Analysis
- max time kernel
49s - max time network
50s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 17:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
576c3f3d3903969173fbdaaca2f2ad45ccb3dfc3516be939c4b05d12e592c1bc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
576c3f3d3903969173fbdaaca2f2ad45ccb3dfc3516be939c4b05d12e592c1bc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target 576c3f3d3903969173fbdaaca2f2ad45ccb3dfc3516be939c4b05d12e592c1bc.exe
- Size 9.5MB
- Sample260723-vmrqbatbnb
- SHA256 576c3f3d3903969173fbdaaca2f2ad45ccb3dfc3516be939c4b05d12e592c1bc
- MD5 94445efc3d6e2ac83dfacebcf3c4485c
- SHA1 0dfe4e553594f7963af61c2fad0770ff19f52494
- SHA512 d9b24cf564208acfa1ed221d6636134bdbe979a8e242e563ce69eec016d6a9fe7fbe728b9774f3f184c711563c47872599550df1ba9d9983864b1d4a20ead339
- SSDEEP 196608:SuINXU4odZiwaHurLlmMAeR0cfh1cnfcEBmKSYRpslD8YzxIIpoY:SuIh4+ucMocZCfcEUKpritdpoY
- TLSH T1C5A6331AB53404B1D6A3E135C9E19342E37271950F61A34B325143BFAE2B7D2CDBAF62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4512 H2OFFT-Wx64.exe - Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\{b52b7751-5598-f54f-8428-7789d4f627bd}\SET4FE7.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{b52b7751-5598-f54f-8428-7789d4f627bd}\H2OFFT.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{b52b7751-5598-f54f-8428-7789d4f627bd}\SET4FE6.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{b52b7751-5598-f54f-8428-7789d4f627bd}\SET4FE6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{b52b7751-5598-f54f-8428-7789d4f627bd}\H2OFFT64.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{b52b7751-5598-f54f-8428-7789d4f627bd}\SET4FE7.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{b52b7751-5598-f54f-8428-7789d4f627bd}\SET4FF8.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{b52b7751-5598-f54f-8428-7789d4f627bd}\SET4FF8.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{b52b7751-5598-f54f-8428-7789d4f627bd}\h2offt.inf DrvInst.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\INF\oem0.PNF H2OFFT-Wx64.exe File opened for modification C:\Windows\INF\setupapi.dev.log H2OFFT-Wx64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe - Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID H2OFFT-Wx64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 H2OFFT-Wx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID H2OFFT-Wx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs H2OFFT-Wx64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 H2OFFT-Wx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom H2OFFT-Wx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs H2OFFT-Wx64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 H2OFFT-Wx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID H2OFFT-Wx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom H2OFFT-Wx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags H2OFFT-Wx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID H2OFFT-Wx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs H2OFFT-Wx64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 H2OFFT-Wx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags H2OFFT-Wx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs H2OFFT-Wx64.exe - Modifies data under HKEY_USERS 40 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2 H2OFFT-Wx64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 6b0000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e707e0000000100000008000000000010c51e92d201620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e7009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030119000000010000001000000091161b894b117ecdc257628db460cc04030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e21d000000010000001000000027b3517667331ce2c1e74002b5ff2298140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69770b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d00610072007900200043004100000004000000010000001000000010fc635df6263e0df325be5f79cd67670f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad853000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c07a000000010000000e000000300c060a2b0601040182375e010268000000010000000800000000003db65bd9d5012000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64 H2OFFT-Wx64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob = 5c00000001000000040000000004000068000000010000000800000000003db65bd9d5017a000000010000000e000000300c060a2b0601040182375e010253000000010000002400000030223020060a2b0601040182375e010130123010060a2b0601040182373c0101030200c00f0000000100000010000000d7c63be0837dbabf881d4fbf5f986ad804000000010000001000000010fc635df6263e0df325be5f79cd67670b000000010000004600000056006500720069005300690067006e00200043006c006100730073002000330020005000750062006c006900630020005000720069006d006100720079002000430041000000140000000100000014000000e27f7bd877d5df9e0a3f9eb4cb0e2ea9efdb69771d000000010000001000000027b3517667331ce2c1e74002b5ff2298030000000100000014000000742c3192e607e424eb4549542be1bbc53e6174e219000000010000001000000091161b894b117ecdc257628db460cc0409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e707e0000000100000008000000000010c51e92d2016b0000000100000020000000e7685634efacf69ace939a6b255b7b4fabef42935b50a265acb5cb6027e44e702000000001000000400200003082023c308201a5021070bae41d10d92934b638ca7b03ccbabf300d06092a864886f70d0101020500305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479301e170d3936303132393030303030305a170d3238303830313233353935395a305f310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e31373035060355040b132e436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c95c599ef21b8a0114b410df0440dbe357af6a45408f840c0bd133d9d911cfee02581f25f72aa84405aaec031f787f9e93b99a00aa237dd6ac85a26345c77227ccf44cc67571d239ef4f42f075df0a90c68e206f980ff8ac235f702936a4c986e7b19a20cb53a585e73dbe7d9afe244533dc7615ed0fa271644c652e816845a70203010001300d06092a864886f70d010102050003818100bb4c122bcf2c26004f1413dda6fbfc0a11848cf3281c67922f7cb6c5fadff0e895bc1d8f6c2ca851cc73d8a4c053f04ed626c076015781925e21f1d1b1ffe7d02158cd6917e3441c9c194439895cdc9c000f568d0299eda290454ce4bb10a43df032030ef1cef8e8c9518ce6629fe69fc07db7729cc9363a6b9f4ea8ff640d64 H2OFFT-Wx64.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4512 H2OFFT-Wx64.exe 4512 H2OFFT-Wx64.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5536 wrote to memory of 4512 5536 576c3f3d3903969173fbdaaca2f2ad45ccb3dfc3516be939c4b05d12e592c1bc.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\576c3f3d3903969173fbdaaca2f2ad45ccb3dfc3516be939c4b05d12e592c1bc.exe"C:\Users\Admin\AppData\Local\Temp\576c3f3d3903969173fbdaaca2f2ad45ccb3dfc3516be939c4b05d12e592c1bc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\Temp\7zS91D6.tmp\H2OFFT-Wx64.exe.\H2OFFT-Wx64.exe -sfx7z "C:\Users\Admin\AppData\Local\Temp"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:4512
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8f545584-c5c4-4c40-a92c-76876e66501b}\h2offt.inf" "9" "4ddc5e3bb" "0000000000000180" "WinSta0\Default" "000000000000017C" "208" "c:\windows\temp\7zs91d6.tmp"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4648
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\INSYDEDEVICE\0000" "C:\Windows\System32\DriverStore\FileRepository\h2offt.inf_amd64_bc6f1d33c79610d5\h2offt.inf" "oem1.inf:ed86ca1156c0ee7a:Insyde_Device64:9.31.20.62:{416c2604-443b-436f-9e1d-607bdc3cc785}\h2offt," "4ddc5e3bb" "0000000000000170" "496b"1⤵PID:5996
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\DriverStore\FileRepository\h2offt.inf_amd64_bc6f1d33c79610d5.ini
- Size 414B
- SHA256 f414f57cdfc603a90cbe576970959dfe9423fab1d8cd30a7d7e8942851c16f65
- MD5 ec930cd09c1b49365be8d1d2b53ee12f
- SHA1 e216d0cd62f855777a4375ef0a0dff67a0a91602
- SHA512 fe77f3708bb683bc5d6affb6b319d4c843db2b534ad237caf31ca0e64411e6aebeefa2f3adf9b9a57bce8e4d0498a5e2e1dbc8b9c9e5eb2587df556fe6339aa3
- TLSH T1DCE0221107B8C08D64496413600A07B6C272A71F0686B6B1B2A8C094FF0FC8B0EB88E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\7zS91D6.tmp\FWUpdLcl.exe
- Size 220KB
- SHA256 2f98f753ffe3bc5718c040a88f3dc87e63b527dd41b9c83a3105caff16c2f203
- MD5 c281d25299786e7bfbd9a2929d738784
- SHA1 ad69246c0b8288c7c53eb8d799651424f5d006b5
- SHA512 2575607c2c97b565b4868fb93db2c26ea338f973cba21d2360740294df674f05db3bbf82749985c6c6b2b0a7690acb412a0360972b93414966ce5a9ad21e489c
- SSDEEP 3072:7mEpHZ+UaUiCLD1+Uf/rZjHLOuy2fJziXXMc4i5Zqq:rHEUaUpLhxFjr7fJzCcc4i5Z7
- TLSH T12F247D25B751C033C89343F4A5E583F6ADB8A671236460C7F3D40E7A6FA42D1AA3978D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\7zS91D6.tmp\FlsHook.exe
- Size 41KB
- SHA256 1dd8e0705b0910dbdc4b5e3b76afb087b0821feb5a50241fd833a88591145a14
- MD5 88179563bfb2f7d07a37644d58025835
- SHA1 fc1f7be274240ad83fa20cd2bad7fe5d8b8d8f85
- SHA512 f97c6f526be661aaffe5452c87a078f13bff1bd40a9a3f8b067b79e479e20f01043918331c0a75e675dd181948c5094c9c884af2d05c5faa98dba0790bb21ae5
- SSDEEP 768:sXR9dYGpaZdii/pVfi/pEmOxzZCmxvG+FG0:MR9dYGpxmIOJZPr
- TLSH T1FA1327875BA460C0E5A3C97196F1EF36A934F5989B6187CF2370828D1F227D43A3931D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\7zS91D6.tmp\H2OFFT-Wx64.exe
- Size 2.3MB
- SHA256 1d5fb7c6a39ddf6af4332728f90633da56d7dc90cc11dbffda839db36b9ee4bc
- MD5 e89fb717cd17645e578faee2103724e2
- SHA1 f8d41524954188657c6631e0ee00438da392f36f
- SHA512 8651c70ee49fecdcee2e57219061d19ab979fbeaa9ff571251e85d269335fd217461b1819d8f652c05716026d97d1a80bf792cf7b9a571477e261feff9d0acf1
- SSDEEP 49152:22tr+vqgn+FarUX96/y1YvPrbS3FozqLWzswpKrqXWOKKTw7lk2oilB8E3YV:IvHKIj6o2LWzswpKrqXWOKKTw7lk2oi8
- TLSH T1D7B5281DA2A440E4E1A7D27999718EE6D6B13C710B3087DF8D9CF6A80F73AD28C75B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\7zS91D6.tmp\H2OFFT.inf
- Size 6KB
- SHA256 91c9dce565b3c8bec2c1eea1cef81f78059a65dc3b1f5ca75488a6b17e23d630
- MD5 60d7865778efca5562dddd583ed6e274
- SHA1 0b58066b80e9ed1d3ebc532a85490afbf5f2f35c
- SHA512 6a28a5edc78b06df199de0d9a653e3d6e4c523ccc8ef111df2bbd8752048001df4714470625455c43a1bbfb79cef03bc5b04355d075fac7dc13095aa59b4eb1d
- SSDEEP 48:PcRPXJSlf/O9jRGYucTppG8QwFM59NXHXwTwS6QxIxVyOOLcqXXj+E6tE50uLJRE:POmcZucTHGdNJSosRfuwORfuw3
- TLSH T159D1605262E90E59B0F2BE90A6B6C0365A1378D5993DCB1D13AC810A17EFD40DD72FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\7zS91D6.tmp\platform.ini
- Size 52KB
- SHA256 162af5480c3346bca036602175e2759e1a56b35db37c57c1bd8166b6e79352ef
- MD5 699e3f991cd12fc317784d882ab3868b
- SHA1 458f22ae1ee6e374d64459d7d278ba00d6d6573d
- SHA512 834381a227ef9120177ed6872b0b4a47505a169d8e6bec6bd696fc99ada9183cb8294ca26a177464b6e3983bcc449475f7d39a418cd62c17438f6bba99a9ac13
- SSDEEP 768:4EnFCyBzJlxOLuYU9BK7h9bps38h0Q6hO7:xFfta3msh0Qp7
- TLSH T1863372073A0FE5670132A251A3E45416FBA04E2F6A36723974CCCDB81739854E77EBB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\windows\temp\7zs91d6.tmp\H2OFFT.cat
- Size 10KB
- SHA256 3bd5fe67b1a2c89158566f55cc06b670d91f5842841b716a1d4120912c6d5f96
- MD5 679ae1feea9557ce5a1daabfda0c4f60
- SHA1 a25ad34d86c6e7394c31deb252c40096c807fd44
- SHA512 6bd8430f53e18bdec33464e71076bce698f19707975e33780c916215f0398e98078b5e8efb05f7379b7be93757a8d7b25b08a8dfed0fc4c0c0bc6723f65453e9
- SSDEEP 192:7NRHyF9mtQ32iBJCaKXooyKfPFWQFO/5qnajleo6j:E1BtUrPFR0hlxK
- TLSH T13122E7E2896C51C3E9A3ACB013A8E55BBC3D67CB581085A935AFF3690D937C1F70845E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\windows\temp\7zs91d6.tmp\H2OFFT64.sys
- Size 46KB
- SHA256 7c80c7218884e8b5c660c56cf7bfed580c02d0df6b97807097d6cd2f1f9fc9a1
- MD5 01e64144f43af6a43c656385a6f55498
- SHA1 698187034d0306777c250e2043a8a6d8131df0c1
- SHA512 ad61552fced1366cbfcc90e0ec989ea287040b7cf137cf55303a45efbd2d88374ee8d692ae6764794303c5ff8295ad08bf6b5766c01ffa3955c8c0255637d03d
- SSDEEP 768:S1joA+oyoqwe/NqWpAhksL2rs86KhBfvb3:S53U3pqO3
- TLSH T14F237DA18BA80C92ED57AE3075F0C527BD71F5817B70C9EF1165C0600FA2BE1667C7A9
- MD5 SHA1 SHA512 SSDEEP TLSH