2c12490f6ab94cd9332d8db991df49d97690801b99ebd8ec520b78100930e915

Analysis

max time kernel
86s
max time network
161s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nursultan.exe
Size 93.9MB
Sample260810-sraw9acj4w
SHA256 2c12490f6ab94cd9332d8db991df49d97690801b99ebd8ec520b78100930e915
MD5 136161c78d9f7cad0a24a0b2b3b42591
SHA1 00adf514575f7cce7d2aaf644436948cdd60eedf
SHA512 bca3268bedaab9f094a93de973fae69463347fe461bfedc7c8cc8ea495b2fbd00e826da151c43c6ec28a150d6f8f29cb5463d17f695d6253e2dd756f0cd0f9b5
SSDEEP 1572864:s7Pas/X2heCZyFEWg0izspdwdwIeudhSrrZGszY1OTgqTcaNH21A/Ibpip0WWKcR:sjPCZyFE4pqmIe5/ZGsE1Ot7lxItE0Wt
TLSH
T1382833583913D011F1746A32D497E32877662EE539BF6C8286F037C374A68C2AD7B5E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\en-US\modem.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\sdstor.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ipnat.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\msrpc.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\BtaMPM.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Classpnp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\Microsoft.Bluetooth.AvrcpTransport.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\intelpmax.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\xinputhid.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\pmem.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbhub.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\bttflt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\npfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\msquic.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Vid.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\gm.dls	cmd.exe
File opened for modification	C:\Windows\System32\drivers\msquic.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\evbda.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\scsiport.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\bam.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\raspppoe.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ahcache.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mrxsmb20.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mshidumdf.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\msiscsi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\agilevpn.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\nwifi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tunnel.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ws2ifsl.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\pacer.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\cdfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tsusbhub.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\EhStorClass.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\beep.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dumpsd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\UcmCx.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\kdnic.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\acpitime.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\intelpmax.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\winnat.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rteth.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\storqosflt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\bridge.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\globmerger.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\BTHUSB.SYS.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\netio.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\cdrom.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dumpsdport.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\nwifi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dxgkrnl.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\en-US\IddCx.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WindowsTrustedRT.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\condrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Dmpusbstor.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rteth.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vmbkmcl.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\wanarp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidparse.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\udfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\mslldp.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hvservice.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\netbios.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dumpfve.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\cmimcext.sys.mui	cmd.exe

Manipulates Digital Signatures 1 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\System32\wintrust.dll	cmd.exe

Loads dropped DLL 64 IoCs

pid	Process
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe
4652	nursultan.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nursultan.exe"	nursultan.exe

Looks up external IP address via web service 1 TTPs 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
32	api.ipify.org
1	api.ipify.org
2	api.ipify.org
13	api.ipify.org
22	api.ipify.org

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\it-IT\RDCameraDriver.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\wdmvsc.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\en-US\help.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\printercleanuptask.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\Windows.ApplicationModel.Store.TestingFramework.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\eeutil.dll	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\lprmonui.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ml-IN\SyncRes.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\en-US\ipsecsnp.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\AgentService.exe	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\Mystify.scr.mui	cmd.exe
File opened for modification	C:\Windows\System32\en-US\uireng.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\PeerDist.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\devmgmt.msc	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\auditpolmsg.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\pegi.rs.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\winsrv.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\en-US\perfnet.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\autotimesvc.dll	cmd.exe
File opened for modification	C:\Windows\System32\posetup.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\qwave.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\windowsudkservices.shellcommon.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\c_magneticstripereader.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\perfdisk.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\microsoft-windows-system-events.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\netcenter.dll	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\MSFT_WaitForAny.psm1	cmd.exe
File opened for modification	C:\Windows\System32\en-US\sdiagnhost.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\PhoneCallHistoryApis.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\PeerDistCleaner.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\de-DE\MSFT_ArchiveResource.schema.mfl	cmd.exe
File opened for modification	C:\Windows\System32\WinOpcIrmProtector.dll	cmd.exe
File opened for modification	C:\Windows\System32\wshbth.dll	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\SMCCx.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\VaultCmd.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\Dism\en-US\SysprepProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\en-US\fhtask.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\usermgr.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\printui.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\wfcvsc.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\dnscmmc.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\IdCtrls.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\WSDScDrv.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\FirewallUX.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterUro.cdxml	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\ja-JP\MSFT_UserResource.schema.mfl	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\cht4vx64.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\MemoryDiagnostic.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\bi.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\NETBC6~1.INF\netbc64.inf	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\Windows.Security.Authentication.Web.Core.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\prnntfy.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\mfmp4srcsnk.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\VaultCmd.exe	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pnpxinternetgatewaydevices.inf_amd64_b2605c47adc8c2ae\pnpxinternetgatewaydevices.inf	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\mstask.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\TetheringMgr.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\wow64con.dll	cmd.exe
File opened for modification	C:\Windows\System32\cic.dll	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\vaultsvc.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\relog.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\NlsData0009.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\WS3CAP~1.INF\vms3cap.sys	cmd.exe
File opened for modification	C:\Windows\System32\credprovs.dll	cmd.exe

Modifies termsrv.dll 1 TTPs 1 IoCs

Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol

T1021.001

description	ioc	Process
File opened for modification	C:\Windows\System32\termsrv.dll	cmd.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\devices.json	nursultan.exe
File opened for modification	C:\Windows\temp_Chrome.db	nursultan.exe
File created	C:\Windows\temp_history.db	nursultan.exe
File created	C:\Windows\data_20260810_162451\hardware.txt	nursultan.exe
File created	C:\Windows\temp_Chrome.db	nursultan.exe
File opened for modification	C:\Windows\temp_Edge.db	nursultan.exe
File created	C:\Windows\data_20260810_162451\passwords.txt	nursultan.exe
File opened for modification	C:\Windows\temp_history.db	nursultan.exe
File created	C:\Windows\data_20260810_162451\wifi.txt	nursultan.exe
File created	C:\Windows\data_Oaggwfqt_20260810_162454.zip	nursultan.exe
File created	C:\Windows\data_20260810_162451\cookies.txt	nursultan.exe
File created	C:\Windows\data_20260810_162451\history.txt	nursultan.exe
File created	C:\Windows\data_20260810_162451\tokens.txt	nursultan.exe
File created	C:\Windows\screen_20260810_162453.png	nursultan.exe
File created	C:\Windows\data_20260810_162451\screenshot.png	nursultan.exe
File created	C:\Windows\temp_Edge.db	nursultan.exe
File created	C:\Windows\data_20260810_162451\seeds.txt	nursultan.exe
File created	C:\Windows\data_20260810_162451\system.txt	nursultan.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4168	cmd.exe
5228	cmd.exe
1484	cmd.exe
2420	cmd.exe
2568	cmd.exe
5736	cmd.exe
2836	cmd.exe
5076	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5228	cmd.exe
5060	netsh.exe
5736	cmd.exe
2992	netsh.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1260	WMIC.exe
1260	WMIC.exe
1260	WMIC.exe
1260	WMIC.exe
3680	WMIC.exe
3680	WMIC.exe
3680	WMIC.exe
3680	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	nursultan.exe
Token: SeIncreaseQuotaPrivilege	1260	WMIC.exe
Token: SeSecurityPrivilege	1260	WMIC.exe
Token: SeTakeOwnershipPrivilege	1260	WMIC.exe
Token: SeLoadDriverPrivilege	1260	WMIC.exe
Token: SeSystemProfilePrivilege	1260	WMIC.exe
Token: SeSystemtimePrivilege	1260	WMIC.exe
Token: SeProfSingleProcessPrivilege	1260	WMIC.exe
Token: SeIncBasePriorityPrivilege	1260	WMIC.exe
Token: SeCreatePagefilePrivilege	1260	WMIC.exe
Token: SeBackupPrivilege	1260	WMIC.exe
Token: SeRestorePrivilege	1260	WMIC.exe
Token: SeShutdownPrivilege	1260	WMIC.exe
Token: SeDebugPrivilege	1260	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1260	WMIC.exe
Token: SeRemoteShutdownPrivilege	1260	WMIC.exe
Token: SeUndockPrivilege	1260	WMIC.exe
Token: SeManageVolumePrivilege	1260	WMIC.exe
Token: 33	1260	WMIC.exe
Token: 34	1260	WMIC.exe
Token: 35	1260	WMIC.exe
Token: 36	1260	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1260	WMIC.exe
Token: SeSecurityPrivilege	1260	WMIC.exe
Token: SeTakeOwnershipPrivilege	1260	WMIC.exe
Token: SeLoadDriverPrivilege	1260	WMIC.exe
Token: SeSystemProfilePrivilege	1260	WMIC.exe
Token: SeSystemtimePrivilege	1260	WMIC.exe
Token: SeProfSingleProcessPrivilege	1260	WMIC.exe
Token: SeIncBasePriorityPrivilege	1260	WMIC.exe
Token: SeCreatePagefilePrivilege	1260	WMIC.exe
Token: SeBackupPrivilege	1260	WMIC.exe
Token: SeRestorePrivilege	1260	WMIC.exe
Token: SeShutdownPrivilege	1260	WMIC.exe
Token: SeDebugPrivilege	1260	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1260	WMIC.exe
Token: SeRemoteShutdownPrivilege	1260	WMIC.exe
Token: SeUndockPrivilege	1260	WMIC.exe
Token: SeManageVolumePrivilege	1260	WMIC.exe
Token: 33	1260	WMIC.exe
Token: 34	1260	WMIC.exe
Token: 35	1260	WMIC.exe
Token: 36	1260	WMIC.exe
Token: SeDebugPrivilege	6044	nursultan.exe
Token: SeIncreaseQuotaPrivilege	3680	WMIC.exe
Token: SeSecurityPrivilege	3680	WMIC.exe
Token: SeTakeOwnershipPrivilege	3680	WMIC.exe
Token: SeLoadDriverPrivilege	3680	WMIC.exe
Token: SeSystemProfilePrivilege	3680	WMIC.exe
Token: SeSystemtimePrivilege	3680	WMIC.exe
Token: SeProfSingleProcessPrivilege	3680	WMIC.exe
Token: SeIncBasePriorityPrivilege	3680	WMIC.exe
Token: SeCreatePagefilePrivilege	3680	WMIC.exe
Token: SeBackupPrivilege	3680	WMIC.exe
Token: SeRestorePrivilege	3680	WMIC.exe
Token: SeShutdownPrivilege	3680	WMIC.exe
Token: SeDebugPrivilege	3680	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3680	WMIC.exe
Token: SeRemoteShutdownPrivilege	3680	WMIC.exe
Token: SeUndockPrivilege	3680	WMIC.exe
Token: SeManageVolumePrivilege	3680	WMIC.exe
Token: 33	3680	WMIC.exe
Token: 34	3680	WMIC.exe
Token: 35	3680	WMIC.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4652	4932	nursultan.exe	90
PID 4652 wrote to memory of 5228	4652	nursultan.exe	92
PID 5228 wrote to memory of 5060	5228	cmd.exe	94
PID 4652 wrote to memory of 1484	4652	nursultan.exe	95
PID 1484 wrote to memory of 1820	1484	cmd.exe	97
PID 4652 wrote to memory of 2420	4652	nursultan.exe	99
PID 2420 wrote to memory of 1260	2420	cmd.exe	101
PID 4652 wrote to memory of 2568	4652	nursultan.exe	102
PID 4784 wrote to memory of 6044	4784	nursultan.exe	106
PID 6044 wrote to memory of 5736	6044	nursultan.exe	108
PID 5736 wrote to memory of 2992	5736	cmd.exe	110
PID 6044 wrote to memory of 2836	6044	nursultan.exe	111
PID 2836 wrote to memory of 5224	2836	cmd.exe	113
PID 6044 wrote to memory of 5076	6044	nursultan.exe	114
PID 5076 wrote to memory of 3680	5076	cmd.exe	116
PID 6044 wrote to memory of 4168	6044	nursultan.exe	117

C:\Users\Admin\AppData\Local\Temp\nursultan.exe
"C:\Users\Admin\AppData\Local\Temp\nursultan.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\nursultan.exe
  "C:\Users\Admin\AppData\Local\Temp\nursultan.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5228
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:1820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get processorid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get processorid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q C:\Windows\System32
    3⤵
    - Drops file in Drivers directory
    - Manipulates Digital Signatures
    - Drops file in System32 directory
    - Modifies termsrv.dll
    - Executes a command shell one-liner
    PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:724

C:\Users\Admin\AppData\Local\Temp\nursultan.exe
C:\Users\Admin\AppData\Local\Temp\nursultan.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Users\Admin\AppData\Local\Temp\nursultan.exe
  C:\Users\Admin\AppData\Local\Temp\nursultan.exe
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5736
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get processorid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get processorid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q C:\Windows\System32
    3⤵
    - Drops file in Drivers directory
    - Drops file in System32 directory
    - Executes a command shell one-liner
    PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_brotli.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_brotli.cp313-win_amd64.pyd
Size 804KB
SHA256 67dfa82dcaed04ed3f358d84b18d1375d59126161de92e00164d36087b179d4d
MD5 5ed46a7126dbdb70f3c60530e35ba035
SHA1 b5c0dcbe3ee42e258cadd54ac46f70f1f903ae1b
SHA512 7f5d2b52c310a239182eedd60833951d46cdd18ca2edd828fcabed4299b2ab5df506a2b271e33f129d0256d6db90f9c902ee4d18a7e41ca61f65365504451de0
SSDEEP 12288:XO85hNmCUoltfSNAHhlyp8aXTw05nmZfR:XTT6AzRAmZfR
TLSH
T16C059D0BD9A25739CC27C4398D6B1236EB357168931089A7B25CE5353B83A2417FF3AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_bz2.pyd
Size 84KB
SHA256 5ba872caa7fcee0f4fb81c6e0201ceed9bd92a3624f16828dd316144d292a869
MD5 057325e89b4db46e6b18a52d1a691caa
SHA1 8eab0897d679e223aa0d753f6d3d2119f4d72230
SHA512 6bc7606869ca871b7ee5f2d43ec52ed295fa5c3a7df31dbd7e955ddb98c0748aff58d67f09d82edcde9d727e662d1550c6a9cf82f9cb7be021159d4b410e7cbc
SSDEEP 1536:IEfz7lgmVLsSIX0qku0Spf72hbktdj8Z8spLFIDLVe7yo47Q9M/fITjNO:5fz1IX8FS12itdAZvpLFIDLVekY1O
TLSH
T15D839E86F79567F2F45B81B686C103A7E771BA91031093AFF258C2552F03F816E6C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_ctypes.pyd
Size 131KB
SHA256 199cd8d7db743c316771ef7bbf414ba9a9cdae1f974e90da6103563b2023538d
MD5 2185849bc0423f6641ee30804f475478
SHA1 d37ca3e68f4b2111fc0c0cead9695d598795c780
SHA512 ba89db9f265a546b331482d779ab30131814e42ad3711a837a3450f375d2910bd41b3b3258db90b29cd5afccdc695318fc8ad8cd921a57ce25f69aea539b26ee
SSDEEP 3072:gt2Y/2//P+H9SUNn8LBBhc5Nvf/FH3ofTvaZIDyPn3f2:gst/GH9SUCBIf/FH3ITire
TLSH
T1BDD36C0B775840AADAA78174C533AF47EBB1B453165053CF02A8C69A2F637D7AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_hashlib.pyd
Size 63KB
SHA256 14765e83996fe6d50aedc11bb41d7c427a3e846a6a6293a4a46f7ea7e3f14148
MD5 cf4120bad9a7f77993dd7a95568d83d7
SHA1 ac477c046d14c5306aa09bb65015330701ef0f89
SHA512 f905f9d203f86a7b1fc81be3aba51a82174411878c53fd7a62d17f8e26f5010d195f9371fa7400e2e2dc35fda0db0cbe68367fcaf834dd157542e9ee7a9742b6
SSDEEP 1536:jLDxflFwY9XDhWjLTNwjg40nEdIDvI/7yo47Q9LfIi7K:jJ92AT63Nag40nEdIDvI/EF
TLSH
T1BE538C44A29480A6CA6742B4CAE39F87F6B1F2425740ABDF0354C1CD1F237C3D6BA75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_lzma.pyd
Size 155KB
SHA256 6f48e7eba363cb67f3465a6c91b5872454b44fc30b82710dfa4a4489270ce95c
MD5 3e73bc69efb418e76d38be5857a77027
SHA1 7bee01096669caa7bec81cdc77d6bb2f2346608c
SHA512 b6850e764c8849058488f7051dcabff096709b002d2f427a49e83455838d62a9d3fc7b65285702de2b995858ed433e35a0c4da93c2d5ae34684bf624eb59fa6a
SSDEEP 3072:rn18fe1+/ol6s/7NjQWzjaZ1/om6znfB9mNoUr8RJP4V0FID01QGp5f:r0s0Ef6gJ5YOUwrP4V0IGL
TLSH
T128F35B86A394F0E5F7728C78D6624F57E7F5781A0320928A01CC976D2B1FB659E2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_queue.pyd
Size 33KB
SHA256 e4956834df819c1758d17c1c42a152306f7c0ea7b457ca24ce2f6466a6cb1caa
MD5 59c05030e47bde800ad937ccb98802d8
SHA1 f7b830029a9371b4e500c1548597beb8fbc1864f
SHA512 4f5e7ef0948155db6712e1bd7f4f31cb81602b325ba4e6e199f67693913b4bb70bb2c983393646c0ac0d86ef81071907d04bceb8ab0d506b7c5ac7c389fe692d
SSDEEP 768:AkTQ6rDvtxZID9UiiQ+Eyobo+Y7N2Ip4SCxf1mljr8VMj:AqhTtxZID9Ui77yo47Q93fI38VMj
TLSH
T10CF27ECA66584147D5A3C9B0C5A2EE53F579B7935B0187DF2054C28D1F233C2A73A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_socket.pyd
Size 82KB
SHA256 8daefaff53e6956f5aea5279a7c71f17d8c63e2b0d54031c3b9e82fcb0fb84db
MD5 69c4a9a654cf6d1684b73a431949b333
SHA1 3c8886dac45bb21a6b11d25893c83a273ff19e0b
SHA512 cadcec9a6688b54b36dbd125210d1a742047167dad308907a3c4e976b68483a8c6144e02d5cf26f887744dc41af63b7731551287bb3ef8bd947c38c277783c16
SSDEEP 1536:quV3gvWHQdMq3ORCnOypTAQlyJ+9+nztYwsFF6t7lCuZIDywN7yo47Q9EfIb5:quVQvcQTqypTAQlyJs+nztYtF6ntZIDv
TLSH
T17F836B01A69041FAEBA3C1B5C2679E23FB74F5C11395975F00A6C55A1F333C2AF3AA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_sqlite3.pyd
Size 126KB
SHA256 1decb0ff369a1c314908e0933da663de8aa7732d8bd1472383906d18029cac67
MD5 42f32a4f1913823e034a948a7031ff03
SHA1 a675a6bdeced07cf668ffcc9c7bef2eb9cf3d7df
SHA512 80b84a774369d1a5d0efbbd12bf41746de502b726ecc3d84baed054f1650eda12ede4c00e919abffb49538d43eb43b77cb8e4094950a4aa2ca507e43a165976f
SSDEEP 3072:L+tL+A3/fvE7qxwDcCpz6j5ydrJumaAsXdIDvQ1qZ:LG9k7qxwDLsj5EVaAsX36
TLSH
T1FFC35B2B631400AAE9E75278C1734603EB75B962532153CF55E0C6892F377D3AF3AB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_ssl.pyd
Size 178KB
SHA256 21ca71b2c1766fc68734cb3d1e7c2c0439b86bcfb95e00b367c5fd48c59e617c
MD5 ce19076f6b62292ed66fd06e5ba67bba
SHA1 231f6236bdbbe95c662e860d46e56e42c4e3fe28
SHA512 7357598bc63195c2fd2ddde0376b3ecf5bd0211a286f4a5c1e72e8c68b6e881e7e617f561e7a859c800fe67bec8f4c376e7a6943cab8dacfeda0056b8e864143
SSDEEP 3072:A20jYjQ80NV96LE2fU6CosjLEmMPi1ba+VRJNI7IM/H9o/PCrXuII4oFIDL7Riz:500rklqU6CoJ9PijTT4o8W
TLSH
T134047C47B5805AF7D913E4F9C2234903EBB0F155331157DE48D6EA890F03B4AAE6AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_wmi.pyd
Size 39KB
SHA256 ab87fe4b0cf5b2b17901905ea86367b9756c44845eb463e77435648f0f719354
MD5 e3213cf44340d7b4cb65f7231a65e3a4
SHA1 815e5809a01905ecaa463f6827f657c11b95d243
SHA512 d32b6cb1c5a286b2ce9837051d099fea98f9e5ad00c15b14ccce02b4556d74c4b703b1c94a59670599bf6a9bfbf84c7c22dac25653af9b455999a5e42cf38b7a
SSDEEP 768:/oEkKVVgWOZbY7Ect6PlFIDLiTQ+Eyobo+Y7N2Ip4QTxf1mlWZG8vD8r/+w:/oE9vjk0EctcFIDLi07yo47Q98fIW44w
TLSH
T1AC036C8AE6680046EA67DA75C5A2DE43F934B7D35711938F329586990F233C0E73E329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\base_library.zip
Size 1.3MB
SHA256 fc1d3a4d9009e9489f8eca520d2d96451a1e7e7c0460af58e4e0da7f95057a71
MD5 6a8ca27505caf17db24c96ae98c8700e
SHA1 b355ea1b0eaf9025ad4b6626ffabec81e370790e
SHA512 f85840fadc13b39f767812d820a97d05be553321b40372bc518cdb81b720591a2ce9499dba1d7397a4033c9f480710230dc54830ec675668cec4e5441848bf3f
SSDEEP 12288:m6RjZXKiML+DzGnuOBa80201jwCVRDVoioSYBoXW7Wp3djdTwi2cPPdxhYdptn8W:onzJ7Wp3dZw5cPPdxhYZ7SeT1fJ6M
TLSH
T110550992B9527953FF54F37B80B7484CF32E86A2EF00C207355A42661FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\certifi\cacert.pem
Size 290KB
SHA256 c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7
MD5 234d271ecb91165aaec148ad6326dd39
SHA1 d7fccec47f7a5fbc549222a064f3053601400b6f
SHA512 69289a9b1b923d89ba6e914ab601c9aee4d03ff98f4ed8400780d4b88df5f4d92a8ca1a458abcfde00c8455d3676aca9ec03f7d0593c64b7a05ed0895701d7ed
SSDEEP 6144:QW1xB8fRRiplkXURrVADwYCuCCgT/Q5MSRqNb7d84u5Nahv:QWbiRiLWURrId5MWavdX08Z
TLSH
T196547C964F269C052C9FE1C1CA9B1357DD3A027B99FEF0F1394A2448D24622A17FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\charset_normalizer\md.cp313-win_amd64.pyd
Size 10KB
SHA256 1f8a5173d8bfe6c569e81c738b830800307ed4586d2ae9ac5cc13a468c6e1892
MD5 480b5eb45af69a315bd2c3b1b34459d1
SHA1 e056c3e8b3c4d46163e105e6095703d092676b5b
SHA512 2aefd6356cf6f9ab773e0c19d828c065b41447b0da24c98d0fa2e14b9580e5e7e8f5d3b707e73f682cad85a199f134c42b103740caf3173e8f29e75dadda6623
SSDEEP 96:/70hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFjCQAADoNolycC0:/Yv9XFCk2z1/t12iwU5usJFPCyooccE
TLSH
T17F222A0CFA6148DAEA158178C52B5E0BF0B5B710172273CF4770956B3FB63D6AA3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
Size 122KB
SHA256 437ceb75e7bc7c72c9090558397ef3598b0bc7bc499434af5827028083d300ca
MD5 501b867c424a8e3a41a9be4ab22dbeed
SHA1 97bf5d2c9fa5bb833e739b183a01ce53d19f4a6c
SHA512 38b2d7f2587d73d2edf9cb685ef920ea4c511b88ae9cc25f7fc65d04a87e07ac03024228b9119adfd6914441089cf13ad9d67ff144cf86576cb37d97946677ff
SSDEEP 3072:KopV3pa+bk86Z7dCyV+PdtJ8dHsvGpoA:lUkG6A
TLSH
T166C32A1722950077C96341B98CB36817DBE2F5510B3253CF05A4CBAA6F13BDABEBE611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\libssl-3.dll
Size 774KB
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
TLSH
T108F44BADB3B8059CD8B6C17D86934623E3B6F4553330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\pyexpat.pyd
Size 197KB
SHA256 b93e6083eb06137cc9191dac0d9cf4483e47192113d3ac2228b4549f737bac85
MD5 0351dc34c06a7e74e977c142a8784da8
SHA1 1096bc9b3ae3a57dc7f684d53191df5365889164
SHA512 92caee00cc0588d30659d4b0bde38bf229beab0fc07d9aac362b84814b6ea541c39c03aba936124cbfd5d60c219d01cb09eba8005dd2236774503094cbdc609b
SSDEEP 3072:DQ38C7XURBox3eNAe5XxBpiedxMmiuXTB+qEEWB062lBDG4gPKR5uECuZIDyhiYY:w7XURBNAeyQxMmiuXTkazZldGPPzOEBf
TLSH
T129145B9A71A2C1EBD8938038D6D78E07D7B2B865038097CF52D4EB7D5F27B423A29315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\python3.DLL
Size 70KB
SHA256 4f93342b59addedbe45ebd973e6449ab85b11c0aab6ad7962124e293c5d03638
MD5 98b008be9834bfc362b4c2eef4e8cdb9
SHA1 a4a50ced1329c3986e3c1576f089b25aff5ffdf2
SHA512 d594ffd7d44d4d862475711973df87b08fb63a900ddfd87c7771ad27f0cc71e5fbdce92da4d4ad5856fe3cfb803257ce0b71cd8dc24ca5c421ddb1b9b44c7881
SSDEEP 1536:fotssyKcunV8P2ZIDy0Q7yo47Q9dfITzp:AtssyKlZIDy0QGh
TLSH
T121633CC25B57F8A2D6F669FC78DDD9CE242B02CC57258C9FA47993920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\python313.dll
Size 5.8MB
SHA256 bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749
MD5 501080884bed38cb8801a307c9d7b7b4
SHA1 881b250cc8f4fa4f75111ac557a4fde8e1e217af
SHA512 63d74a4871d1c72c2a79ae8a5d380070f9d2128c16949c3ad36c9862fcc4dab738137ed3d51caf0bc46b36655f8bd8a2d425d68200123415ee8d4de0e1cbebc9
SSDEEP 98304:zS6EtadqkkJdwHSVi0gB+zmvHHDMiEVWI4SS:zt0aMdwNOizI4
TLSH
T17F568C16729D00ACD97B8078CA038A4BF7B27C017F60534BA1E6BB5D2F737624A6E745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\pywin32_system32\pywintypes313.dll
Size 133KB
SHA256 ea82e185e0bed58485a8df23712b62224f5e486dbb84d946115cad17512065cb
MD5 53e3a01abb3ed77219a364445b3f2c97
SHA1 4542d5390aa4cd5ec34992da4d7118b52d2f8bf7
SHA512 6605ed1550b8d7fe8b72a6ddb25c17298807f497bcf681c3cac2dcb3b128d4c9da2b5f2b209e345181d276da4729eed313284c807997541f7f4dbc72b0ea0ef1
SSDEEP 3072:0dyqdYmyWa5br4d1qfGHrY/rZ6Yr2laFU4LGUgl4jptIaiTa:04aYlWa9r61LrY/rPbFU4NgOjptI
TLSH
T167D33A47378684DAE96A937DCD771A02D3A2B0100711E3CF46A1C28B6F637E66D3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\select.pyd
Size 31KB
SHA256 baee284995b22d495fd12fa8378077e470978db1522c61bfb9af37fb827f33d1
MD5 2663e22900ab5791c6687a264473ae1e
SHA1 d8db587b6c632200ae13be880cc824cdc8390df9
SHA512 5f29ff4288b9db33976f5f79b9fd07c4900a560bb41fe98c93a33da7a36c0981ffd71f460e81e13e4f6a2debafa6d9284bc1a728734752ba5ad5fbd766659e80
SSDEEP 768:yCyfHfPpZZID9GaQ+Eyobo+Y7N2Ip4S66Cxf1mlY6Cr:yCyf/PpZZID9Gj7yo47Q9S+fIir
TLSH
T1CBE27C8F6A785087EA93C6B181A2DE43FC39B793861182CF30A5D59D0E537C1B73A359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\sqlite3.dll
Size 1.5MB
SHA256 aba94c2a103e9ab331466823c28217c6fa00f4280ed7f3502c11f5aae71c5814
MD5 08db2deaee0e45043461325310e1cd0f
SHA1 e557691bca88edc4a1ec664b4a4b052eda76c7c5
SHA512 794979ce457c8eaa946a2034d06eaeef22aed264bd3a684927b30065448b1e49d5cbaf06e9fd7ef2da31ec808bd310bff0e143fa41988fa45de6713cbb6bae7b
SSDEEP 24576:/sQ1ZE1JGDqFjmJNO4keGLHe0UJPChzwI5ajkgohxOw6nTs+Zv5YOH:PkjmJNOMGLHe0U1awI54kgohATs+J
TLSH
T10D658C4BF2B801ADC0A7C1B9C91B5707EBB274051770A7DB5590CA696F23FE217BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\unicodedata.pyd
Size 694KB
SHA256 a67eec238162fde20ac24ca7df931792734aad0611be22d1b3a71bc15acf72f3
MD5 c0b4c55ce3711af914b2015f707e4452
SHA1 f1c1e9f8a461cfee1199d2100f5c0796733518b6
SHA512 fa6bd9223898ef0c54ca9a67b10207bfce152eadbaec4c91d4e951d0790f455066f5095ed739fa2452aea1420d154beb00bfa9e6e10b46bed687c5d0d7484900
SSDEEP 12288:6YidLI/X77mvfldCKGihH32W3cnPSqrUgLiE:6YiW7qNxr3cnPXLiE
TLSH
T185E4F5D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\wheel-0.45.1.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\win32\win32api.pyd
Size 135KB
SHA256 040d6a9ce12555d2585f89dce2aa4e25265c27dfa827eb9cae4c922e12ec731c
MD5 be180d10694c90e0b3e477c30b7620c7
SHA1 17dd8031f0008a15f4003d228d0661de5a8ae5ab
SHA512 c69c10c3ac8361ad682111d1f40c13f7736c2422967fdda2e0ade35a1bb970bff5d48bc17d8b6f0341963652425bb36b40a0d02108508b3643c6e9e58533ccb3
SSDEEP 3072:87AK00RjZk+uEIvPlRVlhLaN/PSexhlT9qTmP9bDm/GgUXJke:YAF0fu73lRVsPSexhbqyvcGg0
TLSH
T114D30683B35410C6D86AA37C81675F23DB72B8240725A7CF06A0C68A1F63BE97D3D795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32gui.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\win32\win32gui.pyd
Size 218KB
SHA256 b021c6ab915fd9370c659aebc90db1b52b3da7ccf61420687d40ff7eb813f20e
MD5 4d7b6ae4170817e0e2c51a5583793620
SHA1 044d4f741ec86fe300b0e84ac8ad9df65cd8a74f
SHA512 7ebbb43a4e2bca8871f9337ff152d1084fe7d9e85c6eaa00f2e7dc1e611ea20b1daad9cbb6e8c75fc75dc78f847ae200dc37a434dbc328a28207a2e390c0d399
SSDEEP 6144:d17Q3m78ggkAMXkfKVLEY1/H3ScssYJt:d1Qm72MUf8Qk4J
TLSH
T1E524D497B2955095D86AA1BC895B5E27F1B374300320ABCF0630CBBA1F1B7EA753D784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32process.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\win32\win32process.pyd
Size 52KB
SHA256 05dc1c58c825d0282194b34ff519b3fe29083324b59e0ff06d73f0ed8c890c98
MD5 3182f71b9be2e420fb187c323e0d8636
SHA1 830f0554036178bb5873c556d8a9f6bee5fc0a7f
SHA512 c42001bad73c4ead747e8e7f1e132e56c0cf6ef3533533a827454135ba711e915c8bc45013d8a75e59de869bd517f242dd81873cc2972bece5c0c8f3b7a07936
SSDEEP 768:Brnr85sP0wkx+Z6sBJlnxPRyY0EJdsJU0w7oTrjIKbr:BrrbM38U8JXwY0EnsJU0/fjIKbr
TLSH
T19A33179AB39900D9D89AD1F9C4375F13E5B2B8240761A7DF0260C68A1F237E4B87D794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32service.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\win32\win32service.pyd
Size 59KB
SHA256 d96382dc23bfe1024feae356d171ad0f00dbc77861dd08c793f4c545b1cc673e
MD5 22f2ed21cd94ff52b0c39f13b2649279
SHA1 3f0ba6142cbd401aed24ba7b070154594ab2b353
SHA512 e75e538c8fa7407aea7eb34c40b0aa2bd092e47f13808bf4af2f77912f3440c367fe1f193b38d786be75db0ca540a79095523a2cf5967cf377eb9d2409cbb938
SSDEEP 768:Mge4AlG2r4Hkps4dsXJERz66QYPsbZtym/vN6XKNuSs7jN:Pe7pZxWJERz66jkltv/vN66NuSs7jN
TLSH
T1BC43084BA3A611E5E82AC2FCC5631F53E676B804239176CF43D1C6491FA36C47E39B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.txt

Path C:\Windows\data_20260810_162451\cookies.txt
Size 80B
SHA256 1f2c2beba3dc704a8131dc090e1e05d9155c5ef7f7627d6b0ec47c3bcaf82e4e
MD5 34ed8227ad220b4fd6d931778def8e23
SHA1 fd21b8f4c013f7bb612c7934f8f833c061d3ee4e
SHA512 6ba8b4fab449723dd90a7d9ee0ba70dcc6f3f2a59b8ed631ba425c79cb93a417c593756e5b9c1d0eae62e4b18299fb13ba4c35146f67abe9b6c82c4341accd4d
MD5 SHA1 SHA512

Submit Download

history.txt

Path C:\Windows\data_20260810_162451\history.txt
Size 107B
SHA256 01e6500189e0f2dda9f0bdd95fbe24e8f4065ad30e728b5c41613a82bda2e7ef
MD5 586f227f0515726248011915977d0971
SHA1 1192150d1e17bb0dce4ea31a59c5ab9ac386e73d
SHA512 0190f9b979784c1b6d05748ee23e8af6b7a6611383987a86b8b1accff20a02d4e0800646e0d62d57f8727c0b4f9b71b2f21fd2e9647a293af3586f7b667c8169
TLSH
T13DB0023F48117560782C593D6E934B98E9137521471A515B54D151000EB1B6C1F85000
MD5 SHA1 SHA512 TLSH

Submit Download

passwords.txt

Path C:\Windows\data_20260810_162451\passwords.txt
Size 85B
SHA256 8d5466830c4f9add5a3a1dd3d7911a09d54a2093c6a9a399db2c1e8b18de1376
MD5 4a6602caed4ad7e6b3785fb070e03430
SHA1 91fe9deea60f6f50791fe5eb838c278addcb9388
SHA512 9657ad1416e13ab722e25f05fedbfb2a57a86d3ed010345fd3b4f3872b7331ef88808f5cc0e683997e801446d8d2135887e9390c171cbc0151dfa7c47c31c804
MD5 SHA1 SHA512

Submit Download

tokens.txt

Path C:\Windows\data_20260810_162451\tokens.txt
Size 85B
SHA256 0b8309ff19a019291b24b6b7601e940e5970e7374f2189dfbb66d6c26efc7eee
MD5 035a9a035f05a32488df19efc3857623
SHA1 999eb3b7411d79c800db3efe12be6e3d31211cca
SHA512 5b536059af46e5b0c4342ea2951dadc6cc4562170b6d6d85fcb622ad26167e139a9a1836b79639c3d4ddf8a67439d2b8bb9d72564d42c6d2f3960a3939edec1a
MD5 SHA1 SHA512

Submit Download

wifi.txt

Path C:\Windows\data_20260810_162451\wifi.txt
Size 32B
SHA256 5406e2da86b8db28037fdf9856f992127a8353f12174a32256bb4b9bc60a40bb
MD5 ac2c07c3850237bc3525947d59a5a2c3
SHA1 d9d5b69d10a014315139cbae01143f835a7d7708
SHA512 f8e216993e7ad3d659f9fb5e91126890559142c0aa2ba6657192a824071a94cd32c12206e27163b7d8f378e94882b654dbb20f3d3651bdc4ba047e6deb36cdf7
MD5 SHA1 SHA512

Submit Download

devices.json

Path C:\Windows\devices.json
Size 125B
SHA256 87556044cf55500a37d93b53f089f9db069a9f5a7616086c49713bf01df15557
MD5 cb5fc7554101599051ffe6fe45976980
SHA1 575490304c74346aa2d84976e9551d59b07e5310
SHA512 d2b87b2c0c77dccbd0cee043fc34194606b7e2234b4909c3daaaba5e602df5001d177f9ee29766382f0def04bc301bb31f3d737c9e8569b0486f21c0e5ad0a6c
TLSH
T142B092B6C8A68D9358B842A9A5368212BA21672B20550C45B37E0D486E616256885E49
MD5 SHA1 SHA512 TLSH

Submit Download