ee2e195d098256a159a04d20e3fac620ec6e091e1315c535281b91ef7199b7b3

Analysis

max time kernel
19s
max time network
43s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ee2e195d098256a159a04d20e3fac620ec6e091e1315c535281b91ef7199b7b3.vbs
Size 23.4MB
Sample260808-2b57wsff52
SHA256 ee2e195d098256a159a04d20e3fac620ec6e091e1315c535281b91ef7199b7b3
MD5 2e56e7f1513fd58e3e420144909b6688
SHA1 19e374b19c039857538cef2df01fe9286ccf2b7d
SHA512 e75c22abed408d09e5d4e7f805c0033f5783532294fcc0d9cbdf48b3ea7ff8ac380377fa0bcf4fb1d2d771a188f6f6050648ebba7b3c14e38493c696327f716f
SSDEEP 49152:pg0BNnlRGnda82yNGOEFo4cNrLzFRadA9hQrtzHdFXVbCdxt3IawVyqDrmnDHRFf:2
TLSH
T1F33712E0AE942ACC19B147F3B4B9E2E0E86217F7DF418E1B0141D977E9B44CF9A35912
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5976	fwupd.exe

Loads dropped DLL 33 IoCs

pid	Process
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe
5976	fwupd.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
832	cmd.exe
5324	certutil.exe
5168	cmd.exe
2572	certutil.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
2208	wscript.exe
1616	wscript.exe
1816	WScript.exe
3776	wscript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\fwupd\share\locale\hi\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libssp-0.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\liblzma-5.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\hu\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\sv\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\bg\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\nl\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\pl\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libssl-3-x64.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libgnutls-30.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libreadline8.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libffi-8.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\iconv.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libfwupdutil.dll.a	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ro\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ky\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libcrypto-3-x64.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libnettle-8.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libfwupdengine.dll.a	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libfwupdengine.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\uk\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\sk\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\lt\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\cs\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libgmodule-2.0-0.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libxmlb-2.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ka\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\kk\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\sr\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\zh_CN\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\fwupd\quirks.d\builtin.quirk.gz	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libxml2-2.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libcurl-4.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\pki\fwupd-metadata\LVFS-CA.pem	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\fwupd\remotes.d\lvfs-testing.conf	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\fwupdmgr.exe	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libfwupdplugin.dll.a	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\sq\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\sl\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libunistring-2.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libgmp-10.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\fwupd.exe	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\dbus-1\system.d\org.freedesktop.fwupd.conf	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libtasn1-6.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libssh2-1.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\pki\fwupd\LVFS-CA-2025PQ.pem	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\fwupd\fwupd.conf	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\tr\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\si\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\fi\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\dbus-1\system-services\org.freedesktop.fwupd.service	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\pki\fwupd-metadata\LVFS-CA-2025PQ.pem	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\gl\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ko\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\lv\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\da\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ast\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ja\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\dbus-1\interfaces\org.freedesktop.fwupd.xml	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libsqlite3-0.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libzstd.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\pki\fwupd\LVFS-CA.pem	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\fwupd\remotes.d\lvfs-embargo.conf	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ar\LC_MESSAGES\fwupd.mo	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{76493109-E6AB-5C48-940D-49544A688596}	msiexec.exe
File created	C:\Windows\var\cache\fwupd\metainfo.xmlb	fwupd.exe
File created	C:\Windows\SystemTemp\~DF8727340190279291.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCE9BA3807B396D45.TMP	msiexec.exe
File created	C:\Windows\Installer\e59931e.msi	msiexec.exe
File opened for modification	C:\Windows\var\cache\fwupd\quirks.db-journal	fwupd.exe
File created	C:\Windows\var\cache\fwupd\quirks.xmlb	fwupd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFA650DA30C841704.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDE6C306A9CBD8955.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI960C.tmp	msiexec.exe
File created	C:\Windows\Installer\e599322.msi	msiexec.exe
File created	C:\Windows\Installer\{76493109-E6AB-5C48-940D-49544A688596}\fwupd.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{76493109-E6AB-5C48-940D-49544A688596}\fwupd.ico	msiexec.exe
File opened for modification	C:\Windows\var\cache\fwupd\quirks.db	fwupd.exe
File opened for modification	C:\Windows\Installer\e59931e.msi	msiexec.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000d00000001c51f-182.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\Setup_35096\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\PackageCode = "616DB7C281FC3CA4D995B5B0DBA4A5A1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\Version = "33619974"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Setup_35096\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\90139467BA6E84C549D09445A4865869	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\90139467BA6E84C549D09445A4865879	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\90139467BA6E84C549D09445A4865879\90139467BA6E84C549D09445A4865869	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\90139467BA6E84C549D09445A4865869\Complete	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\ProductName = "fwupd 2.1.6 (64-bit)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\ProductIcon = "C:\\Windows\\Installer\\{76493109-E6AB-5C48-940D-49544A688596}\\fwupd.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\PackageName = "setup.msi"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4736	msiexec.exe
4736	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2824	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2824	msiexec.exe
Token: SeSecurityPrivilege	4736	msiexec.exe
Token: SeCreateTokenPrivilege	2824	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2824	msiexec.exe
Token: SeLockMemoryPrivilege	2824	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2824	msiexec.exe
Token: SeMachineAccountPrivilege	2824	msiexec.exe
Token: SeTcbPrivilege	2824	msiexec.exe
Token: SeSecurityPrivilege	2824	msiexec.exe
Token: SeTakeOwnershipPrivilege	2824	msiexec.exe
Token: SeLoadDriverPrivilege	2824	msiexec.exe
Token: SeSystemProfilePrivilege	2824	msiexec.exe
Token: SeSystemtimePrivilege	2824	msiexec.exe
Token: SeProfSingleProcessPrivilege	2824	msiexec.exe
Token: SeIncBasePriorityPrivilege	2824	msiexec.exe
Token: SeCreatePagefilePrivilege	2824	msiexec.exe
Token: SeCreatePermanentPrivilege	2824	msiexec.exe
Token: SeBackupPrivilege	2824	msiexec.exe
Token: SeRestorePrivilege	2824	msiexec.exe
Token: SeShutdownPrivilege	2824	msiexec.exe
Token: SeDebugPrivilege	2824	msiexec.exe
Token: SeAuditPrivilege	2824	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2824	msiexec.exe
Token: SeChangeNotifyPrivilege	2824	msiexec.exe
Token: SeRemoteShutdownPrivilege	2824	msiexec.exe
Token: SeUndockPrivilege	2824	msiexec.exe
Token: SeSyncAgentPrivilege	2824	msiexec.exe
Token: SeEnableDelegationPrivilege	2824	msiexec.exe
Token: SeManageVolumePrivilege	2824	msiexec.exe
Token: SeImpersonatePrivilege	2824	msiexec.exe
Token: SeCreateGlobalPrivilege	2824	msiexec.exe
Token: SeRestorePrivilege	4736	msiexec.exe
Token: SeTakeOwnershipPrivilege	4736	msiexec.exe
Token: SeRestorePrivilege	4736	msiexec.exe
Token: SeTakeOwnershipPrivilege	4736	msiexec.exe
Token: SeRestorePrivilege	4736	msiexec.exe
Token: SeTakeOwnershipPrivilege	4736	msiexec.exe
Token: SeRestorePrivilege	4736	msiexec.exe
Token: SeTakeOwnershipPrivilege	4736	msiexec.exe
Token: SeRestorePrivilege	4736	msiexec.exe
Token: SeTakeOwnershipPrivilege	4736	msiexec.exe
Token: SeRestorePrivilege	4736	msiexec.exe
Token: SeTakeOwnershipPrivilege	4736	msiexec.exe
Token: SeRestorePrivilege	4736	msiexec.exe
Token: SeTakeOwnershipPrivilege	4736	msiexec.exe
Token: SeRestorePrivilege	4736	msiexec.exe
Token: SeTakeOwnershipPrivilege	4736	msiexec.exe
Token: SeRestorePrivilege	4736	msiexec.exe
Token: SeTakeOwnershipPrivilege	4736	msiexec.exe
Token: SeRestorePrivilege	4736	msiexec.exe
Token: SeTakeOwnershipPrivilege	4736	msiexec.exe
Token: SeRestorePrivilege	4736	msiexec.exe
Token: SeTakeOwnershipPrivilege	4736	msiexec.exe
Token: SeRestorePrivilege	4736	msiexec.exe
Token: SeTakeOwnershipPrivilege	4736	msiexec.exe
Token: SeRestorePrivilege	4736	msiexec.exe
Token: SeTakeOwnershipPrivilege	4736	msiexec.exe
Token: SeRestorePrivilege	4736	msiexec.exe
Token: SeTakeOwnershipPrivilege	4736	msiexec.exe
Token: SeRestorePrivilege	4736	msiexec.exe
Token: SeTakeOwnershipPrivilege	4736	msiexec.exe
Token: SeRestorePrivilege	4736	msiexec.exe
Token: SeTakeOwnershipPrivilege	4736	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2824	msiexec.exe
4736	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 3776	1816	WScript.exe	89
PID 3776 wrote to memory of 832	3776	wscript.exe	90
PID 832 wrote to memory of 5324	832	cmd.exe	92
PID 3776 wrote to memory of 5168	3776	wscript.exe	93
PID 5168 wrote to memory of 2572	5168	cmd.exe	95
PID 3776 wrote to memory of 2824	3776	wscript.exe	96
PID 3776 wrote to memory of 2208	3776	wscript.exe	98
PID 2208 wrote to memory of 1616	2208	wscript.exe	100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee2e195d098256a159a04d20e3fac620ec6e091e1315c535281b91ef7199b7b3.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\ee2e195d098256a159a04d20e3fac620ec6e091e1315c535281b91ef7199b7b3.vbs" /elevated:1
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup_35096\m.b64" "C:\Users\Admin\AppData\Local\Temp\Setup_35096\setup.msi"
    3⤵
    - Deobfuscate/Decode Files or Information
    - Suspicious use of WriteProcessMemory
    PID:832
  - - C:\Windows\system32\certutil.exe
      certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup_35096\m.b64" "C:\Users\Admin\AppData\Local\Temp\Setup_35096\setup.msi"
      4⤵
      Deobfuscate/Decode Files or Information
      PID:5324
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup_35096\e.b64" "C:\Users\Admin\AppData\Local\Temp\Setup_35096\payload.vbs"
    3⤵
    - Deobfuscate/Decode Files or Information
    - Suspicious use of WriteProcessMemory
    PID:5168
  - - C:\Windows\system32\certutil.exe
      certutil -decode "C:\Users\Admin\AppData\Local\Temp\Setup_35096\e.b64" "C:\Users\Admin\AppData\Local\Temp\Setup_35096\payload.vbs"
      4⤵
      Deobfuscate/Decode Files or Information
      PID:2572
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Setup_35096\setup.msi" /quiet /norestart
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2824
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Setup_35096\payload.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B //NoLogo "C:\Users\Admin\AppData\Local\Temp\Setup_35096\payload.vbs" /elevate
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:1616

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4736

C:\Program Files (x86)\fwupd\bin\fwupd.exe
"C:\Program Files (x86)\fwupd\bin\fwupd.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e599321.rbs

Path C:\Config.Msi\e599321.rbs
Size 30KB
SHA256 c2be6c8fb42e4e05a8c775fa909d238c729d6d61541a0eef1e2a111c9023e2ef
MD5 4fe9df9ebc1bdabc3ff0cc3ac4955a6a
SHA1 0a923fc136b38d1801d3119ecc50c216a658e993
SHA512 ca6a1c242d74f94a990220336daa82e26d5a037af2852778f4ff29644f200d9c61878b6f3219baf617bd168c8cacedfb937a886ad0e2aa1d308c87b8fbc3e2d8
SSDEEP 768:ebp/i/KMLtTvhdSG1sjeACFJqUFaeIteP7XviOpohGmEOnP+bQqP1bakW7hTOOK8:2p/i/KMLtTvhdSG1sjeACFJqUFaeIteY
TLSH
T161D22F405C07D5C2F246ADA2B7D36C24C758FE2C6B744CAA40CA872F9DC0B56BDEA4D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fwupd.exe

Path C:\Program Files (x86)\fwupd\bin\fwupd.exe
Size 158KB
SHA256 ba9d0931ada5b2ed07fc0fb8c15554d70483ad1f75901bd1e93384a94ee7821d
MD5 ddd0814fa2844d786c2cf4471ae593f5
SHA1 8382bf2ee69faebdf91ab540835778aba50cf3d4
SHA512 b8467de53285bb0ffa3b144dd0069b89e5773c0a135b4295a38b627fa7ddbb04731e4e5f5684ed5d5485b34ac57dcffbacbe3ba7c764ad19c7749fa8de2c5c81
SSDEEP 1536:WK846crJrtLqU6vEHEhEhak3OsoK/GkZu+4edNBrWeuhFqH1SRSshBbQKjvzv:WK80rT+8Qgz3OsN/n74epYhFq/2vzv
TLSH
T1BFF380E676D45CDAEA15827C809BD231223CF5E0C2229F1B653037361F52EA23DD766E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconv.dll

Path C:\Program Files (x86)\fwupd\bin\iconv.dll
Size 38KB
SHA256 3ffa5bc870ddf20abb6fbf6e933f93f42ef30ebc075b1264cd3e01609c831b43
MD5 a0f87d78421c93e9d8a5769bd59c3f90
SHA1 e87040c74ef71200fd2d0a062a7574a3f4db1d30
SHA512 20f452f2c499d73f51532d97e87eb8cb0cf77199d4a63e65c4da9728d59377fb761798c1a15c080081311f063d10e1b360b882d517872641c32eb23bb6456710
SSDEEP 768:6c8moRCodDmZjjQckQOTi1T+A1jmFQw7WrKj3N:6DCodTckVTYTjeQfrKj3N
TLSH
T1E9031925928D5C5EED57D338A9E747327538BC222633E72F0610E6715E236E05F3CA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Program Files (x86)\fwupd\bin\libcrypto-3-x64.dll
Size 4.8MB
SHA256 2d332cb7aefd59387e00a4ae24391e317826890299c3aea5cd03bafc933e1d9f
MD5 25de73fe9b3f90c79a7b977c40f5a1a4
SHA1 d3c6aac98742dc0337a887b00d2a9894a065532f
SHA512 c5f7345154f23e8534af5d0c37eddff493001f165563b03eb392324d9b8c2ca5df6ee3ef54aa0ed516bb6eb37d8c55817ad0e93f69603e01904fd1fc032b5d7c
SSDEEP 98304:6TLdZnVQ4+EOF6CVNERt9GmZByabpZ11CPwDvt3uFXZC55C3tv13uFnCPwxU8ibq:YpZSG7ZZh1CPwDvt3uFXZC55C3tv13u1
TLSH
T113365B2BA07F285EC95BA2B0C2E79B337534B81013B57E7F6A14DBF01E11D9017AAB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl-4.dll

Path C:\Program Files (x86)\fwupd\bin\libcurl-4.dll
Size 814KB
SHA256 094d6a069e4434baa5f5e7f9317f196be1c48b80a3f154b7f448f702bc109cd6
MD5 8e15a01c3422f33307e43d281f5b68b3
SHA1 5a923e4c2960b2ca9db3977274886e2e04557ced
SHA512 556c2ac80235cf9018813b9a02744e2f80fbed305ce3ca2c3c17d6d86f80944608d757dff782fa4040c7c15de664c5d63eee1c0528ee11978c465c4de1404c6f
SSDEEP 24576:d64Gpw3Ak86NtzyYzfcM46R6mpUiAAAAAAAAAAAAAAZACAAAAZAALAAAAAAAg9A3:d63w3AoNtOYz01mqDW5o
TLSH
T161055B2BA29328ADD56BC334D2A797737435B8152231BD7F5664CB302E51ED0233BBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Program Files (x86)\fwupd\bin\libffi-8.dll
Size 36KB
SHA256 d2dcd97bfe809da10cc055c03067b5844dd06234c8b445f7ab70942469f0bd58
MD5 325a54a0fdeb7b139d8e3e72c6d342a5
SHA1 3780955adbcc59249b2991be4c569754985890f8
SHA512 fec5f303bea8be1c4c62f1d1436fec00dc85a6e395ae1167bd0e26786386f5ab22d0030436db3cadd4d6b163d18a0ebb49ab8cc8d8b284c93cc40028e52fd89c
SSDEEP 768:14aI7eqqUio1etGI8MVGxVekKMz7m7HXyQ:JtpbaekbXY3yQ
TLSH
T19EF2191A6683A97DD94BE334A5F38772E138F81117326E3F05A5E3311F166A00B59F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfwupd-3.dll

Path C:\Program Files (x86)\fwupd\bin\libfwupd-3.dll
Size 619KB
SHA256 93c1618514cd1d9f3d43ad9f8e4412bf9bdadcf6a22d65b1c21e4dbbc2cf5bd4
MD5 506cc250abe9279d5d9044cce104d6fe
SHA1 2ca165f45d182bb12a6cd54de551255b8d9378c7
SHA512 48720067cee438b7678bca47da07cc9fe6ccdedf2226a6bd870005688ca51f68d58247a205a00818fd9f3f9476f7d354f6f390f97e3db966480432accd65e4fd
SSDEEP 12288:NDDRipYzljeijA/IdFNDBSlOQRSCaWnpxszPUUB+:NDVJjSIxeOQRTpQvU
TLSH
T118D4D82A10D51C5EFD3A8235C693E7222078F5684372FF6B9420C6357F91DB1E6AEAC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfwupdengine.dll

Path C:\Program Files (x86)\fwupd\bin\libfwupdengine.dll
Size 3.2MB
SHA256 cbb9812033f97527e69303384725971d613e6028542411304457cdcdf85d297d
MD5 e8c0f1be05c553de2d83b924fa5c833c
SHA1 5bf56b07ddb7e6f9d75eba4d9f49418cffa41e58
SHA512 a75d518d3e4c715f615dfa2ef3b98894881a2eb21927fcc56297e30adbd0e378e066b8dae52768f4440d883531a18c5b7ceb2408dcacee16db93afa03c2bd5a8
SSDEEP 49152:gV4gBbvYS7ujkKGSgqEdFEauBdBO+ggfzLMtlC4bJ2tzdyOKv7jGKf4PetG:d8nKPO+tLM3hbJ2tdKTjGKf4POG
TLSH
T17CF53B27B1B698DDC9E6827CC29AE3333578B5944735BF7B742446312F01FE016ABA48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfwupdplugin.dll

Path C:\Program Files (x86)\fwupd\bin\libfwupdplugin.dll
Size 2.0MB
SHA256 2dcb508a993fad2fc8369d404c37d1b826a8ca192d4aeb442af66681a8abaf4e
MD5 5f0a8229c81cf2ab53385c63a222bb3b
SHA1 446662b0a07f12589e05e6e5a9211cde9908d050
SHA512 b82ca38e9f8e256f8dcf75c73ed43e05ca251ae261c907e86cdc2b96d1795e948b25fc738366d19e15a8c9addda36379a51d98cf1fffed6c2cddc4da5fd3a370
SSDEEP 49152:rwv+xkCKWEI4alqKH3H0X1Z1/6f/ZqsKfTHInJjwy+HcL/Xq:M6AC30rfIJjwy+HcL/Xq
TLSH
T148A52B2761E6988DDDAAC23CC1DBD3222574B1640331EF7BB42486353F51FF116AAB89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_seh-1.dll

Path C:\Program Files (x86)\fwupd\bin\libgcc_s_seh-1.dll
Size 912KB
SHA256 bf204c248ccea9a2ad76d55fc6277b9145fa67cfa0a85e480b8762a3ccf8462e
MD5 9755454c3b9cd2d9aece37bc9dce2cdc
SHA1 511d6622ee70ed15908f172cb2a257664dca4113
SHA512 e37ce040d48a73bd8aa66668561e8c942286975a5a5939f5261bb1692866e6bd11bc5e52dbfdcf90056a0e67a646eee68063b209608d18d196b311ad4395e020
SSDEEP 12288:0LRM5cS5UlCwUelfRCoJtoSqUQf35abh6Nr+NaAGjE1:KR5S5Ul7UelfRCoJtoSqUQf35b+YjE1
TLSH
T1C2156B81B78DF09AC43101B16A9743675330B58533AABA2BBE6A7734CCD33D9DE446D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgio-2.0-0.dll

Path C:\Program Files (x86)\fwupd\bin\libgio-2.0-0.dll
Size 2.0MB
SHA256 0e543990bcff8bf923f2cd234d54b9cce4a0002d83c9e8a58f182b5777f53a3d
MD5 516445f9a37711f01f849addf9900855
SHA1 4025df37eccdd5b6343e40d52307777146085665
SHA512 9a96827b4c13b98a8d3a05663f80bba49e52c49cdd64ece5af1264e4c64963a5e4938252f1977469f3d1b3d111856fd050a014d78b18f86dc1b7705368f891b8
SSDEEP 24576:rUV6l888A99P3P87rPcMWl4AEvZWSt8WgUm94qIPSaM:rw6l58APP3PEKl4hZWSt8RF94hPSaM
TLSH
T1FF95372B9293680DCABBD270819BA7237574B8141332BD2B5924C7357F32FF1469BB49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglib-2.0-0.dll

Path C:\Program Files (x86)\fwupd\bin\libglib-2.0-0.dll
Size 1.5MB
SHA256 24ce9cdec4325956da58a5bbf349d123d42f4dd7900658fb783e8ef86d0232a4
MD5 45e1fbd75a9e95bd720ddfa60cdd7bbb
SHA1 37ba8087c784eb0139cb500510e052177540e53d
SHA512 f8371491805f69ee76542f7f6572686c53dd2db4e89e113049c89480d5d44589c26b64e45c6b87ef1be46f4bde3908dcde2d06d29e7562eeea3a85aec922faa9
SSDEEP 49152:znLHqHvO0JO13LVfBYFDrPBtvOe3UZ3ixd:zG/JOtLVfBYFaZ3ixd
TLSH
T1A875181BA28678AFE75ADE3485E6A7B3E530B4140F33787A2D5CC7341E2DD92021AF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgmodule-2.0-0.dll

Path C:\Program Files (x86)\fwupd\bin\libgmodule-2.0-0.dll
Size 28KB
SHA256 2f0b4c65abb9c38918fae9a4182b9fbeb80ae0faf9cdb58d617142ebff7b3df7
MD5 d8d77451d5b362c69bb7fe1ef7ddd90d
SHA1 ee9daac914aa4e3f59db99a4713088ed270b1c48
SHA512 64c5b24d258a7257dbd95cef8836359e33b71754e57226a632401dc20c9fc17cc00426b4f148d28e216af815a7ebf73bc02bf9e8f30529e549269791ab4b56b4
SSDEEP 384:z7VjTyhZKi8RLqlpVeesenku8/FP7sisjsKSAe4lbQPWSoMLNz7:fiLOLqljJsIkdjsiQlBQPxTNz7
TLSH
T132D2F82B7245645FC85AE738F4E75332B63EB4161772EA2F0358C2B05F723B04668B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgmp-10.dll

Path C:\Program Files (x86)\fwupd\bin\libgmp-10.dll
Size 569KB
SHA256 024193fcb2c773cacbfc93cbfefbdc6b0754643c2af452e5d4c885c1659a148f
MD5 8e59175d09ac0860d6c529da0429fcb7
SHA1 d07ab371ae478d48f924593a6bacbf8052ae743b
SHA512 c8a5bacd594b13fa3fe6679e91e2c7a74bcc8d8dcfcff8abbfa0345d2433c78189024bdce6f8e2807120482a483b000a047426d4ebad070dbffe22d90a11d29f
SSDEEP 6144:O6VjI38Y2CbUbe9sYWwt4b4ZarI2bgZNhm1zz7q37xbj/qxVPTzHabTUOR98qjQu:bM3sC6e2wt+To/aP7JVvAUqjQmXJJF3n
TLSH
T1BEC43A37D143B8BCD66BE37067ABCAB2B131B8620534BD370690D7711FA5EA01B18B65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgnutls-30.dll

Path C:\Program Files (x86)\fwupd\bin\libgnutls-30.dll
Size 2.3MB
SHA256 3499422bda726d2d145c7b6bde2445f61291376f0a3b33b4a8936805f220b002
MD5 7e6ed51d64748c5fa2c4674bf40f8a29
SHA1 52af1e53f61c413ef797cf718cc7b1f832985870
SHA512 cb61688fcdfce2584faff9c3d17532ffe496ca2345aa5c037133e74d49b1d2b7767d6fc95cada86aaf69f29efa66eaf37b979a05fe49552bf827cdced7d4a0fa
SSDEEP 49152:ZYSF3AMNLZoKteRXPpSKGr3EKFcFMsnmGtlqd6BmdEAFXk2XAxO5qNKi7f:KSF5a/dQAg6BvO5qNKi7f
TLSH
T1C7B52902F5D2A99CD937D634CA53A27372737C20AA71EE776E44F6742E31EE0061AE14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgobject-2.0-0.dll

Path C:\Program Files (x86)\fwupd\bin\libgobject-2.0-0.dll
Size 385KB
SHA256 06f62ea3c54fc3362ae7da7559fac75979789d287590b808a3214c279240752a
MD5 e21d54542c93daa02b7bee47f4e62855
SHA1 c92134a4581dee30dd27b99d6be4d0f2b708cfbe
SHA512 1d8404355b6581b23aba5a6b0cfb184170520d83c92c3b8d9da55d7ddf0fae516cf5ddd47d980ee999cc650e009f838323afa1fd34f295ead0d62daefa0268df
SSDEEP 6144:2TJHY6Zq24jQgfBxl/CuqkM/k7fD23uK7uf8xLgvkPlviEt0L/1uqccm8bneriKC:m8Q4BxoIM/kTDySgi4au5V74x+Q
TLSH
T1A8845B2BB3023C2DC99BD1748187E7237275B42823737DFB56A8C7705D25DA19A1AF0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libhogweed-6.dll

Path C:\Program Files (x86)\fwupd\bin\libhogweed-6.dll
Size 257KB
SHA256 4a169d2c8c77074a510e1d30d67e232128fa35ca023537db9d48643cd47198ac
MD5 cf57f987f1c0415724bc417558c2bf34
SHA1 34d52807dd7ab48793699d083f843c833d87c34c
SHA512 5c4ec0a969880e5ef0254376df07973bcc9320a48cf6df059dc3f1a6fe7f3013408aea389b68636722e52d67edf2fe33f79c0c6aff6d5d8b79655c932a26ea6f
SSDEEP 3072:3RMFadPgVttrKqrBRM2RolESlKXzmfwD2sHurSD0rn0xkxbIzwo/5IkanN/:3+V0q7ZcrlKyfwD7HurSQICytanN/
TLSH
T19044AF23C2895CBEFABF6330AA9586732130FC901EF5DB5B1614E6743D72EE04E15698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libidn2-0.dll

Path C:\Program Files (x86)\fwupd\bin\libidn2-0.dll
Size 397KB
SHA256 c60419fd629c8f7c9d469ce0446c45f8e1f653057e4deaf1b76ceff747c0451c
MD5 8b23d4a8d5cc8412f594e6954990f3b7
SHA1 8816973ee7afb8b0804af5806de7aecef1dfed7d
SHA512 6613055ab512e5f438858ced752b2a30bcdf5a0c6bdf317bf7324b17a4f2a91c7ebd19b4324e2dca4644ca08948d2d67b0ef322450a88e658db82e1932cb5f5b
SSDEEP 6144:NnlCDxHQQqBsDwSs4SpHAhIvdEcvH/ukLi3gep3Q0:SdwyIrIYkgep3Q0
TLSH
T14B84FA52FAA2D06DEE2B8132A4975B6303927C719EB38757B71CF6AD6C37ED00D4050A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libintl-8.dll

Path C:\Program Files (x86)\fwupd\bin\libintl-8.dll
Size 223KB
SHA256 24b3bf5b2cad29ec390f17277d48e7aa900b84eb903ef9e7a8a204b769256ff6
MD5 05a76362798afee25d6b2c4bf8c30b90
SHA1 aa818b301d384753aebd55df074a759812fdd0c2
SHA512 8130f690dc0feb290cc142663ec4f95f70555161635c0f46023260adc10373f6ec1ea2ab85e5dd7752038d8b91206c720dc097f21888cd54297144d8fd6e6dd9
SSDEEP 6144:Gy/W/pi4YjxrwPZSnci51V06dFlu1PMm6FV:D/4PAci+Mlrm6FV
TLSH
T1AC24390A90475EAEE947E6309ADBCBB57A73B87205E1DDBB12D0D7301E138D06B24F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblzma-5.dll

Path C:\Program Files (x86)\fwupd\bin\liblzma-5.dll
Size 165KB
SHA256 59aeabc1f605764caedecc7b89d8efdfb9aca02c204cc92ce1d0522119c21a28
MD5 dcec4012c956a260b41bae04d9c73c92
SHA1 246b5e387b9901fa39907074d63e6fa222803199
SHA512 82e7301463267c2e6f66f297e5fdb28a54a40573afbcec18cdfe80b7d148ad9fb32ed77a03bed7ea0fece4041f9757cb1d0a1e1158b4419561998a147a23af42
SSDEEP 3072:mYB3LxNjIBMyi27W546us/EElsPPfZKGH7TuJ1qU3r2NX9mNofwXrhZSIIF3P8:mUjyuAYOfwFZSIIF3P8
TLSH
T17AF308669162F4EEE66BDE30D9E68F3371F4B81142319A3A498CD37C1D2BBB01609717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libnettle-8.dll

Path C:\Program Files (x86)\fwupd\bin\libnettle-8.dll
Size 317KB
SHA256 f3c613c0c6d464b6889a32ad9b8dbc1c52050a356b84ee6a8ae47f794c72aa68
MD5 43787b988eec2a71151b52661a26ca89
SHA1 6344cbda04a48068accd4dff85273fb9d0039de4
SHA512 4710d12d6507106c51a609987dcab729e17f8211b0f57eefaa023e0bc628d52a5fe079d604a5a8beb4b3605d8c9bbb4dbaef62039a11257fb0b680157ddae38d
SSDEEP 6144:TBEDwXnvpD8eshtEoNwqqD0aUF9wTZj6F3J8:TBqwJ8e/O1qJUGj6F3J8
TLSH
T122647D0B96CD64EDF55BD33096ABC7323138BC644A70AAF65748E2747E237E09A10DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpcre2-8-0.dll

Path C:\Program Files (x86)\fwupd\bin\libpcre2-8-0.dll
Size 655KB
SHA256 84f20af6b88c475067fc0c096d76b7c556d98890eefd8ab4fae5d84a7d133b63
MD5 463ab29e851e5192136c7ebd255d8293
SHA1 69ca23fbc5229ffcf6a0c796d9b224fee69266b9
SHA512 1bb553509555ecfef92f5a912cc9d087a47a3f863093692e3b1b16f7432f89fda2ae0a3233600493cf05b680d4339461391bc927a98d33adfba57f3a036de58c
SSDEEP 12288:n9wvJ9iUkF9IxJpo9321SmZLJu8jjFUd8:n9wvJ9XkFmJpo9321S+g8jjFUd8
TLSH
T194E4B203F193E1F9CD26C23557A7E6B2F176B4994138AEFA01A092743DD7A201A1DB3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpsl-5.dll

Path C:\Program Files (x86)\fwupd\bin\libpsl-5.dll
Size 108KB
SHA256 9508f5205c3bbe732d9c98ec65bdfa204ff1938e1a524da7db4b0e3259e9fada
MD5 07d1f6b0b07bb86c61d9f299b78e57ba
SHA1 4254b3b26f1cb30402a296b4de478d854d82367c
SHA512 1d815034af8bd3f6c98765643d2c2db63e1c7994fa55f3739730ad15c2f375f3a9bc6255f82fc8ecc16fa594f9f05ab5535393bc7c08b03dc43961ef36149de2
SSDEEP 3072:oKySZ1sc9jr0SKJ9QLA/W5wn1rhuCAPLZdufNZdbFTn:oMZ1YxjFW5wn1tcLZduf3dbFTn
TLSH
T194B3AE11B3877A7DDA5BE23094C79772B639F8206633AE3B5340CA349E32EA05F19715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libsqlite3-0.dll

Path C:\Program Files (x86)\fwupd\bin\libsqlite3-0.dll
Size 1.4MB
SHA256 d73a89902912ebcfd73936cf1d46a24687a9e2a4ce420a0dc7efa0012a08a695
MD5 d31179831e19c75e1be1a5c503ca595c
SHA1 d68ff1e78ea78e7233ee37edde17fab8362e54b3
SHA512 ca217af2a397a7e5d7261d7eb27660bf962f90b290f77e0a0c9462f3eaec404461c08fc2ca74875621a87799394c7b6c187a65982992306c1c690f53a8d25bd8
SSDEEP 24576:UFmxgxUpE4+kmofSh89fMXzpvTX6+g1/e7NYXatuahVnoOxx/tLXaybZjIGi36l:UFmxwADKSEFvTXPC62XrahOOxx/1XaQ9
TLSH
T111655C47E2A324FCC56BC234872797B3B934B8245135BEBF8594DB302E52E90572EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssh2-1.dll

Path C:\Program Files (x86)\fwupd\bin\libssh2-1.dll
Size 281KB
SHA256 ca021927355876db2c9b483ed7740f248d4888c884499af24e5feb91824686df
MD5 01c89d4369eb4375878e50945cbe1150
SHA1 0c04643032e8b03b9fec2c964e41a9b49616edb4
SHA512 64dc175cc40b22622963d7c0202ee9613d2f1d4c9290b21447df1a869f18b90de12ddaffb81257c5305f3d40ddb62a4965ad5a3050ee79e2624edf1f6907ac18
SSDEEP 6144:S8mHgMyzEFdQzNicR0dBf5MDBQ6HWTLxZjn43YFVj7:6yzEFTA0dP3wYFVj7
TLSH
T1F0543903D29228BCC46BD23892E75733B535B8156336BCAB1734DA365F21FA0572EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Program Files (x86)\fwupd\bin\libssl-3-x64.dll
Size 976KB
SHA256 317ea9738b7f77e69d769052c86b87e37bcecfbd801da3aaa2593c42f71a73ea
MD5 3bc45065b09da4f2318ea0674ecb2c2e
SHA1 257ccbafe4eba7860954508617e9e9fa7d83ce6b
SHA512 6e346254c8c0fe4ac5b05a7e62bf64e240f8db4284ae8b9bde72776e729cf9fab0ea56845829a7c78db270a917368577a2813f2c96aa6f2e01a3a526db34779e
SSDEEP 24576:1r6+UVLJDq15Qyn8hAi9zyFLyjKRjvctFYN60cqfGUxgh9cHy:E+UBJe5Qy8LoF2jKRjvctFYN60cqfGU2
TLSH
T1CD252A26E66728ACC857D234CBA79373B539B8142336FD7B1A10CA353F60DA4172D768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libtasn1-6.dll

Path C:\Program Files (x86)\fwupd\bin\libtasn1-6.dll
Size 115KB
SHA256 1c00d590c8e43fcf7ea858ab404416072c46e3d4bf44fedc9154c84da4038556
MD5 d53a7f52feebba4a2c21c3df3f53ff1c
SHA1 5ae258059b4fb062ed37b2020ad35366c6e3a87b
SHA512 9707d9a70411f61e2f7a1fba1d9f76ec0f7ab72641e031ef21a8f842be04a5aab25e33e60e1988a3a83969f098e1b35c5387473c3a1736a55f4fa2f473ef21e1
SSDEEP 3072:yvhv88mYgH4FOvtWgp7cOccr0DbAyDzJrfF3U8:4RmXHEgprkDEyDzJrfF3U8
TLSH
T1FDB34C1BE25274BECA97D23495D78B73A630FC246230BE7FDB04E7B01D21E909A15B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libusb-1.0.dll

Path C:\Program Files (x86)\fwupd\bin\libusb-1.0.dll
Size 791KB
SHA256 e52e2a891b65460d065f43e73a1ee45380e0adf9f78cbf363d8da961187d0703
MD5 b1afb428a8561a8cdd0788e1ab92f264
SHA1 94b1acf1c8ed51817f34e283c2e94f4e1e1bc718
SHA512 a78d3fb0ff3ae00e86299b3f110293781971fb79d54cf9efebc200e65f0ad4cc4697ab4d2b59f3bff8bd7b13d3cc53b4d0922476028d4e626646bee419866417
SSDEEP 12288:L1wPjCgdtofmy7yAuc/jUre2wCwLv2EDVVUR9FzB07tilChEsXr:RwPjHtofHnBUre2VwiKVE1wHhEsXr
TLSH
T152059E4BBBCC5C29CAC149318C9B83A2F7F8F1612B5B9B7B471092741E27ED2ED45A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Program Files (x86)\fwupd\bin\libwinpthread-1.dll
Size 67KB
SHA256 3e27a182fa8217353f4eec3d9170dfda46361a1c717a449274993934b87ae66c
MD5 372877d69e9aaf4eb3790bbc26cf2fff
SHA1 782cef48d669e484d7f527b345fd0772a2c6ff2b
SHA512 f7714a0d5249338d045294e732ffc23b05b185fd5f2f45b4c3d0ccfaa1bf968dc7f71a623f34589ef52805197b096a5a9fe07573bc14a59961a8d353a993d16a
SSDEEP 1536:MqFwq3gZutb8l5gkyK6tPm3YkHKI+EbyT4u1Zy:MqF2U8nFyK6tPm3YkHKBEb+4u1Zy
TLSH
T121631A1A336A14FEC557A33094EB53737537F4202376AE1FE734D3312E6AD609A19A88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libxmlb-2.dll

Path C:\Program Files (x86)\fwupd\bin\libxmlb-2.dll
Size 194KB
SHA256 1c3d2237257d2c697e9df3ffdd578dde6dc0ce27fc0f4c783f58e41fd13d11b4
MD5 331f814c80238d94b0a4a7981ec78c8d
SHA1 5a04cf8f530ec9c7cd4620bb514f2f155f44ef10
SHA512 11eb453b56ddf713177419a025283016523ed9c979ddda2510c6433648d7df9095866d8cebbcf3b5aa3cc017fb2d8f2a6f4132d8d96b848e5a5a7a0ee2b3afcb
SSDEEP 3072:ohVWhy3p2QNdoYuaShBExz8n52OSUz5SXRgsFdM2ml2xk1t+aLIP:SFdXUwI9psFWPl2xkuaLIP
TLSH
T1D814193B1185245DD86B923491EBD77371B6B4251371FA7F46208B313F22EB4BA7AB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Program Files (x86)\fwupd\bin\zlib1.dll
Size 130KB
SHA256 699d6ac86e72f78070cf4323c13b152a59979512d1ad2acda8494c733e6b5963
MD5 1d69628fa389f26a09e115767409ea6f
SHA1 441d28d46c351b6c93adc61b5c48a91321f1fc1b
SHA512 7c4e37c7767889ecaf30f411813083b1f4c436ce6f15dc4695dfa943c29b771ae2218f01e8fa99223caf51b53d84ca7d66274eef839c14a05fe6592f3609042a
SSDEEP 3072:OzHysPgsCmN80Y5uShSjmmbhoKEiaycNhlr00h2gPKw+Fj22F3v:Oa9mNe0Sh7mWiaDK0BPd+Y2F3v
TLSH
T189D36B5BBA9375BDC6679230C6E78B72B134F81147316EBB9148D7312E12E901F08BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fwupd.mo

Path C:\Program Files (x86)\fwupd\share\locale\es\LC_MESSAGES\fwupd.mo
Size 91KB
SHA256 df07c42cc7e0efd55b94c649c9a922ae4b5598f49e03089c66729fe9992950db
MD5 2a727489fed2a4df8fb5e1e28b56200b
SHA1 64d1e2d40eff261a4a8324c6371a0869bab35913
SHA512 0fa3c7b73b674cc2b2991ec70b8c5c5a04badfe2a40c6dfe45d84da175f312cc574023b805f42e56b4bde7ef07739fd6b3296bf825d6feb06f48dc78d978cff2
SSDEEP 1536:WzoXFcLQTjJWqL+RPnQs4gimGWsoIKHcsqnH2dJhHMzDMl:SyTjJWq6PQs4giFWjIK2Ml
TLSH
T13793F95272C42933F993937EE6019277ABD8C1DC7258C39A906A921D7CCC9C8CD37AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e.b64

Path C:\Users\Admin\AppData\Local\Temp\Setup_35096\e.b64
Size 4KB
SHA256 3ff2a2c841866e68592f407da43344760779da5f68934f7d8bcfa5988a9e3e61
MD5 10bab98aae3b38d3d5186b055a1cffb6
SHA1 3e94549b39431f795a94d38e82d567537def1e0f
SHA512 5edeb852611b9fa51a16dd4e8a478d770a0233b656298713976b0ba9b31f17723c82e7fd493d62fb728a4d35bab6024a61fa71d998f0ac8b1c9355743a1a2b29
SSDEEP 96:LrOlXOacFko/lEgKdnDXNErH9kZ5pNh/DNN5Sefp9CKNKFMYp:HOxVukodEg6hWkZbfDNND9xYma
TLSH
T1C4918768CE471E4C7A8632BD6EDE7DC4538D33EE05500AED5D16A5CC53368E541C70E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m.b64

Path C:\Users\Admin\AppData\Local\Temp\Setup_35096\m.b64
Size 20.0MB
SHA256 bc9fcf4170773997136d365811dec8b7aa9f2c68d1b4e2ebf92b4e4acc1a0bd6
MD5 f57a1b96401c2360deb0a975b7197ee9
SHA1 300c1f9f8b4f29cf8ba9fe4d31341485ce5c8258
SHA512 675a669e9d40a2d07989312be4266d1da18785da3e70b213ccab116d92db2e8c10a1d3ebf7bee6ad860215c442f16aeda0a920055024d2bdf0e93140d3622864
SSDEEP 49152:bmEdlznDU/nWg5Hg66NuiCl9TbPeVuvl23vjXTBVjhor5jV2kePuoRn65pDLj+IB:y
TLSH
T1E2272374F55D2BDE091091BDB1A9E9547CDD22870882836703AE82B931E5878DFF7CB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.vbs

Path C:\Users\Admin\AppData\Local\Temp\Setup_35096\payload.vbs
Size 3KB
SHA256 80be69e3d2d2749901970f4b06d5dd9cb5c5cc81badbb79ba5bd7e514f43e4a9
MD5 2274ff4582adabce65bc984cdd29ccab
SHA1 e83f87e34dc0c693024c61c7992682c2ee763854
SHA512 9f0168005eb9df119b9de7f7207843d923b2904a3dea5b6a1092ee8ad31dc186d0cc763835b1c8f646f8aa8c0202a28f96b51d32039a4b3fa292b08f45e4750a
TLSH
T1B461A45F7A039330997297668827640EF1B0067B472414647E9C4C889F7272CFBE56DE
MD5 SHA1 SHA512 TLSH

Submit Download

setup.msi

Path C:\Users\Admin\AppData\Local\Temp\Setup_35096\setup.msi
Size 14.6MB
SHA256 91e42a249859074b43954a1e8cbc425e1d64c3e79284f06c6e4e7ea7c5524d2e
MD5 e2296212c07c8413f8ea78bcb626ca99
SHA1 2c55a349311c3e1e2ce604969d2d600702e94959
SHA512 4097934edd0768f61a9f700512021984ec17fe9a4d251eff0c970404b7b619ee8d5ed67cdad3d2593e6668e3e8983e78110bff985e316cd2b276894593a35ebf
SSDEEP 393216:6FQwdg876dqLYoaqIYr+XpHRrf1oxC8nwx7q1B:6uwdOqLYoaqIYC/Orom7
TLSH
T1A4F633D6E82BFE4EC671297AC9750A3EF323A525403670C677E0F48454B5A60F8B8CD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devices.json

Path C:\Windows\var\cache\fwupd\devices.json
Size 3B
SHA256 8eb95bcbc154530931e15fc418c8b1fe991095671409552099ea1aa596999ede
MD5 3d29a75fcf0ed7dfff86d3db8f92fc69
SHA1 dff8a1731f59ccad056b346102d1e1d014b843f3
SHA512 b7a65febc18b7eb5b159100842eed0018f0b56694baf042e366a97b1d8fe9eeb238b6ced3fe1b27c659837564ca3605e1c733e4f4621e3e8584237a6880f47ef
MD5 SHA1 SHA512

Submit Download

memory/5976-241-0x00007FF89FE50000-0x00007FF8A02BF000-memory.dmp

Download

memory/5976-235-0x00007FF8A79F0000-0x00007FF8A7A13000-memory.dmp

Download

memory/5976-230-0x00007FF8A0350000-0x00007FF8A0414000-memory.dmp

Download

memory/5976-244-0x00007FF89F8F0000-0x00007FF89FAB6000-memory.dmp

Download

memory/5976-243-0x00007FF89FAC0000-0x00007FF89FBE7000-memory.dmp

Download

memory/5976-242-0x00007FF89FD70000-0x00007FF89FE4A000-memory.dmp

Download

memory/5976-231-0x00007FF8AA420000-0x00007FF8AA437000-memory.dmp

Download

memory/5976-226-0x00007FF8A0590000-0x00007FF8A07BA000-memory.dmp

Download

memory/5976-227-0x00007FF8A0420000-0x00007FF8A0583000-memory.dmp

Download

memory/5976-225-0x00007FF8A2430000-0x00007FF8A2505000-memory.dmp

Download

memory/5976-223-0x00007FF8A07C0000-0x00007FF8A0A35000-memory.dmp

Download

memory/5976-221-0x00007FF8A38B0000-0x00007FF8A3959000-memory.dmp

Download

memory/5976-214-0x00007FF8A0DA0000-0x00007FF8A0F12000-memory.dmp

Download

memory/5976-240-0x00007FF8A02C0000-0x00007FF8A034E000-memory.dmp

Download

memory/5976-239-0x00007FF8A2560000-0x00007FF8A25A8000-memory.dmp

Download

memory/5976-238-0x00007FF8A4BF0000-0x00007FF8A4C12000-memory.dmp

Download

memory/5976-236-0x00007FF8A8350000-0x00007FF8A8362000-memory.dmp

Download

memory/5976-234-0x00007FF8A25B0000-0x00007FF8A2601000-memory.dmp

Download

memory/5976-233-0x00007FF8A8F90000-0x00007FF8A8FD3000-memory.dmp

Download

memory/5976-232-0x00007FF8A9B20000-0x00007FF8A9B4E000-memory.dmp

Download

memory/5976-228-0x00007FF8A1F20000-0x00007FF8A1FDE000-memory.dmp

Download

memory/5976-224-0x00007FF8AABC0000-0x00007FF8AABD2000-memory.dmp

Download

memory/5976-218-0x00007FF8A0A40000-0x00007FF8A0BD5000-memory.dmp

Download

memory/5976-222-0x00007FF8A91E0000-0x00007FF8A921E000-memory.dmp

Download

memory/5976-220-0x00007FF8B8920000-0x00007FF8B8930000-memory.dmp

Download

memory/5976-217-0x00007FF8AA090000-0x00007FF8AA115000-memory.dmp

Download

memory/5976-215-0x00007FF8A0BE0000-0x00007FF8A0D95000-memory.dmp

Download

memory/5976-216-0x00007FF8AA4E0000-0x00007FF8AA53B000-memory.dmp

Download

memory/5976-213-0x00007FF7A20D0000-0x00007FF7A20F4000-memory.dmp

Download

memory/5976-237-0x00007FF8A23C0000-0x00007FF8A2428000-memory.dmp

Download

memory/5976-229-0x00007FF8A8FE0000-0x00007FF8A9013000-memory.dmp

Download

memory/5976-219-0x00007FF8AABE0000-0x00007FF8AAC08000-memory.dmp

Download

memory/5976-259-0x00007FF8A0420000-0x00007FF8A0583000-memory.dmp

Download