77cbc99a978bb27353042b56651d53324035e42e710e50c7fdc307423ab369c4

Resubmissions

24/10/2026, 06:23

261024-g5wv4aed647

24/10/2026, 06:10

261024-gw3x2sxv9r7

Analysis

max time kernel
149s
max time network
111s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
udp-tor.exe
Size 626KB
Sample261024-g5wv4aed64
SHA256 77cbc99a978bb27353042b56651d53324035e42e710e50c7fdc307423ab369c4
MD5 3e85a7327e3ed492250f5d54ed9a5b27
SHA1 afbb1e1bebf24a5826399a9d371beafb2aef4f66
SHA512 d6f28aabb5e6446d6f9d8b4f4e20c19f0c3fe2720a7d2ceb1b454aea276d95a8b6ab556d10d7e3c1eaa06d86643f4e2d37a6f1687aa12756f3648228e4bcc3eb
SSDEEP 6144:gZIakP73ORchAJSBuOAItKDfAd2oEJhwefq3abLYeyNEWGNSK/B99fSdj6Ahx5Xp:tajSBuOASUJ3fqKP5y8pBOxV8muJLVa
TLSH
T122D49D58F6A401EDE27AC274CE479613F7B2B449137499EF03E089721F276A24B3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3164	SystemSettings.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettings = "C:\\Users\\Admin\\AppData\\Roaming\\SystemSettings.exe"	SystemSettings.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettings = "C:\\Users\\Admin\\AppData\\Roaming\\SystemSettings.exe"	udp-tor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 5020	1148	udp-tor.exe	79
PID 1148 wrote to memory of 5020	1148	udp-tor.exe	79
PID 3164 wrote to memory of 2360	3164	SystemSettings.exe	85
PID 3164 wrote to memory of 2360	3164	SystemSettings.exe	85
PID 1148 wrote to memory of 124	1148	udp-tor.exe	88
PID 1148 wrote to memory of 124	1148	udp-tor.exe	88
PID 3164 wrote to memory of 3364	3164	SystemSettings.exe	91
PID 3164 wrote to memory of 3364	3164	SystemSettings.exe	91
PID 1148 wrote to memory of 4796	1148	udp-tor.exe	94
PID 1148 wrote to memory of 4796	1148	udp-tor.exe	94
PID 3164 wrote to memory of 3104	3164	SystemSettings.exe	97
PID 3164 wrote to memory of 3104	3164	SystemSettings.exe	97

C:\Users\Admin\AppData\Local\Temp\udp-tor.exe
"C:\Users\Admin\AppData\Local\Temp\udp-tor.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe
  2⤵
  PID:5020
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe
  2⤵
  PID:124
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:4796

C:\Users\Admin\AppData\Roaming\SystemSettings.exe
C:\Users\Admin\AppData\Roaming\SystemSettings.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe
  2⤵
  PID:2360
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe
  2⤵
  PID:3364
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:3104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dc_inj.log

Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
Size 1KB
SHA256 25f30a9b92c2375a80453c2a9189db700cf7626ded0ddc5b083b36321efbddaa
MD5 48cbc6825afe6918236cf59afc53a12c
SHA1 701cebf2b78dd16396b8bcce02cc66f4cbc021ab
SHA512 0c5239d4273c093fb293de2a3f0f6225c72f70ed57c37110709df044df28e6c3d71065346e0daa0181ad5b608473aa2bda28decbd4eb2e58b483e098c7e1c462
TLSH
T1BF318B215568C528F9F8904AB5217EF5E699BA8318C68C2FB08D8084DF3B5DCBD1BDD8
MD5 SHA1 SHA512 TLSH

Submit Download

dc_inj.log

Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
Size 1KB
SHA256 4f81bb85be60b98c80e9f595aabe5a34c1b74aa6ca9c0b4774fc09d2d5f73333
MD5 e6b2b4e777633b0a4957b78d6dd6df92
SHA1 9e58e606d481e6a66db2a0684c376bcddc6cbe89
SHA512 28b7b0cc5e7c652d1c853a6848c627672bb8aef6370298e81f142510cf0888f1aed142e1d30b8594cbf49100053f9d9215e949839890751c88e5dcfcee8079ff
TLSH
T1E8418D605564C524F8F4504AB5247EF4E68DBA8308CA8C2FB08D8184DF3B5DDBD0BDE8
MD5 SHA1 SHA512 TLSH

Submit Download

dc_inj.log

Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
Size 2KB
SHA256 3267599a9a00cc8618cb6dd23638a897e495bf796bcc137eefade4dfacda7f35
MD5 f9b51cea6cb55528b04019d255fb4c99
SHA1 fb73171bd4859799dc80f00a7b97155f3da90248
SHA512 b1c00ff4ac0288c3952fc38a8c489a5e5d8c90ee1643aad1523137ab2dd08008cc35ad04f91cee85bdd3a1bf394f912562eaf1a7760d07c214cadf17eccf74e9
TLSH
T16B417B205564D524F9B8504AB5247EF4EA9DBA8308CA8C2FB08D8184DF3B5DDBD0BDD8
MD5 SHA1 SHA512 TLSH

Submit Download

dc_inj.log

Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
Size 2KB
SHA256 3975dbe52dd451d0f07b91b87934c94d006371b7eab1f2c641a13a34ee2a00bc
MD5 873dbe76b7ffa8905b9733fdec1b30b6
SHA1 bc2d073035d33f7a69a60641c8c8a43ce1432f5a
SHA512 567967b118cec192a32aea950140270e3fd4095e2f3037132c9c65e6e44575085ca3581ed050c1f7e8ce7fdad7dd889d78b3be8d861f420699b686dd20905462
TLSH
T19A419C205564C524F8B8504AB5247EF4E69DFA8308CA8C2FB08D8084DF3B5DDBD0BDD8
MD5 SHA1 SHA512 TLSH

Submit Download

dc_inj.log

Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
Size 2KB
SHA256 1cb6cc9aefba94b2852efb630ec355674b6079853e20f62a2d67686667d03698
MD5 992b18335443ab2daf184b628174a114
SHA1 a2d3a64d095fedf52fa203443b2a995dbc6856bb
SHA512 716c4e4b585c6816b6ee59ed04fc6730abbaa487c91bb32befa989cb85500cd1ee3e3570b7d8265072a2789f78e703d20a8f6aecf702eb7b4d787910b32a4b96
TLSH
T1E2515A605565D524F8B4504AB5247EF4E69CBAC308CA8C2FB08D8194CF3B5DDBD0BDE8
MD5 SHA1 SHA512 TLSH

Submit Download

dc_inj.log

Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
Size 2KB
SHA256 267cb2db8650d0ce4fa4455d3f4bc395f679496a7760a374456ed20a8dd97b34
MD5 58e5ac78dede02c3fb07e43cd84f371c
SHA1 41a005eff1c2a02d7d5a5437cbde8f4d5832d0dc
SHA512 4fd3e5bd7ed519d9d44d1868541d628d4d2292089d81d1e43aeb51b622a291aab2d7f05cf17977f695bb57c878e5af2438118ac3e043ee33261d1015d9a5c9c6
TLSH
T1FA515B605555D524F8B4504AF5287EF4EA9CBA8308CA8C2FB08D8184CF7B5DDBD0BDD8
MD5 SHA1 SHA512 TLSH

Submit Download

dc_inj.log

Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
Size 3KB
SHA256 b7cb5f3f735c40a4483e31991293e2ff03adac05a10f11cc1f919ff3628aceb9
MD5 02ace28235c2cef0fb199eea8a6b980b
SHA1 07c60652b52b264a78110d0a4c40b43ce70b8338
SHA512 9be1fb51893c61525d86b541a586a0913d22095f0e946d4f66409b6bdaef0374330687fea08ba6cc5c3a11e2d32d4ba8b71c2a890016ee3b9f3d33f2dd9f0059
TLSH
T1A16148605565D924E8B4509AB5283EF4EA9CBA8304CA8C2FB08D8194CF7B5DDBD0BDD8
MD5 SHA1 SHA512 TLSH

Submit Download

dc_inj.log

Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
Size 3KB
SHA256 7a411f4b6e131450b46f6823788d1334619f71a5bef3041b159e9683b0a18c74
MD5 9ce0fe26a58350848e0e7ff43c63d8da
SHA1 d795f5e5d502be9808f8886d9d87438d6d33a385
SHA512 00094c4ccf78dd1c02e5b45927c12c24144ca57d0a2e8b4e7e3337d0cef0865fe3501901fa923caa4081a8b2aefa88afd3057032bf89c59c23bc5fe2c05ef027
TLSH
T16E6148605565D924F8B4509AF5283EF4EA9CBA8304CA8C2FB08D8194CF7B5DDBD0BDD8
MD5 SHA1 SHA512 TLSH

Submit Download

dc_inj.log

Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
Size 3KB
SHA256 a9100088d693dbbb7e349893dc39da6de7d918fff4246a8cc79bca6a5738631a
MD5 54e7b0ecda0c794cfb7b9472221e2f16
SHA1 e39d7e8535ac0742be6b1b1fe188511c488014fc
SHA512 6a6a377928e97e586463c4f66343320fd211b7606396d7727d946eab0d110daa35eeb99fdcacf7b7fc852ab1625ed7710e9944de2144ca97d8b9ac1f9be5534b
TLSH
T1337159605565D924E8B4509AF5283EF4EA9CBAC304CA8C2FB08D8194CF7B5DDBD0BDD8
MD5 SHA1 SHA512 TLSH

Submit Download

dc_inj.log

Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
Size 3KB
SHA256 018d666b0157bf6bcd6fb76043c74168b4d1d56f3f19360584875d060953e9b5
MD5 8b902e9b238a2e1c8849dfb829462d4f
SHA1 938571074224481a1fdb906c8eb10cda91aaf235
SHA512 a450de5d4941f525872c1d3950704d5107b4d33f3522a074ae5d447d2ba65d1bfe854dc62b93b4d6906a06a51dcf28789e58ec72b7c9fcef8e068ed226b59b13
TLSH
T1C18159601555D914E8B4509AF5283EF4EA9CBAC304CA8C2FB08D8194CF7B5DDBD0BDD8
MD5 SHA1 SHA512 TLSH

Submit Download

dc_inj.log

Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
Size 3KB
SHA256 a7caf3d5d683380b7321a97fab6a41bcb4308e09a1d80c2c53b5fcb4644afbe2
MD5 87e6be6b36d79086197f10a3701cbe7c
SHA1 308c07020a26411d89dc325533f2cbcf6b34c766
SHA512 147fffbae7b5efd9c34d845551219106ecfb1d3ca6f725139adab1b5fd25a303a3e566f02f170f0bdb74635e7b6414aa927b016e03a49ffb45e82e71eacf19f6
TLSH
T1658159601655D914E8B4509AF5283EF4EA9CBAC304CA9C2FB08D8194CF7B5DDBD0BED8
MD5 SHA1 SHA512 TLSH

Submit Download

dc_inj.log

Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
Size 1KB
SHA256 3ca98ec7b36e46968c400a83806058c0dd0f05d8375b0be0bfbc5f625cd2f7f7
MD5 7bff4f822e91c8d2dba6df771100c676
SHA1 e2821d0f8165b0add416697740b670376b71218a
SHA512 68fdbe5e4858440ac8702523125ac3fa64d0b58dfc0c21cd0f13fa9602aa0ebfdc98f04b94d343bd12baaa9d998c22c37aa3ff56c6d8b2a968bf392cc9b95331
TLSH
T1E821CE20462CC154F5F4904AB1217EF5E6C9B9831CC68C2B708D8084DF3B9DCBE0A8E8
MD5 SHA1 SHA512 TLSH

Submit Download

dc_inj.log

Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
Size 961B
SHA256 4c9a1521bbf121471872819eebff7f29ce99f1f242e4b4de6beedb621a225790
MD5 ca08aa6fcd24d2fd891dd2b0c75e5494
SHA1 3bfca9295ec0364d50374fb76dca91659a50bdc7
SHA512 7f94edaa4ec65aaf22da280280d11ff24faf8554b3a10fef64e7dfe517dc267bc14ea0d2e1590d09596e986d8bba065ccc6bc00e9d2b52a36cffaa9fa1834eea
TLSH
T148116B15552C8128F5F8904E7221BDFAE2C5B9432CD24C2B30CD9044DF379DC7A19499
MD5 SHA1 SHA512 TLSH

Submit Download

dc_inj.log

Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
Size 931B
SHA256 9e803208d286b98d287b119fcd934cce18205c416f5b366664aa5052b21ced91
MD5 48dc3bc939035a1c316d962e2bb70540
SHA1 096e4e25d6c8317d45c466b4e4e834c85a246041
SHA512 17a1b99ea387b667b56c5adc60b7da1f97a2fc775386280450776b1177cb62eb5b226bddecf2d12672559569fef0d8ec6f4cea46db6076cdf8e37aa726f843de
TLSH
T123114916412C8428F5F8904E7131BDF7E2C6BA031CD24C2B74CD9044DF3B9DC7A198A9
MD5 SHA1 SHA512 TLSH

Submit Download

dc_inj.log

Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
Size 1KB
SHA256 d0faac412f18537533746dd4c866b36e81baf7188a5878303b7f9e215ba51a6e
MD5 6e44ff1cf9bdf1eb5c4a69849614f5a3
SHA1 3a8edf8ec3db065a0cae87b318bbac741e1d3a39
SHA512 313e93fbdc97510fc1a64e17c78d5757707a090be9eb0f379a9cec176cc27133fd7f0b26d29b571d1f04f87ec3fb640ec588b99836dd6634c881f5a37d3a8257
TLSH
T149218E214528C524F5F8905EB5217EF5E6C9BA8318D68C2FB0CD8184DF3B5DDBD1A8E8
MD5 SHA1 SHA512 TLSH

Submit Download

wctk.dat

Path C:\Users\Admin\AppData\Local\Temp\wctk.dat
Size 123B
SHA256 2ded6071fb203b4d20ca6c4ea4db40bd31428c748388d93797b81ceab346ad22
MD5 d182db2e069dd9df439ce3f1231de0b2
SHA1 00131c34293daa18b32acae7651781d443348ccd
SHA512 737ee29df8acf8998f4107a3480fd7524e88c8e48e23d6656f4017155525d880bb7577027d3b0ef9c38285d159457de44d91c2bb192681a21c687551a708fa1d
TLSH
T1AEB02B6004C3B03647A1121454030DB0BA4CD1F8C30112B8214CC062C9B82C0C644740
MD5 SHA1 SHA512 TLSH

Submit Download

wctk.dat

Path C:\Users\Admin\AppData\Local\Temp\wctk.dat
Size 159B
SHA256 e06eb819019f5ea4749d202dc66f9d1e65bbf4043cf95daaf5614f4b8f8efbda
MD5 65040884b5ba779a171a511bd6b47802
SHA1 f8618c69fcb890b1a71571c47060d567a2618da0
SHA512 b8ba91f1c3e3d8033c21d2d11f6cb6e11022ce7764f8eedad0be737157b395d2a94d0643dca9efa2b618a659f91711b0eee00996d66f540b861932f14d7839de
TLSH
T1AEC08CB049C6A03647A21618E6131AE8AA4CE2F8C30252F825ACC063CAB92C0DA84B42
MD5 SHA1 SHA512 TLSH

Submit Download

wctk.dat

Path C:\Users\Admin\AppData\Local\Temp\wctk.dat
Size 159B
SHA256 a78a231c84def720604628135e5d3ba4e9e25b0dcf5152e3543a233f527ba5dd
MD5 b4de7c40d29b73678137f7d8f0f01459
SHA1 330be48929216dd3e10ca4aa40574e1e758de4e3
SHA512 fbdd67af4c8309b178fb4226d058da71f21512cc8b5459725b23776de41652e486dcdca91fb732828637d5661969f5632fd98fc43a5a17a9cfe2f6c62715a771
TLSH
T196C08CB14DC5603647E21B18FA1316B8AA4CE2ECC34152E821ACC062CAB92C0DB44B52
MD5 SHA1 SHA512 TLSH

Submit Download

wctk.dat

Path C:\Users\Admin\AppData\Local\Temp\wctk.dat
Size 123B
SHA256 417b87f624c85b78d0cfeebd3f25a3e9cc30f0576c4ff7a8f53a5f9cc802295d
MD5 22b50bbf7efa5aa6ad324a0254fcd938
SHA1 c476c16f272ec943953bee4555efa4122e98cf2a
SHA512 be918b39a888db2c73a18d6e78bcaac0437a2e452ea8f3388e61eb7cb13610efd43360762ed6ea14303d0d307e791f22f1dae00c733d2418e3490f87aba32e84
TLSH
T1C7B02BA108C1703747D11B14E80304706E4CD1FCC30011A4218CC060C5F82C0C704340
MD5 SHA1 SHA512 TLSH

Submit Download

wctk.dat

Path C:\Users\Admin\AppData\Local\Temp\wctk.dat
Size 123B
SHA256 5dc4df5912f535dd766a08304885dbb40f57de1d10a7e9708d8ba964216d47c7
MD5 04713897c9b26d9e653fd1177580c396
SHA1 f1a4b53bb80af5d33f7ec9efc8104ed7ec287fd2
SHA512 fd94c224d803f88e87311dd136879f11877c22c2e148b348ab36f25e7e3d77338a191c60ad1fd6849ca9095f1b8024d9a37fd445a5d106d650156be6c6cf5274
TLSH
T182B02B3008C1B1764B91172469030474BA4CD1F8CB0015A52148C060C5B82C0CA05340
MD5 SHA1 SHA512 TLSH

Submit Download

wctk.dat

Path C:\Users\Admin\AppData\Local\Temp\wctk.dat
Size 159B
SHA256 1a06303ea0b18e1ecc53ea685f6a7eb207e14222d13c605ffc96ce54eb79f2fc
MD5 d6fdd8bafbf066a0fff6f0fd13ebd7d5
SHA1 7ecf7be058dd870a857b4b077e99882c9191e019
SHA512 0710efab879d647bc2b68bc45a2b2b070c0d2fa55e872485455356b445c3b7d443a38aa8d10e88b6c96177b9c50ccc7206949c5a36e9738380ad2c24be99f965
TLSH
T1A9C08C704DC5B1764BA21B28FA1316B9AA4CE2F8CB0156E921ACC062CAB92C0CA45B42
MD5 SHA1 SHA512 TLSH

Submit Download

wctk.dat

Path C:\Users\Admin\AppData\Local\Temp\wctk.dat
Size 123B
SHA256 8c68d2a20246d51fd2b6c0084185c985109cd1968996137b85c39bc9d3281e89
MD5 69cf2d78687026e58653e640759bce04
SHA1 938822e6c5d9290d57e795813f3d77e49d47d145
SHA512 39c384b95fc5c924aa622e55bbf90e12b8241a2d7d4120dc9af5895a2b42ae42b661a1e7038f47ad586855724fe96e1acb56064dd540d27239f04421a440daaf
TLSH
T146B02B2004C1713E47A52214550304746B4CD3F8C30013B4114CC060C9B82C0C784340
MD5 SHA1 SHA512 TLSH

Submit Download

wctk.dat

Path C:\Users\Admin\AppData\Local\Temp\wctk.dat
Size 159B
SHA256 906b6a4231f22ca5688b10f0c5605a47d894162d12ea8d51d80504d3bdcfda83
MD5 fb5969f2e0878005a55d934a08d5c45f
SHA1 df8428518317ae70fd57e5c5e78d8a5312fcba84
SHA512 f32caf875c7e334cdfa1886f47aed1db1461544653bc82dddae1fa5ffb4d160194f00e239ac5ef13c0465ad84e111609a87efa3abbfaaea71907be7816cf04ab
TLSH
T1D0C08C7049C5613A47A62618E61316B9AA4CE3E8C30153F821ACC062CAB92C0CB84B42
MD5 SHA1 SHA512 TLSH

Submit Download

wctk.dat

Path C:\Users\Admin\AppData\Local\Temp\wctk.dat
Size 123B
SHA256 9afa3cd37d5c7656e9ab599d77b00c4a01cfe61fd337657221870981020355c1
MD5 d90714cf94649967ec68bd0a171704e0
SHA1 a104d74eb7d9a7356f8f0602f44c8ec20b6990d4
SHA512 cda7a88cf93eb30cbd5602626d17d68bf580f87f01ed5051f1fef735003a08e244b8558328bd44f196f18c7ee8df17559b58be5ca7d4179e5646dad5167885b3
TLSH
T13AB02B3004C1703647D11714952304F07A4CD1FCC30021A46548C060C9BD2C0CA04340
MD5 SHA1 SHA512 TLSH

Submit Download

wctk.dat

Path C:\Users\Admin\AppData\Local\Temp\wctk.dat
Size 123B
SHA256 8da08334e84850e468aa7286f666cddf25f214cbfc72b8bca1905cce7f915af2
MD5 6e18388f6847a8b88611eb94a3f0a675
SHA1 de5cf11de64ddfdccd0bfa05ee0ab4ccd836a840
SHA512 f4b43698a8e7f0a321b27482670d3d8e46216a0be57ec9bfa8102eb1b36ed1ff941c92a41d8cdda1c2aab52ec6e6862a81c58493754f6bec54a9e135d693a9cb
TLSH
T1F8B02B2014C1743A87912314550328B86A4CD2F8C31212B4118CC061D5F83C0C644740
MD5 SHA1 SHA512 TLSH

Submit Download

wctk.dat

Path C:\Users\Admin\AppData\Local\Temp\wctk.dat
Size 159B
SHA256 3146251a90ff5b51a398c338a3622663fc348f440b37aa021996fb39ca3d515a
MD5 11d71436eaf836c459d0418d4fc7cb73
SHA1 d69984c2ef9efd19c282ac6088050349c5bff699
SHA512 912f84a1dc3a288aa50d3be315379d7d2a9cee226a625753a4562ffdf9cc3916647db09eed0e34e53a12806558ac550ad0495b5e583653680e0578f36f5e2163
TLSH
T110C0807059C5643547911714E61325FC554CE2E8C31252F4159CC053D5B93C0C644B42
MD5 SHA1 SHA512 TLSH

Submit Download

SystemSettings.exe

Path C:\Users\Admin\AppData\Roaming\SystemSettings.exe
Size 626KB
SHA256 77cbc99a978bb27353042b56651d53324035e42e710e50c7fdc307423ab369c4
MD5 3e85a7327e3ed492250f5d54ed9a5b27
SHA1 afbb1e1bebf24a5826399a9d371beafb2aef4f66
SHA512 d6f28aabb5e6446d6f9d8b4f4e20c19f0c3fe2720a7d2ceb1b454aea276d95a8b6ab556d10d7e3c1eaa06d86643f4e2d37a6f1687aa12756f3648228e4bcc3eb
SSDEEP 6144:gZIakP73ORchAJSBuOAItKDfAd2oEJhwefq3abLYeyNEWGNSK/B99fSdj6Ahx5Xp:tajSBuOASUJ3fqKP5y8pBOxV8muJLVa
TLSH
T122D49D58F6A401EDE27AC274CE479613F7B2B449137499EF03E089721F276A24B3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1148-1-0x0000015A5A2F0000-0x0000015A5A2F1000-memory.dmp

Download

memory/2360-96-0x0000016F59030000-0x0000016F590DF000-memory.dmp

Download

memory/2360-100-0x0000016F59030000-0x0000016F590DF000-memory.dmp

Download

memory/5020-49-0x000001DBD1510000-0x000001DBD15BF000-memory.dmp

Download

memory/5020-45-0x000001DBD1510000-0x000001DBD15BF000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads