Overview
overview
8Static
static
3MTPdrive210.exe
windows10-2004-x64
8MTPdrive210.exe
windows11-ltsc_2024-x64
8$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...an.dll
windows10-2004-x64
3$PLUGINSDI...an.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/IsVM.dll
windows10-2004-x64
3$PLUGINSDIR/IsVM.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ry.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/SR.dll
windows10-2004-x64
3$PLUGINSDIR/SR.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$SYSDIR/dokan.dll
windows10-2004-x64
3$SYSDIR/dokan.dll
windows11-ltsc_2024-x64
3$SYSDIR/dr...an.sys
windows10-2004-x64
3dokan_mounter.exe
windows10-2004-x64
3dokan_mounter.exe
windows11-ltsc_2024-x64
3Analysis
- max time kernel
179s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 12:31
Behavioral task
behavioral1
Sample
MTPdrive210.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
MTPdrive210.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/GetWinVersion.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/GetWinVersion.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/IsDokan.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/IsDokan.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/IsVM.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/IsVM.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/Registry.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/Registry.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/SR.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/SR.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
$SYSDIR/dokan.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
$SYSDIR/dokan.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
$SYSDIR/drivers/dokan.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
dokan_mounter.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
dokan_mounter.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target MTPdrive210.exe
- Size 3.4MB
- Sample260723-pp9e9acm7w
- SHA256 41a41c7e294056c8d440883e7ec87127483528e9c3b41d571c9d9f8c77479f51
- MD5 3461018c0008cb0e36204add2458f915
- SHA1 6277f554a5fd3fde7e0f3c02cba043ec054b27d4
- SHA512 756a662206aa58912dcbc22ba550a2dba77e90331dcbdd4b5ec223690e3de6d3d1bc276aa750e4749d4ce8b5eb5c005d8c03a9ec6c1efe2b3f5d778eab8032d0
- SSDEEP 98304:1zv0WmjN6jJ1su9m1NF/j/RBw9UBJ/c+mD94uI0C7Apquq9:FMWmjAXDmR9BJ/c+mD9Kaquq9
- TLSH T196F533C132D0EC93FA3EAE32E4F3936D4A38E421EA8D53A6DB533DB6D900712D156495
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\dokan.sys MTPdrive210.exe File opened for modification C:\Windows\system32\drivers\dokan.sys MTPdrive210.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\dokan.dll MTPdrive210.exe File opened for modification C:\Windows\system32\dokan.dll MTPdrive210.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\MTPdrive\MTPdrive.cpl MTPdrive210.exe File opened for modification C:\Program Files\MTPdrive\MTPdrive.cpl MTPdrive210.exe File opened for modification C:\Program Files\MTPdrive\dokan_mounter.exe MTPdrive210.exe File opened for modification C:\Program Files\MTPdrive\EULA.txt MTPdrive210.exe File created C:\Program Files\MTPdrive\MTPdriveFB.exe MTPdrive210.exe File created C:\Program Files\MTPdrive\MTPdriveAgent.exe MTPdrive210.exe File created C:\Program Files\MTPdrive\EULA.txt MTPdrive210.exe File opened for modification C:\Program Files\MTPdrive\MTPdrive.exe MTPdrive210.exe File opened for modification C:\Program Files\MTPdrive\MTPdriveAgent.exe MTPdrive210.exe File opened for modification C:\Program Files\MTPdrive\ MTPdrive210.exe File created C:\Program Files\MTPdrive\MTPdrive.exe MTPdrive210.exe File opened for modification C:\Program Files\MTPdrive\MTPdriveFB.exe MTPdrive210.exe File opened for modification C:\Program Files\MTPdrive\MTPdrive.dll MTPdrive210.exe File created C:\Program Files\MTPdrive\dokan_mounter.exe MTPdrive210.exe File created C:\Program Files\MTPdrive\MTPdrive.dll MTPdrive210.exe - Executes dropped EXE 3 IoCs
pid Process 4128 dokan_mounter.exe 4084 MTPdriveAgent.exe 3100 dokan.sys - Loads dropped DLL 26 IoCs
pid Process 5872 MTPdrive210.exe 5872 MTPdrive210.exe 5872 MTPdrive210.exe 5872 MTPdrive210.exe 5872 MTPdrive210.exe 5872 MTPdrive210.exe 5872 MTPdrive210.exe 5872 MTPdrive210.exe 5872 MTPdrive210.exe 5872 MTPdrive210.exe 5872 MTPdrive210.exe 5872 MTPdrive210.exe 5872 MTPdrive210.exe 5872 MTPdrive210.exe 5872 MTPdrive210.exe 6076 regsvr32.exe 1800 regsvr32.exe 1800 regsvr32.exe 4084 MTPdriveAgent.exe 1656 regsvr32.exe 6116 regsvr32.exe 6116 regsvr32.exe 5872 MTPdrive210.exe 5872 MTPdrive210.exe 5872 MTPdrive210.exe 5872 MTPdrive210.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTPdrive210.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Checks SCSI registry key(s) 3 TTPs 13 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009 svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe - Modifies registry class 2 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\PropertySheetHandlers regsvr32.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 812 Process not Found - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeBackupPrivilege 1832 vssvc.exe Token: SeRestorePrivilege 1832 vssvc.exe Token: SeAuditPrivilege 1832 vssvc.exe Token: SeBackupPrivilege 4084 MTPdriveAgent.exe Token: SeRestorePrivilege 4084 MTPdriveAgent.exe Token: SeBackupPrivilege 4084 MTPdriveAgent.exe Token: SeRestorePrivilege 4084 MTPdriveAgent.exe Token: SeBackupPrivilege 4084 MTPdriveAgent.exe Token: SeRestorePrivilege 4084 MTPdriveAgent.exe Token: SeBackupPrivilege 4084 MTPdriveAgent.exe Token: SeRestorePrivilege 4084 MTPdriveAgent.exe Token: SeBackupPrivilege 4084 MTPdriveAgent.exe Token: SeRestorePrivilege 4084 MTPdriveAgent.exe Token: SeBackupPrivilege 4084 MTPdriveAgent.exe Token: SeRestorePrivilege 4084 MTPdriveAgent.exe Token: SeBackupPrivilege 4084 MTPdriveAgent.exe Token: SeRestorePrivilege 4084 MTPdriveAgent.exe Token: SeBackupPrivilege 4084 MTPdriveAgent.exe Token: SeRestorePrivilege 4084 MTPdriveAgent.exe Token: SeBackupPrivilege 4084 MTPdriveAgent.exe Token: SeRestorePrivilege 4084 MTPdriveAgent.exe Token: SeBackupPrivilege 2844 srtasks.exe Token: SeRestorePrivilege 2844 srtasks.exe Token: SeSecurityPrivilege 2844 srtasks.exe Token: SeTakeOwnershipPrivilege 2844 srtasks.exe Token: SeBackupPrivilege 4084 MTPdriveAgent.exe Token: SeRestorePrivilege 4084 MTPdriveAgent.exe Token: SeBackupPrivilege 4084 MTPdriveAgent.exe Token: SeRestorePrivilege 4084 MTPdriveAgent.exe Token: SeBackupPrivilege 2844 srtasks.exe Token: SeRestorePrivilege 2844 srtasks.exe Token: SeSecurityPrivilege 2844 srtasks.exe Token: SeTakeOwnershipPrivilege 2844 srtasks.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5872 wrote to memory of 6076 5872 MTPdrive210.exe 97 PID 6076 wrote to memory of 1800 6076 regsvr32.exe 98 PID 5872 wrote to memory of 1656 5872 MTPdrive210.exe 103 PID 1656 wrote to memory of 6116 1656 regsvr32.exe 104 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\MTPdrive210.exe"C:\Users\Admin\AppData\Local\Temp\MTPdrive210.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files\MTPdrive\MTPdrive.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\MTPdrive\MTPdrive.dll"3⤵
- Loads dropped DLL
PID:1800
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /u /s "C:\Program Files\MTPdrive\MTPdrive.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\system32\regsvr32.exe/u /s "C:\Program Files\MTPdrive\MTPdrive.dll"3⤵
- Loads dropped DLL
- Modifies registry class
PID:6116
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
C:\Program Files\MTPdrive\dokan_mounter.exe"C:\Program Files\MTPdrive\dokan_mounter.exe"1⤵
- Executes dropped EXE
PID:4128
-
C:\Program Files\MTPdrive\MTPdriveAgent.exe"C:\Program Files\MTPdrive\MTPdriveAgent.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4084
-
C:\Windows\system32\drivers\dokan.sysC:\Windows\system32\drivers\dokan.sys1⤵
- Executes dropped EXE
PID:3100
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
- Checks SCSI registry key(s)
PID:3368
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\MTPdrive\MTPdrive.dll
- Size 891KB
- SHA256 db0b9679124ad75fe80a29908ca58f2417d7655b254f7400d3b63a8057bceb52
- MD5 f20fbc367d3b871dd308bf4da4f067bc
- SHA1 8e846abe2de0f6290c9be5a0ea38ad2f045f00dd
- SHA512 b17e460c406b5bcddf88698c6e5bf10286da88fc1c2aa02811c1a66ccf269291b32e89694aa11f7149b0574607ce44db8f9cafc96ebf591257fd297b0da22144
- SSDEEP 24576:JH456ypEDRFksyl5pRk38AYfL7HsMSnErmy+rp:JH45oyl5pq8AYfinErmy+
- TLSH T1B115F8016ADC10A8F4B7A6B5CEBFC516DB72F8960371979F12E0654F1E23B806A39335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\MTPdrive\MTPdriveAgent.exe
- Size 155KB
- SHA256 759ffb0d43598bcae99131b398303d2777a55a3a4381010e1b18e19be940cdb0
- MD5 bc18b384f70f22b126829545589de23e
- SHA1 b7157c6ac84d6c039a604c6bae16f0ccf971c3a7
- SHA512 26d126806d9478f63731d26a0fcb3c00f1a0b4de35230aa618def5e4293d5511165ce249e0a563aab603db96e417274fd523bded540b98e4695a277d0d8e9855
- SSDEEP 3072:QdA3PWtUM6OtfTGE/pBcTNh/Z/5UmxvS+DK5+x6bV3SUkQvY1ZPOwTm:Q63+UMTG0ITPZ/uqvS+yl5MZP
- TLSH T12AF3294373E421F9E0B7AA3488B24601EB727C725535CB4E1760729E5F72791AE39B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\MTPdrive\dokan_mounter.exe
- Size 138KB
- SHA256 6d008af2a488b096d436d4a51c09cccd28442f74c67849e9b25876fd4161af83
- MD5 5363ffc275245eb28acc418df087f742
- SHA1 fa949fac150a8d9bf3963602afb4eb0025ef2b36
- SHA512 c939d58b9e207d5be8585201c55846fde207d6e87b3139aafcd7f5284b5d3425d07a693311b68534cbf866a9c0c26d4f9290d527f5e797f3e36083bc19146d4c
- SSDEEP 3072:sGseSlZpKZS9J787VJix/u6c6mmyBw/PGaXvx5+gV6Db/5t:sG14KZQF87VmGJawkf0/T
- TLSH T1DCD36B4772A430F5E1768639C9615906E7B378760731CB5F07A8426A2F277A09E3EF32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nskB5EA.tmp\GetWinVersion.dll
- Size 43KB
- SHA256 e1fd50b544127688a24509b3e3349669067a857d174875842cbe820e6b1adaff
- MD5 eb7a6b6702e9379ba963d0f0e4aca737
- SHA1 e42d759d93bc9b4178b97f675f2af233a0de22ed
- SHA512 6936eff08e07dc68229a5caebc3eec6eee804063bf2a2ac7c1deeaf57e092feebf4137f861307acc7489c5925f9bc9afd7f18fe082f8d69c2bb1805a45ac888e
- SSDEEP 768:YxnMWsozvbHB7WOJ6Q/oyGI6BJ6zNphzOQJUkJ:YxMWsAMe6Q/9GI6BJwTOQLJ
- TLSH T107136B113591C0B3D54A8279155ADB095BBFB9221BE494837FFB178E9E323E1A23F306
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nskB5EA.tmp\IsDokan.dll
- Size 3KB
- SHA256 b97e29e5b441ac2c17021afecad8544f19a0b5de523e6f865eb37137cb257d0f
- MD5 b6996bce4ed7a4f544aca3a4fad844f8
- SHA1 941a5088f5436aab1f8975de1c1de0f53b337926
- SHA512 63303d2ff50268a2e80b06b7296b2ac21928700c05d6d2a176247839981787121e3842a7c12ebd754c3ed76df9f790d9075a5fdc5bb4f753f6db8498a620b4d7
- TLSH T1F6515023C3C808F2D04807F564D3097672BB872403E308CC4D86A12A3822B577E75E3A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nskB5EA.tmp\IsVM.dll
- Size 4KB
- SHA256 ccf52c19fc3628b1437584c14fdfb4f8bf1a9b86cb99ee4dd6feca46f9608dd8
- MD5 51e2f871b45ebd38d6e07d4a26e35db5
- SHA1 c387635d34e1f497f85417eea5f38b335d0eb681
- SHA512 bdea9f419af512b347d79b161ad19b0bb1f4de369800635624513c728efe7d96c8756073d23191d0ed4fd573d786ac06b7d5c30cf1beacf7ea828f47ce959f86
- TLSH T1BF817233F7A242F1C1C843F929A7566EB33D259017A484DB9A89573EAC304C73C35E22
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nskB5EA.tmp\Registry.dll
- Size 16KB
- SHA256 ae53f8e00574a87dd243fdf344141417cfe2af318c6c5e363a030d727a6c75d1
- MD5 24a7a119e289f1b5b69f3d6cf258db7c
- SHA1 fec84298f9819adf155fcf4e9e57dd402636c177
- SHA512 fdbbedcc877bf020a5965f6ba8586ade48cfbe03ac0af8190a8acf077fb294ffd6b5a7ae49870bff8cacd9e33d591be63b5b3d5c2e432c640212bdcd0c602861
- SSDEEP 384:Bl1fUuJHxreh2OatbswPCr64oLchV0oLQYYfVB:BlBzHxrehKbswK2TchDLQZfVB
- TLSH T17B724B4ECFE098B1D0EB283D75932E0F8A7BDC78251928A251C72CC1155D6A7336F7A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nskB5EA.tmp\SR.dll
- Size 37KB
- SHA256 ae2d77b9417c14a00eb32299cf1a9d75efc3d81ba9755f28aded9070248656c8
- MD5 e352416e1787148ed042bf25a6327567
- SHA1 2e7fda27d0d0f6109b186d8e13d4273fe4543421
- SHA512 4741d0876f8ee50ae87b4440c4c8ca27c601df6355bd49a38765e0cc572efdcbb8ec387e902af56b8db61c6675c6d858ac4b8e7ed7c49e7ded796e5289c7f9f3
- SSDEEP 768:2VJ7pRVLj1uVXyYPba5K80cUy9HScH4epeRlL7:a3UQS040Il
- TLSH T16F036D21755184B3D28685B272A2DF265A7E7E3007E21443BBF72B573E306E4B232B47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nskB5EA.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nskB5EA.tmp\nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- TLSH T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM32\dokan.dll
- Size 392KB
- SHA256 87d344003fb6c2c83da8328a61f4621abbba306c7968d31b36a2185284454067
- MD5 fda63aa4a4dee1bf0ed10be3549a28fd
- SHA1 4e2d10f28f2a55edc3d9e6ddcaf32cdbcef0faa7
- SHA512 066f8039348b23b3dddf58a3ebb95a384d5303ae3a61f32595e31f92ddb1c279d92968afd1bb669f2e308f88b3cf78fd16aa648bc2a54b5c8b718db35161afcc
- SSDEEP 6144:3G2/fGD92rRdTFVpBxs4twLqNvrlMFFK1rxR+mGOQi72WQBlwTV/4R0OGK/LA/U:W2GgRdTGqrlMFFK1rxR+6PpE0X0
- TLSH T137847D46F7A019B5E137D23DCA634A15E9B23C1A5721E78F13B842A61F337606A3F721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\dokan.sys
- Size 56KB
- SHA256 2f07d7e7fef5a13d9ab29d9be7fdf7071ee7d8b22ce49232a217ff4c31211015
- MD5 ddeb357fb7b8fe0def2cb3d888ab488d
- SHA1 64d9c7d8a9301f26c2b417ebe2476378692e6985
- SHA512 45abf1392c022c21e7365f3df4a4b2b8df40d729816cfd7a41b59dd883c237deafe29290217b1334a304e924bc7a0f261e7708d7a557a8a026f107b638b085b5
- SSDEEP 768:p7FXWtBSDKu9saRXmbfBMJp4wjFdHtx5jk2zGB+hlym4cTT/QPeONE6uaQYgvHBc:+PSBp1pFhtHjZzGB+hlypebqYBv5/y
- TLSH T1BE4359D262B819E6E5A7C6B4C6B79927DB71F442272683CF42A0C1611F23BE0DD3D319
- MD5 SHA1 SHA512 SSDEEP TLSH