20a0bd6ed113a2e57b4d108f8168234317be9f54e3399048b1f53b4899dc729d

Analysis

max time kernel
149s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TESTING.x64.3.vbs
Size 23.7MB
Sample260808-2f7arawame
SHA256 20a0bd6ed113a2e57b4d108f8168234317be9f54e3399048b1f53b4899dc729d
MD5 a81eddefcc13f42916c4ea67d0262fb1
SHA1 f5fe4168fa6d05b428dd5332b71da3b6097d0086
SHA512 dc68ca0e2b41eea97bd4c2587b61a27e24654ba0905780033bb1849eb8197d0e4c0b689b4ca86cbf6e8ca198d9a5b2fea47ef9cb64877db32c9f05327e845e33
SSDEEP 49152:5K/tW2LWJiaTnFK7vkdOYGmSAGv+iW+09hzDvDrCXga09u2ksRXTrf+Ren6stbHs:s
TLSH
T1C9471260AE142ADC4AB547F3B0E9E6E8D97107F3CF019D1E0115DDB79E721CF9A2281A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution ransomware

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	2592	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2592	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5696	fwupd.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\Wine	fwupd.exe

Loads dropped DLL 36 IoCs

pid	Process
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe
5696	fwupd.exe

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2672	cmd.exe
6040	certutil.exe
4340	cmd.exe
5108	certutil.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
2128	WScript.exe
4916	wscript.exe
2540	wscript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\fwupd\bin\libreadline8.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libgcc_s_seh-1.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libtermcap-0.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libfwupdplugin.dll.a	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\fur\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\sv\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\fr\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\dbus-1\system-services\org.freedesktop.fwupd.service	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libpsl-5.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libunistring-2.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libfwupdutil.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libfwupdutil.dll.a	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\fwupdmgr.exe	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ar\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ky\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\fwupd\remotes.d\vendor\firmware\README.md	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libcrypto-3-x64.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libgnutls-30.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libxmlb-2.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libfwupdengine.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\nl\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\sq\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\id\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\fwupd\metainfo\org.freedesktop.fwupd.remotes.lvfs-testing.metainfo.xml	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libssl-3-x64.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libwinpthread-1.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\fwupd\remotes.d\lvfs-embargo.conf	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libfwupdplugin.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\af\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\hi\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libgio-2.0-0.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libtasn1-6.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\pki\fwupd-metadata\LVFS-CA.pem	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\it\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\zh_CN\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\dbus-1\system.d\org.freedesktop.fwupd.conf	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libglib-2.0-0.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\pki\fwupd\LVFS-CA.pem	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\en_GB\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\bg\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libidn2-0.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\gspawn-win64-helper-console.exe	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ko\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\pt\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\es\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libintl-8.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libusb-1.0.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libssh2-1.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\fwupd\remotes.d\lvfs-testing.conf	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\lt\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\hr\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\gl\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ru\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\et\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\fi\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\sl\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\fwupd\quirks.d\builtin.quirk.gz	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\pki\fwupd\LVFS-CA-2025PQ.pem	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\fwupd\remotes.d\lvfs.conf	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ca\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\lv\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\tr\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\oc\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\eu\LC_MESSAGES\fwupd.mo	msiexec.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{76493109-E6AB-5C48-940D-49544A688596}	msiexec.exe
File created	C:\Windows\Installer\{76493109-E6AB-5C48-940D-49544A688596}\fwupd.ico	msiexec.exe
File created	C:\Windows\var\cache\fwupd\devices.json.GS4JT3	fwupd.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF66E3E52B45E12206.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF522139F722E2CD0A.TMP	msiexec.exe
File created	C:\Windows\Installer\e597548.msi	msiexec.exe
File opened for modification	C:\Windows\var\cache\fwupd\quirks.db	fwupd.exe
File created	C:\Windows\var\lib\fwupd\pki\client.pem.V6ETT3	fwupd.exe
File created	C:\Windows\var\cache\fwupd\motd.d\85-fwupd.ITSWT3	fwupd.exe
File created	C:\Windows\Installer\e597546.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF65C1403FCE4721B0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB4A8A52B5C0F6BFF.TMP	msiexec.exe
File opened for modification	C:\Windows\var\cache\fwupd\quirks.db-journal	fwupd.exe
File opened for modification	C:\Windows\var\lib\fwupd\pending.db	fwupd.exe
File created	C:\Windows\var\cache\fwupd\devices.json.HS4JT3	fwupd.exe
File opened for modification	C:\Windows\Installer\e597546.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7BFC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{76493109-E6AB-5C48-940D-49544A688596}\fwupd.ico	msiexec.exe
File created	C:\Windows\var\cache\fwupd\quirks.xmlb	fwupd.exe
File created	C:\Windows\var\cache\fwupd\metainfo.xmlb	fwupd.exe
File created	C:\Windows\var\lib\fwupd\pki\secret.key.19EUT3	fwupd.exe
File opened for modification	C:\Windows\var\lib\fwupd\pending.db-journal	fwupd.exe
File created	C:\Windows\var\cache\fwupd\metadata.xmlb	fwupd.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000d00000001c497-198.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\PackageCode = "616DB7C281FC3CA4D995B5B0DBA4A5A1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\Version = "33619974"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FWSetup_43250\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\90139467BA6E84C549D09445A4865869\Complete	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\ProductName = "fwupd 2.1.6 (64-bit)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\90139467BA6E84C549D09445A4865879\90139467BA6E84C549D09445A4865869	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\PackageName = "fwupd-2.1.6-setup-x86_64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\90139467BA6E84C549D09445A4865879	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\FWSetup_43250\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\90139467BA6E84C549D09445A4865869	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\ProductIcon = "C:\\Windows\\Installer\\{76493109-E6AB-5C48-940D-49544A688596}\\fwupd.ico"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2592	powershell.exe
2592	powershell.exe
2592	powershell.exe
2400	msiexec.exe
2400	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3480	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3480	msiexec.exe
Token: SeSecurityPrivilege	2400	msiexec.exe
Token: SeCreateTokenPrivilege	3480	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3480	msiexec.exe
Token: SeLockMemoryPrivilege	3480	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3480	msiexec.exe
Token: SeMachineAccountPrivilege	3480	msiexec.exe
Token: SeTcbPrivilege	3480	msiexec.exe
Token: SeSecurityPrivilege	3480	msiexec.exe
Token: SeTakeOwnershipPrivilege	3480	msiexec.exe
Token: SeLoadDriverPrivilege	3480	msiexec.exe
Token: SeSystemProfilePrivilege	3480	msiexec.exe
Token: SeSystemtimePrivilege	3480	msiexec.exe
Token: SeProfSingleProcessPrivilege	3480	msiexec.exe
Token: SeIncBasePriorityPrivilege	3480	msiexec.exe
Token: SeCreatePagefilePrivilege	3480	msiexec.exe
Token: SeCreatePermanentPrivilege	3480	msiexec.exe
Token: SeBackupPrivilege	3480	msiexec.exe
Token: SeRestorePrivilege	3480	msiexec.exe
Token: SeShutdownPrivilege	3480	msiexec.exe
Token: SeDebugPrivilege	3480	msiexec.exe
Token: SeAuditPrivilege	3480	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3480	msiexec.exe
Token: SeChangeNotifyPrivilege	3480	msiexec.exe
Token: SeRemoteShutdownPrivilege	3480	msiexec.exe
Token: SeUndockPrivilege	3480	msiexec.exe
Token: SeSyncAgentPrivilege	3480	msiexec.exe
Token: SeEnableDelegationPrivilege	3480	msiexec.exe
Token: SeManageVolumePrivilege	3480	msiexec.exe
Token: SeImpersonatePrivilege	3480	msiexec.exe
Token: SeCreateGlobalPrivilege	3480	msiexec.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeBackupPrivilege	1512	vssvc.exe
Token: SeRestorePrivilege	1512	vssvc.exe
Token: SeAuditPrivilege	1512	vssvc.exe
Token: SeBackupPrivilege	2400	msiexec.exe
Token: SeRestorePrivilege	2400	msiexec.exe
Token: SeShutdownPrivilege	1272	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1272	msiexec.exe
Token: SeCreateTokenPrivilege	1272	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1272	msiexec.exe
Token: SeLockMemoryPrivilege	1272	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1272	msiexec.exe
Token: SeMachineAccountPrivilege	1272	msiexec.exe
Token: SeTcbPrivilege	1272	msiexec.exe
Token: SeSecurityPrivilege	1272	msiexec.exe
Token: SeTakeOwnershipPrivilege	1272	msiexec.exe
Token: SeLoadDriverPrivilege	1272	msiexec.exe
Token: SeSystemProfilePrivilege	1272	msiexec.exe
Token: SeSystemtimePrivilege	1272	msiexec.exe
Token: SeProfSingleProcessPrivilege	1272	msiexec.exe
Token: SeIncBasePriorityPrivilege	1272	msiexec.exe
Token: SeCreatePagefilePrivilege	1272	msiexec.exe
Token: SeCreatePermanentPrivilege	1272	msiexec.exe
Token: SeBackupPrivilege	1272	msiexec.exe
Token: SeRestorePrivilege	1272	msiexec.exe
Token: SeShutdownPrivilege	1272	msiexec.exe
Token: SeDebugPrivilege	1272	msiexec.exe
Token: SeAuditPrivilege	1272	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1272	msiexec.exe
Token: SeChangeNotifyPrivilege	1272	msiexec.exe
Token: SeRemoteShutdownPrivilege	1272	msiexec.exe
Token: SeUndockPrivilege	1272	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3480	msiexec.exe
3480	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3480	msiexec.exe
2400	msiexec.exe
1272	msiexec.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2672	2128	WScript.exe	89
PID 2672 wrote to memory of 6040	2672	cmd.exe	91
PID 2128 wrote to memory of 4340	2128	WScript.exe	92
PID 4340 wrote to memory of 5108	4340	cmd.exe	94
PID 2128 wrote to memory of 4916	2128	WScript.exe	95
PID 2128 wrote to memory of 3480	2128	WScript.exe	96
PID 4916 wrote to memory of 2540	4916	wscript.exe	97
PID 2540 wrote to memory of 2592	2540	wscript.exe	98
PID 2540 wrote to memory of 1272	2540	wscript.exe	103
PID 2400 wrote to memory of 4556	2400	msiexec.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\TESTING.x64.3.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c certutil -decode "C:\Users\Admin\AppData\Local\Temp\FWSetup_43250\m.b64" "C:\Users\Admin\AppData\Local\Temp\FWSetup_43250\fwupd-2.1.6-setup-x86_64.msi"
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\system32\certutil.exe
    certutil -decode "C:\Users\Admin\AppData\Local\Temp\FWSetup_43250\m.b64" "C:\Users\Admin\AppData\Local\Temp\FWSetup_43250\fwupd-2.1.6-setup-x86_64.msi"
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:6040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c certutil -decode "C:\Users\Admin\AppData\Local\Temp\FWSetup_43250\v.b64" "C:\Users\Admin\AppData\Local\Temp\FWSetup_43250\InstallerTesting.vbs"
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\system32\certutil.exe
    certutil -decode "C:\Users\Admin\AppData\Local\Temp\FWSetup_43250\v.b64" "C:\Users\Admin\AppData\Local\Temp\FWSetup_43250\InstallerTesting.vbs"
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:5108
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\FWSetup_43250\InstallerTesting.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B //NoLogo "C:\Users\Admin\AppData\Local\Temp\FWSetup_43250\InstallerTesting.vbs" /elevate
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\download.ps1"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2592
  - - C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.msi" /qn /norestart
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1272
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\FWSetup_43250\fwupd-2.1.6-setup-x86_64.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3480

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4556

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Program Files (x86)\fwupd\bin\fwupd.exe
"C:\Program Files (x86)\fwupd\bin\fwupd.exe"
1⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in Windows directory
PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e597547.rbs

Path C:\Config.Msi\e597547.rbs
Size 30KB
SHA256 d779d35ca0f0ea27181f76fc10398db1c63530a3683e035ffa7132d3d89bf778
MD5 fc7dce832ffe0b12e76c02578e3b3f0c
SHA1 29a70b98d64ae4130b87d2211bf0a08884f47cac
SHA512 10825a1c023e7156e0302910e826434deb08ac8146d3e6d3ba55849ecbaf0be5dce007c1a571482d65df97427a47aa3014bb6d3493b7db54509e2c2ad753b4f8
SSDEEP 768:5tp/i/KMLtTvhdSG1sjeACFJqUFaeIteP7XviOpohGmEOnP+bQqP1bakW7hTOOKg:3p/i/KMLtTvhdSG1sjeACFJqUFaeItek
TLSH
T14ED22F405C07D5C2F246ADA2B7D36C24C758FE2C6B744CAA40CA872F9DC0B56BDEA4D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fwupd.exe

Path C:\Program Files (x86)\fwupd\bin\fwupd.exe
Size 158KB
SHA256 ba9d0931ada5b2ed07fc0fb8c15554d70483ad1f75901bd1e93384a94ee7821d
MD5 ddd0814fa2844d786c2cf4471ae593f5
SHA1 8382bf2ee69faebdf91ab540835778aba50cf3d4
SHA512 b8467de53285bb0ffa3b144dd0069b89e5773c0a135b4295a38b627fa7ddbb04731e4e5f5684ed5d5485b34ac57dcffbacbe3ba7c764ad19c7749fa8de2c5c81
SSDEEP 1536:WK846crJrtLqU6vEHEhEhak3OsoK/GkZu+4edNBrWeuhFqH1SRSshBbQKjvzv:WK80rT+8Qgz3OsN/n74epYhFq/2vzv
TLSH
T1BFF380E676D45CDAEA15827C809BD231223CF5E0C2229F1B653037361F52EA23DD766E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconv.dll

Path C:\Program Files (x86)\fwupd\bin\iconv.dll
Size 38KB
SHA256 3ffa5bc870ddf20abb6fbf6e933f93f42ef30ebc075b1264cd3e01609c831b43
MD5 a0f87d78421c93e9d8a5769bd59c3f90
SHA1 e87040c74ef71200fd2d0a062a7574a3f4db1d30
SHA512 20f452f2c499d73f51532d97e87eb8cb0cf77199d4a63e65c4da9728d59377fb761798c1a15c080081311f063d10e1b360b882d517872641c32eb23bb6456710
SSDEEP 768:6c8moRCodDmZjjQckQOTi1T+A1jmFQw7WrKj3N:6DCodTckVTYTjeQfrKj3N
TLSH
T1E9031925928D5C5EED57D338A9E747327538BC222633E72F0610E6715E236E05F3CA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Program Files (x86)\fwupd\bin\libcrypto-3-x64.dll
Size 4.8MB
SHA256 2d332cb7aefd59387e00a4ae24391e317826890299c3aea5cd03bafc933e1d9f
MD5 25de73fe9b3f90c79a7b977c40f5a1a4
SHA1 d3c6aac98742dc0337a887b00d2a9894a065532f
SHA512 c5f7345154f23e8534af5d0c37eddff493001f165563b03eb392324d9b8c2ca5df6ee3ef54aa0ed516bb6eb37d8c55817ad0e93f69603e01904fd1fc032b5d7c
SSDEEP 98304:6TLdZnVQ4+EOF6CVNERt9GmZByabpZ11CPwDvt3uFXZC55C3tv13uFnCPwxU8ibq:YpZSG7ZZh1CPwDvt3uFXZC55C3tv13u1
TLSH
T113365B2BA07F285EC95BA2B0C2E79B337534B81013B57E7F6A14DBF01E11D9017AAB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl-4.dll

Path C:\Program Files (x86)\fwupd\bin\libcurl-4.dll
Size 814KB
SHA256 094d6a069e4434baa5f5e7f9317f196be1c48b80a3f154b7f448f702bc109cd6
MD5 8e15a01c3422f33307e43d281f5b68b3
SHA1 5a923e4c2960b2ca9db3977274886e2e04557ced
SHA512 556c2ac80235cf9018813b9a02744e2f80fbed305ce3ca2c3c17d6d86f80944608d757dff782fa4040c7c15de664c5d63eee1c0528ee11978c465c4de1404c6f
SSDEEP 24576:d64Gpw3Ak86NtzyYzfcM46R6mpUiAAAAAAAAAAAAAAZACAAAAZAALAAAAAAAg9A3:d63w3AoNtOYz01mqDW5o
TLSH
T161055B2BA29328ADD56BC334D2A797737435B8152231BD7F5664CB302E51ED0233BBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Program Files (x86)\fwupd\bin\libffi-8.dll
Size 36KB
SHA256 d2dcd97bfe809da10cc055c03067b5844dd06234c8b445f7ab70942469f0bd58
MD5 325a54a0fdeb7b139d8e3e72c6d342a5
SHA1 3780955adbcc59249b2991be4c569754985890f8
SHA512 fec5f303bea8be1c4c62f1d1436fec00dc85a6e395ae1167bd0e26786386f5ab22d0030436db3cadd4d6b163d18a0ebb49ab8cc8d8b284c93cc40028e52fd89c
SSDEEP 768:14aI7eqqUio1etGI8MVGxVekKMz7m7HXyQ:JtpbaekbXY3yQ
TLSH
T19EF2191A6683A97DD94BE334A5F38772E138F81117326E3F05A5E3311F166A00B59F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfwupd-3.dll

Path C:\Program Files (x86)\fwupd\bin\libfwupd-3.dll
Size 619KB
SHA256 93c1618514cd1d9f3d43ad9f8e4412bf9bdadcf6a22d65b1c21e4dbbc2cf5bd4
MD5 506cc250abe9279d5d9044cce104d6fe
SHA1 2ca165f45d182bb12a6cd54de551255b8d9378c7
SHA512 48720067cee438b7678bca47da07cc9fe6ccdedf2226a6bd870005688ca51f68d58247a205a00818fd9f3f9476f7d354f6f390f97e3db966480432accd65e4fd
SSDEEP 12288:NDDRipYzljeijA/IdFNDBSlOQRSCaWnpxszPUUB+:NDVJjSIxeOQRTpQvU
TLSH
T118D4D82A10D51C5EFD3A8235C693E7222078F5684372FF6B9420C6357F91DB1E6AEAC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfwupdengine.dll

Path C:\Program Files (x86)\fwupd\bin\libfwupdengine.dll
Size 3.2MB
SHA256 cbb9812033f97527e69303384725971d613e6028542411304457cdcdf85d297d
MD5 e8c0f1be05c553de2d83b924fa5c833c
SHA1 5bf56b07ddb7e6f9d75eba4d9f49418cffa41e58
SHA512 a75d518d3e4c715f615dfa2ef3b98894881a2eb21927fcc56297e30adbd0e378e066b8dae52768f4440d883531a18c5b7ceb2408dcacee16db93afa03c2bd5a8
SSDEEP 49152:gV4gBbvYS7ujkKGSgqEdFEauBdBO+ggfzLMtlC4bJ2tzdyOKv7jGKf4PetG:d8nKPO+tLM3hbJ2tdKTjGKf4POG
TLSH
T17CF53B27B1B698DDC9E6827CC29AE3333578B5944735BF7B742446312F01FE016ABA48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfwupdplugin.dll

Path C:\Program Files (x86)\fwupd\bin\libfwupdplugin.dll
Size 2.0MB
SHA256 2dcb508a993fad2fc8369d404c37d1b826a8ca192d4aeb442af66681a8abaf4e
MD5 5f0a8229c81cf2ab53385c63a222bb3b
SHA1 446662b0a07f12589e05e6e5a9211cde9908d050
SHA512 b82ca38e9f8e256f8dcf75c73ed43e05ca251ae261c907e86cdc2b96d1795e948b25fc738366d19e15a8c9addda36379a51d98cf1fffed6c2cddc4da5fd3a370
SSDEEP 49152:rwv+xkCKWEI4alqKH3H0X1Z1/6f/ZqsKfTHInJjwy+HcL/Xq:M6AC30rfIJjwy+HcL/Xq
TLSH
T148A52B2761E6988DDDAAC23CC1DBD3222574B1640331EF7BB42486353F51FF116AAB89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_seh-1.dll

Path C:\Program Files (x86)\fwupd\bin\libgcc_s_seh-1.dll
Size 912KB
SHA256 bf204c248ccea9a2ad76d55fc6277b9145fa67cfa0a85e480b8762a3ccf8462e
MD5 9755454c3b9cd2d9aece37bc9dce2cdc
SHA1 511d6622ee70ed15908f172cb2a257664dca4113
SHA512 e37ce040d48a73bd8aa66668561e8c942286975a5a5939f5261bb1692866e6bd11bc5e52dbfdcf90056a0e67a646eee68063b209608d18d196b311ad4395e020
SSDEEP 12288:0LRM5cS5UlCwUelfRCoJtoSqUQf35abh6Nr+NaAGjE1:KR5S5Ul7UelfRCoJtoSqUQf35b+YjE1
TLSH
T1C2156B81B78DF09AC43101B16A9743675330B58533AABA2BBE6A7734CCD33D9DE446D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgio-2.0-0.dll

Path C:\Program Files (x86)\fwupd\bin\libgio-2.0-0.dll
Size 2.0MB
SHA256 0e543990bcff8bf923f2cd234d54b9cce4a0002d83c9e8a58f182b5777f53a3d
MD5 516445f9a37711f01f849addf9900855
SHA1 4025df37eccdd5b6343e40d52307777146085665
SHA512 9a96827b4c13b98a8d3a05663f80bba49e52c49cdd64ece5af1264e4c64963a5e4938252f1977469f3d1b3d111856fd050a014d78b18f86dc1b7705368f891b8
SSDEEP 24576:rUV6l888A99P3P87rPcMWl4AEvZWSt8WgUm94qIPSaM:rw6l58APP3PEKl4hZWSt8RF94hPSaM
TLSH
T1FF95372B9293680DCABBD270819BA7237574B8141332BD2B5924C7357F32FF1469BB49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglib-2.0-0.dll

Path C:\Program Files (x86)\fwupd\bin\libglib-2.0-0.dll
Size 1.5MB
SHA256 24ce9cdec4325956da58a5bbf349d123d42f4dd7900658fb783e8ef86d0232a4
MD5 45e1fbd75a9e95bd720ddfa60cdd7bbb
SHA1 37ba8087c784eb0139cb500510e052177540e53d
SHA512 f8371491805f69ee76542f7f6572686c53dd2db4e89e113049c89480d5d44589c26b64e45c6b87ef1be46f4bde3908dcde2d06d29e7562eeea3a85aec922faa9
SSDEEP 49152:znLHqHvO0JO13LVfBYFDrPBtvOe3UZ3ixd:zG/JOtLVfBYFaZ3ixd
TLSH
T1A875181BA28678AFE75ADE3485E6A7B3E530B4140F33787A2D5CC7341E2DD92021AF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgmodule-2.0-0.dll

Path C:\Program Files (x86)\fwupd\bin\libgmodule-2.0-0.dll
Size 28KB
SHA256 2f0b4c65abb9c38918fae9a4182b9fbeb80ae0faf9cdb58d617142ebff7b3df7
MD5 d8d77451d5b362c69bb7fe1ef7ddd90d
SHA1 ee9daac914aa4e3f59db99a4713088ed270b1c48
SHA512 64c5b24d258a7257dbd95cef8836359e33b71754e57226a632401dc20c9fc17cc00426b4f148d28e216af815a7ebf73bc02bf9e8f30529e549269791ab4b56b4
SSDEEP 384:z7VjTyhZKi8RLqlpVeesenku8/FP7sisjsKSAe4lbQPWSoMLNz7:fiLOLqljJsIkdjsiQlBQPxTNz7
TLSH
T132D2F82B7245645FC85AE738F4E75332B63EB4161772EA2F0358C2B05F723B04668B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgmp-10.dll

Path C:\Program Files (x86)\fwupd\bin\libgmp-10.dll
Size 569KB
SHA256 024193fcb2c773cacbfc93cbfefbdc6b0754643c2af452e5d4c885c1659a148f
MD5 8e59175d09ac0860d6c529da0429fcb7
SHA1 d07ab371ae478d48f924593a6bacbf8052ae743b
SHA512 c8a5bacd594b13fa3fe6679e91e2c7a74bcc8d8dcfcff8abbfa0345d2433c78189024bdce6f8e2807120482a483b000a047426d4ebad070dbffe22d90a11d29f
SSDEEP 6144:O6VjI38Y2CbUbe9sYWwt4b4ZarI2bgZNhm1zz7q37xbj/qxVPTzHabTUOR98qjQu:bM3sC6e2wt+To/aP7JVvAUqjQmXJJF3n
TLSH
T1BEC43A37D143B8BCD66BE37067ABCAB2B131B8620534BD370690D7711FA5EA01B18B65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgnutls-30.dll

Path C:\Program Files (x86)\fwupd\bin\libgnutls-30.dll
Size 2.3MB
SHA256 3499422bda726d2d145c7b6bde2445f61291376f0a3b33b4a8936805f220b002
MD5 7e6ed51d64748c5fa2c4674bf40f8a29
SHA1 52af1e53f61c413ef797cf718cc7b1f832985870
SHA512 cb61688fcdfce2584faff9c3d17532ffe496ca2345aa5c037133e74d49b1d2b7767d6fc95cada86aaf69f29efa66eaf37b979a05fe49552bf827cdced7d4a0fa
SSDEEP 49152:ZYSF3AMNLZoKteRXPpSKGr3EKFcFMsnmGtlqd6BmdEAFXk2XAxO5qNKi7f:KSF5a/dQAg6BvO5qNKi7f
TLSH
T1C7B52902F5D2A99CD937D634CA53A27372737C20AA71EE776E44F6742E31EE0061AE14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgobject-2.0-0.dll

Path C:\Program Files (x86)\fwupd\bin\libgobject-2.0-0.dll
Size 385KB
SHA256 06f62ea3c54fc3362ae7da7559fac75979789d287590b808a3214c279240752a
MD5 e21d54542c93daa02b7bee47f4e62855
SHA1 c92134a4581dee30dd27b99d6be4d0f2b708cfbe
SHA512 1d8404355b6581b23aba5a6b0cfb184170520d83c92c3b8d9da55d7ddf0fae516cf5ddd47d980ee999cc650e009f838323afa1fd34f295ead0d62daefa0268df
SSDEEP 6144:2TJHY6Zq24jQgfBxl/CuqkM/k7fD23uK7uf8xLgvkPlviEt0L/1uqccm8bneriKC:m8Q4BxoIM/kTDySgi4au5V74x+Q
TLSH
T1A8845B2BB3023C2DC99BD1748187E7237275B42823737DFB56A8C7705D25DA19A1AF0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libhogweed-6.dll

Path C:\Program Files (x86)\fwupd\bin\libhogweed-6.dll
Size 257KB
SHA256 4a169d2c8c77074a510e1d30d67e232128fa35ca023537db9d48643cd47198ac
MD5 cf57f987f1c0415724bc417558c2bf34
SHA1 34d52807dd7ab48793699d083f843c833d87c34c
SHA512 5c4ec0a969880e5ef0254376df07973bcc9320a48cf6df059dc3f1a6fe7f3013408aea389b68636722e52d67edf2fe33f79c0c6aff6d5d8b79655c932a26ea6f
SSDEEP 3072:3RMFadPgVttrKqrBRM2RolESlKXzmfwD2sHurSD0rn0xkxbIzwo/5IkanN/:3+V0q7ZcrlKyfwD7HurSQICytanN/
TLSH
T19044AF23C2895CBEFABF6330AA9586732130FC901EF5DB5B1614E6743D72EE04E15698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libidn2-0.dll

Path C:\Program Files (x86)\fwupd\bin\libidn2-0.dll
Size 397KB
SHA256 c60419fd629c8f7c9d469ce0446c45f8e1f653057e4deaf1b76ceff747c0451c
MD5 8b23d4a8d5cc8412f594e6954990f3b7
SHA1 8816973ee7afb8b0804af5806de7aecef1dfed7d
SHA512 6613055ab512e5f438858ced752b2a30bcdf5a0c6bdf317bf7324b17a4f2a91c7ebd19b4324e2dca4644ca08948d2d67b0ef322450a88e658db82e1932cb5f5b
SSDEEP 6144:NnlCDxHQQqBsDwSs4SpHAhIvdEcvH/ukLi3gep3Q0:SdwyIrIYkgep3Q0
TLSH
T14B84FA52FAA2D06DEE2B8132A4975B6303927C719EB38757B71CF6AD6C37ED00D4050A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libintl-8.dll

Path C:\Program Files (x86)\fwupd\bin\libintl-8.dll
Size 223KB
SHA256 24b3bf5b2cad29ec390f17277d48e7aa900b84eb903ef9e7a8a204b769256ff6
MD5 05a76362798afee25d6b2c4bf8c30b90
SHA1 aa818b301d384753aebd55df074a759812fdd0c2
SHA512 8130f690dc0feb290cc142663ec4f95f70555161635c0f46023260adc10373f6ec1ea2ab85e5dd7752038d8b91206c720dc097f21888cd54297144d8fd6e6dd9
SSDEEP 6144:Gy/W/pi4YjxrwPZSnci51V06dFlu1PMm6FV:D/4PAci+Mlrm6FV
TLSH
T1AC24390A90475EAEE947E6309ADBCBB57A73B87205E1DDBB12D0D7301E138D06B24F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblzma-5.dll

Path C:\Program Files (x86)\fwupd\bin\liblzma-5.dll
Size 165KB
SHA256 59aeabc1f605764caedecc7b89d8efdfb9aca02c204cc92ce1d0522119c21a28
MD5 dcec4012c956a260b41bae04d9c73c92
SHA1 246b5e387b9901fa39907074d63e6fa222803199
SHA512 82e7301463267c2e6f66f297e5fdb28a54a40573afbcec18cdfe80b7d148ad9fb32ed77a03bed7ea0fece4041f9757cb1d0a1e1158b4419561998a147a23af42
SSDEEP 3072:mYB3LxNjIBMyi27W546us/EElsPPfZKGH7TuJ1qU3r2NX9mNofwXrhZSIIF3P8:mUjyuAYOfwFZSIIF3P8
TLSH
T17AF308669162F4EEE66BDE30D9E68F3371F4B81142319A3A498CD37C1D2BBB01609717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libnettle-8.dll

Path C:\Program Files (x86)\fwupd\bin\libnettle-8.dll
Size 317KB
SHA256 f3c613c0c6d464b6889a32ad9b8dbc1c52050a356b84ee6a8ae47f794c72aa68
MD5 43787b988eec2a71151b52661a26ca89
SHA1 6344cbda04a48068accd4dff85273fb9d0039de4
SHA512 4710d12d6507106c51a609987dcab729e17f8211b0f57eefaa023e0bc628d52a5fe079d604a5a8beb4b3605d8c9bbb4dbaef62039a11257fb0b680157ddae38d
SSDEEP 6144:TBEDwXnvpD8eshtEoNwqqD0aUF9wTZj6F3J8:TBqwJ8e/O1qJUGj6F3J8
TLSH
T122647D0B96CD64EDF55BD33096ABC7323138BC644A70AAF65748E2747E237E09A10DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpcre2-8-0.dll

Path C:\Program Files (x86)\fwupd\bin\libpcre2-8-0.dll
Size 655KB
SHA256 84f20af6b88c475067fc0c096d76b7c556d98890eefd8ab4fae5d84a7d133b63
MD5 463ab29e851e5192136c7ebd255d8293
SHA1 69ca23fbc5229ffcf6a0c796d9b224fee69266b9
SHA512 1bb553509555ecfef92f5a912cc9d087a47a3f863093692e3b1b16f7432f89fda2ae0a3233600493cf05b680d4339461391bc927a98d33adfba57f3a036de58c
SSDEEP 12288:n9wvJ9iUkF9IxJpo9321SmZLJu8jjFUd8:n9wvJ9XkFmJpo9321S+g8jjFUd8
TLSH
T194E4B203F193E1F9CD26C23557A7E6B2F176B4994138AEFA01A092743DD7A201A1DB3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpsl-5.dll

Path C:\Program Files (x86)\fwupd\bin\libpsl-5.dll
Size 108KB
SHA256 9508f5205c3bbe732d9c98ec65bdfa204ff1938e1a524da7db4b0e3259e9fada
MD5 07d1f6b0b07bb86c61d9f299b78e57ba
SHA1 4254b3b26f1cb30402a296b4de478d854d82367c
SHA512 1d815034af8bd3f6c98765643d2c2db63e1c7994fa55f3739730ad15c2f375f3a9bc6255f82fc8ecc16fa594f9f05ab5535393bc7c08b03dc43961ef36149de2
SSDEEP 3072:oKySZ1sc9jr0SKJ9QLA/W5wn1rhuCAPLZdufNZdbFTn:oMZ1YxjFW5wn1tcLZduf3dbFTn
TLSH
T194B3AE11B3877A7DDA5BE23094C79772B639F8206633AE3B5340CA349E32EA05F19715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libsqlite3-0.dll

Path C:\Program Files (x86)\fwupd\bin\libsqlite3-0.dll
Size 1.4MB
SHA256 d73a89902912ebcfd73936cf1d46a24687a9e2a4ce420a0dc7efa0012a08a695
MD5 d31179831e19c75e1be1a5c503ca595c
SHA1 d68ff1e78ea78e7233ee37edde17fab8362e54b3
SHA512 ca217af2a397a7e5d7261d7eb27660bf962f90b290f77e0a0c9462f3eaec404461c08fc2ca74875621a87799394c7b6c187a65982992306c1c690f53a8d25bd8
SSDEEP 24576:UFmxgxUpE4+kmofSh89fMXzpvTX6+g1/e7NYXatuahVnoOxx/tLXaybZjIGi36l:UFmxwADKSEFvTXPC62XrahOOxx/1XaQ9
TLSH
T111655C47E2A324FCC56BC234872797B3B934B8245135BEBF8594DB302E52E90572EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libtasn1-6.dll

Path C:\Program Files (x86)\fwupd\bin\libtasn1-6.dll
Size 115KB
SHA256 1c00d590c8e43fcf7ea858ab404416072c46e3d4bf44fedc9154c84da4038556
MD5 d53a7f52feebba4a2c21c3df3f53ff1c
SHA1 5ae258059b4fb062ed37b2020ad35366c6e3a87b
SHA512 9707d9a70411f61e2f7a1fba1d9f76ec0f7ab72641e031ef21a8f842be04a5aab25e33e60e1988a3a83969f098e1b35c5387473c3a1736a55f4fa2f473ef21e1
SSDEEP 3072:yvhv88mYgH4FOvtWgp7cOccr0DbAyDzJrfF3U8:4RmXHEgprkDEyDzJrfF3U8
TLSH
T1FDB34C1BE25274BECA97D23495D78B73A630FC246230BE7FDB04E7B01D21E909A15B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libusb-1.0.dll

Path C:\Program Files (x86)\fwupd\bin\libusb-1.0.dll
Size 791KB
SHA256 e52e2a891b65460d065f43e73a1ee45380e0adf9f78cbf363d8da961187d0703
MD5 b1afb428a8561a8cdd0788e1ab92f264
SHA1 94b1acf1c8ed51817f34e283c2e94f4e1e1bc718
SHA512 a78d3fb0ff3ae00e86299b3f110293781971fb79d54cf9efebc200e65f0ad4cc4697ab4d2b59f3bff8bd7b13d3cc53b4d0922476028d4e626646bee419866417
SSDEEP 12288:L1wPjCgdtofmy7yAuc/jUre2wCwLv2EDVVUR9FzB07tilChEsXr:RwPjHtofHnBUre2VwiKVE1wHhEsXr
TLSH
T152059E4BBBCC5C29CAC149318C9B83A2F7F8F1612B5B9B7B471092741E27ED2ED45A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Program Files (x86)\fwupd\bin\libwinpthread-1.dll
Size 67KB
SHA256 3e27a182fa8217353f4eec3d9170dfda46361a1c717a449274993934b87ae66c
MD5 372877d69e9aaf4eb3790bbc26cf2fff
SHA1 782cef48d669e484d7f527b345fd0772a2c6ff2b
SHA512 f7714a0d5249338d045294e732ffc23b05b185fd5f2f45b4c3d0ccfaa1bf968dc7f71a623f34589ef52805197b096a5a9fe07573bc14a59961a8d353a993d16a
SSDEEP 1536:MqFwq3gZutb8l5gkyK6tPm3YkHKI+EbyT4u1Zy:MqF2U8nFyK6tPm3YkHKBEb+4u1Zy
TLSH
T121631A1A336A14FEC557A33094EB53737537F4202376AE1FE734D3312E6AD609A19A88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libxmlb-2.dll

Path C:\Program Files (x86)\fwupd\bin\libxmlb-2.dll
Size 194KB
SHA256 1c3d2237257d2c697e9df3ffdd578dde6dc0ce27fc0f4c783f58e41fd13d11b4
MD5 331f814c80238d94b0a4a7981ec78c8d
SHA1 5a04cf8f530ec9c7cd4620bb514f2f155f44ef10
SHA512 11eb453b56ddf713177419a025283016523ed9c979ddda2510c6433648d7df9095866d8cebbcf3b5aa3cc017fb2d8f2a6f4132d8d96b848e5a5a7a0ee2b3afcb
SSDEEP 3072:ohVWhy3p2QNdoYuaShBExz8n52OSUz5SXRgsFdM2ml2xk1t+aLIP:SFdXUwI9psFWPl2xkuaLIP
TLSH
T1D814193B1185245DD86B923491EBD77371B6B4251371FA7F46208B313F22EB4BA7AB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Program Files (x86)\fwupd\bin\zlib1.dll
Size 130KB
SHA256 699d6ac86e72f78070cf4323c13b152a59979512d1ad2acda8494c733e6b5963
MD5 1d69628fa389f26a09e115767409ea6f
SHA1 441d28d46c351b6c93adc61b5c48a91321f1fc1b
SHA512 7c4e37c7767889ecaf30f411813083b1f4c436ce6f15dc4695dfa943c29b771ae2218f01e8fa99223caf51b53d84ca7d66274eef839c14a05fe6592f3609042a
SSDEEP 3072:OzHysPgsCmN80Y5uShSjmmbhoKEiaycNhlr00h2gPKw+Fj22F3v:Oa9mNe0Sh7mWiaDK0BPd+Y2F3v
TLSH
T189D36B5BBA9375BDC6679230C6E78B72B134F81147316EBB9148D7312E12E901F08BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fwupd.mo

Path C:\Program Files (x86)\fwupd\share\locale\es\LC_MESSAGES\fwupd.mo
Size 91KB
SHA256 df07c42cc7e0efd55b94c649c9a922ae4b5598f49e03089c66729fe9992950db
MD5 2a727489fed2a4df8fb5e1e28b56200b
SHA1 64d1e2d40eff261a4a8324c6371a0869bab35913
SHA512 0fa3c7b73b674cc2b2991ec70b8c5c5a04badfe2a40c6dfe45d84da175f312cc574023b805f42e56b4bde7ef07739fd6b3296bf825d6feb06f48dc78d978cff2
SSDEEP 1536:WzoXFcLQTjJWqL+RPnQs4gimGWsoIKHcsqnH2dJhHMzDMl:SyTjJWq6PQs4giFWjIK2Ml
TLSH
T13793F95272C42933F993937EE6019277ABD8C1DC7258C39A906A921D7CCC9C8CD37AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallerTesting.vbs

Path C:\Users\Admin\AppData\Local\Temp\FWSetup_43250\InstallerTesting.vbs
Size 3KB
SHA256 80be69e3d2d2749901970f4b06d5dd9cb5c5cc81badbb79ba5bd7e514f43e4a9
MD5 2274ff4582adabce65bc984cdd29ccab
SHA1 e83f87e34dc0c693024c61c7992682c2ee763854
SHA512 9f0168005eb9df119b9de7f7207843d923b2904a3dea5b6a1092ee8ad31dc186d0cc763835b1c8f646f8aa8c0202a28f96b51d32039a4b3fa292b08f45e4750a
TLSH
T1B461A45F7A039330997297668827640EF1B0067B472414647E9C4C889F7272CFBE56DE
MD5 SHA1 SHA512 TLSH

Submit Download

fwupd-2.1.6-setup-x86_64.msi

Path C:\Users\Admin\AppData\Local\Temp\FWSetup_43250\fwupd-2.1.6-setup-x86_64.msi
Size 14.6MB
SHA256 91e42a249859074b43954a1e8cbc425e1d64c3e79284f06c6e4e7ea7c5524d2e
MD5 e2296212c07c8413f8ea78bcb626ca99
SHA1 2c55a349311c3e1e2ce604969d2d600702e94959
SHA512 4097934edd0768f61a9f700512021984ec17fe9a4d251eff0c970404b7b619ee8d5ed67cdad3d2593e6668e3e8983e78110bff985e316cd2b276894593a35ebf
SSDEEP 393216:6FQwdg876dqLYoaqIYr+XpHRrf1oxC8nwx7q1B:6uwdOqLYoaqIYC/Orom7
TLSH
T1A4F633D6E82BFE4EC671297AC9750A3EF323A525403670C677E0F48454B5A60F8B8CD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m.b64

Path C:\Users\Admin\AppData\Local\Temp\FWSetup_43250\m.b64
Size 20.0MB
SHA256 bc9fcf4170773997136d365811dec8b7aa9f2c68d1b4e2ebf92b4e4acc1a0bd6
MD5 f57a1b96401c2360deb0a975b7197ee9
SHA1 300c1f9f8b4f29cf8ba9fe4d31341485ce5c8258
SHA512 675a669e9d40a2d07989312be4266d1da18785da3e70b213ccab116d92db2e8c10a1d3ebf7bee6ad860215c442f16aeda0a920055024d2bdf0e93140d3622864
SSDEEP 49152:bmEdlznDU/nWg5Hg66NuiCl9TbPeVuvl23vjXTBVjhor5jV2kePuoRn65pDLj+IB:y
TLSH
T1E2272374F55D2BDE091091BDB1A9E9547CDD22870882836703AE82B931E5878DFF7CB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v.b64

Path C:\Users\Admin\AppData\Local\Temp\FWSetup_43250\v.b64
Size 4KB
SHA256 3ff2a2c841866e68592f407da43344760779da5f68934f7d8bcfa5988a9e3e61
MD5 10bab98aae3b38d3d5186b055a1cffb6
SHA1 3e94549b39431f795a94d38e82d567537def1e0f
SHA512 5edeb852611b9fa51a16dd4e8a478d770a0233b656298713976b0ba9b31f17723c82e7fd493d62fb728a4d35bab6024a61fa71d998f0ac8b1c9355743a1a2b29
SSDEEP 96:LrOlXOacFko/lEgKdnDXNErH9kZ5pNh/DNN5Sefp9CKNKFMYp:HOxVukodEg6hWkZbfDNND9xYma
TLSH
T1C4918768CE471E4C7A8632BD6EDE7DC4538D33EE05500AED5D16A5CC53368E541C70E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.msi
Size 13.0MB
SHA256 cfaa14efc44bc4c233e268264dfabe0532140b8466c62573a2a58d8cd5f7ce89
MD5 5c35a74ca8598d9b54ecd1ed6625a92d
SHA1 f99adfbb40fdb58e42d0f8d4730893fa31394202
SHA512 a540f196ce297801e84ca626885ce7cc2bc9adee1056e4fe2a043b6463b996e43af1ecf2ac1163397ae705891ef17562bfd5c350d4cad16f43b964c3c468ffdf
SSDEEP 196608:xrnLYG3zDhukO2rnLYG3z0rnLYG3z2rnLYG3zfrnLYG3zIrnLYG3zprnLYG3z:xbDDDgv2bDD0bDD2bDDfbDDIbDDpbDD
TLSH
T177D6233167FD4A18E1B36774EE3A91E1D1367DA4DF11D18F2264386E68B1E4082A373B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

download.ps1

Path C:\Users\Admin\AppData\Local\Temp\download.ps1
Size 349B
SHA256 5f1e17f8bd861f5466e45574f76a1b8fb1095cb88978fa6f4cff43d0170585f8
MD5 9de4c2385ce8f62155c21d470b8ea731
SHA1 1a6a8c84c36d19e744fc664525d44e888ab9603c
SHA512 11e4abf7a6a7ddb385f169543456ce4f22d885339d00f92df5c8f0cec3d7d66d8a0273cefe127d1d52b3333924989891392479ba90135c132de6132ef14404a3
TLSH
T1DDE06863F24A2278194A1262C42B439AF5355CD9574631626370902CD582A9CDBFC2C0
MD5 SHA1 SHA512 TLSH

Submit Download

devices.json

Path C:\Windows\var\cache\fwupd\devices.json
Size 3B
SHA256 8eb95bcbc154530931e15fc418c8b1fe991095671409552099ea1aa596999ede
MD5 3d29a75fcf0ed7dfff86d3db8f92fc69
SHA1 dff8a1731f59ccad056b346102d1e1d014b843f3
SHA512 b7a65febc18b7eb5b159100842eed0018f0b56694baf042e366a97b1d8fe9eeb238b6ced3fe1b27c659837564ca3605e1c733e4f4621e3e8584237a6880f47ef
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 4520e41cbe346f0ad27254070de1b3a183555860355d0621ede220057d8bbc4c
MD5 06e36379ffe22b2f790669e29f3ca63d
SHA1 463f936e143b4befe99ec5df9f73bedb3da72d42
SHA512 7415a5db8be7501582ec95821276b09a1d557c832ea1e51c26f33157fa76a75113bc471bf5ecb8c4d7d4b08532e19de58b461c2159d9b38d77f53dab8ead4f62
SSDEEP 24576:IFo3DMPGdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+a:rHc
TLSH
T1DA57B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7db733e2-b6b0-41a9-9b88-0eb58275da64}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{7db733e2-b6b0-41a9-9b88-0eb58275da64}_OnDiskSnapshotProp
Size 6KB
SHA256 830fb1efec5326d46cb7113c2de8f6f09bb8b61632a70c03be7d6fa01b66e235
MD5 6eec508ba2cca365ea8b14ce6544523b
SHA1 24d35fc23bccab4f88aae3549d5f0b90e85fa50f
SHA512 f627b7345bef007e05599abaf810a31a06602e9f383697dd13ff795c3b5689ae49b9f04a6f62f1821f0429df4dc9eea6067e4d4c4800a8e91f8b6fa67432a30b
SSDEEP 96:Fqp7bCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:Ypeb++uVmN
TLSH
T14CD1780C1AE54711E2B3AB7129F18557A877B911FF33CB8E0198238E2671A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2592-12-0x00000142CD390000-0x00000142CD3B2000-memory.dmp

Download

memory/5696-255-0x00007FF9CD2A0000-0x00007FF9CD70F000-memory.dmp

Download

memory/5696-244-0x00007FF9D20D0000-0x00007FF9D2121000-memory.dmp

Download

memory/5696-241-0x00007FF9CDC40000-0x00007FF9CDDA3000-memory.dmp

Download

memory/5696-242-0x00007FF9D3FA0000-0x00007FF9D3FCE000-memory.dmp

Download

memory/5696-253-0x00007FF9CD7F0000-0x00007FF9CD9B6000-memory.dmp

Download

memory/5696-252-0x00007FF9CD9C0000-0x00007FF9CDAE7000-memory.dmp

Download

memory/5696-237-0x00007FF9CDF40000-0x00007FF9CE16A000-memory.dmp

Download

memory/5696-232-0x00007FF9CE300000-0x00007FF9CE495000-memory.dmp

Download

memory/5696-231-0x00007FF9CE4A0000-0x00007FF9CE715000-memory.dmp

Download

memory/5696-227-0x00007FF9CE720000-0x00007FF9CE892000-memory.dmp

Download

memory/5696-254-0x00007FF9CD710000-0x00007FF9CD7EA000-memory.dmp

Download

memory/5696-251-0x00007FF9CDAF0000-0x00007FF9CDB38000-memory.dmp

Download

memory/5696-250-0x00007FF9D0310000-0x00007FF9D0332000-memory.dmp

Download

memory/5696-249-0x00007FF9CDB40000-0x00007FF9CDBCE000-memory.dmp

Download

memory/5696-247-0x00007FF9CDBD0000-0x00007FF9CDC38000-memory.dmp

Download

memory/5696-246-0x00007FF9D1F90000-0x00007FF9D1FB3000-memory.dmp

Download

memory/5696-245-0x00007FF9D20B0000-0x00007FF9D20C7000-memory.dmp

Download

memory/5696-248-0x00007FF9D1EC0000-0x00007FF9D1F03000-memory.dmp

Download

memory/5696-243-0x00007FF9D3F30000-0x00007FF9D3F42000-memory.dmp

Download

memory/5696-240-0x00007FF9D3FD0000-0x00007FF9D4003000-memory.dmp

Download

memory/5696-239-0x00007FF9CDDB0000-0x00007FF9CDE74000-memory.dmp

Download

memory/5696-234-0x00007FF9CE170000-0x00007FF9CE219000-memory.dmp

Download

memory/5696-236-0x00007FF9D5FA0000-0x00007FF9D5FB2000-memory.dmp

Download

memory/5696-235-0x00007FF9E17C0000-0x00007FF9E17D0000-memory.dmp

Download

memory/5696-233-0x00007FF9CE220000-0x00007FF9CE2F5000-memory.dmp

Download

memory/5696-229-0x00007FF9D4040000-0x00007FF9D40C5000-memory.dmp

Download

memory/5696-228-0x00007FF9D5FC0000-0x00007FF9D5FFE000-memory.dmp

Download

memory/5696-226-0x00007FF9D72D0000-0x00007FF9D732B000-memory.dmp

Download

memory/5696-225-0x00007FF9CE8A0000-0x00007FF9CEA55000-memory.dmp

Download

memory/5696-224-0x00007FF7D0120000-0x00007FF7D0144000-memory.dmp

Download

memory/5696-238-0x00007FF9CDE80000-0x00007FF9CDF3E000-memory.dmp

Download

memory/5696-230-0x00007FF9D4010000-0x00007FF9D4038000-memory.dmp

Download

memory/5696-273-0x00007FF9CDC40000-0x00007FF9CDDA3000-memory.dmp

Download