714E9E72F81CDA4727
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\state.rsm
Size 1KB
SHA256 a4a2113f1dc2e532b8f846b3871353e4c35ce75dd1cc993e513a19cf10751d05
MD5 eb9dadd0dc6edb8cb4f5dc81180d31b6
SHA1 2dbf932fe8cc450e0c2154a3acdaafab53095d65
SHA512 af7a856ede54b2a6bb6370ec2c2dd52a174d1f9f459f09cd11d73a6c8c693d129fd48dacd3748ae00e566adc6d55507704dd1844e5186baad55d65c397d5e65e
TLSH
T1EC218F616FF61528F3F7AB35A9FA1A24997FBC121C20C11E0001714E9E72F81CDA4727
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\state.rsm
Size 1KB
SHA256 250c5cadeadf76e5521297b8fb728169a8f7147c22a7cccf2cc69b9cdbb51fe8
MD5 048d923e260d624ad354643a6a80df01
SHA1 569428bf99d40b6651e8eff4c43d3d91527d57e2
SHA512 a79d975bce26a2b1a6c3167be1a56270443c7a7374192a32c6fa7868781f059564d1e775ec9904c591daf0391fe51801dde649e6c800989b6da8a4d7c94f95ac
TLSH
T199218F616FF61528F3F7AB35A9FA1A24997FBC121C20C11E0001714E9E72F81CDA4727
MD5 SHA1 SHA512 TLSH

Submit Download

Decompiler.exe

Path C:\Users\Admin\AppData\Local\Ndrangheta\bin\Decompiler.exe
Size 9.4MB
SHA256 fb5c5e11296f8cd6b552aa03daf760d99a380077ff92ba657d4d956af5f3d0f8
MD5 a109790efbe0542dddf63ef0415dd508
SHA1 34d3f0c57dd5359f21bee246e00ee01f69132678
SHA512 a148f1b6a5423147651ab12fad0250ff000efb605e7d468fa45d1e1c1bba71bf2748741d9e62aa72228b9e674d3766d736df64e81b85c9d441e840e0bed75d7f
SSDEEP 49152:AhW7+AqGnMYHZi0h/tipa/lZ9dco869rpyd8cuIhwSt+AOaQXkiShcwaPJXqlExR:UkDPUKXmtGYGz2YhN
TLSH
T124A6C62A676960D9C1BFC07892839F22BD21749D073977F7898182692F20EF87D3D764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Ndrangheta\Z0uFnshlJbsn\D3DCompiler_47_cor3.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Ndrangheta\Z0uFnshlJbsn\PresentationNative_cor3.dll
Size 1.2MB
SHA256 58c4e1174515ec7d07dc6b1a5c258aae88572576e1bc9f09ea92e555752b2554
MD5 e10a0ec11f249c021024a81905d12464
SHA1 3ec0392cc1396d6bf001ad033acaafdf8f09f29f
SHA512 4820510e0237078c7f3f74bc6d0eee02e1ca275436b4099c6e0d520bbfb2cd63b4d010286ad170796f0905a63f8fe8a9154acd8c17ff4837cdf42d3d56ffef54
SSDEEP 24576:uGD+42x2Jvddeoyo7Pkmn/V1Pt8clT3D4iLFxVCPL67uMFAC0q4dovzvfPbRnR9C:+2BzeoRPkmTP2clT31wPO7hACNYovzns
TLSH
T135454A62E2E642E5C47FC1B8C6469717FBB0740A131C66DB87608B592F27FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Ndrangheta\Z0uFnshlJbsn\wpfgfx_cor3.dll
Size 1.9MB
SHA256 098d9cefaca7b1e36460eb28f2725d7afdb8e93855c29f8dd3627a1fb692ae8e
MD5 f22b637c7ac66f9c13bca4059babe75d
SHA1 28637745b2e5c913df87756ea163a6bc1485bbc9
SHA512 dd4204b7001fc2440d83dfefd2191ce0e3a4c94fc6222aa3d3af28464c668d4742e90fa3c45c27d4fce56de07dfd2d7a7374fae315f32d97d6968b304478526c
SSDEEP 24576:4X0ECpcq1uFKlvkW3GRnGdMPVCSbzPOI2NCmlydYbpg85Vay2JeipNU4slL:kBmUqvkWsGdE9Pt24msMpg8Wy2JwvF
TLSH
T19B955A4AB6AC40E9D07AD23CD9D7961FF63178142B61A7CF23A0479D6F27BD0097A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002549_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002549_000_DotNetHost.log
Size 2KB
SHA256 467ee9b6629775a0290beb3677113d1370ee777c3726da677aaf5fe5dc791e1e
MD5 f72a5431573524838a51df3a46638d34
SHA1 cc68c3f21d568ea969b3b76d9a1d3964150e4ed2
SHA512 5dfdcb4b9e7a9e0eeb09e72a87e27dc0b9f0db93bc86e72b5f71a6c7891509f89009b2eb1a6fc735a1d5a70344dc8ce2353b4cafda499cb8d4a6989a63c80c4d
TLSH
T1754105561AF40844B1F657479DF3C0539A73FCA66974CF0C23868319076BD409968FBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002549_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002549_001_DotNetHostFxr.log
Size 2KB
SHA256 67a2a03febba02668077c61ef9e88d9560719bee1c6842059a45ce561f27bdb8
MD5 a8a93d11c800d1ca122cf5b18fa30e34
SHA1 1838546f4c11e53fb828c7ad46e536a561b65f57
SHA512 7462c25dd668b86ebfb190706ab4828b42c81253ed92a42a0ad21360f63f81074cb730184bfed6494b438c04f3e58b30522906eb9e29c568a8bdd822fb621fa1
TLSH
T19D4116561EE40859F1B697479EF3C0139A33FD926874CF4D13868319076BD0099A8BBF
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002549_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002549_002_DotNetRuntime.log
Size 2KB
SHA256 cec3a9f8a92160090531b758a465134b5bc1070f075c58e9ec3b3dff3bec8c31
MD5 569b05871e1274c62206731e40166f93
SHA1 d55033adddfeba451532bbf1ecb0c59ea3014761
SHA512 dbbca4cef104d833274383b012946cec70b41497631eaa283fa54d884e48756ef85cee1caea1aa721e77a3bd80b04759114a8484d1e5702d2f45b0a95eab5b98
TLSH
T1E74124591BE80846B2B297439EF3C0535E73FCE26834CB4C13C69319436AD019D68BBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002549_003_WindowsDesktopRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002549_003_WindowsDesktopRuntime.log
Size 2KB
SHA256 ca782f37221532d8a4c27c26ed6d74c0691c29dd045def3e5f4e8611259e4719
MD5 6f2dcb17449c266165797947c7348cbb
SHA1 ad3fd5e28da7c3697faab70d71b70786979323cf
SHA512 63c2217a606a393f6c4313b4c2d692b1993131f2c40cfc774c5012615d3dc325e034a106373d136d857deec56264809cdea120fdbee7673529e2640d67efc5d4
TLSH
T1FA4119551BE44846B1B257879EF3C063AB33FCA66878DB0C53864319076BD009C58BBE
MD5 SHA1 SHA512 TLSH

Submit Download

ndrangheta_fishstrap_9448a93e09d94843844aaaf0bb63c015.exe

Path C:\Users\Admin\AppData\Local\Temp\ndrangheta_fishstrap_9448a93e09d94843844aaaf0bb63c015.exe
Size 14.9MB
SHA256 d3a66023c4a04b13b7df0159930f748f309c1307b1bccbd022bacdd68d878f35
MD5 a0c3321ff616288101e1184e9d5c5af3
SHA1 261e6651e2c1fbc710df2e63135333d0f6a838dc
SHA512 ef6e6594aaf98c0bfd1e86c541fa06effc417f5db7ccd7b796e0624d12f615297512099e331de4416fa37fb1e3b9e944fbcfce32a127a536399b42b255d34ae4
SSDEEP 98304:hlE7JmE7FIAUxdgeTsTE7OVfasIYyFLjW/sa+ZmD3JxOYoHwfLk3vSmaR0+Mc4AI:hSHDUsYsPQsIjKsa+ZWObAbN0z
TLSH
T12AF68E8573FC2B35E3B74B35A970621A4976BC1AA911D78E2B887A1D1972340CCF1B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{11D0BA55-9F96-406B-BFE6-75B96182F013}\DotNetHost
Size 1012KB
SHA256 c8fa13b9c79f39d88a324a03ff97c21585643095b32e674fa668c58e1f106ef1
MD5 7bc75d5cc808fcc218f7d03f252db9ba
SHA1 fe59d3c4f3529fd31bdd277fa667eea4ccacc32e
SHA512 e51b451f4a6f7c919a4dbabf52470a3c448d5b9b1740d9e4cc5051310bcfe30b31d95e7c8766e414a5147f82c74b1b79500a9d48a6c7c80c466dced9e995a830
SSDEEP 12288:0N2etgX0xsm7HrObWMInYLE/BbdJ0zErWolCJ9TeWxqYZfUfP3R:I26gG74W6WBbdJwEqECJ9Te7Yxs3R
TLSH
T188256A1BBFA404A9D8B24E75C5B78321EE357C482320969F43A47229DEFB7D0647A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{11D0BA55-9F96-406B-BFE6-75B96182F013}\DotNetHostFxr
Size 1.1MB
SHA256 4edb63c267c96ca5c05f309081b55e3374626e25dddb205cf8b37a42c2438750
MD5 7edeb549573882d34df2df078c7299ce
SHA1 9d889c19de10586f6fb0138030afd519fd40d02c
SHA512 acab3c45b994afbe04d06c58d9d446e1bc10c2bc8e76275a6542f00b86a379cc6fb08dcd1ddb7e51280e5552b823fee64eb7917bf8993b80f82a5a70b14536f0
SSDEEP 24576:f26gG74W6WBbdJwEqECJ9Te7YxkQTbVHmIzOd:f26748BnwEpI9T6YGiVHmI
TLSH
T157357B1BBFA404A9D8A24E75C5B78321EE357C082320969F43A47229DEFB7D0647B7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{11D0BA55-9F96-406B-BFE6-75B96182F013}\DotNetRuntime
Size 28.1MB
SHA256 076b2f180cc513184db1d41b98ef8cab51a9059ad33a0c64919bac0dc9733775
MD5 4b8531ed0b9364894105ee2d0c2001d8
SHA1 6c0b1a0769fefa49f3ff2dd0918ef3f7f7913578
SHA512 8f823ba69293b3b106e550e5d69be29c8227f63b9edb15c1f753b72cb28d9f0fb7d7b5940d9dd7c3da326996f7a2f7e4dc61b2137ced1732755c497dc8d1fd35
SSDEEP 393216:BGA0lAITbkXCfyp4Q/24AJzL1GCn0LA8RVdhtmrBK6q5rONk/1CubJLetP/oj90x:JCAIkXCqOF4y0jbM1K6qV3lJL30VX
TLSH
T182573357BF9548A9C8624E3888BBD725AA7A3C082720964F5758751CCFF73E012BB7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{11D0BA55-9F96-406B-BFE6-75B96182F013}\WindowsDesktopRuntime
Size 28.8MB
SHA256 4d029b3bef558b3232e33e6e7c54f65feada347b99cac142978643cd7cadb12c
MD5 eb6a43971c26a1d58cf47055357f7300
SHA1 a5ac458efb05ca0166fb5b498b48bc6c42c20dd9
SHA512 fe49a258147dbb13cc37d5764e3af27dd424b0d49d2d353c3010f7d4d07495dd373c9a3fcee14696032fefff823f926b6e99a7d69b89154f36530d30d24783f7
SSDEEP 786432:fTxfdq4WD1EQMyoE5mX8/3LBGxTfb+T5Suf+0zkOPQa:7NyBowmXcgT+oe+1YQ
TLSH
T1086733177F9129A9C8AA4EB1C4778325AE313D44272089AF02A4725DEFFB3E4557B7C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9517.tmp

Path C:\Windows\Installer\MSI9517.tmp
Size 392KB
SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
MD5 f1fafe5c54813a5d7b60d08b859bd58b
SHA1 95e6598ce1c02220d68edab5474980b7f0f0a12c
SHA512 6dbc8b10277c6fae8d7ba961a843810df0bb11c9c6e3ba54eea1b24e13b1069e454ef5d76d345839a32f94871855928578a15948ba242d03c990b21d8f845df9
SSDEEP 6144:u/VbdUw0z9ursTolCJSqJiIUk8AeWNxFqYrtUc06N:u/VbdJ0zErWolCJ9TeWxqYZfN
TLSH
T1CC846A29F7E418EDD4B782B6C5A68030FF75754D332095AF8BA845291F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{11D0BA55-9F96-406B-BFE6-75B96182F013}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 5d0f15575f07c77858f4d2862603a0212eeb2bd7c8ec677f24f9b61c40e4e0ae
MD5 4a6fccfbb948643090ee45d55e11b483
SHA1 8cc055b7d7bc7ff5167ab02537eb334d72ba399c
SHA512 11e8d7dacd303c85c89bf4a071cfc10ae0136f03d1ac74bc40b4a7a3f1cd3741025240647ee432d21149bc5f244357e7b6b15ac5b17c70ce4b21631a862a0400
SSDEEP 96:2bpcBM/En6Yic0wZycLn2Vn6sKj0wFycr4qn6URL0wNycLCXn6fMSJw0wpMdycA7:2+z+TzV/zvI4qn2X5a3a1KcITzsCsysz
TLSH
T1C112D3512BFD0218F0F3AE48EFFAA5555A36BD552E39C82D01201D0F49B2E858962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{11D0BA55-9F96-406B-BFE6-75B96182F013}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{11D0BA55-9F96-406B-BFE6-75B96182F013}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{11D0BA55-9F96-406B-BFE6-75B96182F013}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{11D0BA55-9F96-406B-BFE6-75B96182F013}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{11D0BA55-9F96-406B-BFE6-75B96182F013}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.9-win-x64.exe

Path C:\Windows\Temp\{11D0BA55-9F96-406B-BFE6-75B96182F013}\.be\windowsdesktop-runtime-10.0.9-win-x64.exe
Size 966KB
SHA256 e2e18ec5b9eba1f7d53f5bbfb68b56d0bb9910abc92d429db538544ac8eb2b10
MD5 b6789f69e59f457288a3c4e37cc5e4ac
SHA1 4c5d5ad73304db60ba0e539f30d0a019621570cb
SHA512 2880a9b5ae09640d444fa888f1b05bba4eece82abbb226e80a0451a38f2892d3d8d525fb63ec38a11159cd1ae51e08c1aca113c84b0afcc5a49f79869c7ed7b2
SSDEEP 12288:SVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJErEA6Z2E2gh+3+U8FHFJb:SVGWl6qCmyt6UdmcpMzYzkR3+U8/Jb
TLSH
T178256D31A166242BD6F50973F914D2307E2CD7082B5C95BAC6C0D90D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/764-92-0x000002144A330000-0x000002144A350000-memory.dmp

Download

memory/764-88-0x000002144A200000-0x000002144A230000-memory.dmp

Download

memory/764-158-0x000002144CD10000-0x000002144CD80000-memory.dmp

Download

memory/764-162-0x000002144BA60000-0x000002144BA70000-memory.dmp

Download

memory/764-166-0x000002144DD50000-0x000002144DDD0000-memory.dmp

Download

memory/764-170-0x000002144DE80000-0x000002144DF20000-memory.dmp

Download

memory/764-174-0x000002144E2B0000-0x000002144E520000-memory.dmp

Download

memory/764-178-0x000002144DCC0000-0x000002144DCD0000-memory.dmp

Download

memory/764-184-0x000002144CDE0000-0x000002144CE60000-memory.dmp

Download

memory/764-188-0x000002144E5C0000-0x000002144E5E0000-memory.dmp

Download

memory/764-196-0x0000021450920000-0x0000021450940000-memory.dmp

Download

memory/764-192-0x0000021450970000-0x00000214509A0000-memory.dmp

Download

memory/764-154-0x000002144CBF0000-0x000002144CCA0000-memory.dmp

Download

memory/764-146-0x000002144CAA0000-0x000002144CAE0000-memory.dmp

Download

memory/764-150-0x000002144BA50000-0x000002144BA60000-memory.dmp

Download

memory/764-96-0x000002144A4D0000-0x000002144A590000-memory.dmp

Download

memory/764-100-0x000002144A3C0000-0x000002144A3E0000-memory.dmp

Download

memory/764-104-0x0000020C2E410000-0x0000020C2E420000-memory.dmp

Download

memory/764-128-0x000002144C330000-0x000002144C430000-memory.dmp

Download

memory/764-133-0x000002144BAA0000-0x000002144BAF0000-memory.dmp

Download

memory/764-116-0x000002144B700000-0x000002144B860000-memory.dmp

Download

memory/764-124-0x000002144BCA0000-0x000002144BE50000-memory.dmp

Download

memory/764-120-0x000002144B860000-0x000002144B8A0000-memory.dmp

Download

memory/764-108-0x000002144A3E0000-0x000002144A410000-memory.dmp

Download

memory/764-112-0x000002144A600000-0x000002144A620000-memory.dmp

Download

memory/764-5-0x0000020C313F0000-0x0000020C32340000-memory.dmp

Download

memory/764-84-0x000002144ADA0000-0x000002144B510000-memory.dmp

Download

memory/764-142-0x000002144CA40000-0x000002144CAA0000-memory.dmp

Download

memory/764-80-0x000002144A290000-0x000002144A2E0000-memory.dmp

Download

memory/764-76-0x0000020C34560000-0x0000020C34660000-memory.dmp

Download

memory/764-21-0x0000020C325B0000-0x0000020C32600000-memory.dmp

Download

memory/764-37-0x0000020C2E480000-0x0000020C2E4A0000-memory.dmp

Download

memory/764-41-0x0000020C33990000-0x0000020C33A10000-memory.dmp

Download

memory/764-45-0x0000020C32600000-0x0000020C32610000-memory.dmp

Download

memory/764-49-0x0000020C329A0000-0x0000020C329C0000-memory.dmp

Download

memory/764-57-0x0000020C33C50000-0x0000020C33C70000-memory.dmp

Download

memory/764-61-0x0000020C34480000-0x0000020C344A0000-memory.dmp

Download

memory/764-65-0x0000020C34510000-0x0000020C34540000-memory.dmp

Download

memory/764-2464-0x0000021450D30000-0x0000021450D40000-memory.dmp

Download

memory/764-69-0x0000020C34540000-0x0000020C34560000-memory.dmp

Download

memory/764-53-0x0000020C33A30000-0x0000020C33A50000-memory.dmp

Download

memory/764-937-0x0000021450AF0000-0x0000021450B60000-memory.dmp

Download

memory/764-34-0x0000021447EF0000-0x00000214486E0000-memory.dmp

Download

memory/764-29-0x0000020C32950000-0x0000020C329A0000-memory.dmp

Download

memory/764-25-0x0000020C2FC90000-0x0000020C2FCD0000-memory.dmp

Download

memory/764-13-0x0000020C30240000-0x0000020C30460000-memory.dmp

Download

memory/764-17-0x0000020C32770000-0x0000020C328D0000-memory.dmp

Download

memory/764-2429-0x0000021453BB0000-0x0000021453D80000-memory.dmp

Download

memory/764-2434-0x0000021450A30000-0x0000021450A60000-memory.dmp

Download

memory/764-2441-0x0000021450690000-0x00000214506B0000-memory.dmp

Download

memory/764-10-0x0000021446FD0000-0x0000021447EF0000-memory.dmp

Download

memory/764-2472-0x00000214549A0000-0x0000021454A90000-memory.dmp

Download

memory/764-2468-0x0000021454790000-0x00000214548B0000-memory.dmp

Download

memory/5868-915-0x00000000009C0000-0x0000000000A86000-memory.dmp

Download