ed21b2a650477fca201a1a1a97c388c3a427634f26c82cf6953bfcb688a591ca

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ndrangheta.exe
Size 73.4MB
Sample260623-e1hrkaaw4x
SHA256 ed21b2a650477fca201a1a1a97c388c3a427634f26c82cf6953bfcb688a591ca
MD5 78524e08c5266583bb3c013134ced71f
SHA1 46aff110b00edcdcc5cf0c01a85b4391f8965def
SHA512 9a13fe9004ccb708bbf45eec2b80d8e1b279ba6673d1dfdde555e4918375e193d0bd35257891f84768c3d30b741ce3e7fba4f088d3e1f5c77cabb95481a3b2ed
SSDEEP 1572864:nxmmctRbAEk5KM0BW84OQf0IM8IZngjMke8QQkJ1SCya7VNMgmylY:nxKn9p9Q86IZnmMp8UkE7VNMrylY
TLSH
T11FF72356E2F900E8D4BBC0B8CA5B4627EBB23455133457EB12A48A692F37FE15E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
3164	ndrangheta_dotnet10_c381f1ed3e174f179a9101e62878067e.exe
5904	wixstdba.exe
4824	windowsdesktop-runtime-10.0.9-win-x64.exe
804	windowsdesktop-runtime-10.0.9-win-x64.exe
3144	windowsdesktop-runtime-10.0.9-win-x64.exe
2988	wixstdba.exe
6060	ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe
4324	Decompiler.exe
6836	Decompiler.exe

Loads dropped DLL 12 IoCs

pid	Process
3540	Ndrangheta.exe
3540	Ndrangheta.exe
3540	Ndrangheta.exe
3708	MsiExec.exe
3708	MsiExec.exe
3392	MsiExec.exe
3392	MsiExec.exe
3948	MsiExec.exe
6964	MsiExec.exe
6964	MsiExec.exe
6396	MsiExec.exe
6396	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C} = "\"C:\\ProgramData\\Package Cache\\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\\windowsdesktop-runtime-10.0.9-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.9-win-x64.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	1088	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\host\fxr\10.0.9\hostfxr.dll	msiexec.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime 10.0.9 (x64).swidtag	windowsdesktop-runtime-10.0.9-win-x64.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	msiexec.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	msiexec.exe
File opened for modification	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\dotnet.exe	msiexec.exe
File created	C:\Program Files\dotnet\host\fxr\10.0.9\hostfxr.dll	msiexec.exe

Drops file in Windows directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI7722.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{946BA18E-2919-4151-B0AF-54F42D8515A3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI788B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI75D9.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF498D6BB3E7DADEAC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI817B.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1BE0093C-57AD-46B8-9781-8437664E9957}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAEBE0465FFCD357F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF669D0E4DF6E763D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0EC4CF06A5114714.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\Installer\e586b9c.msi	msiexec.exe
File created	C:\Windows\Installer\e586b9d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e586b9d.msi	msiexec.exe
File created	C:\Windows\Installer\e586ba2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI808F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI82F4.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8E652470AF4B4419.TMP	msiexec.exe
File created	C:\Windows\Installer\e586ba1.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF832A258200C0022A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF567C4A83D8A72862.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF172B373C62D83CD.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7385.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF7A71EE61BFF43AB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7480.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File created	C:\Windows\SystemTemp\~DF47970A57428AAE99.TMP	msiexec.exe
File created	C:\Windows\Installer\e586b96.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e586b96.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCC97340C85BC1647.TMP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF43451C9D93543CBE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7125BAD10B9434E6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD3469FE2EF5102D9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e586ba2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7C74.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2896830383236F8E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7FE2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5A280EF63FEE6E0B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8228.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCEE3DF864BE900BF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI77DF.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{39F1106B-DDD4-4912-9069-D6491D1142BE}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E98.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA28BDAAFE78ADABC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F74.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ndrangheta_dotnet10_c381f1ed3e174f179a9101e62878067e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.36.53633_x64\Dependents	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\ = "{1BE0093C-57AD-46B8-9781-8437664E9957}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Version = "80.36.53633"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\Version = "1344590209"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.36.53633_x64	windowsdesktop-runtime-10.0.9-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}	windowsdesktop-runtime-10.0.9-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\Dependents\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\roblox	ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\roblox\DefaultIcon	ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\roblox\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Fishstrap\\Fishstrap.exe\" -player \"%1\""	ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\roblox-player\shell\open\command	ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.36.53633_x64\Version = "80.36.53633"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E81AB649919215140BFA454FD258513A\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\ProductName = "Microsoft .NET Host FX Resolver - 10.0.9 (x64)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\roblox-player\shell\open	ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\roblox-player\ = "URL: Roblox Protocol"	ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\roblox-player\URL Protocol	ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.36.53633_x64\DisplayName = "Microsoft .NET Host FX Resolver - 10.0.9 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{946BA18E-2919-4151-B0AF-54F42D8515A3}v80.36.53633\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\roblox\shell	ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\PackageCode = "6ADCA068A141F9941A0654693A78C453"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.36.53633_x64\Dependents\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}	windowsdesktop-runtime-10.0.9-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E81AB649919215140BFA454FD258513A	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\roblox\URL Protocol	ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3900EB1DA758B647918487366E49975\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4\C3900EB1DA758B647918487366E49975	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\SourceList\PackageName = "dotnet-hostfxr-10.0.9-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Fishstrap\\Fishstrap.exe"	ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\Version = "1344590209"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Fishstrap\\Fishstrap.exe"	ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.9 (x64)"	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\SourceList\PackageName = "dotnet-host-10.0.9-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{1BE0093C-57AD-46B8-9781-8437664E9957}v80.36.53633\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.36.53633_x64	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\roblox\shell\open	ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\ = "{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}"	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\Dependents	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E81AB649919215140BFA454FD258513A\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.36.53633_x64\Dependents\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}	windowsdesktop-runtime-10.0.9-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\Version = "10.0.9.50000"	windowsdesktop-runtime-10.0.9-win-x64.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1088	msiexec.exe
1088	msiexec.exe
1088	msiexec.exe
1088	msiexec.exe
1088	msiexec.exe
1088	msiexec.exe
1088	msiexec.exe
1088	msiexec.exe
1088	msiexec.exe
1088	msiexec.exe
1088	msiexec.exe
1088	msiexec.exe
3540	Ndrangheta.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3540	Ndrangheta.exe
Token: SeShutdownPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSecurityPrivilege	1088	msiexec.exe
Token: SeCreateTokenPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeLockMemoryPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeMachineAccountPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeTcbPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSecurityPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeTakeOwnershipPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeLoadDriverPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSystemProfilePrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSystemtimePrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeProfSingleProcessPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeIncBasePriorityPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeCreatePagefilePrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeCreatePermanentPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeBackupPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeRestorePrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeShutdownPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeDebugPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeAuditPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSystemEnvironmentPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeChangeNotifyPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeRemoteShutdownPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeUndockPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSyncAgentPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeEnableDelegationPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeManageVolumePrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeImpersonatePrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeCreateGlobalPrivilege	4824	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeRestorePrivilege	1088	msiexec.exe
Token: SeTakeOwnershipPrivilege	1088	msiexec.exe
Token: SeRestorePrivilege	1088	msiexec.exe
Token: SeTakeOwnershipPrivilege	1088	msiexec.exe
Token: SeRestorePrivilege	1088	msiexec.exe
Token: SeTakeOwnershipPrivilege	1088	msiexec.exe
Token: SeRestorePrivilege	1088	msiexec.exe
Token: SeTakeOwnershipPrivilege	1088	msiexec.exe
Token: SeRestorePrivilege	1088	msiexec.exe
Token: SeTakeOwnershipPrivilege	1088	msiexec.exe
Token: SeRestorePrivilege	1088	msiexec.exe
Token: SeTakeOwnershipPrivilege	1088	msiexec.exe
Token: SeRestorePrivilege	1088	msiexec.exe
Token: SeTakeOwnershipPrivilege	1088	msiexec.exe
Token: SeRestorePrivilege	1088	msiexec.exe
Token: SeTakeOwnershipPrivilege	1088	msiexec.exe
Token: SeRestorePrivilege	1088	msiexec.exe
Token: SeTakeOwnershipPrivilege	1088	msiexec.exe
Token: SeRestorePrivilege	1088	msiexec.exe
Token: SeTakeOwnershipPrivilege	1088	msiexec.exe
Token: SeRestorePrivilege	1088	msiexec.exe
Token: SeTakeOwnershipPrivilege	1088	msiexec.exe
Token: SeRestorePrivilege	1088	msiexec.exe
Token: SeTakeOwnershipPrivilege	1088	msiexec.exe
Token: SeRestorePrivilege	1088	msiexec.exe
Token: SeTakeOwnershipPrivilege	1088	msiexec.exe
Token: SeRestorePrivilege	1088	msiexec.exe
Token: SeTakeOwnershipPrivilege	1088	msiexec.exe
Token: SeRestorePrivilege	1088	msiexec.exe
Token: SeTakeOwnershipPrivilege	1088	msiexec.exe
Token: SeRestorePrivilege	1088	msiexec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1088	msiexec.exe
3708	MsiExec.exe
3392	MsiExec.exe
3948	MsiExec.exe
6964	MsiExec.exe
6396	MsiExec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 3164	3540	Ndrangheta.exe	91
PID 3164 wrote to memory of 5904	3164	ndrangheta_dotnet10_c381f1ed3e174f179a9101e62878067e.exe	92
PID 3164 wrote to memory of 4824	3164	ndrangheta_dotnet10_c381f1ed3e174f179a9101e62878067e.exe	93
PID 804 wrote to memory of 3144	804	windowsdesktop-runtime-10.0.9-win-x64.exe	97
PID 1088 wrote to memory of 3708	1088	msiexec.exe	98
PID 1088 wrote to memory of 3392	1088	msiexec.exe	99
PID 1088 wrote to memory of 3948	1088	msiexec.exe	100
PID 1088 wrote to memory of 6964	1088	msiexec.exe	101
PID 1088 wrote to memory of 6396	1088	msiexec.exe	102
PID 3144 wrote to memory of 2988	3144	windowsdesktop-runtime-10.0.9-win-x64.exe	103
PID 3540 wrote to memory of 6060	3540	Ndrangheta.exe	104
PID 3540 wrote to memory of 4324	3540	Ndrangheta.exe	107
PID 3540 wrote to memory of 6836	3540	Ndrangheta.exe	108

C:\Users\Admin\AppData\Local\Temp\Ndrangheta.exe
"C:\Users\Admin\AppData\Local\Temp\Ndrangheta.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\AppData\Local\Temp\ndrangheta_dotnet10_c381f1ed3e174f179a9101e62878067e.exe
  "C:\Users\Admin\AppData\Local\Temp\ndrangheta_dotnet10_c381f1ed3e174f179a9101e62878067e.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\TEMP\{695F7910-4445-48CC-B8B1-6AC50692703E}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{695F7910-4445-48CC-B8B1-6AC50692703E}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{BDDFD5CD-04F6-47C9-AF5D-21BB0B1D85A5} {0388BD8D-BA36-4021-8046-26E9D5155FF2}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5904
- - C:\Windows\TEMP\{695F7910-4445-48CC-B8B1-6AC50692703E}\.be\windowsdesktop-runtime-10.0.9-win-x64.exe
    "C:\Windows\TEMP\{695F7910-4445-48CC-B8B1-6AC50692703E}\.be\windowsdesktop-runtime-10.0.9-win-x64.exe" -q -burn.elevated BurnPipe.{22AF03AD-B9F9-46B6-87C8-0EE77801049D} {F69E8FBB-5892-4BA2-ACD5-E561C587A394} 3164
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:4824
- C:\Users\Admin\AppData\Local\Temp\ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe
  "C:\Users\Admin\AppData\Local\Temp\ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe" -quiet
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:6060
- C:\Users\Admin\AppData\Local\Ndrangheta\bin\Decompiler.exe
  "C:\Users\Admin\AppData\Local\Ndrangheta\bin\Decompiler.exe"
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Users\Admin\AppData\Local\Ndrangheta\bin\Decompiler.exe
  "C:\Users\Admin\AppData\Local\Ndrangheta\bin\Decompiler.exe"
  2⤵
  - Executes dropped EXE
  PID:6836

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F45147ED69A44894266856C1B149B685
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3708
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4B798EFDB925D0E584ED2C588FB316E7
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3392
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 358223A1F016A7D8A7289303E7217DF0
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3948
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding BA87022A5E88AB593A0B39A365E7DEE7
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:6964
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 163BBB6865181B5FD345C28E59E27BDA
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:6396

C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe
"C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:804
- C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe
  "C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002552.log" /quiet /install /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Windows\TEMP\{247E5ADE-4131-4168-B74A-6EDC6F63AC54}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{247E5ADE-4131-4168-B74A-6EDC6F63AC54}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{F7CDAE4A-422E-4EB8-991B-E9C4264DC79E} {B0BD3C76-EACB-457E-AA9E-8EE0880D09B9}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e586b99.rbs

Path C:\Config.Msi\e586b99.rbs
Size 11KB
SHA256 c08bda365fdd443519a6384575bf0a9e707d7bc78ef55bddcbb652c2469e044d
MD5 920b3e38b2661c0c6864d20ecea9af21
SHA1 918bca2898c967fe7b013f27692e00a72c67c6c8
SHA512 59b99ef1015f62d27cad2a9baa7e5c3167048512c39e8abf7ee405227189b7fe7b9df7f746052e208120652b603bc386f064c992dcab93d3ff2ca1b446794213
SSDEEP 192:EOLCfIQ7tBuA5HLDDYP9CrOUUIYUUMcEKs9Cdeph:EOLCfIQ7tBuA5HLD0LUYUkk
TLSH
T12F3221856204C6C7F9D61734D3172F21B7B7E2D6A318124F00AD92359F0B3A52BA96DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e586ba0.rbs

Path C:\Config.Msi\e586ba0.rbs
Size 9KB
SHA256 4dc956fc2323f41c14ba8c72e3d9ecac8b58ef583f459c11076dc91b5af2e5d3
MD5 63f72f366c43e337c05b0468e0743cc2
SHA1 dea22f6ba4c2a347e21391c9599de07ef47d93d4
SHA512 69fc7df85ec4150f39e6950b2a2fed4ef044e6f42e4d8fa1189a918f032020747214d07ad5ca5e90af184e243076c10f862ce819438f331d32fece86e6643764
SSDEEP 96:pmfD1HZjALHrbcBCblZ1UEeD2RhCsTlkUEeD2RhC6jI74UYsTlSY0j7E5Z7P/5L+:ErHjgL0CjOMUIdMUPe7E/nvSG2uepd
TLSH
T124122E01B60081E2F99F1B39E7577BA237B7D297D380635F58ADA0708F4B7C84B94199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e586ba7.rbs

Path C:\Config.Msi\e586ba7.rbs
Size 9KB
SHA256 31dbe87f43d39cd4d087b11fbb35904d7e442c46920f4c32c979958459360427
MD5 31f803cf3fcf9aa5fd06411625d96e26
SHA1 2b20043148e83d128e502f4716661dd5d7a64d7b
SHA512 d82e8c524b0f45563293ddc700fa9a30c3d1d26cbdfaef1c14b44368685cad44890480842da274181718de61e29c0f4ec66dc70f66b55ec857a7740bc25b86f0
SSDEEP 192:zrRRplk2RxlkyrSGn5ToniLN3lN9+rlHU:zrRRpldRxlx+vlHU
TLSH
T134123402A50482A2FD9F1B35E7537BB137F7C297D340939B60EDB4B09F0A7C85AA4199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e586ba8.rbf

Path C:\Config.Msi\e586ba8.rbf
Size 370KB
SHA256 b41af3ca044a75a77f3bf7883ec586a63e8bd25e74106b21d08131488141581b
MD5 0c6eb37639b34781e9850b11aa9550e3
SHA1 ade8a88164cf883a41297cf7d693db2f74889468
SHA512 3cdb4c929a0ea418cac444390cfa73f74a05f96fe3daec38fa8d31f9f7788bcb718c09d14710b1b74b158e63f54acb04190d109f9172b3cd326dd756693f1b3b
SSDEEP 6144:lal9vjNggqbRudaUzIS64W+/zvZ0UCVvfpdAl0FsGxilKmkRAwBAt/UIQ2CUHFh5:lFuAOOnpa2vDWF9BqW
TLSH
T1FD840816D3E8057CF0B79678DAB29902EB727C494BB0E5DF139088651E73BD09A39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e586bab.rbs

Path C:\Config.Msi\e586bab.rbs
Size 9KB
SHA256 6bd10e6bf46b64549fd0ec85848bc05e8164d3e27cc33ff7e0ad1d533ed7f53f
MD5 57b3dfc936a9c9a37959bb9bfd201b66
SHA1 0bba4974023ff00c823bef23cb9e9e55ba532a7c
SHA512 eb79d884e4281f76cc43c2c09d84001e700b787c8cd9921c77857886cc26d782b2a2834089698b40cbdab5610c84f2b2ead6b7e5a1e51d0b1d6081d61d4a0e7c
SSDEEP 96:ymWrk2FVm8RLeDmlkxzm8RpeDmlkCjmp/97VcV4Zz4FhYIGLNTQjmp/4bFVPOHLQ:ziRXlkJRNlkmGBTszyBquJ4NptJj
TLSH
T1AB122245520887CBEAD64B35C7132F3077E7E2D6E31C024B10ED62719B0A3657B6A2A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 a5ccdc3a41d5e5c6014ff64509aed176db39f4f14caffff3dd1997f8907e94d7
MD5 b497651137eb819839df76f909340d9a
SHA1 549dbe63c781ee26d5ebd2ca8f605ce757b3dc21
SHA512 ed4e6f3556c08b832da992ec329610a0cd4671c51da49a81e1e08075036b46ae1951c5caff14789d5faafef84e88d467343ad400a0810522edadcc31141f18f2
SSDEEP 3072:UGgPzwruvTSBbQ/fp4SbDqIG/sk7l55wKGxvu:UGrrubgbQpDvqIwtQG
TLSH
T152F3F61AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sequence.js

Path C:\ProgramData\Monaco\package\esm\vs\base\common\sequence.js
Size 11B
SHA256 8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881
MD5 e2ebd7ddedcadeeadbf819c35985c768
SHA1 b878c11a77128e74c3cf15c93ef2ceddf2aa0b38
SHA512 4ee1c88f8c3f4e4cd34cb6c00339bf9d6d036ff4ade3af49e871cc8966b84c729d8b75492acc6413c9a664ac00a57958223ac13c4229da8c62ebe6a53e4f783f
MD5 SHA1 SHA512

Submit Download

bat.contribution.d.ts

Path C:\ProgramData\Monaco\package\esm\vs\basic-languages\bat\bat.contribution.d.ts
Size 10B
SHA256 7992a39d6cde5e050eb78461a8bf9ad986175a94826e835c110b3967290bd249
MD5 97b214023a92a133a4df15bdfa51ee47
SHA1 1ebfad438f68fddb4db84d9ef5c0b922b59f895b
SHA512 bbfff7acd12649dcbaa64c9525e49808b3c214609635b0aa22c35e5b21b923a9535c00ecaabbc4bfd4fe5491b158e9f6a227cf1e35c728dd4d606cf6075e9b34
MD5 SHA1 SHA512

Submit Download

dimension.js

Path C:\ProgramData\Monaco\package\esm\vs\editor\common\core\dimension.js
Size 363B
SHA256 09a97316f8af849b49abe77e72e13f0d587c2527dfeaa7f3bc8d0015438eeeab
MD5 dd263e5dbcdedd3493e61d0c57df0f4b
SHA1 128c04e296589029cee7103263a115c68bf04343
SHA512 e22d08f9b3ffc9e9089a11f774f5e0b14a2c89dc1bca715d8190c0173bbd8c76cb53bb8474b381b32254df9986043c4f6fd5c613f823b0ee629a4ffa2e2fdc6a
TLSH
T1FDE0220CAC184623A380C63BAA03A80FF31CC246212E68161D9488081422B50078E601
MD5 SHA1 SHA512 TLSH

Submit Download

Decompiler.exe

Path C:\Users\Admin\AppData\Local\Ndrangheta\bin\Decompiler.exe
Size 9.4MB
SHA256 fb5c5e11296f8cd6b552aa03daf760d99a380077ff92ba657d4d956af5f3d0f8
MD5 a109790efbe0542dddf63ef0415dd508
SHA1 34d3f0c57dd5359f21bee246e00ee01f69132678
SHA512 a148f1b6a5423147651ab12fad0250ff000efb605e7d468fa45d1e1c1bba71bf2748741d9e62aa72228b9e674d3766d736df64e81b85c9d441e840e0bed75d7f
SSDEEP 49152:AhW7+AqGnMYHZi0h/tipa/lZ9dco869rpyd8cuIhwSt+AOaQXkiShcwaPJXqlExR:UkDPUKXmtGYGz2YhN
TLSH
T124A6C62A676960D9C1BFC07892839F22BD21749D073977F7898182692F20EF87D3D764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Ndrangheta\Z0uFnshlJbsn\D3DCompiler_47_cor3.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Ndrangheta\Z0uFnshlJbsn\PresentationNative_cor3.dll
Size 1.2MB
SHA256 58c4e1174515ec7d07dc6b1a5c258aae88572576e1bc9f09ea92e555752b2554
MD5 e10a0ec11f249c021024a81905d12464
SHA1 3ec0392cc1396d6bf001ad033acaafdf8f09f29f
SHA512 4820510e0237078c7f3f74bc6d0eee02e1ca275436b4099c6e0d520bbfb2cd63b4d010286ad170796f0905a63f8fe8a9154acd8c17ff4837cdf42d3d56ffef54
SSDEEP 24576:uGD+42x2Jvddeoyo7Pkmn/V1Pt8clT3D4iLFxVCPL67uMFAC0q4dovzvfPbRnR9C:+2BzeoRPkmTP2clT31wPO7hACNYovzns
TLSH
T135454A62E2E642E5C47FC1B8C6469717FBB0740A131C66DB87608B592F27FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Ndrangheta\Z0uFnshlJbsn\wpfgfx_cor3.dll
Size 1.9MB
SHA256 098d9cefaca7b1e36460eb28f2725d7afdb8e93855c29f8dd3627a1fb692ae8e
MD5 f22b637c7ac66f9c13bca4059babe75d
SHA1 28637745b2e5c913df87756ea163a6bc1485bbc9
SHA512 dd4204b7001fc2440d83dfefd2191ce0e3a4c94fc6222aa3d3af28464c668d4742e90fa3c45c27d4fce56de07dfd2d7a7374fae315f32d97d6968b304478526c
SSDEEP 24576:4X0ECpcq1uFKlvkW3GRnGdMPVCSbzPOI2NCmlydYbpg85Vay2JeipNU4slL:kBmUqvkWsGdE9Pt24msMpg8Wy2JwvF
TLSH
T19B955A4AB6AC40E9D07AD23CD9D7961FF63178142B61A7CF23A0479D6F27BD0097A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002552.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002552.log
Size 25KB
SHA256 c2575aee13cd483d24535462f897b7a77aa49f2492701a14919b9a64b96a266b
MD5 d1050711d27af4dd5e3a4b577038cf9d
SHA1 f95a5e79883c1f519c2ee0cddff01462f0308534
SHA512 f1ebc5f0d5dfca9632626945c5884eb81367262c005cea8382616e7031a9aeedc8b91c7c93600d22cbaed925bc62f7ede1e233e48011d5f3c9b345852ccef161
SSDEEP 384:zKQvI1tIGIxZ8V5Kn5Kx5K+5K7tDkDwt1++wCjlL0:7kVUnUxU+U7Q
TLSH
T1E7C2440C96FC77052CAD8A5BF8AF1FC8BD157819131101F1FAE3014C6698AB867DF9A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002552_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002552_000_DotNetHost.log
Size 3KB
SHA256 68411ad4c4a87aed6ee41792ff11fca80dbe0549c2eb18a1867c890af108c4b1
MD5 ccc6003fb88a4223028cb326e91d5d58
SHA1 347950388252dc6a3a2a4f0a9ed6092f9c52fb36
SHA512 73a808083ee4866ad7c650820253d5641147b48e3c67c2853f50f684a6bcee2d7c7f91b6138cfed25424f0e7a26b2c41d4c810e838520f86420da8002d40a9b4
TLSH
T13071D7251AE90854A2B75607DAF3C413AA73BCD3A974CF0D23468319069BD0598ACBAE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002552_000_DotNetHost_rollback.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002552_000_DotNetHost_rollback.log
Size 1KB
SHA256 e33c40da0e007a436067f7de17c9fe1107c2d4608e667c1abb714e3b09cb865e
MD5 a193609280b4db460f5577db1f6a3f61
SHA1 e1b453aad842d1f2363ae5028c7208998342e730
SHA512 2e72851a7449d75d77c0743922f779a04c2671752c4c842b3941c7e76220db9626d9696f7b1793ea2e6fec789ab9b08bc399e5e63e7b302c48c379c1fcb046ab
TLSH
T11B4113651EE44845B1B29647DAF3C0539AB3BC926875DB0C2385831907ABD059C9CBBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002552_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002552_001_DotNetHostFxr.log
Size 2KB
SHA256 cf0a9c33356d1cfffc6f7827d21ca35ac06f3e49cecc09c32fae095910c20634
MD5 bbc865801059e7e7258bfd071206522c
SHA1 b451308858c8ea324764d385f271b4685500ca51
SHA512 ea4cf29e21b9f5b73d18af4ae2c0e1e786b07cd56742abbf627a5c88d85f27776ffc61798c319024880cd75f27a72fac595b88cb35f0f70403901afb470fa320
TLSH
T1914116551AE84846B1B69707DEF3C053FA33BCD27974CF0C1386831906ABD05986CBAE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002552_001_DotNetHostFxr_rollback.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002552_001_DotNetHostFxr_rollback.log
Size 1KB
SHA256 bbe4b520e757a31cd8d9739d93feac59324328cbab76c2a8583195de66bade0f
MD5 20049a7d51124a37f059b521c4cb2390
SHA1 ecc55184001f1d686a1badd3f592a46ff5b29574
SHA512 c90f44f8cef1e548af833467908969144bb5787304eff4aaca757ab6704b59a9d6778d0481f1ca812516ec82381f3c0d4ff60b8f0f0d792c6583abf6c847368b
TLSH
T13A4139551EE84845B2B69757DBF3C012BA33FCD26838DB4C1386822906ABD01985CBBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002552_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260623002552_002_DotNetRuntime.log
Size 2KB
SHA256 ae3143a17c01cdaf13deb9e8c9769d86d46f0a0f0b8d2adce3ed874dd37c6ef0
MD5 db92803b4e7ce57866de7a9b9ed59a4c
SHA1 70f3daa4d3792dc61c7190b723823cb524374bc2
SHA512 46280eec110ce4d7d73490ac6e7d1857d65add4c7b05edaeffc3cf9e33fdfdfc9e198f8e16316bdb19104798a16f8f5ceae5d78e7a659caf641d1284f09319ba
TLSH
T112412C651EE84949B1B2E707DBF3C053AE33BCD67974DB0C13458319066BD0598ACBAE
MD5 SHA1 SHA512 TLSH

Submit Download

ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe

Path C:\Users\Admin\AppData\Local\Temp\ndrangheta_fishstrap_3a53775e3c72473da6e3a19ea89ee2d8.exe
Size 14.9MB
SHA256 d3a66023c4a04b13b7df0159930f748f309c1307b1bccbd022bacdd68d878f35
MD5 a0c3321ff616288101e1184e9d5c5af3
SHA1 261e6651e2c1fbc710df2e63135333d0f6a838dc
SHA512 ef6e6594aaf98c0bfd1e86c541fa06effc417f5db7ccd7b796e0624d12f615297512099e331de4416fa37fb1e3b9e944fbcfce32a127a536399b42b255d34ae4
SSDEEP 98304:hlE7JmE7FIAUxdgeTsTE7OVfasIYyFLjW/sa+ZmD3JxOYoHwfLk3vSmaR0+Mc4AI:hSHDUsYsPQsIjKsa+ZWObAbN0z
TLSH
T12AF68E8573FC2B35E3B74B35A970621A4976BC1AA911D78E2B887A1D1972340CCF1B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{695F7910-4445-48CC-B8B1-6AC50692703E}\DotNetHost
Size 1012KB
SHA256 c8fa13b9c79f39d88a324a03ff97c21585643095b32e674fa668c58e1f106ef1
MD5 7bc75d5cc808fcc218f7d03f252db9ba
SHA1 fe59d3c4f3529fd31bdd277fa667eea4ccacc32e
SHA512 e51b451f4a6f7c919a4dbabf52470a3c448d5b9b1740d9e4cc5051310bcfe30b31d95e7c8766e414a5147f82c74b1b79500a9d48a6c7c80c466dced9e995a830
SSDEEP 12288:0N2etgX0xsm7HrObWMInYLE/BbdJ0zErWolCJ9TeWxqYZfUfP3R:I26gG74W6WBbdJwEqECJ9Te7Yxs3R
TLSH
T188256A1BBFA404A9D8B24E75C5B78321EE357C482320969F43A47229DEFB7D0647A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{695F7910-4445-48CC-B8B1-6AC50692703E}\DotNetHostFxr
Size 1.1MB
SHA256 4edb63c267c96ca5c05f309081b55e3374626e25dddb205cf8b37a42c2438750
MD5 7edeb549573882d34df2df078c7299ce
SHA1 9d889c19de10586f6fb0138030afd519fd40d02c
SHA512 acab3c45b994afbe04d06c58d9d446e1bc10c2bc8e76275a6542f00b86a379cc6fb08dcd1ddb7e51280e5552b823fee64eb7917bf8993b80f82a5a70b14536f0
SSDEEP 24576:f26gG74W6WBbdJwEqECJ9Te7YxkQTbVHmIzOd:f26748BnwEpI9T6YGiVHmI
TLSH
T157357B1BBFA404A9D8A24E75C5B78321EE357C082320969F43A47229DEFB7D0647B7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{695F7910-4445-48CC-B8B1-6AC50692703E}\DotNetRuntime
Size 28.1MB
SHA256 076b2f180cc513184db1d41b98ef8cab51a9059ad33a0c64919bac0dc9733775
MD5 4b8531ed0b9364894105ee2d0c2001d8
SHA1 6c0b1a0769fefa49f3ff2dd0918ef3f7f7913578
SHA512 8f823ba69293b3b106e550e5d69be29c8227f63b9edb15c1f753b72cb28d9f0fb7d7b5940d9dd7c3da326996f7a2f7e4dc61b2137ced1732755c497dc8d1fd35
SSDEEP 393216:BGA0lAITbkXCfyp4Q/24AJzL1GCn0LA8RVdhtmrBK6q5rONk/1CubJLetP/oj90x:JCAIkXCqOF4y0jbM1K6qV3lJL30VX
TLSH
T182573357BF9548A9C8624E3888BBD725AA7A3C082720964F5758751CCFF73E012BB7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{695F7910-4445-48CC-B8B1-6AC50692703E}\WindowsDesktopRuntime
Size 28.8MB
SHA256 4d029b3bef558b3232e33e6e7c54f65feada347b99cac142978643cd7cadb12c
MD5 eb6a43971c26a1d58cf47055357f7300
SHA1 a5ac458efb05ca0166fb5b498b48bc6c42c20dd9
SHA512 fe49a258147dbb13cc37d5764e3af27dd424b0d49d2d353c3010f7d4d07495dd373c9a3fcee14696032fefff823f926b6e99a7d69b89154f36530d30d24783f7
SSDEEP 786432:fTxfdq4WD1EQMyoE5mX8/3LBGxTfb+T5Suf+0zkOPQa:7NyBowmXcgT+oe+1YQ
TLSH
T1086733177F9129A9C8AA4EB1C4778325AE313D44272089AF02A4725DEFFB3E4557B7C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7385.tmp

Path C:\Windows\Installer\MSI7385.tmp
Size 392KB
SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
MD5 f1fafe5c54813a5d7b60d08b859bd58b
SHA1 95e6598ce1c02220d68edab5474980b7f0f0a12c
SHA512 6dbc8b10277c6fae8d7ba961a843810df0bb11c9c6e3ba54eea1b24e13b1069e454ef5d76d345839a32f94871855928578a15948ba242d03c990b21d8f845df9
SSDEEP 6144:u/VbdUw0z9ursTolCJSqJiIUk8AeWNxFqYrtUc06N:u/VbdJ0zErWolCJ9TeWxqYZfN
TLSH
T1CC846A29F7E418EDD4B782B6C5A68030FF75754D332095AF8BA845291F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{695F7910-4445-48CC-B8B1-6AC50692703E}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 5d0f15575f07c77858f4d2862603a0212eeb2bd7c8ec677f24f9b61c40e4e0ae
MD5 4a6fccfbb948643090ee45d55e11b483
SHA1 8cc055b7d7bc7ff5167ab02537eb334d72ba399c
SHA512 11e8d7dacd303c85c89bf4a071cfc10ae0136f03d1ac74bc40b4a7a3f1cd3741025240647ee432d21149bc5f244357e7b6b15ac5b17c70ce4b21631a862a0400
SSDEEP 96:2bpcBM/En6Yic0wZycLn2Vn6sKj0wFycr4qn6URL0wNycLCXn6fMSJw0wpMdycA7:2+z+TzV/zvI4qn2X5a3a1KcITzsCsysz
TLSH
T1C112D3512BFD0218F0F3AE48EFFAA5555A36BD552E39C82D01201D0F49B2E858962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{695F7910-4445-48CC-B8B1-6AC50692703E}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{695F7910-4445-48CC-B8B1-6AC50692703E}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{695F7910-4445-48CC-B8B1-6AC50692703E}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{695F7910-4445-48CC-B8B1-6AC50692703E}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{695F7910-4445-48CC-B8B1-6AC50692703E}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.9-win-x64.exe

Path C:\Windows\Temp\{695F7910-4445-48CC-B8B1-6AC50692703E}\.be\windowsdesktop-runtime-10.0.9-win-x64.exe
Size 966KB
SHA256 e2e18ec5b9eba1f7d53f5bbfb68b56d0bb9910abc92d429db538544ac8eb2b10
MD5 b6789f69e59f457288a3c4e37cc5e4ac
SHA1 4c5d5ad73304db60ba0e539f30d0a019621570cb
SHA512 2880a9b5ae09640d444fa888f1b05bba4eece82abbb226e80a0451a38f2892d3d8d525fb63ec38a11159cd1ae51e08c1aca113c84b0afcc5a49f79869c7ed7b2
SSDEEP 12288:SVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJErEA6Z2E2gh+3+U8FHFJb:SVGWl6qCmyt6UdmcpMzYzkR3+U8/Jb
TLSH
T178256D31A166242BD6F50973F914D2307E2CD7082B5C95BAC6C0D90D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-1629-0x0000018B32C30000-0x0000018B335D4000-memory.dmp

Download

memory/3144-1039-0x00000000006A0000-0x0000000000766000-memory.dmp

Download

memory/3540-108-0x000002269AC50000-0x000002269AC80000-memory.dmp

Download

memory/3540-88-0x000002269A6C0000-0x000002269A6F0000-memory.dmp

Download

memory/3540-146-0x000002269D820000-0x000002269D860000-memory.dmp

Download

memory/3540-154-0x000002269DA70000-0x000002269DB20000-memory.dmp

Download

memory/3540-158-0x000002269DB90000-0x000002269DC00000-memory.dmp

Download

memory/3540-162-0x000002269D970000-0x000002269D980000-memory.dmp

Download

memory/3540-166-0x000002269E9F0000-0x000002269EA70000-memory.dmp

Download

memory/3540-170-0x000002269EB20000-0x000002269EBC0000-memory.dmp

Download

memory/3540-174-0x000002269EF50000-0x000002269F1C0000-memory.dmp

Download

memory/3540-178-0x000002269DC10000-0x000002269DC20000-memory.dmp

Download

memory/3540-185-0x00000226A3600000-0x00000226A3680000-memory.dmp

Download

memory/3540-188-0x00000226A3550000-0x00000226A3570000-memory.dmp

Download

memory/3540-192-0x00000226A3960000-0x00000226A3990000-memory.dmp

Download

memory/3540-196-0x00000226A3910000-0x00000226A3930000-memory.dmp

Download

memory/3540-142-0x000002269D8C0000-0x000002269D920000-memory.dmp

Download

memory/3540-133-0x000002269CE10000-0x000002269CE60000-memory.dmp

Download

memory/3540-129-0x000002269D6B0000-0x000002269D7B0000-memory.dmp

Download

memory/3540-124-0x000002269D020000-0x000002269D1D0000-memory.dmp

Download

memory/3540-116-0x000002269C170000-0x000002269C2D0000-memory.dmp

Download

memory/3540-120-0x000002269C2D0000-0x000002269C310000-memory.dmp

Download

memory/3540-92-0x000002269A9B0000-0x000002269A9D0000-memory.dmp

Download

memory/3540-97-0x000002269AB30000-0x000002269ABF0000-memory.dmp

Download

memory/3540-100-0x000002269AA30000-0x000002269AA50000-memory.dmp

Download

memory/3540-104-0x000002269AA00000-0x000002269AA10000-memory.dmp

Download

memory/3540-112-0x000002269AC80000-0x000002269ACA0000-memory.dmp

Download

memory/3540-5-0x0000022693F00000-0x0000022694E50000-memory.dmp

Download

memory/3540-84-0x000002269B410000-0x000002269BB80000-memory.dmp

Download

memory/3540-150-0x000002269CE60000-0x000002269CE70000-memory.dmp

Download

memory/3540-13-0x0000022695070000-0x0000022695290000-memory.dmp

Download

memory/3540-37-0x0000022692D80000-0x0000022692DA0000-memory.dmp

Download

memory/3540-41-0x0000022697500000-0x0000022697580000-memory.dmp

Download

memory/3540-45-0x0000022695460000-0x0000022695470000-memory.dmp

Download

memory/3540-57-0x00000226977A0000-0x00000226977C0000-memory.dmp

Download

memory/3540-61-0x00000226977E0000-0x0000022697800000-memory.dmp

Download

memory/3540-65-0x0000022697820000-0x0000022697850000-memory.dmp

Download

memory/3540-77-0x000002269A7F0000-0x000002269A8F0000-memory.dmp

Download

memory/3540-80-0x000002269A660000-0x000002269A6B0000-memory.dmp

Download

memory/3540-69-0x000002269A640000-0x000002269A660000-memory.dmp

Download

memory/3540-1949-0x000002269DCB0000-0x000002269DCC0000-memory.dmp

Download

memory/3540-53-0x0000022697580000-0x00000226975A0000-memory.dmp

Download

memory/3540-417-0x00000226A3C90000-0x00000226A3D00000-memory.dmp

Download

memory/3540-49-0x00000226973F0000-0x0000022697410000-memory.dmp

Download

memory/3540-33-0x0000022698050000-0x0000022698840000-memory.dmp

Download

memory/3540-17-0x0000022692DE0000-0x0000022692F40000-memory.dmp

Download

memory/3540-25-0x00000226954B0000-0x00000226954F0000-memory.dmp

Download

memory/3540-21-0x0000022692F40000-0x0000022692F90000-memory.dmp

Download

memory/3540-29-0x0000022697390000-0x00000226973E0000-memory.dmp

Download

memory/3540-1913-0x00000226A15F0000-0x00000226A17C0000-memory.dmp

Download

memory/3540-1918-0x00000226A11D0000-0x00000226A1200000-memory.dmp

Download

memory/3540-1925-0x00000226A1390000-0x00000226A13B0000-memory.dmp

Download

memory/3540-9-0x0000022696420000-0x0000022697340000-memory.dmp

Download

memory/3540-1957-0x00000226A5790000-0x00000226A5880000-memory.dmp

Download

memory/3540-1954-0x00000226A5580000-0x00000226A56A0000-memory.dmp

Download

memory/4824-413-0x0000000000F40000-0x0000000001006000-memory.dmp

Download