daac502e5429826ef1675a65c792521a640669b8cba59d0587eadbdafee2d352

Analysis

user interaction
yes
max time kernel
49s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nicotine+-3.3.10-mingw_x86_64_msvcrt_gnu.msi
Size 39.7MB
Sample260629-xtcabads5z
SHA256 daac502e5429826ef1675a65c792521a640669b8cba59d0587eadbdafee2d352
MD5 28841e4b46162689ffadc8c7ec9b85d5
SHA1 7ff168b60f75e47e623d846909702b62a6021556
SHA512 78ed3f0595876f6243309e4c01e7c5f9b461f3bc88fca60ebadfb371ad2cd1876faa64ead863127c58efdb0ad4925c81399d2d316df5e4f88a624308a9e1ff27
SSDEEP 786432:1vyWk4Zkbps3eRxgsMO3qC1lce3XuDwOuTsct/dBBfRuNWpWEGSKgI1zpFKE//V7:1vJZas3eXyYqC1N3XuJ2sGBJuNWpGnpB
TLSH
T1D5973382F92D5732DFA42FF1B192471B6E9A2C449A329161BBD0732D3672E63217314F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3368	Nicotine+.exe
5780	gdbus.exe
3400	Nicotine+.exe

Loads dropped DLL 64 IoCs

pid	Process
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-io.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\share\fonts\conf.d\11-lcdfilter-default.conf	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\widgets\__pycache__\filechooser.cpython-312.pyc	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\headless\__init__.pyc	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-mv.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\audioop.cp312-mingw_x86_64_msvcrt_gnu.pyd	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\libsharpyuv-0.dll	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\emblems\__init__.py	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-cf.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-lu.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\libpixbufloader-ico.dll	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\gi._gi.cp312-mingw_x86_64_msvcrt_gnu.pyd	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\_csv.cp312-mingw_x86_64_msvcrt_gnu.pyd	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\plugins\plugin_debugger\__init__.py	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\__init__.py	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-hr.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\locale\ca\LC_MESSAGES\nicotine.mo	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-pf.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-pe.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-vu.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\widgets\__init__.pyc	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-bm.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-md.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\scalable\actions\__init__.pyc	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\48x48@2\apps\org.nicotine_plus.Nicotine.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\32x32\apps\org.nicotine_plus.Nicotine.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\locale\nl\__init__.py	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-mf.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-pa.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\locale\hu\LC_MESSAGES\__init__.pyc	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\__init__.pyc	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\24x24\apps\org.nicotine_plus.Nicotine.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\css\__init__.pyc	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\locale\tr\LC_MESSAGES\nicotine.mo	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\popovers\chatcommandhelp.py	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-gq.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-lv.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\locale\hu\__pycache__\__init__.cpython-312.pyc	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\widgets\__pycache__\trayicon.cpython-312.pyc	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-fo.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-ie.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\nowplaying.pyc	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\ui\popovers\chathistory.ui	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\ui\popovers\roomwall.ui	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\ui\dialogs\about.ui	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-hm.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-om.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-mh.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\libyaml-0-2.dll	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\widgets\filechooser.py	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\ui\settings\ban.ui	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\ui\settings\log.ui	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-ro.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-cw.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-sc.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\share\locale\de\LC_MESSAGES\gtk40.mo	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\libpixbufloader-qtif.dll	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-ao.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-bt.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-ly.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-nr.svg	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\__pycache__\search.cpython-312.pyc	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\locale\de\LC_MESSAGES\__pycache__\__init__.cpython-312.pyc	msiexec.exe
File created	C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-gh.svg	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDF3B10FB10FEB193.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{133E94BF-EF22-430F-981A-EE4260B4CFDE}	msiexec.exe
File created	C:\Windows\Installer\{133E94BF-EF22-430F-981A-EE4260B4CFDE}\InstallIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{133E94BF-EF22-430F-981A-EE4260B4CFDE}\InstallIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF30F4FC1E720CAE02.TMP	msiexec.exe
File created	C:\Windows\Installer\e5925fd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5925fd.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF10B9DD76BF9FF9AF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2BF8.tmp	msiexec.exe
File created	C:\Windows\Installer\e5925ff.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9D816A6787EAE920.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4908	msiexec.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Control Panel\Colors	Nicotine+.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BBD9BFF86017CF14E9A82B64A91AEFF9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\SourceList\PackageName = "Nicotine+-3.3.10-mingw_x86_64_msvcrt_gnu.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FB49E33122FEF03489A1EE24064BFCED\default	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\ProductIcon = "C:\\Windows\\Installer\\{133E94BF-EF22-430F-981A-EE4260B4CFDE}\\InstallIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FB49E33122FEF03489A1EE24064BFCED	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\ProductName = "Nicotine+"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BBD9BFF86017CF14E9A82B64A91AEFF9\FB49E33122FEF03489A1EE24064BFCED	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\PackageCode = "DCC7A990A0AE369479A837EAF5C41E55"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\Version = "50528266"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FB49E33122FEF03489A1EE24064BFCED\AuthorizedLUAApp = "0"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3368	Nicotine+.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4952	msiexec.exe
4952	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4908	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4908	msiexec.exe
Token: SeSecurityPrivilege	4952	msiexec.exe
Token: SeCreateTokenPrivilege	4908	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4908	msiexec.exe
Token: SeLockMemoryPrivilege	4908	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4908	msiexec.exe
Token: SeMachineAccountPrivilege	4908	msiexec.exe
Token: SeTcbPrivilege	4908	msiexec.exe
Token: SeSecurityPrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeLoadDriverPrivilege	4908	msiexec.exe
Token: SeSystemProfilePrivilege	4908	msiexec.exe
Token: SeSystemtimePrivilege	4908	msiexec.exe
Token: SeProfSingleProcessPrivilege	4908	msiexec.exe
Token: SeIncBasePriorityPrivilege	4908	msiexec.exe
Token: SeCreatePagefilePrivilege	4908	msiexec.exe
Token: SeCreatePermanentPrivilege	4908	msiexec.exe
Token: SeBackupPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeShutdownPrivilege	4908	msiexec.exe
Token: SeDebugPrivilege	4908	msiexec.exe
Token: SeAuditPrivilege	4908	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4908	msiexec.exe
Token: SeChangeNotifyPrivilege	4908	msiexec.exe
Token: SeRemoteShutdownPrivilege	4908	msiexec.exe
Token: SeUndockPrivilege	4908	msiexec.exe
Token: SeSyncAgentPrivilege	4908	msiexec.exe
Token: SeEnableDelegationPrivilege	4908	msiexec.exe
Token: SeManageVolumePrivilege	4908	msiexec.exe
Token: SeImpersonatePrivilege	4908	msiexec.exe
Token: SeCreateGlobalPrivilege	4908	msiexec.exe
Token: SeBackupPrivilege	6076	vssvc.exe
Token: SeRestorePrivilege	6076	vssvc.exe
Token: SeAuditPrivilege	6076	vssvc.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4908	msiexec.exe
4908	msiexec.exe
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3368	Nicotine+.exe
3368	Nicotine+.exe
3368	Nicotine+.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4908	msiexec.exe
4952	msiexec.exe
3368	Nicotine+.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 5780	3368	Nicotine+.exe	92
PID 3368 wrote to memory of 3400	3368	Nicotine+.exe	93

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Nicotine+-3.3.10-mingw_x86_64_msvcrt_gnu.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4908

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4952

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6076

C:\Program Files\Nicotine+\Nicotine+.exe
"C:\Program Files\Nicotine+\Nicotine+.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Control Panel
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Program Files\Nicotine+\lib\gdbus.exe
  "C:\Program Files\Nicotine+\lib\gdbus.exe" _win32_run_session_bus
  2⤵
  - Executes dropped EXE
  PID:5780
- C:\Program Files\Nicotine+\Nicotine+.exe
  "C:\Program Files\Nicotine+\Nicotine+.exe" "--multiprocessing-fork" "parent_pid=3368" "pipe_handle=4688"
  2⤵
  - Executes dropped EXE
  PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5925fe.rbs

Path C:\Config.Msi\e5925fe.rbs
Size 190KB
SHA256 7304f06150311974372c5d76107c44b5aa690557d971abccb8c3a94dca1ef762
MD5 8d8158c669ec9b4c0f8c459a1273bb95
SHA1 59c351678807d6ed79974b87a3cb82a3d0173af7
SHA512 fed92848ba6e359d364ce279f55a2f858ff57946f1cb0648db60403f935d31d282d06e67b9dcf7c6d18fc942e4b81af5156064cf258dea020ac7e37671382593
SSDEEP 1536:0PF2fzK6TBRxREn3Lpis3sSJT4vam4xg37AXFowxdwDAjUu2Smb2+mfpodNzOFWX:LIVbGKgCyo+
TLSH
T1BA141612CA04C3D77343A1AF23546A9C011F8C367F854EF6776893769C82B66AF3B562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nicotine+.exe

Path C:\Program Files\Nicotine+\Nicotine+.exe
Size 237KB
SHA256 9fe56515d62ed467351328c27218536d7fe886b364166a23d147c88ec7f1c8a6
MD5 9e5e95eced74ad26259d0910547e161c
SHA1 b67475b782c93dd432b72c9774f5a021342d0a26
SHA512 745291535e9de1d42a6670f2dd626f70b598d5f803e1c9a1c3aa5b47d36ba625c4c21b58f447d6d86c72f86b43b0c7680c08acf17a3068ab0b4a1a119e13d12f
SSDEEP 1536:skaTIQVokt2WUV4cXaGwsS0InV4cXaGwsxfb:skaTIQVddUVTXaxayVTXax6
TLSH
T1C434D703AB5DA498CFB14FF4B863C6A79E11FC251A785A1A3FC4B72A9A70DC3791410D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bisect.cp312-mingw_x86_64_msvcrt_gnu.pyd

Path C:\Program Files\Nicotine+\lib\_bisect.cp312-mingw_x86_64_msvcrt_gnu.pyd
Size 29KB
SHA256 3027a8e07fc6e77f30aee6511b1681766d8e07c2e63795d02677088284a4f781
MD5 866a82c31ce1f0945c2a0a9699669fbb
SHA1 2d767710e8998aa8ec17d009054797cd80af9089
SHA512 72c3764d75b88789efa2fce703ac51063070f15aa6d881616e2bde2817bbd3ee7a4d33962ec688025708a40d513b664b9bb883d5057a606a483b52faa1bdbed9
SSDEEP 384:5fdRQGTkuO/nk6mreaMXbckzFGjVhi6jbuY5GV0CzdaBX:5zQEkVkZrnMXbJzFGjVhi6vEK
TLSH
T1FFD2D73BB0515CFBCA76D178A5C6C732B975B8231332AB3B1144D9392F75BA2831DA06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.cp312-mingw_x86_64_msvcrt_gnu.pyd

Path C:\Program Files\Nicotine+\lib\_bz2.cp312-mingw_x86_64_msvcrt_gnu.pyd
Size 32KB
SHA256 f8fbe44bab20fb8e5ac587ef186d1cbc9064224f9fcc05bd4fc85c31610b47e3
MD5 88ab6a0b2a739f7cfb3ba7ddfd68f0ff
SHA1 9a8d50750d4b99a627c434cd06cf8a4af2277eed
SHA512 7042c803e83d052bc6a07094373185182bc5c3d09740c5b14346bc65df238f7ff5993715c8f346d59828141fc74a36b54649580ef1d4c8bdd8fab718099af8eb
SSDEEP 384:MOnjEFWXkuU/HQ1HF2A7VS3kZxlYqsO+OyxEYOaEQhUFNMe2LFiO3nJzwCu:MOngFwkHQ1l2A7VS0RYqsDvE6hf3Ji
TLSH
T147E2D93BB18258FBC167D63CE9C18736A4B4BC112331D6AF5118EA7A1F71A708B28DC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.cp312-mingw_x86_64_msvcrt_gnu.pyd

Path C:\Program Files\Nicotine+\lib\_ctypes.cp312-mingw_x86_64_msvcrt_gnu.pyd
Size 170KB
SHA256 e376991eb70cd5b0f8e850e75e642c2341ab7479a4644ecf030e7cb9dc2c3a14
MD5 c97bbed50e7ecc05bac470276d0bb9b6
SHA1 50b70104591100d155117d6a0bcfe1ef2ddc50bd
SHA512 c5d6f9347f84ba635670b96e80516f1a2de243492ce40e802d25385fe13d96a5784432c7d8bcb02e4566251412c13bacdd1b18f880466a5fdfca667a0e11175b
SSDEEP 3072:q05ti7MuwcF6r8yVuxim40GNloFwGNhj2IWHXfNaYLrz74NFeTQy:q0+7MuD6V7PHXfNaWryFecy
TLSH
T1ED043A37A28555FAC5678239CDD38B72B972F4116330AD9F2198C7316B30F70672A74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_json.cp312-mingw_x86_64_msvcrt_gnu.pyd

Path C:\Program Files\Nicotine+\lib\_json.cp312-mingw_x86_64_msvcrt_gnu.pyd
Size 50KB
SHA256 703ef9e4f024d9ba23d795972f224f8f1123fa3c1fdcbdaaab3643c86b70129b
MD5 950f6d610627f70e0b08cca3192fd5b6
SHA1 6d0fba14af350b424e68b2d318e3de29c7267137
SHA512 48cefeac1bc9f23644284463fd5de3a82ea776392e4a5416344cb14b95da90bf984a71fa64a45ad0fe65a984f27f7d93b8588f5d2ac275e6149ce734f977d4aa
SSDEEP 768:HsS9yQk5Z+SDY4u4LIFnySPvoTA/P1EtTgazVLw3OdSLmWR:HkQkGuYMLIFyovoTA/P1wdVLuL9R
TLSH
T139334B3AF2C199FEC2B6D138C0D78332B779BC2566219B6B1194F6355F326705E2A1C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.cp312-mingw_x86_64_msvcrt_gnu.pyd

Path C:\Program Files\Nicotine+\lib\_lzma.cp312-mingw_x86_64_msvcrt_gnu.pyd
Size 47KB
SHA256 af0271bc059ebc8bdfb2bf563d63aa3494d3a87b9a94836a94f54df7557da49b
MD5 b7c4bf1cc58da9b1535e83b35eba94b9
SHA1 2d37f152b494ef8d98f836f00abe1c7f2c948eb3
SHA512 5d16ba9a762eeaf8f6ad552a6a82ce4a51c7c41a6e54d71c5c5aad5241cbe35e9e3c61ed8d781e674ffef569d0c455db25620b72854b7559d52754e936babe9d
SSDEEP 768:iBNIpkGgdfTD49R9xN5oDjzjLrjVvaHKN9Ty6KBG03S33zK1P62lHFIq8vG:iBWpkxdiHc/mSnz2iYFV8vG
TLSH
T12A230A26F64395BFC172D53D99DA8731B975FC0222329A6E2188D7336F35E208B2D9C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_md5.cp312-mingw_x86_64_msvcrt_gnu.pyd

Path C:\Program Files\Nicotine+\lib\_md5.cp312-mingw_x86_64_msvcrt_gnu.pyd
Size 28KB
SHA256 586b79ba6e8f6bdccfc93db46fa7635fc3117621da101e404a9690eab9e5fe6a
MD5 cb3706f167ac6aab053a774b836b8b34
SHA1 4b608830fb0ea8ce36134b5047219d78095900e0
SHA512 b8fcfcba579b352a8f76fdfa8b9257a4d77989a599d006d4be8692b9a98c13a996bd222941f57740f032ba13a122365aa43e39d0deb9b9fa88967168f081632c
SSDEEP 384:fQGzNBkgtakush/4JEHB/NmnPogKbfngVrB1uCO1xbm4XJRi271RyCO:YGxBkgYk4SH+1KTnaHuCNs1y
TLSH
T194D2C42AF682D9BFD6A6C27985D6C772F07278441331EE3F1218C2752E70EA1CA3D485
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_pickle.cp312-mingw_x86_64_msvcrt_gnu.pyd

Path C:\Program Files\Nicotine+\lib\_pickle.cp312-mingw_x86_64_msvcrt_gnu.pyd
Size 158KB
SHA256 90fad380c1dc5f43a37bad7e9b299eaafe0ebc7010e84d62f2f4b61b81c58f97
MD5 5f2ff516e6f7979eba35edc5648b66dc
SHA1 4f941f6cc9c98e3294ffb1bd077c7f6bd215ee6d
SHA512 a9eed17ee6c066c4b96bcfd70d4bfb9f494f88198e651d62e46cfff84f422e8546d8037595e6643fba898d5c2e26a52a06dfc74095ad18c02b5622fae99b22f0
SSDEEP 3072:DKstQPQNcg/r8ouTvGLBT+SnQcl/ZNBBpmoBqzpUsH1YMGTX/91lEp:DCPQoBr20GBBp5qlUsH1Y1/91lI
TLSH
T1B3F34B27B29294FFC66BD13989D79B33B436B4115331EDAF6194DA300BB0E70676922C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_random.cp312-mingw_x86_64_msvcrt_gnu.pyd

Path C:\Program Files\Nicotine+\lib\_random.cp312-mingw_x86_64_msvcrt_gnu.pyd
Size 26KB
SHA256 68ff31ab2412a9ad90bbad3989b1f4fb7e42ded84c0469237156ddb8be062c89
MD5 a482bdfc7bcdd9bcfb22919be20db36e
SHA1 4e083f257061d1186c30356df773e9e04fcc6c9f
SHA512 579657a62574d589c7ff35c4ac8c38658c2efe090251188237f3087a7190fe802e9aa7e0c99b8954443a6a2f4fca9144d9cfb478a10a60d7a2f0b13c0ac42f2f
SSDEEP 384:+4h/R3/ZkuI0XAlXHwR3nRhZ6p3aUJtibajIgTMuYUXH/wUj3QZSC:+433BkpM3RhsE2OaBTMyj3fC
TLSH
T14EC2183FB6429C9EC765E23894D68BB3F1357801E361EA2B521CD135AF32BA0565EC81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sha2.cp312-mingw_x86_64_msvcrt_gnu.pyd

Path C:\Program Files\Nicotine+\lib\_sha2.cp312-mingw_x86_64_msvcrt_gnu.pyd
Size 83KB
SHA256 c2ce8f8d9a003ab9a18d6e4cf53103ae65d2faac375e6ea1e4b2d62db4094e85
MD5 c79b61ecbfb26a588ada49119b876d50
SHA1 06c475495d88a7d6844995b4bbffca3d7969139c
SHA512 e2e2992faf12a485648826853322e0bb5dbb2ee475b37161b452c73fb889419aad4f67058a7e74a71b9f7c7341699430cc7a84898868d2ece30f146c52efca94
SSDEEP 1536:+vk8Fquvn34CINpJFPAfmhdPyHkBkp7kA+gZQGrC4t6pnbP3s:+c8z4PFPAoaHkBjCQGdGnbP3s
TLSH
T1C5837E6FB68244E8C59BF570D5BB4B61BF35781C63A43B23014686B16A21BE09C7EFC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.cp312-mingw_x86_64_msvcrt_gnu.pyd

Path C:\Program Files\Nicotine+\lib\_socket.cp312-mingw_x86_64_msvcrt_gnu.pyd
Size 133KB
SHA256 5f3cc313bcc1317159506d99538a96e6a4cdbcb47d34abe9def6131fab2dd24d
MD5 8a982891940b375e3362cc729f8b3827
SHA1 90d6f113d60b5d4a03e94bc18f4560de3f84760a
SHA512 c00a1f7df0ad7b57eaa7cc45739ae4cc3e670129bf3285899dd790c0649c209f5556a73f6b4411a67cb352014799d57b2d4480f4171a32e29d0dbde9291878c1
SSDEEP 3072:qAW88bTYiktQTer8KCy+ZJ0UoXVkDF9eBr0kp+2owfe7YdIOX1:ZeYIc+QY9MfW4e8dIOl
TLSH
T1C0D31933E54261FEC177817846C35372B9B4B4952321FA6E67A4CF311A31F60AF2E689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_struct.cp312-mingw_x86_64_msvcrt_gnu.pyd

Path C:\Program Files\Nicotine+\lib\_struct.cp312-mingw_x86_64_msvcrt_gnu.pyd
Size 56KB
SHA256 41860ba69a073b6c2af26e00dd669a4642ee03f503bad27858594c5254094083
MD5 1c5ed59491f0d835aed1e7b7c076a9ca
SHA1 73ddc40fe27efd67bc743c002307f6e22e5700a7
SHA512 ef99e36fab68e2d77f515aea98cb70419f5cec296f24cea06cb3539464adb7346db0857db448aaca99ce3e24482a00e5067196e309d6b65f366dae9c012be8eb
SSDEEP 768:4lKCQAks+4Q7PSPnoF7MPslc4QxbiuMDA/iMgueC0E8XnGc5/W7nHz+HIfq:4liAkNjSPoyPslBQBiU/iJSp+HIfq
TLSH
T18943196BB341D9BED567D13D88C68B727B70F9001231DBAF6558D1F12E60E204B2AAF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

binascii.cp312-mingw_x86_64_msvcrt_gnu.pyd

Path C:\Program Files\Nicotine+\lib\binascii.cp312-mingw_x86_64_msvcrt_gnu.pyd
Size 37KB
SHA256 b7328aa6cced1fffc25967a91424fd69b79d5d24a9e1163d8ba5659cad36d25e
MD5 d9cbf25d7f840b376729dfc6341e5e86
SHA1 df856b9b38604f78d87602c6113da5ca73ea4eaa
SHA512 b928f427a51540c46d216c7d3f63f246b6c5089fb16dcfabe00a448488fa0c0511e94ef9a9a3514da5a0c268718a4408e406d2b1ffa8b74a180c24db5430af25
SSDEEP 384:aeLQxThNaku8n/xux3r2EmIO5FEtV8LPZ5xi+vuvDdNedzssCkc8jSsjSDxPaDLQ:aeLQP4kZZuJo5+L8H4ZNedaFL0Pu0pOd
TLSH
T13E030926F2805CFFD66AE13C89F64B32FC747C059221AD6F2588F631AE72E60462D546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libbz2-1.dll

Path C:\Program Files\Nicotine+\lib\libbz2-1.dll
Size 98KB
SHA256 b79cd3a7102e359ef6324e98966a67939e58ec2b651ae2847cae84a4dfa453f7
MD5 981dac0b4d9eb1da0be9f51024d5649a
SHA1 bd47b357caeaf24bed207b379da8f961f901dea9
SHA512 89be623acfae7ce840509462d8c142626c7b3a3c2fad90f2d8fc0d5b5465d5203bbb2423a781c5e7004c55ec2d52e5239c709a85d64767fb0df811423911d8e1
SSDEEP 3072:L2bM6qvTwjW7Ofiw6zd+srIBMnw6DewF35:O7qvTwjW7bdzce7F35
TLSH
T160A34B19F0E35AEFC653C23081874A37EEB1FC69061077776224E23A6EA2F605E6D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Program Files\Nicotine+\lib\libffi-8.dll
Size 33KB
SHA256 9bd4b28b3a406f24dd17b5c087c3e98bf8c973cec4b0f459ffff17f804019cc4
MD5 b515dae648265e8573c9c59ea745fb5e
SHA1 d27ecbf52f3e87ca34fe845cd6ba35da247d8f21
SHA512 7c0d58f839babc562572d7007151a7992d1cb1d0a7d7d173b215ea3ffcbe97aed6eb77bfed8fe3b80bcce3b780f7b35661a0c7840a4ab7f54c63d712628fc097
SSDEEP 768:s3T0D2WbtEqOZqR8GZM9tH4wazkxJvBUCn/:R7KI8zkzkNUu/
TLSH
T1BEF23A2AF19368FED747D234A1E38B72E031FC111332BE3F15A5E2356E25A641B1D91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblzma-5.dll

Path C:\Program Files\Nicotine+\lib\liblzma-5.dll
Size 182KB
SHA256 e8fdaa9954bc5df9c6ac7af10f795803e4e438c4fcdeff17f0e65eb93f9f7e78
MD5 842e560d761af754cf6a20e401779c07
SHA1 690a4bba4a21e045e057627fd99dae19f74a491a
SHA512 02e35c009c5cc04cc12dd997e5aa58ed3aa9bf4a5e3a530d8b14665d3bd416148d3170a0da0e899ae568841ce9356bd4498bd263d32b5d26afcab9d907b7f3f0
SSDEEP 3072:5dgc44vBsGD7ehIME2zsVo1/DjaWKb9kY9mNocywoVUF358:ov4mGD7eTaPYOBwcUF358
TLSH
T146041852E692F4EDE76BC830D5668F72A6F178150220AD3B5598D33C2E2BF70460DB27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

library.dat

Path C:\Program Files\Nicotine+\lib\library.dat
Size 11B
SHA256 1794a90e19985ee2dee89f9bdffac8dcb3676e2555db9469384493d14708aed5
MD5 12d737558481ffdec6d9fc90f1c64e10
SHA1 2d99fd826f22325c6715a6b9fabc64ffa56ba7c9
SHA512 2c62c69718a41d011cb9a0bc436e874f967e4174094802e13142eaba4967e61a76ba06eeb3c6b4dd8c76dc4c41df6bd1e4397143f94aad03cc534d3084ee32d8
MD5 SHA1 SHA512

Submit Download

library.zip

Path C:\Program Files\Nicotine+\lib\library.zip
Size 3.4MB
SHA256 7f454c37dcae0363ac540fc4f17fe6cd56567285d0cf3d71cac7a052be9dc5f1
MD5 a4d1d0303e9ad61073ea4e22ca4149d8
SHA1 25f7cbf03a187b73da10fa5833e443627a0b5e61
SHA512 3435c079c5332c2f740119a78e6a488211676a59b006d1e888624872f44d1b02fee2914ab6430c4574460a38a089cba4e98c483f7235cdba673a7aa0753bb960
SSDEEP 49152:b/BwVhg85iEYLUiM+MlA86wRgpywF4dSatJCn+V/9BJBa0uwAka3NtWzJ4mut4qJ:b/sOeipLQUwRgpy3ddV1BJBumON0zJry
TLSH
T1F4F533A2ED7D3115FDB7B2756622CE6ED38E8721B385F50B0E2B06A164917C91F0E01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

math.cp312-mingw_x86_64_msvcrt_gnu.pyd

Path C:\Program Files\Nicotine+\lib\math.cp312-mingw_x86_64_msvcrt_gnu.pyd
Size 97KB
SHA256 f5922883fcf0e9718039ad0b16aa373eec563be2fd5aa370518df26e01249886
MD5 cfbf3b9ce0f8923e872364b634ef9e7d
SHA1 91a139f541c7395223c5b42ca0f2aa4cc5d4fa38
SHA512 4c23d4fec99e8ea43c37731089c7fd4fc13ad06e59b2eb50b1da60cbcd7da1688e0640145f0293d2dbfdded025a38d2ca1b1a8e18182ba476003e66fd552b755
SSDEEP 3072:Sur2Nmt3/dMRjbFZ9eJOgEqx3JYNOy7Jn:Sur2NWMRfFZ2Eu5YH7h
TLSH
T129A34AA661415DBFC663907C84D66BB1E925B4210138DF3F0798CC212F3BFA06FAB959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmap.cp312-mingw_x86_64_msvcrt_gnu.pyd

Path C:\Program Files\Nicotine+\lib\mmap.cp312-mingw_x86_64_msvcrt_gnu.pyd
Size 32KB
SHA256 8086e0d70c547785efda4c4864ea171af3862237dd68efc29489cfcb53ef4258
MD5 863cbafdf2ea259aafe33542b483e31a
SHA1 6765e94ab43b2732b8db4e35d139976c9c0bbfba
SHA512 2479caa17a4577cd3113804002e5786b374f06da46bfecfa3aad2970677d4c83c33dda4fc67ea4ac83f699c20d4f033412bc0c6425ec07b1147b7ec95206f5c5
SSDEEP 384:5oYkfiu7RD4kurXHQCQxDLWZb1F3bmlrfhRymGe8VEMwo2/u/YwdgixiB7UOnIfk:5o91EkcQCQ5WH9mbcwftfgOIM
TLSH
T1DEE2073EA1810CFFE562D23C84CD4775B9B878051322E62F2558DA37BF71A31862E9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.pyc

Path C:\Program Files\Nicotine+\lib\pynicotine\__init__.pyc
Size 9KB
SHA256 da101c06e106d996d79edb87e39f9b6ab3f491aedda8364a41d7b487d693bd5d
MD5 9e4ac25b8c9773d6c52ee36c4d00a203
SHA1 9be6011671550e6a4b5c10d8ea2c041c472c8e80
SHA512 bc271b8eeaea923ab299251ff732e6ae94f7542c2eac9a7c9519f3ac7513c5d631af031e92fa4a9f26649770e2f633d07442d205e0527f9bbdd049b1855b73bf
SSDEEP 96:D8FTAmYolTMrprqpU9QINjV+uWgj7GIiW1gcbTr12TVi+m5/ocDVBr4GU9LfKTA/:YAmYolIprX9QIuuGIfTraV/m5/R3hUH
TLSH
T14012B6997F65D573EB40F1BB8171378BD72181B8B182DB23236B82241E571B9DC6A0DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cli.pyc

Path C:\Program Files\Nicotine+\lib\pynicotine\cli.pyc
Size 6KB
SHA256 e6e2fff70a5608218e8a8f2d6abdbbf683e0bc6cdadc11b717bdd5f07b35c1bc
MD5 7850f90d02cbf4c8c4846b22c498b408
SHA1 8901f0260f0679454272b10fceb6cbefa57e565e
SHA512 3855bef760a0ba5729acd06a8e47c14ac9ba2343601709a9be1562ba20487fa9380e252e7c823e14ad999e3ee0dd06f5be63782eae542e5a95c197bfca1fc560
SSDEEP 96:fFSkZKlTnszPy+LXita7lboLGuFnvrNkgu4cPmST68r:fFfZgncbXi47lqGuxrNKE8r
TLSH
T19DD1B880BE9B8476FC99F5F9956B2F4553E252FB7609A313522BA0394D8F2408E503CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.pyc

Path C:\Program Files\Nicotine+\lib\pynicotine\config.pyc
Size 25KB
SHA256 1184bea3501a8dd6c8d049cbee8d7b91d660de0d4c37e15d68dfda4881aa69a7
MD5 bd8eb128037f415abe01a58d4a482436
SHA1 95e4d1384530bd8fed59ab21acfd140aeccf82b7
SHA512 70523f0de702adc142245046199c9ee16c2ccbafd2f4dcf7a391cf3f01152cec0ab062db2d51360de82d9cf697abd73b984c85855d2b47cbdec09681956a7c62
SSDEEP 768:SUKs1ZaEJvAAJvYcmuDVP/laYGV23IeJdndnGLoh:8s1xSAJvYc11wYxbdnGLoh
TLSH
T1D6C22B833662C437FDA1B0BA94067A5EA6B143B23B03D31361F7D0A56E4B295DC119DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

core.pyc

Path C:\Program Files\Nicotine+\lib\pynicotine\core.pyc
Size 14KB
SHA256 4eb4b69bcae3dc4422946eb4dd81bdae89f96e34a2e4cd58b633bef59b79d24c
MD5 3ac74ecf3d2be8bae415ee6db897674b
SHA1 68843dc9428ee7ff5e81b8039cbc1d80f7a7c540
SHA512 3e04a4760525de080f15c7b8c9c321241ed4bfa6211d609c92021a8adca8a1626f6d672de45bca91536c2e7794e0eabae20cf4f138068f881e485e5fedc1060d
SSDEEP 384:0GYY9dRYWBHvJimqsmSE6xS3ppD+GKxwGT:bX93BHvcGr4B0T
TLSH
T1ED62B5C16B61C83BFFE0F6F954212B4EA72346B6BB02532716FE91690F4B2989D110CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events.pyc

Path C:\Program Files\Nicotine+\lib\pynicotine\events.pyc
Size 10KB
SHA256 de4f1a77bb64c1a709eaebc6821cfff0caf99d4e182b1d365bbcd79d8c07e496
MD5 671c55b696a1ae43c87937e97aff95cc
SHA1 bababaaa34f4fb62319d33d4d42b0c0826055b15
SHA512 5d6c05642c17ea60e5d11f5c6799b2cd93238dd73b531a867fb2e7e4fd2fe0eed386850eaf70c27c5b1a7c583a99653db3b31bfc0d65207b32384d773c6c7e95
SSDEEP 192:j045WWV5+dBfEZ6jNSB0MSF78OVxez5v/DWkYKxZ:j0/WHQBfnjoeTFgOVxq5TSKxZ
TLSH
T1B722D88AA585C46AFDA6F2F8C40427C57A73C2E3BB018307527BC4A79E5B7900C691DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.pyc

Path C:\Program Files\Nicotine+\lib\pynicotine\external\__init__.pyc
Size 161B
SHA256 357547864d51edc1be7e103b10fdea96b01188b39509812a22b73de3a369bfce
MD5 5ce708f1be092bdb2f3eee11a715d00c
SHA1 186eb5f528147c74f78746573463a384ddeddee5
SHA512 253986b1cd92f5adfa31bafd1d459b869427fb5ae38e358b9ca65a96db1cc7720b3be3f611ffad7b69e1bcac51c2e1e1e8f9817cf71b7f7689f8af9804df5c41
TLSH
T12CC02B409300904BD3A876F38C30218CA4C78293C64F0C1357159A84100F5002C9080C
MD5 SHA1 SHA512 TLSH

Submit Download

tinytag.pyc

Path C:\Program Files\Nicotine+\lib\pynicotine\external\tinytag.pyc
Size 70KB
SHA256 47ba76ebb565ef6329fe605ad7fe3c0c84824993de84209a91512c4c9a41ac2f
MD5 6fd4fd59407a66ca33539e983783f002
SHA1 0d9e325f20aa7ade30942023d7bcab7a0f1cdd0d
SHA512 d4e90c01df52fddbb361d2deaaca77c1496b2d40202c70ca9af87dd10a5fc53b844aee89e88660e1084848d7ab9fe18aafd11fe5887418baa5d580fd989e5955
SSDEEP 768:faAnrjKoSAF7aa5znf4YC+6Lm9Ehp37pJW0c2IGxPOoUdivxhi8a5EMWkOPFExGi:faAX1+m9O2R2IzJd7yMROrzpVAaE
TLSH
T19D63B289BB62E837FC94F0B5482A170EF33199A1F741D723647B81B62F8B2A49D151DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nplus-flag-fr.svg

Path C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-fr.svg
Size 752B
SHA256 5d4bdd3353c3f4fefd9afc2c0507330a2fafc51271f460aaed17d6158316f940
MD5 deea3773b7d21556af8369b925459afa
SHA1 03c774540292f722886176a3e2e035e5299bf422
SHA512 61c285429294c5e4b27a582ec1afca05efc9af9cc9df93bb8a6845ef5692b4365effac3806805536bf59c32bb0fba3919b2ba4b973525b8c56298cce214126b8
TLSH
T149019C76D66E6817C42ED3BCDB48E2F2024B10D360E84368F4A0AF1E20285DB8D48B20
MD5 SHA1 SHA512 TLSH

Submit Download

nplus-flag-no.svg

Path C:\Program Files\Nicotine+\lib\pynicotine\gtkgui\icons\hicolor\scalable\intl\nplus-flag-no.svg
Size 782B
SHA256 2e69c689d7f664849c16e673506614e9f9af5d6f9b3d4d715d6245230fda9332
MD5 ad5e8354f5a68d216d2cbcabacc54fda
SHA1 76262f6689cf033aedb751f9640826d479c56533
SHA512 ec3b71d8f6716c219e449f859df1a3e434775ca5d2895240081ba7f3ac1b21bf5168a9b3392e96e993b1b815f0dd020922caf3b487ddbed16e227cdef0cc3175
TLSH
T1B7016D76CB5E6817D42AD3BCDB4492A7025B51D360A84368F4E0AF1E30245DB9E48B50
MD5 SHA1 SHA512 TLSH

Submit Download

i18n.pyc

Path C:\Program Files\Nicotine+\lib\pynicotine\i18n.pyc
Size 3KB
SHA256 12dabf1c45271ccef78dfa24c81a87aeb5f4e29afba83512f241cf090e480be3
MD5 05cd9c94aa6155f9a1da99ab218f0a70
SHA1 5e59bc39ce1bad99e913a27f73d26b150999fa2b
SHA512 0e0771f983651656eaace1283350486d3c3b277ab57b1690caa4bcd1f7d169354851805df32c3ec8d23b0aff22c485785ed4dea33cd9bf469d70a15fbe02c28b
TLSH
T1DA71A881760BD0B7FAE052B75C25778FA15242B2F4278F0723B381655C460B58ABA1DD
MD5 SHA1 SHA512 TLSH

Submit Download

logfacility.pyc

Path C:\Program Files\Nicotine+\lib\pynicotine\logfacility.pyc
Size 17KB
SHA256 2aaf81c815da3ca755cf43212d9c7a08cb5c9e9866cab421c9bbc93b02b13581
MD5 9a53d570a06d66420774bcbc67fce7bb
SHA1 a5209a4fa2b834ce573f651aa7df1cb96fa89bb4
SHA512 3a1f8376a4624beb4afa8feb5cbbd501df74799e54bb5fbe027c7615592330441bde1369f73d43d2b43554ff368780b96707708fc6a7e3ce7f08a579d9d9c00f
SSDEEP 192:IdMJ5bxtVgC0nyA1njq2QHS6bW5zmWZmZjWEVvujF0JdTYTLKT2jYKTLuENgj:IIhVgnyWnjqnNhbZyYvuZeZoL6mY65NE
TLSH
T14D828644ABCBE937FCA8F1F1A819270EB379C1A677009313366FA5255E473A08D911DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmapper.pyc

Path C:\Program Files\Nicotine+\lib\pynicotine\portmapper.pyc
Size 30KB
SHA256 9248ba194b2d22ddb32210a6d0961a36996485ee649f1ed49cf0dee326c3735a
MD5 b0dd5a881e1eac58d8c05aafdb274fa7
SHA1 0f936a393574000c8bbd7db184213b72f23e9a38
SHA512 f834da84e7d30e62f7d5997a77e2c7ae73ddcbd06c72b068a55e2ee61cedb7b93526be530dfd418a0fbd19ec58a3f7e952efcd7cbac13e7df94f42d81a98a2e9
SSDEEP 384:B+0IGwa1I1vZEgJD8bq86h8uE3eUmWCQjlu8kCugWM6e9Igazjujgzs3V+mnh:smJI5rJl86iFsyuNwWM6e9OjujrF+Ih
TLSH
T1D9D2C881BB72C536FC95F2F95816274EB37182B5B201D71769FB907E2E872A49D200CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shares.pyc

Path C:\Program Files\Nicotine+\lib\pynicotine\shares.pyc
Size 49KB
SHA256 dc93f4956d9920534c8b10b167435de35320981d77e960af60d67a6b00e70f04
MD5 e656e0c978b3d78f085896a43bb9b3c3
SHA1 b895eba2117ed57211b5f5776e3e14cde4b5c737
SHA512 4ec9ca459c051c3f901f548afdbd0f529e4ab42ea525eb0209a23de294986271495a8b35ca26bb53a2eb8a07c2d3ba6c8eb82fe1c729e660e2273f33f8aefc7b
SSDEEP 768:37CT51bTDxKRHkmVYRGV8jsTx8GNK/eF2ODp:3MbLxKRHb6Gijc8GNKWkw
TLSH
T145330881BAB2C97BFC90B1B9A4063B5FF76191B1B600C303A1BB81293E573A49D551ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

slskmessages.pyc

Path C:\Program Files\Nicotine+\lib\pynicotine\slskmessages.pyc
Size 144KB
SHA256 88ca2756dc3550a891b38a46e31ad72c973bf54cf4f56e12dc72ffdfb246ab5f
MD5 4687822074ff67661970b96b214c98be
SHA1 315ef2e047fa4026fd75fab619c6413986c6327d
SHA512 fa06c41207bf5c2755b3019ff0b9161e17bb20524d8c0267426dd800396aee929b6ceb9ffb2c6fc4c4533a7413ca52a268438afcc0902b08b94c71b2e3918f89
SSDEEP 1536:dL1BKZZtbBQ2Pl8xeisym7VeO78IhYWSwBoveCpQIpPiyZWrTqROOrkfiz69i8fJ:dhUbBQKoa6UGwV5/hJer3WgJQZ
TLSH
T172E33D81B5B2EEBBFC88F2B568091708F3B185A1B745C757455B04AABF432D08C25BED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

slskproto.pyc

Path C:\Program Files\Nicotine+\lib\pynicotine\slskproto.pyc
Size 100KB
SHA256 34e7ae6a55b366b694fb41aeaf01797fa5653b12a11569cbf158efa528752399
MD5 264eccab6fbbacf07ccb3119aad7967d
SHA1 450aaaaa5a7ede855b02297e21009de7caa732cb
SHA512 5fe4702272b7f4e3eb94c3801606a016df3b32c96b137b61ca83e892755f54463d2d0e259fe1ebfe95ba01f3c6d7d4330abfd14d1ab1140b13215c342fec9adc
SSDEEP 1536:kDv8A/3MxwmxpNH/jLH5MNb/vRqUP0CRimBS3/:oB/cx1NfXZMV/bPL1Ba
TLSH
T1E9A3E581BA72D437FD92F4B52456378AF36591A07701831B51BFC13A7EAB2B08D116CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

users.pyc

Path C:\Program Files\Nicotine+\lib\pynicotine\users.pyc
Size 18KB
SHA256 18cae98bfe49ecc5b229b6ba5afde424b0466fa1770efa729babb0cb643a55d5
MD5 e9551f19c95c430c2cd3c86d658470de
SHA1 f3ea14948d1fd8635a4af7203f9df4a5a365ceb4
SHA512 472f8ee744852c8a236e53b8bce8e4f31e88c5178aa37dbab6fc3ea81bdf7b303fb6361c01fa5d9f41417476d10bccd4df9990524f715fe4dcc105a13525494d
SSDEEP 384:xtk3zOy+nvvSYsaokHZr4ldAgRW3ofTHs9tet09r:/qOyIvbsaoeZr+d/RW3oLM9809r
TLSH
T12C92A184AB42C537FDA0F2F85C96335AF36982F17A11970382BF84A51E87BA0CD551DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utils.pyc

Path C:\Program Files\Nicotine+\lib\pynicotine\utils.pyc
Size 25KB
SHA256 b2d46789091af20c95b6ba7c2af2cde188ae5eb8db5f58d027e307b70f573177
MD5 0f621b7812e6cf48aaca654acb17573e
SHA1 c83f525c08177cdf356bc6e469c2d8a14051aa40
SHA512 d9fe26336b6918fe6142821e786667f89ba5bdf3aef9d06f619aa8b7392f222a88a1c11d7bd81d8e19ede8429b1559d0ce7831c8b1b4d1795ecd5e9a36d4d05e
SSDEEP 384:Q0iHOmBaE12jfR10Xlsbyjowzxg0oxJleeRWF6AfIj7DIfF35VjC1hSk5/zLvp:Q0a78HjfRWlsbyEjr7RrAfwU9C1Ik5/5
TLSH
T1EFC2A391F75ECBEAFB90B5B59381067AFBE4C5A079098783165F802B2D4F1BD88540EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nicotine.mo

Path C:\Program Files\Nicotine+\lib\python3.12\site-packages\pynicotine\locale\pt_BR\LC_MESSAGES\nicotine.mo
Size 99KB
SHA256 dde2adf4536e0f487a9a7437a97a9fd66057fa26c17542544695f6e8cbcea05e
MD5 72869ff5d30319102bd726bf6df3344e
SHA1 14aa113750061a261d8904162b7dac8472deb506
SHA512 b6873f0f10da4ea9f3d76f49d0484877d315aeddacea526da1918a3effb2ada8d94df18c1eafeb9d7d695ff99d3d6d4b885c636d4df85804374ea2cc0d434529
SSDEEP 1536:DQPJi1acwvWDSN/AWyZ5ACjDHHA/lhH+LNKLVC/pp6oM88t:Ds8MfeUyZVfA/llwm8a
TLSH
T15FA35D1B0FC41627C22203B2F6426233A3B4D18D6B0ACB07F99D56653DC6B55ED2F5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.cp312-mingw_x86_64_msvcrt_gnu.pyd

Path C:\Program Files\Nicotine+\lib\select.cp312-mingw_x86_64_msvcrt_gnu.pyd
Size 22KB
SHA256 2b0cd5ea4908d80f0d431cac81143000989b65f97d5f35245e70fcf802ab76be
MD5 8c5e6200b7e266982d7146d9d206ee90
SHA1 092e0a6e23784af7486f4a9b3f414bb723abc94a
SHA512 3e338cabe0a227ce9090532e995a43d4d63588798859da9dd022ee2509f58cd765483bc6dbaf63410c38f1e76ea76ae9972cbe8b4d29ca2ee081e59d973bf170
SSDEEP 384:2YBBiX6kjfkuLrX/hTIOdVBC8BNHHfgt/SoyRUIYYD4FUfXS+:2eG6kTkuhT5dVBC8BNHHfgpSkPSZ
TLSH
T1DAA2F83BB6495CEFCAAAD37898D78B31F476B8111325DA2B1208D5356F70BA09D3D0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib.cp312-mingw_x86_64_msvcrt_gnu.pyd

Path C:\Program Files\Nicotine+\lib\zlib.cp312-mingw_x86_64_msvcrt_gnu.pyd
Size 48KB
SHA256 5f50cc47ae7480a36d6c418b2d99843b36169549a8c1433d9da60a470f4c431c
MD5 eef3a83aa0055178e5df95614cc21125
SHA1 b5e8ddeb1d6e5df9a1dbd2b55d3ce9db0c43e00e
SHA512 6d99998a948be83cb49619b3c4b4f7bd983a8d6ea9b6a0b4f36add5e0173bc92475ecc75ec5ad7e16c44fa6a86b7fabe33bb333f4832acd86f884c5c79911c60
SSDEEP 768:htpF5k5G4f85YRn2uAqinostPjYXGwpRoAdcqXctridx+YwEY:h95k5tf52Jxo687Vc6+ax+YwEY
TLSH
T13223F83BF65289BFC127C5B8CAD6C731F5B5B4063231A61EA14CD6763F349208B6E590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Program Files\Nicotine+\lib\zlib1.dll
Size 117KB
SHA256 cb7ab3788d10940df874acd97b1821bbb5ee4a91f3eec11982bb5bf7a3c96443
MD5 66a3477a51e8b7d4586edf4659cde8d5
SHA1 3306c6aca3937d8bca11dd076effb03746367b9f
SHA512 948ba42499bba17b552723c3189289e9f07879c9303ec6f27b4d631b7d701c16fe66fc8c6a681236cef778b0cb0a14420493e048aa90bba682606ce2990c64ab
SSDEEP 3072:djf8ECbYiB317HVhVpaKdAAcsrK2M2nuh2UI6vTH2F3I:xLCbYiBp1LghAxG9BI6LH2F3I
TLSH
T116C37B9BB8A265E9C6B3C170C5D78B75F930F8210675AEAB4258E3742F21F405B1C2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_seh-1.dll

Path C:\Program Files\Nicotine+\libgcc_s_seh-1.dll
Size 147KB
SHA256 c942a2a60a6b2503229b7bced507d3cbaa26d40fa4c4fc1dcfb4cd870de3adf1
MD5 15d2dc7447085163aa99deab3731b5f6
SHA1 464ea783eb322a3064cf35eb5495dd3d37bc705d
SHA512 14770a32e73a925921bcdb9a033913b1108a5636c5119ece72d54ba43d837d69b24b5e7cca2ee7ca1e9d5e034da1fec6321b6457d9d837d9714b783a04674cd2
SSDEEP 3072:mITxfKzv1wTJ2iSvXgXrWSSpRvHLZhX7z2q613F2:DSzvOgvXaEvH7Fo3F2
TLSH
T120E31856F19274BCD257E2308A839BB1DC33FC740330A9772399FB386CB6E815649696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpython3.12.dll

Path C:\Program Files\Nicotine+\libpython3.12.dll
Size 5.6MB
SHA256 851b9df1c73f7f9f7f151726cb46cd3b42f5df2ed90c98aa2cd2937149d3750e
MD5 dd8be58fc474e24c06863413ae6b1880
SHA1 7205e86ab05ac5c124a838b8b646f3c244863e2e
SHA512 3cefe8d72e84a6c07f485055d59545e9a64a04dd88396de43fcc12008a8bfc1a02ca496f943ef6d401b8481d0162f8eb7349ed1429c599e1630acca4f2ad5e6e
SSDEEP 49152:oLbZVBr99E8nbSoHbsH/WlY4ENJa/iavqHfFKpO9SZ7gjvzFRVXIIRwf0SoCQzDt:4TRzE5coHux1iajOykbTwf3oRxZDaA
TLSH
T106465C037646C4FEC527E1388D56C79A7BA1FC606D30EB1B30AAA72D1F72A604F56358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Program Files\Nicotine+\libwinpthread-1.dll
Size 59KB
SHA256 653ae9368f31e3acc617ed5bed89fa5514c1d45091a99f8ad5a263f8702fca87
MD5 ad9d73c064bf433ebc7978e3bf7d2753
SHA1 352fc9cd4918cae57853b8f8767dde208d6cb8ee
SHA512 4b56f275999dbe949944e787092043e9c0675055aa281534c386eaf710acfda804f2d3efa3b3fa1d70ba2c9e75445ec0834a91cf8e5f7c10884f4ad7ec0ca5a8
SSDEEP 1536:eyCiWdexTFD4OLwJ6CIWmMmk6ftbPm3YfFZM:eUlrLw4CISHgPm3YfFZM
TLSH
T189531C2A729614FEC667C23494EA5372B533F8302235FF2F9714D3353E68D219A1D899
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gtk40.mo

Path C:\Program Files\Nicotine+\share\locale\pl\LC_MESSAGES\gtk40.mo
Size 115KB
SHA256 5bb66d0543722b17767219ba5b96889890f3de43320165367732bec4629380d9
MD5 8ee43d2f61a4401e0af5bb5a4d4288f6
SHA1 fbec5bc25990267258c39815655ca19f7b049d4f
SHA512 da6fa36792c73470fb42d09348f17e33c15571df63b92106729ccd704dddccc9d02269c5e6c5b3a7d12d752d008b5267118e65592de8929dba6e14ab572d4b9c
SSDEEP 3072:L0K2y0HCN0Q7J214lePGmlFe/DpfRF6zCk1qxZU6KiHY5ipoueR:L0K90HCp7J214lC3e/DpfRF6zCk1qxZe
TLSH
T142C36D865AC04817CDA604B7F3633266D7A5C59D4B28970F910E96CE2EC3B2A1CFF25D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpzm4zsi39

Path C:\Users\Admin\AppData\Local\Temp\tmpzm4zsi39
Size 1KB
SHA256 169bf7a7e03919380159bee9b145098beb6e9f29fdd644a52f4f99554f476702
MD5 47e16c57a3c53d34eda388d4c48bc004
SHA1 1bd716b35f90e9c7828ebd554e09d2c09ab7353d
SHA512 edf5f46b3df84425c16630f3afd2adab6be5159f9734fd829f04d1defee40bb0c271569c7a2a0ab6aa84df28dfbaf29bfcacdf5f88337de65b6cd8dccf47dd3d
TLSH
T1A1218B226B4E2A90CE311FF2B036D187DD5EF120ABBC418D3BD40A23C784CABB56844C
MD5 SHA1 SHA512 TLSH

Submit Download

publicstreams.dbn

Path C:\Users\Admin\AppData\Roaming\nicotine\publicstreams.dbn
Size 5B
SHA256 3bb658542e799ba22955020816541078034f64eb6436dde902538ccd5c3a143f
MD5 afc7dd20bcd9ae9d4ba21dc88a47f393
SHA1 cc4b46b0b0270ca8665eb9c123503173d51f3360
SHA512 aea35f6d3806ed2cc5e5c5c891573030d5bdf7afce74a8b8ce0b3a65bed273ebf4baf1c4ef6f606fdb35dce73fcb1609d2d55f8210fcd1702f2eaec6daa5ea0f
MD5 SHA1 SHA512

Submit Download

e5925fd.msi

Path C:\Windows\Installer\e5925fd.msi
Size 39.7MB
SHA256 daac502e5429826ef1675a65c792521a640669b8cba59d0587eadbdafee2d352
MD5 28841e4b46162689ffadc8c7ec9b85d5
SHA1 7ff168b60f75e47e623d846909702b62a6021556
SHA512 78ed3f0595876f6243309e4c01e7c5f9b461f3bc88fca60ebadfb371ad2cd1876faa64ead863127c58efdb0ad4925c81399d2d316df5e4f88a624308a9e1ff27
SSDEEP 786432:1vyWk4Zkbps3eRxgsMO3qC1lce3XuDwOuTsct/dBBfRuNWpWEGSKgI1zpFKE//V7:1vJZas3eXyYqC1N3XuJ2sGBJuNWpGnpB
TLSH
T1D5973382F92D5732DFA42FF1B192471B6E9A2C449A329161BBD0732D3672E63217314F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3368-1550-0x00007FFA86650000-0x00007FFA86660000-memory.dmp

Download

memory/3368-1535-0x00007FFA86F70000-0x00007FFA86F7F000-memory.dmp

Download

memory/3368-1522-0x00007FFA87120000-0x00007FFA87132000-memory.dmp

Download

memory/3368-1523-0x00007FFA870F0000-0x00007FFA87114000-memory.dmp

Download

memory/3368-1524-0x00007FFA8B5D0000-0x00007FFA8B5DE000-memory.dmp

Download

memory/3368-1534-0x00007FFA803C0000-0x00007FFA803EC000-memory.dmp

Download

memory/3368-1536-0x00007FFA81F20000-0x00007FFA81F40000-memory.dmp

Download

memory/3368-1539-0x00007FFA86C70000-0x00007FFA86C7F000-memory.dmp

Download

memory/3368-1519-0x00007FFA72980000-0x00007FFA72F21000-memory.dmp

Download

memory/3368-1520-0x00007FFA87ED0000-0x00007FFA87EFB000-memory.dmp

Download

memory/3368-1525-0x00007FFA86FA0000-0x00007FFA86FBE000-memory.dmp

Download

memory/3368-1526-0x00007FFA89F30000-0x00007FFA89F3F000-memory.dmp

Download

memory/3368-1527-0x00007FFA87E60000-0x00007FFA87E6D000-memory.dmp

Download

memory/3368-1528-0x00007FFA86F80000-0x00007FFA86F9C000-memory.dmp

Download

memory/3368-1529-0x00007FFA86C80000-0x00007FFA86CA6000-memory.dmp

Download

memory/3368-1530-0x00007FFA87C40000-0x00007FFA87C4D000-memory.dmp

Download

memory/3368-1531-0x00007FFA86C00000-0x00007FFA86C14000-memory.dmp

Download

memory/3368-1532-0x00007FFA86BD0000-0x00007FFA86BFF000-memory.dmp

Download

memory/3368-1533-0x00007FFA87AB0000-0x00007FFA87AC0000-memory.dmp

Download

memory/3368-1537-0x00007FFA7FF00000-0x00007FFA7FF13000-memory.dmp

Download

memory/3368-1538-0x00007FFA758A0000-0x00007FFA758D6000-memory.dmp

Download

memory/3368-1540-0x00007FFA86C40000-0x00007FFA86C50000-memory.dmp

Download

memory/3368-1541-0x00007FFA7FDC0000-0x00007FFA7FDD3000-memory.dmp

Download

memory/3368-1542-0x00007FFA74B40000-0x00007FFA74B9C000-memory.dmp

Download

memory/3368-1543-0x00007FFA745E0000-0x00007FFA7463B000-memory.dmp

Download

memory/3368-1554-0x00007FFA7DB30000-0x00007FFA7DB3C000-memory.dmp

Download

memory/3368-1545-0x00007FFA73380000-0x00007FFA733C1000-memory.dmp

Download

memory/3368-1546-0x00007FFA73340000-0x00007FFA7337B000-memory.dmp

Download

memory/3368-1518-0x00007FF6FE6C0000-0x00007FF6FE703000-memory.dmp

Download

memory/3368-1521-0x00007FFA87140000-0x00007FFA87155000-memory.dmp

Download

memory/3368-1555-0x00007FFA7DB20000-0x00007FFA7DB2C000-memory.dmp

Download

memory/3368-1557-0x00007FFA748B0000-0x00007FFA748C1000-memory.dmp

Download

memory/3368-1547-0x00007FFA728C0000-0x00007FFA72973000-memory.dmp

Download

memory/3368-1556-0x00007FFA7D890000-0x00007FFA7D8A6000-memory.dmp

Download

memory/3368-1551-0x00007FFA74CE0000-0x00007FFA74D0D000-memory.dmp

Download

memory/3368-1548-0x00007FFA86BC0000-0x00007FFA86BCE000-memory.dmp

Download

memory/3400-1501-0x00007FFA86C80000-0x00007FFA86CA6000-memory.dmp

Download

memory/3400-1512-0x00007FFA6EE20000-0x00007FFA6EE2D000-memory.dmp

Download

memory/3400-1493-0x00007FFA87140000-0x00007FFA87155000-memory.dmp

Download

memory/3400-1496-0x00007FFA8B5D0000-0x00007FFA8B5DE000-memory.dmp

Download

memory/3400-1514-0x00007FFA81F20000-0x00007FFA81F40000-memory.dmp

Download

memory/3400-1504-0x00007FFA86BD0000-0x00007FFA86BFF000-memory.dmp

Download

memory/3400-1509-0x00007FFA7FDC0000-0x00007FFA7FDD3000-memory.dmp

Download

memory/3400-1490-0x00007FF6FE6C0000-0x00007FF6FE703000-memory.dmp

Download

memory/3400-1494-0x00007FFA87120000-0x00007FFA87132000-memory.dmp

Download

memory/3400-1495-0x00007FFA870F0000-0x00007FFA87114000-memory.dmp

Download

memory/3400-1516-0x00007FFA758A0000-0x00007FFA758D6000-memory.dmp

Download

memory/3400-1497-0x00007FFA86FA0000-0x00007FFA86FBE000-memory.dmp

Download

memory/3400-1492-0x00007FFA87ED0000-0x00007FFA87EFB000-memory.dmp

Download

memory/3400-1498-0x00007FFA89F30000-0x00007FFA89F3F000-memory.dmp

Download

memory/3400-1503-0x00007FFA86C00000-0x00007FFA86C14000-memory.dmp

Download

memory/3400-1500-0x00007FFA86F80000-0x00007FFA86F9C000-memory.dmp

Download

memory/3400-1502-0x00007FFA87C40000-0x00007FFA87C4D000-memory.dmp

Download

memory/3400-1505-0x00007FFA87AB0000-0x00007FFA87AC0000-memory.dmp

Download

memory/3400-1506-0x00007FFA803C0000-0x00007FFA803EC000-memory.dmp

Download

memory/3400-1507-0x00007FFA86C70000-0x00007FFA86C7F000-memory.dmp

Download

memory/3400-1508-0x00007FFA86C40000-0x00007FFA86C50000-memory.dmp

Download

memory/3400-1510-0x00007FFA86650000-0x00007FFA86660000-memory.dmp

Download

memory/3400-1511-0x00007FFA732B0000-0x00007FFA732BD000-memory.dmp

Download

memory/3400-1499-0x00007FFA87E60000-0x00007FFA87E6D000-memory.dmp

Download

memory/3400-1513-0x00007FFA86F70000-0x00007FFA86F7F000-memory.dmp

Download

memory/3400-1515-0x00007FFA7FF00000-0x00007FFA7FF13000-memory.dmp

Download

memory/3400-1491-0x00007FFA72980000-0x00007FFA72F21000-memory.dmp

Download

memory/4952-2-0x0000016BDFEA0000-0x0000016BE0844000-memory.dmp

Download