c99f270999795d385a1807cb3933edbfdf54ae62ac843c8d280faa0bf0735829

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
N11CODE_0.1.0_x64_en-US.msi
Size 2.7MB
Sample261023-cly4wsbv8m
SHA256 c99f270999795d385a1807cb3933edbfdf54ae62ac843c8d280faa0bf0735829
MD5 5d300c0e81fbf79e57352833c9feb637
SHA1 0f1bfafc0d4bcc902c7edcb4dacd29958807cfbb
SHA512 5484dce3c2cbc5ee4f8b0339b056f6887262a635af7679b3f715cdf66b53a10794e5801854ef74e05eb14ba0b22a9415535a65e3270046b8b48a1afb5e8d3e33
SSDEEP 49152:zOI357Cg6l7HWdyhk3ZKFqvx4uGSVTNJf0wEQ7uMVxHAAAYTmmKWHm:zJ3ZlY72pZKFqvJGOJz7uMrHADommKWG
TLSH
T156D5230BBE41A532D8251EB6083B8BA04B3DAC104F96AD47AB99F55DDDF21C08D27DC7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2612	N11CODE.exe

Loads dropped DLL 1 IoCs

pid	Process
4476	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	N11CODE.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\N11CODE\N11CODE.exe	msiexec.exe
File created	C:\Program Files\N11CODE\Uninstall N11CODE.lnk	msiexec.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3972_1090698728\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e59e054.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6E71F1D4FF1CBF04.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BA582108-9C16-47A2-9098-29F59E29DB95}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF17BA063568701DB2.TMP	msiexec.exe
File created	C:\Windows\Installer\{BA582108-9C16-47A2-9098-29F59E29DB95}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{BA582108-9C16-47A2-9098-29F59E29DB95}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e59e056.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e054.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE4C8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1B008F89447A991A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3972_658465808\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3972_658465808\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3972_1090698728\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3972_1090698728\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF05DBEAFD9AD73382.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3972_658465808\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3972_1090698728\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3972_1090698728\manifest.json	msedgewebview2.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5436	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fa6709e762e3d5140000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801fa6709e70000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101fa6709e7000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3fa6709e700000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6fa6709e700000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\801285AB61C92A740989925FE992BD59\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\ProductIcon = "C:\\Windows\\Installer\\{BA582108-9C16-47A2-9098-29F59E29DB95}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\SourceList\PackageName = "N11CODE_0.1.0_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\801285AB61C92A740989925FE992BD59\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\PackageCode = "FF12628E40E39024A912B1C86BBD1D75"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\Version = "65536"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D509856606B13065BAB201ADF38990F7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\801285AB61C92A740989925FE992BD59	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\801285AB61C92A740989925FE992BD59\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\ProductName = "N11CODE"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\801285AB61C92A740989925FE992BD59\Environment = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D509856606B13065BAB201ADF38990F7\801285AB61C92A740989925FE992BD59	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\801285AB61C92A740989925FE992BD59\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3212	msiexec.exe
3212	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3972	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5436	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5436	msiexec.exe
Token: SeSecurityPrivilege	3212	msiexec.exe
Token: SeCreateTokenPrivilege	5436	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5436	msiexec.exe
Token: SeLockMemoryPrivilege	5436	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5436	msiexec.exe
Token: SeMachineAccountPrivilege	5436	msiexec.exe
Token: SeTcbPrivilege	5436	msiexec.exe
Token: SeSecurityPrivilege	5436	msiexec.exe
Token: SeTakeOwnershipPrivilege	5436	msiexec.exe
Token: SeLoadDriverPrivilege	5436	msiexec.exe
Token: SeSystemProfilePrivilege	5436	msiexec.exe
Token: SeSystemtimePrivilege	5436	msiexec.exe
Token: SeProfSingleProcessPrivilege	5436	msiexec.exe
Token: SeIncBasePriorityPrivilege	5436	msiexec.exe
Token: SeCreatePagefilePrivilege	5436	msiexec.exe
Token: SeCreatePermanentPrivilege	5436	msiexec.exe
Token: SeBackupPrivilege	5436	msiexec.exe
Token: SeRestorePrivilege	5436	msiexec.exe
Token: SeShutdownPrivilege	5436	msiexec.exe
Token: SeDebugPrivilege	5436	msiexec.exe
Token: SeAuditPrivilege	5436	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5436	msiexec.exe
Token: SeChangeNotifyPrivilege	5436	msiexec.exe
Token: SeRemoteShutdownPrivilege	5436	msiexec.exe
Token: SeUndockPrivilege	5436	msiexec.exe
Token: SeSyncAgentPrivilege	5436	msiexec.exe
Token: SeEnableDelegationPrivilege	5436	msiexec.exe
Token: SeManageVolumePrivilege	5436	msiexec.exe
Token: SeImpersonatePrivilege	5436	msiexec.exe
Token: SeCreateGlobalPrivilege	5436	msiexec.exe
Token: SeCreateTokenPrivilege	5436	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5436	msiexec.exe
Token: SeLockMemoryPrivilege	5436	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5436	msiexec.exe
Token: SeMachineAccountPrivilege	5436	msiexec.exe
Token: SeTcbPrivilege	5436	msiexec.exe
Token: SeSecurityPrivilege	5436	msiexec.exe
Token: SeTakeOwnershipPrivilege	5436	msiexec.exe
Token: SeLoadDriverPrivilege	5436	msiexec.exe
Token: SeSystemProfilePrivilege	5436	msiexec.exe
Token: SeSystemtimePrivilege	5436	msiexec.exe
Token: SeProfSingleProcessPrivilege	5436	msiexec.exe
Token: SeIncBasePriorityPrivilege	5436	msiexec.exe
Token: SeCreatePagefilePrivilege	5436	msiexec.exe
Token: SeCreatePermanentPrivilege	5436	msiexec.exe
Token: SeBackupPrivilege	5436	msiexec.exe
Token: SeRestorePrivilege	5436	msiexec.exe
Token: SeShutdownPrivilege	5436	msiexec.exe
Token: SeDebugPrivilege	5436	msiexec.exe
Token: SeAuditPrivilege	5436	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5436	msiexec.exe
Token: SeChangeNotifyPrivilege	5436	msiexec.exe
Token: SeRemoteShutdownPrivilege	5436	msiexec.exe
Token: SeUndockPrivilege	5436	msiexec.exe
Token: SeSyncAgentPrivilege	5436	msiexec.exe
Token: SeEnableDelegationPrivilege	5436	msiexec.exe
Token: SeManageVolumePrivilege	5436	msiexec.exe
Token: SeImpersonatePrivilege	5436	msiexec.exe
Token: SeCreateGlobalPrivilege	5436	msiexec.exe
Token: SeCreateTokenPrivilege	5436	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5436	msiexec.exe
Token: SeLockMemoryPrivilege	5436	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5436	msiexec.exe
5436	msiexec.exe
2612	N11CODE.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5436	msiexec.exe
3212	msiexec.exe
4476	MsiExec.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 4476	3212	msiexec.exe	90
PID 3212 wrote to memory of 1960	3212	msiexec.exe	96
PID 5436 wrote to memory of 2612	5436	msiexec.exe	99
PID 2612 wrote to memory of 3972	2612	N11CODE.exe	100
PID 3972 wrote to memory of 3068	3972	msedgewebview2.exe	101
PID 3972 wrote to memory of 1008	3972	msedgewebview2.exe	102
PID 3972 wrote to memory of 1008	3972	msedgewebview2.exe	102
PID 3972 wrote to memory of 1008	3972	msedgewebview2.exe	102
PID 3972 wrote to memory of 1008	3972	msedgewebview2.exe	102
PID 3972 wrote to memory of 5936	3972	msedgewebview2.exe	103
PID 3972 wrote to memory of 3528	3972	msedgewebview2.exe	104
PID 3972 wrote to memory of 3528	3972	msedgewebview2.exe	104
PID 3972 wrote to memory of 3528	3972	msedgewebview2.exe	104
PID 3972 wrote to memory of 5848	3972	msedgewebview2.exe	105
PID 3972 wrote to memory of 5848	3972	msedgewebview2.exe	105
PID 3972 wrote to memory of 5848	3972	msedgewebview2.exe	105
PID 3972 wrote to memory of 5848	3972	msedgewebview2.exe	105
PID 3972 wrote to memory of 5848	3972	msedgewebview2.exe	105
PID 3972 wrote to memory of 2300	3972	msedgewebview2.exe	108
PID 3972 wrote to memory of 2300	3972	msedgewebview2.exe	108
PID 3972 wrote to memory of 2300	3972	msedgewebview2.exe	108
PID 3972 wrote to memory of 2876	3972	msedgewebview2.exe	109
PID 3972 wrote to memory of 2876	3972	msedgewebview2.exe	109
PID 3972 wrote to memory of 2876	3972	msedgewebview2.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\N11CODE_0.1.0_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5436
- C:\Program Files\N11CODE\N11CODE.exe
  "C:\Program Files\N11CODE\N11CODE.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=N11CODE.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2612.464.12197290816262243446 /pfhostedapp:c9a47774eb8a5447bd78ff0a549c58e5542df903
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView /prefetch:4 /pfhostedapp:c9a47774eb8a5447bd78ff0a549c58e5542df903 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffcc8c55fd8,0x7ffcc8c55fe4,0x7ffcc8c55ff0
      4⤵
      PID:3068
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView" --webview-exe-name=N11CODE.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1744,i,954460881566803830,6806001127796071037,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:c9a47774eb8a5447bd78ff0a549c58e5542df903
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView" --webview-exe-name=N11CODE.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2208 --field-trial-handle=1744,i,954460881566803830,6806001127796071037,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:c9a47774eb8a5447bd78ff0a549c58e5542df903
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView" --webview-exe-name=N11CODE.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1744,i,954460881566803830,6806001127796071037,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c9a47774eb8a5447bd78ff0a549c58e5542df903
      4⤵
      PID:3528
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView" --webview-exe-name=N11CODE.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2972 --field-trial-handle=1744,i,954460881566803830,6806001127796071037,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:c9a47774eb8a5447bd78ff0a549c58e5542df903 /prefetch:1
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView" --webview-exe-name=N11CODE.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4544 --field-trial-handle=1744,i,954460881566803830,6806001127796071037,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c9a47774eb8a5447bd78ff0a549c58e5542df903
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView" --webview-exe-name=N11CODE.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4552 --field-trial-handle=1744,i,954460881566803830,6806001127796071037,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c9a47774eb8a5447bd78ff0a549c58e5542df903
      4⤵
      PID:2876

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FABB66B0CB7172FEA1F4C45DBF8BB836 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4476
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1960

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59e055.rbs

Path C:\Config.Msi\e59e055.rbs
Size 9KB
SHA256 954dbf7674d5f5c0819cdb07ede9807f91541403d3baef5a9cd08a4b71641657
MD5 53fe30d3a4fe382c639e1ceafcaece39
SHA1 3bbdec056f87647c1963c1d830a6f140ef206f2a
SHA512 38ff4ec2eb8f5c3bed2c3fc164810fe311260a01bb411bfa6885ef65b7ffe1a283643cbac4924b3e81f5ae728edb0f9b3c882a962c3c2fe881b9a9cf261a10b8
SSDEEP 96:Dm3GmYrzYQYvY3YAsGk+slfCXIFIatUDQp6WCOTls/UDQp6WCgjJ8UIxCTlsJma9:ay4JwIEk+sZCCG/FGL/Few07QWXiQFps
TLSH
T187223F42A60289C3F9961B30D7532BD43FF2E6D8A319634789DE51352E463C81FA92DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N11CODE.exe

Path C:\Program Files\N11CODE\N11CODE.exe
Size 8.1MB
SHA256 33fb565de1f5d240247cad823e4a5492da20cea7897f36ed903fafe3cf8c06ee
MD5 1aa066112f54fbce125a99dac9f4dbe6
SHA1 b1f2b6915868b6cbb5a7be1392799cd4b53d58f3
SHA512 145d11f0324aec55ae8dbb6fb3055f03aaa0385499b679bb90a4d65ec9bb44b70c7c78104f08d4c1a8a20ffb935efb764a96daa28b0b2e006a53898e5651c933
SSDEEP 98304:5T7OQOOyd5wDXJfjFzHHsUcZthJJZoGC5wFR:5T7ODOy4Jfh8
TLSH
T1D486E5257B5F9A6DD05BC4B0824B4A66492130CB0B35B9FF448492392FBEBF52F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N11CODE.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\N11CODE\N11CODE.lnk
Size 1KB
SHA256 ba32916cce6f1f4009aa9e846fac0eb990cf6f5acd3050e029a51f093ac236f8
MD5 ce3737a7693adbd20c349462d2b66d76
SHA1 cc661020feb3f570eb267089f23f5c463b30fe7d
SHA512 f3181f3c13d97b967dd30e5fe071d534133ca365735a4e709d77b9d1ee9163e36093819f814b9ad5f9b369c0e55e270dc2758475dac2083c7901414611d1cc22
TLSH
T1C6410C100FDA1B3DE362827A5BA587568A72FC00F2730F2A02C5428719B4501B669F3F
MD5 SHA1 SHA512 TLSH

Submit Download

~11CODE.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\N11CODE\~11CODE.tmp
Size 1KB
SHA256 8ec21581f2206b7db419ac3ed24435bda44443685d8311f83e01fec4bb388cf8
MD5 7f210eed4ed30b563973c61bb57a26bf
SHA1 29e8abc24cb52a71082ae6c24831e814504f4615
SHA512 364c16dea95f2095637e8aac0ad45b691397a1f6ffb0eb44b334a2c30a1a5e7c499f60ef8cc5fd3412a1a63337045372f69f3f34ef2f1a778b14fcf61b938f6b
TLSH
T15241FD104FEA1B3DE362827A5AA587568A71FC10F2770F2E02C5428719B8640B76CF3F
MD5 SHA1 SHA512 TLSH

Submit Download

MSI8469.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI8469.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75e355dc-006c-4f8e-add3-51cb02058637.tmp

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\75e355dc-006c-4f8e-add3-51cb02058637.tmp
Size 3KB
SHA256 b6b32270af2a7ed7b95d874d0b6fc8c3219506433fea35c4df1bbc6d1d57b8b7
MD5 8c50c237d88f9af7b3d35ebfffe4afb3
SHA1 2da43504229a030ba83627b2fa3390630797fc1f
SHA512 dafb04e24c1511a30b95e2bbc8aafe75f4f214a745c3ce85d93cc080b0ffcc4e02a687a4b97ac7ca342ed3b72b4ffe7d23da45b903750c7562dfeb7863389408
TLSH
T1BE6183776974A93B8EF2DA04799A3B02E7A55033E4917F55C6EC0F0C06E728C2351C27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0afeb770a8bee506af76316e1366690606cbd58c7127e0caa2addffcaccd2a69
MD5 e60b613fe8d3cde7c955d7b6c2ce76ba
SHA1 323b0622168dcb080330d97096bf0a40c31e2804
SHA512 90eba7d46aab2739d2f6c9a6ac2faca25ed17e3988478f2bcdbc9339a05d7e07c8075361359ace0869c996e22eafcde19398298a16cb6b4402862039310728ec
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 71dfa89c0e79c7261673419480124963558af889274416ae2149dab470aa5fb1
MD5 e8b77914628e6133fcbeae924a43c6b4
SHA1 10319fa49ca8c152f1fd64bfa42e71fc2e29f345
SHA512 ed017e64637f56d5dfdff059900c1cb95fb262f42cb510cfb1d75ea33a5633ac5de043c86c929f3ed47af54c4b5256b7c2b64b81610b76f996c5a57fdd1e5e09
TLSH
T1D7D0121333020134C01026330502F50C0801C52F40474041643D961D1A140741D02842
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

598e02e7-1be2-4d70-8b6c-221cf7d89842.tmp

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\Default\598e02e7-1be2-4d70-8b6c-221cf7d89842.tmp
Size 6KB
SHA256 caf7a2084778bed9212ff602470deac030ca742c5d787838ed171f6e6ac0c004
MD5 a19cd29d96fca4cfd5097bb90f2f73ac
SHA1 6d037cf6cf86bc11e4922bf0d880d0fc250a8316
SHA512 e93f7d16a85aa33fb4f768da111f28c2c3a0f06494e2113911897958d7282aba35b37b20b765f2a73a6e61cf716f890228682c25eff7f2994544efe1ecdfe8d6
SSDEEP 96:stQ/d4iRUb9Ak9o5h16Z96s7/x+6Mhmuec/lnS1ejewK+gxX28XM1C7K:stEyAUoc6sV+F7lSQjYLG6K
TLSH
T197D185126A24B9BB8CC6E109BA35BB07E3F5603265D11D58E7FC4A2C0DE76DD631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 264B
SHA256 02c3fe88dfa2b2367e2718f5f8d541c5589418759cc75d392723838900b2eb6a
MD5 b11cfdf59438bbc78435d9ee723c0fcd
SHA1 cbb88a6c6be25f46d96f27a721ebb8270d2ec576
SHA512 7ad0f73b13e54b6eb76fe39c06bc6220665bd2d9ca914a1358bf04b1c22ed756bec8db282df18e32eddc9ca55448f1851e8763f628e78386ef12d41e41d0f4f7
TLSH
T1EFD012D190901632CF88C1F0509A6C36EEF50B3020031F2B80B7B8728DA32E2D30470B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 c61dbb8d6b0881eb588f583156cc24ac9c649db8b11a1ca5e534d991f505a06d
MD5 3f211155d93380eb4c679c00041603c4
SHA1 227b5a1ecd3e588aa4eb9b89f7e18fbf1ab888f7
SHA512 960363675401539875e05c581fefcb7d7dbce8baaa810f3b7bab81ae6b9a55ff6135b95cece0d8d0d0c658d4e9dd30934a89b40d468cb80126352c89c238901c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

6e89251e-3afd-438a-8279-fdbc2c7a347d.tmp

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\Default\Network\6e89251e-3afd-438a-8279-fdbc2c7a347d.tmp
Size 1KB
SHA256 9770427da6ceffff5e6953b48e98f86c0d48ef40aa488fafa308902499f2f245
MD5 6fb375b57419cbf22a64cc39f2e461f4
SHA1 424e39abeedf6e5326e90b5136c2a22656b749e2
SHA512 5c341edc7a0865e90dcb64f7e3040d8a771f5df6f7c48c974cfdae9a1e20ea443c3ededcb0de8d1e2708e8bd6b6be127f1962a7f7b4f82aad7e53a673838da83
TLSH
T19A41D0B6D5E4476C98112AF829243D2BCF2D0C44D3692D19DADCFB8FE7E04F0E24154A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\Local State
Size 1KB
SHA256 d39a0bbcd315e6244dbc1c8a5c62d1d9ca980a8e6cf864fe27b3e2e393843fa5
MD5 6c1117c929c5bb15f9cf62bc0ad6db2b
SHA1 cfe29781e3abf4767554293240383383546e4175
SHA512 0e9c1217b0abd3fa685dc9e920b56e81d55843874826e150829b50ee101971c5cae42f6debf964d630619e6f231932845d990d35444b55336262f1ef85734950
TLSH
T1052140B3E8640F32DDB1A646326AB6439F715077D050DF0861ED4B1C0BE704EA32A833
MD5 SHA1 SHA512 TLSH

Submit Download

cb4f431a-abf1-4256-88be-c5ea6b1d0d2e.tmp

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\cb4f431a-abf1-4256-88be-c5ea6b1d0d2e.tmp
Size 15KB
SHA256 9ab274ce1e4468ef277c91514f4c852a95dd26bb0ad91b46f7d717e0e16326fb
MD5 eda8c3d79cf0dede02374ec7cc947d64
SHA1 1128cfe39aa4c7a7595be51b9121bf9476d04f46
SHA512 15947c9c54888c07ba59a397579b426efce78d88191ee5d1c1eafc134e2cf455e93c9fe43f89a94b2f8db34eaedcffd8d98e132ffa083bcb110c6411071721bb
SSDEEP 384:H+OBqImmJvGBLx3NaFMJFNNBSVHxGvOEEg6rK:WcvGtlNmROOF+
TLSH
T1C2729D772C656A332CF7CA09BA8D7347CBA562A3C090BBD4DDEC9F0F566B0481352856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daf457e0-2624-422e-b292-9936037c2eb1.tmp

Path C:\Users\Admin\AppData\Local\com.n11code.editor\EBWebView\daf457e0-2624-422e-b292-9936037c2eb1.tmp
Size 2KB
SHA256 4140b8e4df87261ceda2e566c2cad8be34b9102d49bf9b28240627da58b9bc8b
MD5 cf6cf55b12a704aa06d8a5b7ecbd72ee
SHA1 6c4d863f2a1037f9a6df2c8309f7546008319f5f
SHA512 ad6c3ddb0f38d1b334cdf19b92591e7b05b6092793846435fa53dd709077de876e55a051d46fdba7b127d747f0bd9529af7c031e5a3b744b78315e506ef30ba3
TLSH
T1A951A5B36C245B37CDF28A04795A7B13CB7590B2A9516F1096ED0B0C46E755D2301C77
MD5 SHA1 SHA512 TLSH

Submit Download

e59e056.msi

Path C:\Windows\Installer\e59e056.msi
Size 2.7MB
SHA256 c99f270999795d385a1807cb3933edbfdf54ae62ac843c8d280faa0bf0735829
MD5 5d300c0e81fbf79e57352833c9feb637
SHA1 0f1bfafc0d4bcc902c7edcb4dacd29958807cfbb
SHA512 5484dce3c2cbc5ee4f8b0339b056f6887262a635af7679b3f715cdf66b53a10794e5801854ef74e05eb14ba0b22a9415535a65e3270046b8b48a1afb5e8d3e33
SSDEEP 49152:zOI357Cg6l7HWdyhk3ZKFqvx4uGSVTNJf0wEQ7uMVxHAAAYTmmKWHm:zJ3ZlY72pZKFqvJGOJz7uMrHADommKWG
TLSH
T156D5230BBE41A532D8251EB6083B8BA04B3DAC104F96AD47AB99F55DDDF21C08D27DC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3972_1090698728\manifest.json
Size 102B
SHA256 4a918873dddefc4e395c8a9f8580c8f03c9a37512eb7da6e6454730be756fdac
MD5 bbd743ed25bbba94c85d6d7310c4fd45
SHA1 d19550c1895576761ab76f3ba9bb813511002bd8
SHA512 070aad3473150ba7388e2305f3d5dff14c69a4b468609fa38e1411e575d271d63cc1bf4083d63372b4d244ee5031bd40933f5f68f041c9650999509666e219e1
TLSH
T1B0B01220EC10B4B30004436C0C6CC3C073272F032C4079180DE59F84E90E9DBE071529
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3972_658465808\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 2d78ddd4cec8c69eab5522cb32030e2edecbb93c92c4f6e33ea48a6bb045424f
MD5 5d9e5e3fe3e69bc7f93ad7a1dff2d8b3
SHA1 7f2ee6f4db66cc27d378e7ec6177e7866aff97d3
SHA512 c12884d6e5527a7f203fd717eac62ae645e9f37b542602c1bcfb68193ec1c1d18d9013327e09ef277af8d8272b94ab9e49a14a5d54eb03d22da24d52973081e6
SSDEEP 24576:tFo3DMPYdoO/vvTL/ig//ylAPL+1UrYc0CZNtSxHpKRa5oOvcYh2/mV+buT:AHE
TLSH
T19057A32537F92210E7B79E3CACF0AA2349397D5B9C16DE8D45411B4E0821F71E8B2F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{78e6c699-0af2-4858-8b3d-f3f4d5833e2f}_OnDiskSnapshotProp

Path \??\Volume{e70967fa-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{78e6c699-0af2-4858-8b3d-f3f4d5833e2f}_OnDiskSnapshotProp
Size 6KB
SHA256 f73152cf25a580c2d15db31a0261214fac7e934579cf5621de81b25aaace2d5f
MD5 534996c90e849b8f53f0eb2587090c30
SHA1 b6e4938e971f01d803d92a1c43a1ae15b472f764
SHA512 f5080fa9aa34853970dcb9ccc7fb5d4d764b1e9b9da09d6b5fb800646934d13398e62b1f43fd184a5851f76d149c84c4a558ebfdba8d5a03dd23fdee6cefe944
SSDEEP 96:FiuO9vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:IPb++uVm
TLSH
T166D188185AE54711E2B3AB712CF18557A877B911FF33CB8E0198238E2670A10F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1008-72-0x00007FFCEBFD0000-0x00007FFCEBFD1000-memory.dmp

Download

memory/2300-331-0x00007FFCEB980000-0x00007FFCEB981000-memory.dmp

Download

memory/2300-332-0x00000245BACA0000-0x00000245BACA1000-memory.dmp

Download

memory/2300-343-0x00000245BAC70000-0x00000245BAC9A000-memory.dmp

Download

memory/2876-355-0x000002189EFF0000-0x000002189EFF1000-memory.dmp

Download

memory/2876-373-0x000002189AFD0000-0x000002189AFFA000-memory.dmp

Download

memory/5848-80-0x00007FFCEBFD0000-0x00007FFCEBFD1000-memory.dmp

Download