85ec038fe75d62306f8710565aeffa4f629577eff94938349def0d9fd1d3caf4

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fwupd-2.1.7-setup-x86_64.msi
Size 15.8MB
Sample261102-nzyk3avw9j
SHA256 85ec038fe75d62306f8710565aeffa4f629577eff94938349def0d9fd1d3caf4
MD5 40b896202b1bc53dd0882a3cdbdd10ea
SHA1 92c77596509ef82a115d1026623640174da770c5
SHA512 1e2365fd45ad6f39ec3c6d4d779b4403557e2ed6845788ba790bc7b82c09774601d17d321ee3340f0e544ad2805785522d31167aa82be75e68ccd9ae40901c2a
SSDEEP 393216:MoUAP5CA01GNrI4G1Infw/gKly/cPM78qZjKb8slRAqyQOtqH:M/ee5enfwY5UPQ8qZeb8UA6Oc
TLSH
T109F633F8F898FC7EC272443990B99A1BE3307969106B90C537D0F6A5207A9D6F571CCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5232	fwupd.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\Wine	fwupd.exe

Loads dropped DLL 33 IoCs

pid	Process
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe
5232	fwupd.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\fwupd\bin\libwinpthread-1.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\fwupd\remotes.d\lvfs.conf	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\uk\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\sr\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ast\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libfwupdtool.exe.a	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libintl-8.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libpcre2-8-0.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libgcc_s_seh-1.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ru\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\da\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\sk\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libreadline8.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libgobject-2.0-0.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ca\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\af\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\es\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\zh_TW\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\bg\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\fwupd\quirks.d\builtin.quirk.gz	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libxmlb-2.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libgio-2.0-0.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\dbus-1\interfaces\org.freedesktop.fwupd.xml	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libfwupdengine.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libgmodule-2.0-0.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\gspawn-win64-helper-console.exe	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\pt\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\sq\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\pl\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libfwupdplugin.dll.a	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libfwupdutil.dll.a	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libssh2-1.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libusb-1.0.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\lv\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libidn2-0.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\fwupd\remotes.d\vendor-directory.conf	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\gl\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ky\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\cs\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\et\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\he\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\tr\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\zh_CN\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\kk\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libnettle-8.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libcrypto-3-x64.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\liblzma-5.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libgmp-10.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\eo\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\eu\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libzstd.dll	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\pki\fwupd-metadata\LVFS-CA.pem	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\si\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ja\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\fwupd\metainfo\org.freedesktop.fwupd.remotes.lvfs.metainfo.xml	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libfwupdengine.dll.a	msiexec.exe
File created	C:\Program Files (x86)\fwupd\etc\fwupd\remotes.d\lvfs-testing.conf	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ka\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\ar\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\sl\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\locale\nl\LC_MESSAGES\fwupd.mo	msiexec.exe
File created	C:\Program Files (x86)\fwupd\share\fwupd\remotes.d\vendor\firmware\README.md	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\fwupdmgr.exe	msiexec.exe
File created	C:\Program Files (x86)\fwupd\bin\libfwupdutil.dll	msiexec.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\var\cache\fwupd\motd.d\85-fwupd.W4AGY3	fwupd.exe
File opened for modification	C:\Windows\Installer\e59c961.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{76493109-E6AB-5C48-940D-49544A688596}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID075.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{76493109-E6AB-5C48-940D-49544A688596}\fwupd.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD0887A64DF93218B.TMP	msiexec.exe
File opened for modification	C:\Windows\var\cache\fwupd\devices.json.D29ZX3	fwupd.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e59c963.msi	msiexec.exe
File created	C:\Windows\Installer\{76493109-E6AB-5C48-940D-49544A688596}\fwupd.ico	msiexec.exe
File opened for modification	C:\Windows\var\cache\fwupd\quirks.db	fwupd.exe
File created	C:\Windows\var\cache\fwupd\quirks.xmlb	fwupd.exe
File created	C:\Windows\var\cache\fwupd\metainfo.xmlb	fwupd.exe
File created	C:\Windows\var\lib\fwupd\pki\client.pem.Y359X3	fwupd.exe
File created	C:\Windows\SystemTemp\~DF13A4EDA3C7BC15DE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6A86FF142B66BDD3.TMP	msiexec.exe
File opened for modification	C:\Windows\var\cache\fwupd\quirks.db-journal	fwupd.exe
File opened for modification	C:\Windows\var\lib\fwupd\pending.db	fwupd.exe
File opened for modification	C:\Windows\var\lib\fwupd\pending.db-journal	fwupd.exe
File created	C:\Windows\var\cache\fwupd\metadata.xmlb	fwupd.exe
File created	C:\Windows\var\cache\fwupd\devices.json.C29ZX3	fwupd.exe
File created	C:\Windows\var\cache\fwupd\devices.json.D29ZX3	fwupd.exe
File created	C:\Windows\Installer\e59c961.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8EDB08027CEF4414.TMP	msiexec.exe
File created	C:\Windows\var\lib\fwupd\pki\secret.key.C1G9X3	fwupd.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000c00000001c5fa-163.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
896	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b0d977edac71670e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801b0d977ed0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101b0d977ed000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3b0d977ed00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6b0d977ed00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\ProductIcon = "C:\\Windows\\Installer\\{76493109-E6AB-5C48-940D-49544A688596}\\fwupd.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\90139467BA6E84C549D09445A4865879	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\90139467BA6E84C549D09445A4865869\Complete	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\90139467BA6E84C549D09445A4865879\90139467BA6E84C549D09445A4865869	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\PackageName = "fwupd-2.1.7-setup-x86_64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\ProductName = "fwupd 2.1.7 (64-bit)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\PackageCode = "D896ED63ED078A640BE9315791886DA5"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\Version = "33619975"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\90139467BA6E84C549D09445A4865869	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90139467BA6E84C549D09445A4865869	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2084	msiexec.exe
2084	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	896	msiexec.exe
Token: SeIncreaseQuotaPrivilege	896	msiexec.exe
Token: SeSecurityPrivilege	2084	msiexec.exe
Token: SeCreateTokenPrivilege	896	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	896	msiexec.exe
Token: SeLockMemoryPrivilege	896	msiexec.exe
Token: SeIncreaseQuotaPrivilege	896	msiexec.exe
Token: SeMachineAccountPrivilege	896	msiexec.exe
Token: SeTcbPrivilege	896	msiexec.exe
Token: SeSecurityPrivilege	896	msiexec.exe
Token: SeTakeOwnershipPrivilege	896	msiexec.exe
Token: SeLoadDriverPrivilege	896	msiexec.exe
Token: SeSystemProfilePrivilege	896	msiexec.exe
Token: SeSystemtimePrivilege	896	msiexec.exe
Token: SeProfSingleProcessPrivilege	896	msiexec.exe
Token: SeIncBasePriorityPrivilege	896	msiexec.exe
Token: SeCreatePagefilePrivilege	896	msiexec.exe
Token: SeCreatePermanentPrivilege	896	msiexec.exe
Token: SeBackupPrivilege	896	msiexec.exe
Token: SeRestorePrivilege	896	msiexec.exe
Token: SeShutdownPrivilege	896	msiexec.exe
Token: SeDebugPrivilege	896	msiexec.exe
Token: SeAuditPrivilege	896	msiexec.exe
Token: SeSystemEnvironmentPrivilege	896	msiexec.exe
Token: SeChangeNotifyPrivilege	896	msiexec.exe
Token: SeRemoteShutdownPrivilege	896	msiexec.exe
Token: SeUndockPrivilege	896	msiexec.exe
Token: SeSyncAgentPrivilege	896	msiexec.exe
Token: SeEnableDelegationPrivilege	896	msiexec.exe
Token: SeManageVolumePrivilege	896	msiexec.exe
Token: SeImpersonatePrivilege	896	msiexec.exe
Token: SeCreateGlobalPrivilege	896	msiexec.exe
Token: SeBackupPrivilege	5440	vssvc.exe
Token: SeRestorePrivilege	5440	vssvc.exe
Token: SeAuditPrivilege	5440	vssvc.exe
Token: SeBackupPrivilege	2084	msiexec.exe
Token: SeRestorePrivilege	2084	msiexec.exe
Token: SeRestorePrivilege	2084	msiexec.exe
Token: SeTakeOwnershipPrivilege	2084	msiexec.exe
Token: SeRestorePrivilege	2084	msiexec.exe
Token: SeTakeOwnershipPrivilege	2084	msiexec.exe
Token: SeRestorePrivilege	2084	msiexec.exe
Token: SeTakeOwnershipPrivilege	2084	msiexec.exe
Token: SeRestorePrivilege	2084	msiexec.exe
Token: SeTakeOwnershipPrivilege	2084	msiexec.exe
Token: SeRestorePrivilege	2084	msiexec.exe
Token: SeTakeOwnershipPrivilege	2084	msiexec.exe
Token: SeRestorePrivilege	2084	msiexec.exe
Token: SeTakeOwnershipPrivilege	2084	msiexec.exe
Token: SeRestorePrivilege	2084	msiexec.exe
Token: SeTakeOwnershipPrivilege	2084	msiexec.exe
Token: SeRestorePrivilege	2084	msiexec.exe
Token: SeTakeOwnershipPrivilege	2084	msiexec.exe
Token: SeRestorePrivilege	2084	msiexec.exe
Token: SeTakeOwnershipPrivilege	2084	msiexec.exe
Token: SeRestorePrivilege	2084	msiexec.exe
Token: SeTakeOwnershipPrivilege	2084	msiexec.exe
Token: SeRestorePrivilege	2084	msiexec.exe
Token: SeTakeOwnershipPrivilege	2084	msiexec.exe
Token: SeRestorePrivilege	2084	msiexec.exe
Token: SeTakeOwnershipPrivilege	2084	msiexec.exe
Token: SeRestorePrivilege	2084	msiexec.exe
Token: SeTakeOwnershipPrivilege	2084	msiexec.exe
Token: SeRestorePrivilege	2084	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
896	msiexec.exe
896	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
896	msiexec.exe
2084	msiexec.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 5600	2084	msiexec.exe	95

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\fwupd-2.1.7-setup-x86_64.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:896

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5440

C:\Program Files (x86)\fwupd\bin\fwupd.exe
"C:\Program Files (x86)\fwupd\bin\fwupd.exe"
1⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in Windows directory
PID:5232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59c962.rbs

Path C:\Config.Msi\e59c962.rbs
Size 30KB
SHA256 54e67f00e732c293330114c9178b1cb91c3bdae6333a5456b9b9049b55e07eeb
MD5 67934209ca4ec559301d154f4d2facbe
SHA1 40cb9669b641cd87bf002de4a9e003ecd53e8802
SHA512 fee0455f2b11daaf7c449ecf2b80880876a25815253471612500edd96652038b8b1aa88ba18b133733bce1a359f6b72b057bbf9ce386a1d4c3eb78c9ad6c1dda
SSDEEP 768:WKjeASi/TKGtde/stpeUvIFFM7XLaqCPhviJ1pGmpohnOPE+b6OHfT7awilOIFxE:VjeASi/TKGtde/stpeUvIFFM7XLaqCPY
TLSH
T17AD21F404C07D5C2F246ADA2BBD36C24C758FE2C6B744CAA40CE872F9DC0756BDAA4D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fwupd.exe

Path C:\Program Files (x86)\fwupd\bin\fwupd.exe
Size 235KB
SHA256 8018cb8f2c84503aeae84d4e51959c5adb67aa221f406b806d1d915f0caf25e0
MD5 1445a0231d17e39cef1c61780f795dde
SHA1 aa1ade1e267ec0b67b8733027f555e7c575ac632
SHA512 a2478e6b7b283216f73ae0617b3e913ddf086134bac789c5b7a6b0ad32421d8f3f1190ca88484ab2f28cedd854dd2f14a2c2a7c3f87f401b3c2a8e0edf6d01b7
SSDEEP 1536:6y/ICBe0eQMJefaI+Ux04wD+H5YGuSkFf337jKaP/h2GpghPzWRG7mBt3NnEwRTg:6y9YI+Um4oo5HkxeewKFFxTDubyrPo
TLSH
T1CC3408D276C05CEAEA15423C94AAC324633CF1E492629B17693437311F53EE23DD7A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconv.dll

Path C:\Program Files (x86)\fwupd\bin\iconv.dll
Size 38KB
SHA256 74e23093e962adceccf77d2b05af4f4c7d6deee4a524140a296609f849700fc2
MD5 c39b9016c53f48535909a965691412ec
SHA1 c76276190ad5838d1934df8298a71a80b8723f3c
SHA512 a70e1a29c73b2a0aaa00caea7ed60739cc94eeb2e6dc16db66cbaf9d9bd636403db1adca120e546df453a0ea6719aa5edd48de5a8c48535b9754651a79d507c3
SSDEEP 768:w6Crb+L0SGiakPPi3Ti2T+A12ytDkj78TgC/uRa3j:1WSL0YpPK3TnT2ys7PauRa3j
TLSH
T13F030810A38D485EE866D2386CEB5B737634F8325A63E72F0614E5704E336D19E3DB89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Program Files (x86)\fwupd\bin\libcrypto-3-x64.dll
Size 5.0MB
SHA256 1755b70d1b7e9de4780859e4eb2f2e0faca9f744467ecca77b800e59f6032924
MD5 e3884d7b7531a1771d1bc15016accf86
SHA1 f07816c79698dd24735dc3f278b00b36af947881
SHA512 f9330a8dadae9e4c12d36c86acb8b3edee57da544fe6a52b93f4b65b31b32c8f6f2260440d4ae14c1398201826ba2ae8c358020aec0c7c687d05945b9f1204c9
SSDEEP 98304:8b6DYUw+ytiNaOgremfaimrh/1CPwDvt3uFXZClCXtv13uFnCPwqU8WkwrR3:+y4qp1CPwDvt3uFXZClCXtv13uFnCPwn
TLSH
T1AB365C2BA07F246DC95FD2B1C2EF6B337634F92003B46E7B6914DBB01E21D90166AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl-4.dll

Path C:\Program Files (x86)\fwupd\bin\libcurl-4.dll
Size 946KB
SHA256 e228b8aa6f8980dbc64c6e1693b060c3d759c625471fe6aabd1ee8a467016b99
MD5 16a936c7be5a6aa8449546ac782eee01
SHA1 1b4feb79733d25c61bb9535de714c515259e2335
SHA512 3b636f002ddea356ccff030a7eed570f42d01751ed22ba0139fc16dc78beed0a4b5d8bc98bbddd24b1b033440f1424761a42fe2a8c37789c3b05c5c63148da51
SSDEEP 24576:3xxk2BEEHKLff5GkGtY5U/azOsSCkktANxv1YhhBVUqWIL:Y2xHKL5/a/hMkktANxv1YhhBVUqWIL
TLSH
T125254C27A19225ADC66BD23482EB9773B675F8361130BE7F1620DA303E51ED0173EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Program Files (x86)\fwupd\bin\libffi-8.dll
Size 36KB
SHA256 c9bb0704e54c17bd72ee7e87fdb1c897928aa38c60eeda1f7586d902f842b857
MD5 cb65dae2c161b1ec5404cbe749cfa993
SHA1 8fac0667a00dd8bc0108b61a5aa88b48c2830f94
SHA512 413282bfd581e842136aa664aeaeb5acbd42d7d88e37363a9416403fa2cb348d3da11c41718306fec0cd7329b8eded045d04f240ed96dfb5e03e637c8e05e700
SSDEEP 768:p6dVjfj0gWnbV4SXkUbsLk0gez3333333333333xZdT7I7d6G91QC:UDNWJjzbsBDz3333333333333l36dB1R
TLSH
T1BBF22C166782997DC84AF235E8F687B3F634F8250721AF3F01A5E2715F2BA900659F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfwupd-3.dll

Path C:\Program Files (x86)\fwupd\bin\libfwupd-3.dll
Size 700KB
SHA256 1104e1bf992c887f7ed98e342a615438e86f3f8fddadeb771970359145146708
MD5 3fbbfbfb387610962ef4127ea2380817
SHA1 1e14dbe9ef15c253d462faeb59684c0f18d69290
SHA512 6848792be2f9588211ca63cce060c06ef0c1c9d4ec4896d2f670afaeeea9a0b44c7f5ef1c348dc54b2e044cdc4b3aff36ebb6fcb4318daf3a578d2f9d45283c9
SSDEEP 12288:mM97mUeGWFgPELUg5HZyiXz84DC2wRx5VUUvl:mM9hrDPEQg5HZy284tw3vN
TLSH
T17DE40B2E10D01D5EF92A8135C66BD7222178F2784371FB6B9420C6347F91DB1EAAEBC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfwupdengine.dll

Path C:\Program Files (x86)\fwupd\bin\libfwupdengine.dll
Size 3.6MB
SHA256 e023f3b8af19ae42c70f03b1d00d258fa123e824aee130dba8a68f8071d45a86
MD5 4439c7d66ba1545d9f3130da4288b91d
SHA1 e8756734e77fe62531cceab0e908d4769fa47cf5
SHA512 c070b163a44cfbc902befc89cea1a26253c17785c28cbc1ef9990679ef2088aee07e00c913fae39b4d0b92a41e2d49404518055acb64f6318f80670fb2c73071
SSDEEP 49152:xdSzoETdlxD+R+10x93c5wIhbVccqeWZSgt5/KKTpJDAaoP4KD/bADa:bQDWok4gtoKTg4KD/bUa
TLSH
T17E064A23B1B698DDC9E6C27C829EE3327678F6A04725BF77742445312F11FE1166BA08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfwupdplugin.dll

Path C:\Program Files (x86)\fwupd\bin\libfwupdplugin.dll
Size 2.1MB
SHA256 d7569d6fa0e6eb028e4e8e0cd3e3434cf5397f324e20a6083265749981c6a6c4
MD5 6a467f95325eaa46d483088cf6806d6c
SHA1 dabc1ca416c9c23fb79691d1beea0697c833da55
SHA512 26401058decc329e2a5f16763f4a87a9289a95755ddcbd373a20d726de2210ddc41e45b351ea5b0318933a43c6cdddbe36b474dcc7bcf72610b830a08f1f8a99
SSDEEP 49152:IdVEuSrMMLTWEn018a3X/nbSTFzh+jYZLq:0qFsL/nbSTFzh+jYZLq
TLSH
T10DA55B2761E5988DC9EAC23C81DED3236674F1610724EF7BB42486342F51FF11AAEB49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_seh-1.dll

Path C:\Program Files (x86)\fwupd\bin\libgcc_s_seh-1.dll
Size 969KB
SHA256 7d5458682d7dcc2838c38c4401bcf25a15af0e2b0bc95ad6f5d2eafc0eaccb4f
MD5 0f1c56a50cb611339b4070993dc250fe
SHA1 d74e8a281d627855cd29df94d09282479424e0f8
SHA512 5f997f9101a58f31f6c179601e6687e864c64b0fd5abf84c80792618d11ca9a2d11ca14004de93723286f205222274b5de325fba3502ba7c473b02b58303911f
SSDEEP 12288:3IQ/sqa6rSoKD003yH+pCM9FdI2y4mgMD5/7rA3eNp78pbEU:3I/gEDAH+pvI2y4mgMD5/7r3AbEU
TLSH
T132257C947B4D60AAC07102F169A707A76730B58433DDD72BB9683634DDC33E4DE8AAD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgio-2.0-0.dll

Path C:\Program Files (x86)\fwupd\bin\libgio-2.0-0.dll
Size 2.1MB
SHA256 14ed66c82bc0c43f534dcd4da009a83d977a9600139791acf0f0601e1b0eecbd
MD5 248e658f13bd57886a9df9583e971231
SHA1 bea9ca0db1e3685fe38aed15919b7b9a65560758
SHA512 10e4d0a62dacf3416983f9cf6a1bdaa74d8c495cf1761b84dc593ea1b6c9ee382e9d9c4304353deff441167fb92d7e51fb7c12c1af0b3dc185de9ef6f8934f4f
SSDEEP 49152:zJJV0PUrv1H2uIWVODL6l6QwWLVrAPVW1Wm:44eU5BrAPVW1Wm
TLSH
T115A538279296645DCABBC23085AFA7337234F8241631BE7B5924C7357F71FA1026EB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglib-2.0-0.dll

Path C:\Program Files (x86)\fwupd\bin\libglib-2.0-0.dll
Size 1.6MB
SHA256 02b7abc146174cf607bfc6383f933845719df7a50129baab9cb59a5c83a485eb
MD5 053305d6aa80f531455eec08f8f1ebd4
SHA1 0b21cd581145be4b92a63df65894b96c28f44a26
SHA512 cd00bbeefb3309ce6207e73c83c6f3972db1e23f6563b7db2f6eb7825e3943b4c861df0a4d94c0b46041169e5188a48ed33eb8411508e8e9af06584f95ab1b8a
SSDEEP 24576:+4kdi8I5Gf12bpQnmymVcwmFYfhnrJItiMzNtvs31M6hZe333+Ez02nNx:+y8IkQ4mymVJmFYfhrJstviHe3jY2nNx
TLSH
T10B851816A24278AFD797DE3484EA97B3F630B8240F33697B2D5CD6341E2DE52021AF15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgmodule-2.0-0.dll

Path C:\Program Files (x86)\fwupd\bin\libgmodule-2.0-0.dll
Size 29KB
SHA256 1ac633164a67e9226aa7812d1a815e890066b8dcb9a4b79643898943ebd23712
MD5 7d9d99a7129be2d86a1d8114bee0aead
SHA1 4d5e0d538746bec31be97318d7ab517efabdf833
SHA512 3d6e272cdb5d8402ac4240ff5bc53e6289184326f91400c559e9cfb071940c02ee686ecfa303bb9c0dec61e3f142fb58ea37e1fbfe3f72ef4b6bc3397ea29719
SSDEEP 384:Tl6jdo8AAhXp5EHroAboiBR/PEoLLmjmZBSG580oInrbntV1M4Nzb:R6jdo2hX/ELDbfJMaqa7oQNVJNzb
TLSH
T1DFD2E81A7285586FC89EE33DF4FA5233F679B4251A72AB2F0318C1F05F763A045A8B45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgmp-10.dll

Path C:\Program Files (x86)\fwupd\bin\libgmp-10.dll
Size 738KB
SHA256 f08b10f629adba4fb0dac80b5cef1e71ea409a7b0def52f65abd217ceac6669d
MD5 2a1771e1ca3c9971983e67c7a280cea6
SHA1 8e9b8079738f6d4ee4aa5ea3eac6e7fa68aaa2fd
SHA512 cc144c598b1e34ff902a247ee05a202e56354ebf5a4ab79e5906560f14df2a6d467ab0a751769c3fc947765e1b4f5bfa692fe885858c8444ff521725d5678a6f
SSDEEP 12288:zP555bCphCmVvvIbcrcOC4HYAv/j/4tf7AUt0MF32:L/pmVvgbcrcq3vL/4j5t0MF32
TLSH
T14EF47C33919378FCD15BE3716AAEAF73B221B5250534AE3B42D4D6301FA9C900E5877A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgnutls-30.dll

Path C:\Program Files (x86)\fwupd\bin\libgnutls-30.dll
Size 2.4MB
SHA256 2688344f1848618e328814d196fdac14ac13869f58d8e82cd0ec12b45a2b5e68
MD5 0d767ebf4e9576f4e3e0bd43067a313c
SHA1 224df62168a81c6e51edbe0164410d36ebdd3f17
SHA512 df38edb11b4ce2c0eeab2794a3c5f1a22374e295526b04d73dea35a15e3002296f743e3e61173827481dd6bb6d82686e16cb5efb2a50a71b9531160c0c41a682
SSDEEP 49152:KIwxx54dYRp3kmHdwawd5V6sU2RGtlqOBXNaOEAMXk2XAxOg/wBYxqf:cdHdRw7CBXNnOQwBYxqf
TLSH
T1CEC53A02F5D2A59CD967D634CA9793737373BC20A930DE7B6E44F6786E31ED0062AA04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgobject-2.0-0.dll

Path C:\Program Files (x86)\fwupd\bin\libgobject-2.0-0.dll
Size 408KB
SHA256 05f64f54697fd2282aaa1a855cf9a638b3d93bbdcef0f74bf19b860a84cdbcbc
MD5 bc64bf8ee49693dbe8ecddf934f6c32d
SHA1 7fb1bc25fe3ba3885e2916a54c855cf6612296dc
SHA512 f9673dfbda156c13855342db7ebb5ddf58725399a7cc476f4e9f2284b0398cea0f2b388345be52086b85029bd0131aedffb11b78cdb39196995bf814bc9e9768
SSDEEP 12288:vTtj/LBPBDS1vjXJgHd0yziLXu1nR4xnTQ:Bj/LBPButK6Xuv4xnTQ
TLSH
T117942A2BB312782DC997D13481CEE723B771F52823727EFB5298C2705D29D94562AF0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libhogweed-6.dll

Path C:\Program Files (x86)\fwupd\bin\libhogweed-6.dll
Size 265KB
SHA256 0688d3d9880556c9f46d88681e5a307a13e141da9e48b6b02c58ff77ebb69582
MD5 8095f37919fb07f2df0e7150988339c7
SHA1 245abfb5d4e2fccf097b85da310d78a94f13e0ae
SHA512 a9f55eeb1869e3dd040119ba586e74465342f9ca5e90804dfd1e309438af351313857f982b6e328e1fc20de8a234cd958f3f927bbc0c109423f0804a418d7f35
SSDEEP 6144:h+tc3RZiZYlKCpfwDz3HurSH6M3CHgPGan9/:P2SlvfALIauban9/
TLSH
T18244AE13C3895CFEF97FA3359AA886737224F86009F1DB571214E6643E77AD08E19398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libidn2-0.dll

Path C:\Program Files (x86)\fwupd\bin\libidn2-0.dll
Size 401KB
SHA256 d8584b766af8b59e705bd31cefd86f3e4249f73f569b2ff557d18d490f7ddb2b
MD5 03e1cce6291c97c2c65348f8bdfbd8f3
SHA1 50c6068e6550720f23cf195ca08647ced6cd6ae2
SHA512 f20f9aae896431305a7d251e9082d1853050b04ec01704458b9cea74ae73a634321bda13e9e80c48bbe07209fb25bf9bc41312d4eaeaad72e6d99d6836949761
SSDEEP 6144:av+3ncFyXHQQqBsDwSs4CWHAhIvdEcvH/ukNg2p3y0:avicYXwyYWIyg2p3y0
TLSH
T15C94FA42FAA2D56DEA3B8132A49B5B6303937C718EB3479BB71CF5AD6C36DD00D50209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libintl-8.dll

Path C:\Program Files (x86)\fwupd\bin\libintl-8.dll
Size 310KB
SHA256 837bf639dc29ea04360d1b2ad3369ed6323b57582bfe4ab013a34aed387991b6
MD5 24a56270cfd84173614dee68b54bf9ea
SHA1 2d56d1da2c0ba4f0018e8a0deeb8ff2e15c2e45e
SHA512 6d27cabf3dd5ed9e4524276dba56a82349cdd3f00e490bf63c32458e93288c7487503a8743ee5a475c554c4ad6e6543d9ea51a51ef25315c3702810088ef3ba4
SSDEEP 6144:Vz49yGkQLxTBr/qvWLJRHFVeQSegSZKF3:V89ZTBrxFRlVeQSegSZKF3
TLSH
T18C643907B2429AA9E057953499DBC7B17F73BC720BE05BB725A0F3382E328905B14B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblzma-5.dll

Path C:\Program Files (x86)\fwupd\bin\liblzma-5.dll
Size 170KB
SHA256 739fb3c3e31f7e2ca54469b1bd8a0ee39a03a7bee69ef64e48135a5c86bc8cee
MD5 513dbf2ce9ac2daabd205eac67ce2705
SHA1 7893a68a61e1f67cfc3f8d24ff2e723f7ab0744b
SHA512 4f55f5fc9b4819aafafedd85b1f73a03204747c227a643cb7d5ac7db5b334960ec467bd813df8b158a58bd06e804eb86bc22801d891c23ec57da583dbc407699
SSDEEP 3072:uQM53zEupAIixIYflD6Jko9mNovhow1s1hFSI3F3R8:shEL7fh6JYOv2wAFSI3F3R8
TLSH
T15504FA529151F5EEE62BD930D5BA9F33B6E4B42102205A3B959CD37C1E3FBB00A0971B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libnettle-8.dll

Path C:\Program Files (x86)\fwupd\bin\libnettle-8.dll
Size 357KB
SHA256 a3ad6f97c218bdffaecbd0b03e6ee1aa7737011a8325050d37fb7adc71b7fb1b
MD5 0bb3894c112d173567c462bd08ee8fdd
SHA1 63e7f771edd6a1484df956eb4b56a23d6db1ec43
SHA512 dfb95adc305d14417416fcce592f6f24d7e04050e7cb5aee66822cd52be7eb81febb07812c5a74f24e9deb5f5994a54f69ced1cc3c30f37a07c58874afbbecd3
SSDEEP 6144:rfQDgJ5ZNLz6DlVZ9I2z08aqqDPJ4FkwcNOF3b8:rfJ5ZNL+DvZ9I2w8vqV4Q4F3b8
TLSH
T1B5746B0BD69964FDF55B933099AE93327334F8B40AA09BE7534CE1747E226D08D50AEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpcre2-8-0.dll

Path C:\Program Files (x86)\fwupd\bin\libpcre2-8-0.dll
Size 709KB
SHA256 ef3fc679d56907b48cc09013f3fe84d427dee6fd48941a0a57dc7839ade7e4dc
MD5 df01bafee111b8f308ef0ae82c46376e
SHA1 76d860f0563ed08b1901f63f22d13c4776bffec6
SHA512 24e50b97238173965d67e7bb1d80c65d8b76a06fdae70e04ba8ae6acbfb565c6f5f5ca8463464af2df0d440d2b5943f006e7a8fed1b8c398abac0448139a0052
SSDEEP 12288:edoM8YQ/LT/Nxe73KGwcoqyt/q8+NF+XFfebjjFUX8:wCYqTNULKRbt/q8+PkGbjjFUX8
TLSH
T1FCF4E707F0E312E8CC67C174DBA732B2F53979E95135BEAE56A4C3312E23E501669A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpsl-5.dll

Path C:\Program Files (x86)\fwupd\bin\libpsl-5.dll
Size 111KB
SHA256 c9f3ab6fa35843b83b3c0460f71e14a3e37719df7d7ec6f1e67bb6a208e6f109
MD5 3db0cbbb027ae37e853c16a62f2f3cb3
SHA1 1e8848c1714aca7fa0c1fecc3402e091de8db7fe
SHA512 4dfb9d1996751294803b29ba5746a62038d2331c07f193bf39f5b8ff69b317b63651512f00a1df61289ab24873f1eebef007eccd25ad2c8cddbc05b9ce4181bf
SSDEEP 3072:yNPrcPmxT5Wcr+q03z52ecLZ5c7Ec5Hr+R0XRe5GmWUppAgLdrNV:uPTVwcaJr+CheWUppAudrNV
TLSH
T143B3AE1BB38369BDC607A27469C267B3B331F42116269F3F6310CA789E72E905E59B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libsqlite3-0.dll

Path C:\Program Files (x86)\fwupd\bin\libsqlite3-0.dll
Size 1.6MB
SHA256 01c702a94eb23ec351658ba49155e0edf0745be1a52ec118cec722efedb73355
MD5 fa3f1d5b4dc92bedb326ff354b312d7d
SHA1 c25b26adfbac90fe1401e4242f24412b5386873e
SHA512 a60276fc5964ec4c5c5e4c213c85de5b58140657e1c8d0e1d3db4aa0b1b5e95e467cef53e507d1c26b46a332e7cfdadb30d4daf0ce352a36fb0be2e7d20fdf43
SSDEEP 49152:jJUB7eYmzZ8JZcgjrq6q+vjvKEopx5i3jl:FUB7hmaig/q+7SV5i3jl
TLSH
T1B1756E47E2A320ECC56BC174866F57B3B931F86481357EBF8590DB302E22E90675EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssh2-1.dll

Path C:\Program Files (x86)\fwupd\bin\libssh2-1.dll
Size 330KB
SHA256 d6e5541bdbb2c7fdc4012d8ea23f4509d33823976e23fabdb17c00ac56c9ac05
MD5 0daa3341fcaf5818714cc4944b60f083
SHA1 c5ac869232acfe569301217a5eaf77b71f6a260c
SHA512 d3ae7ef0da3742c1f2acbc843f9a9944a65b665bf1ef66fd3dcf74405077e529a893cd563aac8163109c9e5ab0534eec53398a931cf4d53f02be2b3293af4603
SSDEEP 6144:V9w3CKh+U1IJOb4ZFGLDyA5b1M7LQdKNI+4ctEZ3GmU4ZqPe34:V9w3CKl1IJOsZFGLDpZM78SIvzqPe34
TLSH
T1BD744B13D29224BCD56BD23492DA5733F635F8249334BEAB1224DE391E21FA0672DF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Program Files (x86)\fwupd\bin\libssl-3-x64.dll
Size 1.0MB
SHA256 6a992469e9f30e8c3d80358f9fae9f0724a6354970cbfd14559971a38f1a6869
MD5 1c611504bd74c1cd856f10e6b8da0798
SHA1 7cb2bb6f39ec2cdf1a478b5e91885ae57da62953
SHA512 94ae901a9fd9a5a6a0f3d5286837aa6fd3d58fa807305e5fe2ea303f97c3c9cf03c61557cfa386d23fa783457ce71ebc80ec2e5e0e5c8da03c363b9f3e01246a
SSDEEP 24576:Nj3vS+0UEP0aUQ0qCpp4qevOlewijKRjv2xEFYs60VqfMUHghTcHy:Nj3vj0Ui0aUQ0zpp3e2l9ijKRjv2xEFp
TLSH
T18D252A23E56729ACC857D234CAAF5373B639F4682235FE7B0A10C6342F61DA4172D768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libtasn1-6.dll

Path C:\Program Files (x86)\fwupd\bin\libtasn1-6.dll
Size 118KB
SHA256 da49e0a85b1499525a338f2b83f21a101f7570e1a9e4dec1edfed6ae987e2d61
MD5 2d601178e0744d8b66e3821f97140d57
SHA1 ff24dea024d10d273ed8c35fb28a513c9bb5bca4
SHA512 4470c4d62bbb68a730dab4fb61ddfd704b5c0a91485910b50928378d43666e823fac77ea957de0a25a2e871d8f01a9fc4c55efedc2ebd33cbbcc20c7ba204ed2
SSDEEP 3072:Tg9pqkx0h4WYJh+St4VOpGTG+85Wcr+qCzWB2Rhbk9m8WTF3C8:MpXRWYJJZBOHhA9m8WTF3C8
TLSH
T108C32907E25224BEC887E27495EB5672E730F8246630AF7FC750EBB04E71E845A19B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libunistring-2.dll

Path C:\Program Files (x86)\fwupd\bin\libunistring-2.dll
Size 1.8MB
SHA256 4b87c324f613f0c45459d167f91d73c35cdf695c63d91afb105c0e7186fdfe4a
MD5 fc35b474f9c21212b1bc3397d8cce813
SHA1 1d54c810a55acaf3809149d0c3d7a01af7f7681b
SHA512 6a351052f12db9439bb42a2473615009087f1f3154910be8f4b4f4aec1a5863f9320cc8654fa77dd562c85a3558ecec95a26f3c2b04efc4fe9761557119fce75
SSDEEP 49152:uAKhnHlu5jsd583V79EsiUGryx3QQ6Gq+yQIygwbF3KA8:uAKhnHOjv9EvryxB7pewbF3KA8
TLSH
T12F858DC1B141E0EFF60A49312DE6DBB67211BCB76D7106AB72E8F76E1D735A31A00648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libusb-1.0.dll

Path C:\Program Files (x86)\fwupd\bin\libusb-1.0.dll
Size 1.1MB
SHA256 c718ba145d51e1d657827dbf7796636ac275c6aca4d602f2743221a0ba76727c
MD5 2052211b465ee001f4ff683558ac9aee
SHA1 f2eb6394e7cdb58221adae1ddd0ab164e3618797
SHA512 0359a102b8aae126d2a29b6beec33baa8aaec8af638ca4d203cc48c5f9a4618b8d82018dd729a6d0ddff1b9895b76748efafdb02a32608b73a5f17c092c2d45e
SSDEEP 24576:QyfFu9dDidGz5RzTr0y/2V35kbywZaw3aayXsXE:QIFu9d+sFRoy/2Mbn0sXE
TLSH
T1C7359D8BBBC84D69C6C248328DAF439AF3B4F1713B4B5B2B571831741E63AD2ED46605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Program Files (x86)\fwupd\bin\libwinpthread-1.dll
Size 73KB
SHA256 80eb2559ea2a3e0c165ea8a4813cd9ba80937b4bbe13a2318a7b3cbaf2dfac43
MD5 1003b3ef590c13fd59789ebdd9ebb57d
SHA1 69931b8f369f80194d8aa3a338ecde83838e79cf
SHA512 9a756f23bcab3dce03283acf5257cfc594c88329fff2cdc210b3561938299094f382f4f0077eba3b6f93f4a745d7fcffe5065a62550e1a592f2a93e09691643f
SSDEEP 1536:zyj5mP9Z7K96ELyKLhyJPQTUFSrHHBRa/zPz8dZn:zyj5mPjlMzhyJPQTUFSbHBg/zz8dZn
TLSH
T12273F606236945ADC457A234D8FE1373B637F4301276AF2FE334D2712E7E990D929A98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libxmlb-2.dll

Path C:\Program Files (x86)\fwupd\bin\libxmlb-2.dll
Size 205KB
SHA256 3cf7b0a4b32c10483919e89e9d2545cf4c62dce3f891bab96608870a15b68faf
MD5 8072a60c24ef7b338a64241610f960c5
SHA1 3afddc162aa7b0a0456dc2a0ba217db83974cdac
SHA512 fbf45852d7410408ea33904811e0664c9991d40ce85db0baa01e5ad8816839593da3220adf472fea8af9bc3ea9c4c633f6ca53782585771342bfec8757b382a3
SSDEEP 6144:ghBwGb98Cqan00W+J3STQVZQvN5AE1RDQwbqSHDqFs0:gMGUOG+hTivN5DDJdDqFs0
TLSH
T13F24F9375195141ED867823495EFD373B3B7F4351331AB6B8B508B302F22AA4BA7A748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libzstd.dll

Path C:\Program Files (x86)\fwupd\bin\libzstd.dll
Size 1.2MB
SHA256 62045139feb0a6d7ae59edd64fd023421df164ff23123c98753e56bd591af9b0
MD5 41d0a9d2c3e3b93643cd93a3921f7131
SHA1 b5b5ca2a4845607e8735d26e3f3d87744e68f232
SHA512 447b4d226afd11028662f2ab6dfd689399eeb889abeab44d83d0bb1f2253ef30a9921b99b126a19967af6b2e1f9ab6bc79d6d7be53c9fb9daa130709fbbb0aeb
SSDEEP 24576:ue8yws/MjAXx9RuQZHcQIMytMwp9WeFaPMZlE5MjXUnjn6tyX8pRQzS1krhoGjey:kywFQZHLIMySwpnF6MZlEPRe397Vrov1
TLSH
T1B2458D83E5D310FCC26BC170876B9A73F676B8185020BE7B97D4DB712D12F909618BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Program Files (x86)\fwupd\bin\zlib1.dll
Size 133KB
SHA256 e5d64914a70e26e1731ed98628be370b855454ff70c9774aea4273dc25c9ce2b
MD5 0697496000c3e5621bbf12cccc384d24
SHA1 6ed17cff7df9fefc9642e2d70383077a923ea388
SHA512 9ffe09ab4b63cd04bade7de6d40a6e682d26830e1e53956ea4f36957a836b149620e73375b63716b9ef796a06a686b08a0a78dbe4982dc07ad9ba828fe39044e
SSDEEP 3072:AKsMyqRr6d9W70xEpwcaVOvfxFpTqbL8FNhq5WcrKq6ZLEmmh2yjwBfF2F3N:55yTDOB/Tqm0SgrjwlF2F3N
TLSH
T1F7D35C57B69361BEC6679270D6EB4B72B234F42016305FBB9248D7701F22E901F48BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fwupd.mo

Path C:\Program Files (x86)\fwupd\share\locale\sv\LC_MESSAGES\fwupd.mo
Size 87KB
SHA256 60c5fe7a6f0968f263a321466518c0baee4aa60a8d217147169e8210ef6d73a7
MD5 4d7a9caaa058601e1ae637e1ef1728c7
SHA1 f20c7865d0df95df8a8d69f656fa56f39b6cf648
SHA512 62ddb5d1ca0726db571cee4ccbebc2d634777057aeae7db92e5248dc3231cf1c4ce8740bd71d5e7ae30caf635d2fcd7724633792aa85846f55aed0a37976d97d
SSDEEP 1536:Wzof09FdcjJWqL+RPnQs4gimGWsoIKHjGFuzg9sRf9dvEZVSUgtV0Q:ScjJWq6PQs4giFWjIK1g9sRfRwQ
TLSH
T1F6933A425600E573EAA342BAC914436A0FFCE0DD43A58B0A94DED46D7DCBB501FBF296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59c963.msi

Path C:\Windows\Installer\e59c963.msi
Size 15.8MB
SHA256 85ec038fe75d62306f8710565aeffa4f629577eff94938349def0d9fd1d3caf4
MD5 40b896202b1bc53dd0882a3cdbdd10ea
SHA1 92c77596509ef82a115d1026623640174da770c5
SHA512 1e2365fd45ad6f39ec3c6d4d779b4403557e2ed6845788ba790bc7b82c09774601d17d321ee3340f0e544ad2805785522d31167aa82be75e68ccd9ae40901c2a
SSDEEP 393216:MoUAP5CA01GNrI4G1Infw/gKly/cPM78qZjKb8slRAqyQOtqH:M/ee5enfwY5UPQ8qZeb8UA6Oc
TLSH
T109F633F8F898FC7EC272443990B99A1BE3307969106B90C537D0F6A5207A9D6F571CCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devices.json

Path C:\Windows\var\cache\fwupd\devices.json
Size 3B
SHA256 8eb95bcbc154530931e15fc418c8b1fe991095671409552099ea1aa596999ede
MD5 3d29a75fcf0ed7dfff86d3db8f92fc69
SHA1 dff8a1731f59ccad056b346102d1e1d014b843f3
SHA512 b7a65febc18b7eb5b159100842eed0018f0b56694baf042e366a97b1d8fe9eeb238b6ced3fe1b27c659837564ca3605e1c733e4f4621e3e8584237a6880f47ef
MD5 SHA1 SHA512

Submit Download

memory/2084-217-0x000001A207200000-0x000001A207BA4000-memory.dmp

Download

memory/5232-247-0x00007FF9C3790000-0x00007FF9C37E8000-memory.dmp

Download

memory/5232-231-0x00007FF9CE7C0000-0x00007FF9CE7EE000-memory.dmp

Download

memory/5232-244-0x00007FF9C28A0000-0x00007FF9C2952000-memory.dmp

Download

memory/5232-242-0x00007FF9C14B0000-0x00007FF9C1674000-memory.dmp

Download

memory/5232-239-0x00007FF9C1B00000-0x00007FF9C1C7F000-memory.dmp

Download

memory/5232-238-0x00007FF9C2C90000-0x00007FF9C2ED4000-memory.dmp

Download

memory/5232-235-0x00007FF9C2EE0000-0x00007FF9C2FF1000-memory.dmp

Download

memory/5232-232-0x00007FF9C3000000-0x00007FF9C32AF000-memory.dmp

Download

memory/5232-224-0x00007FF9C3990000-0x00007FF9C3B3A000-memory.dmp

Download

memory/5232-248-0x00007FF9D0520000-0x00007FF9D0536000-memory.dmp

Download

memory/5232-226-0x00007FF9D7350000-0x00007FF9D7361000-memory.dmp

Download

memory/5232-246-0x00007FF9C12E0000-0x00007FF9C13BB000-memory.dmp

Download

memory/5232-243-0x00007FF9C13C0000-0x00007FF9C14A1000-memory.dmp

Download

memory/5232-223-0x00007FF9C44C0000-0x00007FF9C4640000-memory.dmp

Download

memory/5232-240-0x00007FF9C1680000-0x00007FF9C1AF7000-memory.dmp

Download

memory/5232-236-0x00007FF9C46E0000-0x00007FF9C4748000-memory.dmp

Download

memory/5232-234-0x00007FF9D4770000-0x00007FF9D4781000-memory.dmp

Download

memory/5232-250-0x00007FF9C11B0000-0x00007FF9C12D9000-memory.dmp

Download

memory/5232-230-0x00007FF9D5D80000-0x00007FF9D5DA7000-memory.dmp

Download

memory/5232-229-0x00007FF9C37F0000-0x00007FF9C38A4000-memory.dmp

Download

memory/5232-220-0x00007FF9C4750000-0x00007FF9C491A000-memory.dmp

Download

memory/5232-225-0x00007FF9DB4B0000-0x00007FF9DB4BF000-memory.dmp

Download

memory/5232-249-0x00007FF9C9CD0000-0x00007FF9C9CF2000-memory.dmp

Download

memory/5232-245-0x00007FF9C43C0000-0x00007FF9C4404000-memory.dmp

Download

memory/5232-241-0x00007FF9C4460000-0x00007FF9C44B1000-memory.dmp

Download

memory/5232-237-0x00007FF9CBD10000-0x00007FF9CBD32000-memory.dmp

Download

memory/5232-233-0x00007FF9C5760000-0x00007FF9C5792000-memory.dmp

Download

memory/5232-222-0x00007FF9C6020000-0x00007FF9C60B2000-memory.dmp

Download

memory/5232-228-0x00007FF9C38B0000-0x00007FF9C3984000-memory.dmp

Download

memory/5232-221-0x00007FF9D5DB0000-0x00007FF9D5E0D000-memory.dmp

Download

memory/5232-227-0x00007FF9CAA10000-0x00007FF9CAA62000-memory.dmp

Download

memory/5232-219-0x00007FF74D360000-0x00007FF74D391000-memory.dmp

Download

memory/5232-272-0x00007FF9C1B00000-0x00007FF9C1C7F000-memory.dmp

Download