AI
Anti-debugging and driver-based AV evasion
Local reference
Suspicious dependency
Inferred
Anti-debugging with driver-backed antivirus process control: 68e91f0bde5d4c602eefa5e8057d65cf5a4af17021215736de2359fb4d577ce0.exe:0x225afb
Driver-backed antivirus process control: 68e91f0bde5d4c602eefa5e8057d65cf5a4af17021215736de2359fb4d577ce0.exe:0x225afb
| 0x225aeb | 6f7279446174610e5573625479706514 | oryData.UsbType. |
| 0x225afb | 4765745061796c6f61644000e743152a | GetPayload@..C.*Driver-backed antivirus process control |
| 0x225b0b | 02e7c30e2a0012476574447269766572 | ....*..GetDriver |
| 0x225b1b | 2a476574416e7469766972757350726f | *GetAntivirusProAnti-debugging with driver-backed antivirus process control |
| 0x225b2b | 6365737365734000e763610e00003053 | cesses@..ca...0S |
| 0x225b3b | 74c599c3ad7a6c6976656a5a6a69c5a1 | t....zlivejZji.. |
| 0x225b4b | c5a5756a656d | ..ujem |
| 0x225d18 | 6765745f53746167696e675061746832 | get_StagingPath2 |
| 0x225d28 | 4765744b696c6c50726f63657373436f | GetKillProcessCoDriver-backed antivirus process control |
| 0x225d38 | 6e74726f6c436f64654000a7b3740200 | ntrolCode@...t.. |
| 0x225d48 | 00204275696c644b696c6c5265717565 | . BuildKillRequeAnti-debugging with driver-backed antivirus process control |
| 0x225d58 | 73744000a7b3740204a7b37402e74315 | st@...t....t..C. |
| 0x225d68 | 2a004000d3498b0cd3b97ad38981d389 | *.@..I....z..... |
| 0x225d78 | 82 | . |
| 0x225e9a | 840fd3b99a00105f79c5a0756bc3a11e | ......._y..uk... |
| 0x225eaa | 496e7374616c6c416e64537461727440 | InstallAndStart@Driver-backed antivirus process control |
| 0x225eba | 00d3b19308d3b99ad3b99ad3b99ad3b9 | ................ |
| 0x225eca | 9a00105365744669747a694000d349 | ...SetFitzi@..I |
| 0x225ee3 | 5679c59965c5a16974506f7a64c49b1a | Vy..e..itPozd... |
| 0x225ef3 | 53746f70416e6444656c6574654000d3 | StopAndDelete@..Driver-backed antivirus process control |
| 0x225f03 | b19302d3b99a00144c6f61644d6f6475 | ........LoadModu |
| 0x225f13 | 6c65124765744578706f727440 | le.GetExport@ |
| 0x26cff0 | 618cd9587dece9cdb48e90f775642a1f | a..X}.......ud*. |
| 0x26d000 | 64a9e1f61c95edb10ae0278568867608 | d.........'.h.v. |
| 0x26d010 | fa7d48364a3c7808737d75e8beeafdd0 | .}H6J<x.s}u..... |
| 0x26d020 | d777d53332f805cb0ba1ba846c95f559 | .w.32.......l..Y |
| 0x26d030 | 101ac8e96a2a5949826df0ba975170fe | ....j*YI.m...Qp. |
| 0x26d040 | b7f1677a0ffb99930d817bc795cfc85a | ..gz......{....Z |
| 0x26d050 | 42e4e5b9f94e7ffa72752e5a2a6011ce | B....N..ru.Z*`.. |
| 0x26d060 | 23e5b471fff4a343025ad74d1da65733 | #..q...C.Z.M..W3 |
| 0x26d070 | dccd778e11e40be5c469e1b0cc473c83 | ..w......i...G<. |
| 0x26d080 | a8687935b13209762582331858e947b5 | .hy5.2.v%.3.X.G. |
| 0x26d090 | 2db91d4f52355d967d58e2e3c73f855c | -..OR5].}X...?.\ |
| 0x26d0a0 | aff6f278b95576a58cd5261aa1c3b444 | ...x.Uv...&....D |
| 0x26d0b0 | 656e6cdcf394ff46b83db2f53f7d2890 | enl....F.=..?}(. |
| 0x26d0c0 | 6fb7edad758250aec47f812cfa720823 | o...u.P....,.r.# |
| 0x26d0d0 | 1aecc182b2fa888db1912343a5cf0b73 | ..........#C...s |
| 0x26d0e0 | 90ad9db6ed60b0fd6f9745507fd137dc | .....`..o.EP..7. |
| 0x26d0f0 | 4a5e8a24b4a1b4936d661a263195ac29 | J^.$....mf.&1..) |
| 0x26d100 | 905677f4297b8c81cdffb63815d44225 | .Vw.){.....8..B% |
| 0x26d110 | eef732d59aa0d4eb7c8c8076f9739ced | ..2.....|..v.s.. |
| 0x26d120 | 8fd5f5c7e495b485827a2f134839d060 | .........z/.H9.` |
| 0x26d130 | d9041128b86126495a4f7e1a9696e783 | ...(.a&IZO~..... |
| 0x26d140 | f1f551102d48730b3a5bf47e2accf36a | ..Q.-Hs.:[.~*..j |
| 0x26d150 | 29d4eb7280b8358bef6e31b943006a2e | )..r..5..n1.C.j. |
| 0x26d160 | faeb8578f49fbaba23f88827de1a392a | ...x....#..'..9* |
| 0x26d170 | 0995482d35a5542f1ac3368fbca394d5 | ..H-5.T/..6..... |
| 0x26d180 | 78c603a747fbd4c8d7d16c081c1e0c5a | x...G.....l....ZDriver-backed antivirus process control |
| 0x26d190 | ecf427f774282ccebd330d7d9c334138 | ..'.t(,..3.}.3A8 |
| 0x26d1a0 | 2f299356362690c8c30c62604781aef5 | /).V6&....b`G... |
| 0x26d1b0 | c0a313a190c570526b52403fc129ab64 | ......pRkR@?.).d |
| 0x26d1c0 | 84e4345f5f5c46f3796e179146231ae1 | ..4__\F.yn..F#.. |
| 0x26d1d0 | 970adecd1edd95526686431beb7e3094 | .......Rf.C..~0. |
| 0x26d1e0 | 5be30db102c031327293ffc88275f71d | [.....12r....u.. |
| 0x26d1f0 | 84c1701abf833e1d8bb2660912ed6260 | ..p...>...f...b` |
| 0x26d200 | 7c752ec9385ecaf1b2bab24a2b3da07d | |u..8^.....J+=.} |
| 0x26d210 | 9e30872c39fdffb0d65484e8826f9de1 | .0.,9....T...o.. |
| 0x26d220 | d0b1bb6b77dc6ba7682211675c59ceff | ...kw.k.h".g\Y.. |
| 0x26d230 | 2ac9157950afde0758c7d70b7653e9b6 | *..yP...X...vS.. |
| 0x26d240 | e1db124135d3d77e9a9e7a4922a0cede | ...A5..~..zI"... |
| 0x26d250 | 7a4993c20d44975142a283e8b49ebb6f | zI...D.QB......o |
| 0x26d260 | 1ef9f200192238ebaef346c6c5136322 | ....."8...F...c" |
| 0x26d270 | 16b25351e334e04ebd4b258d4d8f81f8 | ..SQ.4.N.K%.M... |
| 0x26d280 | 590078a296243e25ea010797565deb54 | Y.x..$>%....V].T |
| 0x26d290 | 6fdf07a3e2532e651351320d39bf168b | o....S.e.Q2.9... |
| 0x26d2a0 | a312da0e13926649986155bc5370c62e | ......fI.aU.Sp.. |
| 0x26d2b0 | 9dfa0b9d27dc75cd118aa6c372bd933f | ....'.u.....r..? |
| 0x26d2c0 | d80dddd6554123c5150fb2acaddb2cc7 | ....UA#.......,. |
| 0x26d2d0 | 37b99c8331fa7c5217121ea59d970e71 | 7...1.|R.......q |
| 0x26d2e0 | 2198cba68f03b3347376430d1a4c12fb | !......4svC..L..Modify memory page protection |
Loading traits…
Identity
| SHA-256 | 68e91f0bde5d4c602eefa5e8057d65cf5a4af17021215736de2359fb4d577ce0 |
|---|---|
| Canonical SHA-256 | 165f9021c162fbf1ad6794af8871a3058516df19956aefcb31b18b71c5372e63 |
| Filename | 68e91f0bde5d4c602eefa5e8057d65cf5a4af17021215736de2359fb4d577ce0.exe |
| Package | 68e91f0bde5d4c602eefa5e8057d65cf5a4af17021215736de2359fb4d577ce0 |
Origin
| Source | harvest |
|---|---|
| Feed | malwarebazaar |
| Ecosystem | windows |
| Domain | abuse.ch |
Timeline
| First seen | 14 Jul 2026 02:20 UTC |
|---|---|
| First analyzed | 14 Jul 2026 05:06 UTC |
| Last analyzed | 24 Jul 2026 09:26 UTC |
| Last updated | 24 Jul 2026 09:26 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 294eb |
Not seeing what you expected? Let us know