3d6084faefb79bb5a71dc355659de04493738dfbd0e91834f480f3d30957cb8f

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_e725fdc4e22afec5d0ddeb34c2c77532_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
Size 6.2MB
Sample260819-pphyastgmb
SHA256 3d6084faefb79bb5a71dc355659de04493738dfbd0e91834f480f3d30957cb8f
MD5 e725fdc4e22afec5d0ddeb34c2c77532
SHA1 d48608bdbdbac56643b74cd44fd92111f1292c0b
SHA512 14f572832d0a3b7822511b9241513fe09940eedbabe53184f11e942fa4ad131889073b9208c7c7e6aa2dfafd2a557625c00f5fe0bcd56a566f41149b1d6c7f94
SSDEEP 98304:ZZXYAsdVv1e4kNk2K+v52K+u+/2ZpeSeQgoflrObSr2etq06ZTLd6/iKNX0Xthr0:EAa9e/kL+LEOfzDfEbSieE5RkipdS
TLSH
T1E966231273D6C022FF9B91738F59F2069ABD7D194523E96F12981C7ABC301A1933E663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 13 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c557-16.dat	UPX
behavioral2/memory/1236-17-0x0000000000360000-0x0000000000472000-memory.dmp	UPX
behavioral2/files/0x001400000001c513-27.dat	UPX
behavioral2/memory/2956-28-0x00000000008A0000-0x0000000001120000-memory.dmp	UPX
behavioral2/files/0x000e00000001c558-42.dat	UPX
behavioral2/memory/8-47-0x0000000000400000-0x0000000000931000-memory.dmp	UPX
behavioral2/files/0x000c00000001c55e-51.dat	UPX
behavioral2/memory/3256-57-0x0000000000A70000-0x0000000000ED6000-memory.dmp	UPX
behavioral2/memory/3256-86-0x0000000000A70000-0x0000000000ED6000-memory.dmp	UPX
behavioral2/memory/1236-87-0x0000000000360000-0x0000000000472000-memory.dmp	UPX
behavioral2/memory/2956-89-0x00000000008A0000-0x0000000001120000-memory.dmp	UPX
behavioral2/memory/8-91-0x0000000000400000-0x0000000000931000-memory.dmp	UPX
behavioral2/memory/1236-93-0x0000000000360000-0x0000000000472000-memory.dmp	UPX

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\1D306DA9.sys	sss222.exe

Executes dropped EXE 7 IoCs

pid	Process
4920	sss222.exe
1236	20210226sss222.exe
2956	baofengv17.exe
548	1D306DA9.sys
8	BaofengV16.exe
3256	BaofengSever.exe
6052	7Z.exe

Loads dropped DLL 1 IoCs

pid	Process
6052	7Z.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BaoFeng = "C:\\Users\\BaofengSever.exe"	baofengv17.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3032-0-0x0000000000740000-0x0000000000D86000-memory.dmp	autoit_exe
behavioral2/memory/3256-57-0x0000000000A70000-0x0000000000ED6000-memory.dmp	autoit_exe
behavioral2/memory/3256-86-0x0000000000A70000-0x0000000000ED6000-memory.dmp	autoit_exe
behavioral2/memory/1236-87-0x0000000000360000-0x0000000000472000-memory.dmp	autoit_exe
behavioral2/memory/2956-89-0x00000000008A0000-0x0000000001120000-memory.dmp	autoit_exe
behavioral2/memory/1236-93-0x0000000000360000-0x0000000000472000-memory.dmp	autoit_exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c557-16.dat	upx
behavioral2/memory/1236-17-0x0000000000360000-0x0000000000472000-memory.dmp	upx
behavioral2/files/0x001400000001c513-27.dat	upx
behavioral2/memory/2956-28-0x00000000008A0000-0x0000000001120000-memory.dmp	upx
behavioral2/files/0x000e00000001c558-42.dat	upx
behavioral2/memory/8-47-0x0000000000400000-0x0000000000931000-memory.dmp	upx
behavioral2/files/0x000c00000001c55e-51.dat	upx
behavioral2/memory/3256-57-0x0000000000A70000-0x0000000000ED6000-memory.dmp	upx
behavioral2/memory/3256-86-0x0000000000A70000-0x0000000000ED6000-memory.dmp	upx
behavioral2/memory/1236-87-0x0000000000360000-0x0000000000472000-memory.dmp	upx
behavioral2/memory/2956-89-0x00000000008A0000-0x0000000001120000-memory.dmp	upx
behavioral2/memory/8-91-0x0000000000400000-0x0000000000931000-memory.dmp	upx
behavioral2/memory/1236-93-0x0000000000360000-0x0000000000472000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5520	cmd.exe
5548	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_e725fdc4e22afec5d0ddeb34c2c77532_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20210226sss222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sss222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BaofengV16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7Z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	baofengv17.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BaofengSever.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5520	cmd.exe
5076	PING.EXE
5548	cmd.exe
4168	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5076	PING.EXE
4168	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1236	20210226sss222.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
808	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4920	sss222.exe
Token: SeDebugPrivilege	8	BaofengV16.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3032	2026-08-19_e725fdc4e22afec5d0ddeb34c2c77532_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3032	2026-08-19_e725fdc4e22afec5d0ddeb34c2c77532_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3032	2026-08-19_e725fdc4e22afec5d0ddeb34c2c77532_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
3032	2026-08-19_e725fdc4e22afec5d0ddeb34c2c77532_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3032	2026-08-19_e725fdc4e22afec5d0ddeb34c2c77532_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
3032	2026-08-19_e725fdc4e22afec5d0ddeb34c2c77532_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe
1236	20210226sss222.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1236	20210226sss222.exe
1236	20210226sss222.exe
8	BaofengV16.exe
8	BaofengV16.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 4920	3032	2026-08-19_e725fdc4e22afec5d0ddeb34c2c77532_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	90
PID 3032 wrote to memory of 1236	3032	2026-08-19_e725fdc4e22afec5d0ddeb34c2c77532_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	91
PID 3032 wrote to memory of 2956	3032	2026-08-19_e725fdc4e22afec5d0ddeb34c2c77532_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe	92
PID 4920 wrote to memory of 2584	4920	sss222.exe	95
PID 2956 wrote to memory of 8	2956	baofengv17.exe	97
PID 3256 wrote to memory of 6052	3256	BaofengSever.exe	100
PID 3256 wrote to memory of 5520	3256	BaofengSever.exe	102
PID 5520 wrote to memory of 5076	5520	cmd.exe	104
PID 1236 wrote to memory of 5548	1236	20210226sss222.exe	105
PID 5548 wrote to memory of 4168	5548	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-19_e725fdc4e22afec5d0ddeb34c2c77532_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_e725fdc4e22afec5d0ddeb34c2c77532_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\sss222.exe
  C:\Users\Admin\AppData\Local\Temp\sss222.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\sss222.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2584
- C:\Users\Admin\AppData\Local\Temp\20210226sss222.exe
  C:\Users\Admin\AppData\Local\Temp\20210226sss222.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping 127.0.0.1 -n 3&del /q "C:\Users\Admin\AppData\Local\Temp\20210226sss222.exe"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5548
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 3
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4168
- C:\Users\Admin\AppData\Local\Temp\baofengv17.exe
  C:\Users\Admin\AppData\Local\Temp\baofengv17.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\BaofengV16.exe
    C:\Users\Admin\AppData\Local\Temp\BaofengV16.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:8

C:\Windows\system32\drivers\1D306DA9.sys
C:\Windows\system32\drivers\1D306DA9.sys
1⤵
- Executes dropped EXE
PID:548

C:\Users\BaofengSever.exe
C:\Users\BaofengSever.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Users\Admin\AppData\Local\Temp\7Z.exe
  C:\Users\Admin\AppData\Local\Temp\7Z.exe x C:\Users\Admin\AppData\Local\Temp\BaofengSvc.7z.001 -y -aos -o"C:\Users\" -pbaofeng!@#$%
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping 127.0.0.1 -n 4&del /q "C:\Users\BaofengSever.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5520
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 4
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

20210226sss222.exe

Path C:\Users\Admin\AppData\Local\Temp\20210226sss222.exe
Size 457KB
SHA256 062b80c49c63da0b360ed5c121df82525f7be9420735d515dc77b422b7f1bb74
MD5 e344e02aecafc42e4cd5f960a47557ab
SHA1 440cdbacc9e5d372866d9fe8dda4c29d8a7d247b
SHA512 92d88c535000461bbb2e4f7210f43ebded1f972a97838d71bafdada933893f0bfe021510c1f51b4219f818577f17c861a30922b800972897c0a0e10e2a6c64e8
SSDEEP 12288:pTnBG1B62KU+NVs+Hk6AdYGgsZOS4ePJ0X+HV6Nl:pj8B3KleK6hPJ0XCA
TLSH
T127A402724B294F9CE6EA7E7568066F16738E4C6A5B40054AC8DDFCE4D6700AEAFC74C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7Z.exe

Path C:\Users\Admin\AppData\Local\Temp\7Z.exe
Size 160KB
SHA256 ac9674feb8f2fad20c1e046de67f899419276ae79a60e8cc021a4bf472ae044f
MD5 a51d90f2f9394f5ea0a3acae3bd2b219
SHA1 20fea1314dbed552d5fedee096e2050369172ee1
SHA512 c11f981136db7d9bde01046b1953fd924ff29447d41257da09dd762451e27390cea9b69e43206a8fff825ebcd4ddec5a6247bb502aefbd6e8285622caa985bf6
SSDEEP 3072:6nkCMZlG+fHlDum7uVouWEHR92dZH5TTY8A7GyH367uPlDKw:6kCMndv8WiYZH5A8sGw367Y+
TLSH
T1E6F36C3139F4C577D2230530CEE86BF5E0F6DA650E2248A733C94B2D6A79995C329E2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\7z.dll
Size 893KB
SHA256 a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338
MD5 04ad4b80880b32c94be8d0886482c774
SHA1 344faf61c3eb76f4a2fb6452e83ed16c9cce73e0
SHA512 3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb
SSDEEP 24576:TW+wsDaQw6DDz3qRyPnmGfrnvVUKueY8RmneWtJ:TasY6DwOBfrnvV7UeWt
TLSH
T1BB156D15FBBDC474D28A44318A29ABB250F4E71ACA21E4D367C0FE3E1F36995C129E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BaofengV16.exe

Path C:\Users\Admin\AppData\Local\Temp\BaofengV16.exe
Size 1.7MB
SHA256 10f6750074bea056d42958846b8de840c0cc58c765ecefc684b0cf5797ed27e1
MD5 ef7807c1dd5119374a57942042feec3a
SHA1 0f6bb215f40a6b9b2a4995feb397599a75f4e9f3
SHA512 bd6be98dbfb3ba62ca1260519a239fe99856e1396710a0aee347e0629b27bc271a755dc216bb146b41f0063afcd9e90fd7d0f687c7f53d096c98acfe50ee1283
SSDEEP 49152:PzlVEpv41MT7pX99ffz497lMTYobmcbgWp7f4Um:blqpv41MhXffiGcbcoUm
TLSH
T1FA8533212EB4DC20FC41F8F5E903C4498A1BFA1E47640FBFAD472B5ABB92517E519B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baofengv17.exe

Path C:\Users\Admin\AppData\Local\Temp\baofengv17.exe
Size 4.2MB
SHA256 a3cae7cca89aa388c8cbcda2bfefdf6bd0921ccfba8c2ecbee0bce8e01420d00
MD5 9f3317c0922c2e31e2ba9143ec680a30
SHA1 e2d1ac39407891ec23a05f95fb7cc926003d5e8d
SHA512 d8cff91a86e1b436cfa60a2ad9c85a95211a01ae107e2c9dc7cd67cf6e2dded3ec3515eacb4484c13e25a8ade0d3bc7d60bb448e77c8e7127f88e45d0d9aa34d
SSDEEP 98304:YaLAhRXhyOMk8QK7e3ko2K+sFZOiWyjX/Vw:7MMPk1KToLFP+yjNw
TLSH
T13D16330782B2DF17F8160674DE5C969B1FBD9A5273AE3F604348774B22E4B80A66341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sss222.exe

Path C:\Users\Admin\AppData\Local\Temp\sss222.exe
Size 801KB
SHA256 5109dcddbe8ed46cc7caa8c071fd96f7b7d82dc3f203ed373023d6096c4c6798
MD5 44d4fbb3eea26af18822d407511d8eee
SHA1 88cdf5361818bc6f7755fed0db86a01580222236
SHA512 86aa204fcf9141b5a6b53e8e9c15babb3f50ac0c08a736ec5d9d9eb64e242847e2cb473ae74f6e051ad7432d30c08f432347f504ea1524774b2c9b04152d9e4a
SSDEEP 24576:VWcTPN9Ljbr6pnWFxl1EYx8UVsUuFc/B:V9TV1r6tWFSP6U4B
TLSH
T1EE0502027A00C472E36907358891F9E85A58AD7959E4E14FF27C7E7A2E3528397732CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BaofengSever.exe

Path C:\Users\BaofengSever.exe
Size 2.1MB
SHA256 1f6d8db3d5925c86a612028939a864759e9d5a202d51d53d9de3e6ba55ccbd0c
MD5 eb2070bd57476da6306f11c1828364cd
SHA1 50fb8e669f49fb5adb7e9ae6ad7b545224b225b9
SHA512 7da88c42961fffa47fa2abc15b1a46bd211db2011f21be090f1b24eb502db2bce3ed3f5b0d455797281c90a47682e1b6761168921ff525b54d726f8e811c3f31
SSDEEP 49152:fw3KLAPJnXl1/m0WEAKjDgJG8VIxztUyilRfHuFux9fdGL:oaLAhnXfe0WEXDgHIxR1ilNuFG9fdC
TLSH
T1B6A533839BB68D67F1B8633160523762D9B12E85CFD580C2270A6F6F1F7029785F29B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1D306DA9.sys

Path C:\Windows\System32\drivers\1D306DA9.sys
Size 463KB
SHA256 5e07e57e1766082533c01f1dda8151e3583cefceb1d199e261b552f214ccf4ea
MD5 31bd88b57f6d0b306181492455ec8054
SHA1 771ff9984f4f58a25346a9cfc408b1224833f44b
SHA512 e2bfb0c618a1ca6a5ba77e9f6c988dcb0d585b5675cd4938ed1afd4804bec42fa55c6d39521bb73d329fca54becaa01d300240a3adc5e2ba2e37b18eb857fca9
SSDEEP 12288:UsweBX1ejDZT4FeIFn9ePHxplhf9AHSLMd3dXSnvOtRf:U10X1ejDZTrIFn9ePRplNKHS4nCAf
TLSH
T150A4F195A3E50279D5BAC1B8CAE6863BE7B23414132887CF015097AD2F13BE877353C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-47-0x0000000000400000-0x0000000000931000-memory.dmp

Download

memory/8-91-0x0000000000400000-0x0000000000931000-memory.dmp

Download

memory/548-35-0x0000000000010000-0x000000000008E000-memory.dmp

Download

memory/1236-17-0x0000000000360000-0x0000000000472000-memory.dmp

Download

memory/1236-87-0x0000000000360000-0x0000000000472000-memory.dmp

Download

memory/1236-93-0x0000000000360000-0x0000000000472000-memory.dmp

Download

memory/2956-28-0x00000000008A0000-0x0000000001120000-memory.dmp

Download

memory/2956-89-0x00000000008A0000-0x0000000001120000-memory.dmp

Download

memory/3032-0-0x0000000000740000-0x0000000000D86000-memory.dmp

Download

memory/3256-57-0x0000000000A70000-0x0000000000ED6000-memory.dmp

Download

memory/3256-86-0x0000000000A70000-0x0000000000ED6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads