eaf79431229e8020ef046a91606bf00e7d75cd3736d861c6127d04e2a84a3175

Analysis

max time kernel
13s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cb4715aa7901226fe059c24edfa9511.exe
Size

244KB
MD5

3cb4715aa7901226fe059c24edfa9511
SHA1

28acfab34ee1b9a669c0f8da61b2567805dcfc1d
SHA256

eaf79431229e8020ef046a91606bf00e7d75cd3736d861c6127d04e2a84a3175
SHA512

88adec4a376d91d084fccb3fa0e838e283ee2273f31283aea3d32a37d19093aad596b915417021f245ae817fa709ec8ae3d4471d2a47dbc51f69216e42ada6fb
SSDEEP

6144:cr0l5OVa6Ojc3vhYxnCG6ozHOJoR559Yx0u7JOAi:S0OVr3ZgCGJHOJoRWxH7Qr

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
1728	wincrt32.exe
4328	wincrt32.exe
1268	wincrt32.exe
1364	wincrt32.exe
1448	wincrt32.exe
2220	wincrt32.exe
5112	wincrt32.exe
4868	wincrt32.exe
2908	wincrt32.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wincrt32.exe	3cb4715aa7901226fe059c24edfa9511.exe
File created	C:\Windows\SysWOW64\wincrt32.exe	wincrt32.exe
File created	C:\Windows\SysWOW64\wincrt32.exe	wincrt32.exe
File created	C:\Windows\SysWOW64\wincrt32.exe	wincrt32.exe
File created	C:\Windows\SysWOW64\wincrt32.exe	wincrt32.exe
File created	C:\Windows\SysWOW64\wincrt32.exe	wincrt32.exe
File created	C:\Windows\SysWOW64\wincrt32.exe	wincrt32.exe
File created	C:\Windows\SysWOW64\wincrt32.exe	wincrt32.exe
File created	C:\Windows\SysWOW64\wincrt32.exe	wincrt32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2332	3cb4715aa7901226fe059c24edfa9511.exe
2332	3cb4715aa7901226fe059c24edfa9511.exe
2332	3cb4715aa7901226fe059c24edfa9511.exe
2332	3cb4715aa7901226fe059c24edfa9511.exe
2332	3cb4715aa7901226fe059c24edfa9511.exe
2332	3cb4715aa7901226fe059c24edfa9511.exe
2332	3cb4715aa7901226fe059c24edfa9511.exe
2332	3cb4715aa7901226fe059c24edfa9511.exe
2332	3cb4715aa7901226fe059c24edfa9511.exe
2332	3cb4715aa7901226fe059c24edfa9511.exe
2332	3cb4715aa7901226fe059c24edfa9511.exe
2332	3cb4715aa7901226fe059c24edfa9511.exe
2332	3cb4715aa7901226fe059c24edfa9511.exe
2332	3cb4715aa7901226fe059c24edfa9511.exe
1728	wincrt32.exe
1728	wincrt32.exe
1728	wincrt32.exe
1728	wincrt32.exe
1728	wincrt32.exe
1728	wincrt32.exe
1728	wincrt32.exe
1728	wincrt32.exe
1728	wincrt32.exe
1728	wincrt32.exe
1728	wincrt32.exe
1728	wincrt32.exe
1728	wincrt32.exe
1728	wincrt32.exe
4328	wincrt32.exe
4328	wincrt32.exe
4328	wincrt32.exe
4328	wincrt32.exe
4328	wincrt32.exe
4328	wincrt32.exe
4328	wincrt32.exe
4328	wincrt32.exe
4328	wincrt32.exe
4328	wincrt32.exe
4328	wincrt32.exe
4328	wincrt32.exe
4328	wincrt32.exe
4328	wincrt32.exe
4328	wincrt32.exe
4328	wincrt32.exe
1268	wincrt32.exe
1268	wincrt32.exe
1268	wincrt32.exe
1268	wincrt32.exe
1268	wincrt32.exe
1268	wincrt32.exe
1268	wincrt32.exe
1268	wincrt32.exe
1268	wincrt32.exe
1268	wincrt32.exe
1268	wincrt32.exe
1268	wincrt32.exe
1268	wincrt32.exe
1268	wincrt32.exe
1364	wincrt32.exe
1364	wincrt32.exe
1364	wincrt32.exe
1364	wincrt32.exe
1364	wincrt32.exe
1364	wincrt32.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1728	2332	3cb4715aa7901226fe059c24edfa9511.exe	92
PID 2332 wrote to memory of 1728	2332	3cb4715aa7901226fe059c24edfa9511.exe	92
PID 2332 wrote to memory of 1728	2332	3cb4715aa7901226fe059c24edfa9511.exe	92
PID 1728 wrote to memory of 4328	1728	wincrt32.exe	93
PID 1728 wrote to memory of 4328	1728	wincrt32.exe	93
PID 1728 wrote to memory of 4328	1728	wincrt32.exe	93
PID 4328 wrote to memory of 1268	4328	wincrt32.exe	94
PID 4328 wrote to memory of 1268	4328	wincrt32.exe	94
PID 4328 wrote to memory of 1268	4328	wincrt32.exe	94
PID 1268 wrote to memory of 1364	1268	wincrt32.exe	95
PID 1268 wrote to memory of 1364	1268	wincrt32.exe	95
PID 1268 wrote to memory of 1364	1268	wincrt32.exe	95
PID 1364 wrote to memory of 1448	1364	wincrt32.exe	96
PID 1364 wrote to memory of 1448	1364	wincrt32.exe	96
PID 1364 wrote to memory of 1448	1364	wincrt32.exe	96
PID 1448 wrote to memory of 2220	1448	wincrt32.exe	97
PID 1448 wrote to memory of 2220	1448	wincrt32.exe	97
PID 1448 wrote to memory of 2220	1448	wincrt32.exe	97
PID 2220 wrote to memory of 5112	2220	wincrt32.exe	98
PID 2220 wrote to memory of 5112	2220	wincrt32.exe	98
PID 2220 wrote to memory of 5112	2220	wincrt32.exe	98
PID 5112 wrote to memory of 4868	5112	wincrt32.exe	101
PID 5112 wrote to memory of 4868	5112	wincrt32.exe	101
PID 5112 wrote to memory of 4868	5112	wincrt32.exe	101
PID 4868 wrote to memory of 2908	4868	wincrt32.exe	104
PID 4868 wrote to memory of 2908	4868	wincrt32.exe	104
PID 4868 wrote to memory of 2908	4868	wincrt32.exe	104

C:\Users\Admin\AppData\Local\Temp\3cb4715aa7901226fe059c24edfa9511.exe
"C:\Users\Admin\AppData\Local\Temp\3cb4715aa7901226fe059c24edfa9511.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\wincrt32.exe
  C:\Windows\system32\wincrt32.exe -meltserver "C:\Users\Admin\AppData\Local\Temp\3cb4715aa7901226fe059c24edfa9511.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\wincrt32.exe
    C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\SysWOW64\wincrt32.exe
      C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1268
    - - C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1364
      - C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        10⤵
        Executes dropped EXE
        
        PID:2908
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        11⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        12⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        13⤵
        
        PID:864
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        14⤵
        
        PID:940
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        15⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        16⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        17⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        18⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        19⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        20⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        21⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        22⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        23⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        24⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        25⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        26⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        27⤵
        
        PID:392
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        28⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        29⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        30⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        31⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        32⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        33⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        34⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        35⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        36⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        37⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        38⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        39⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        40⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        41⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        42⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        43⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        44⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        45⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        46⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        47⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        48⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        49⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        50⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        51⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        52⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        53⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        54⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        55⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        56⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        57⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        58⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        59⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        60⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        61⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        62⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        63⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        64⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        65⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        66⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        67⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        68⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        69⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        70⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        71⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        72⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        73⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        74⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        75⤵
        
        PID:796
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        76⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        77⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        78⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        79⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        80⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        81⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        82⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\wincrt32.exe
        
        C:\Windows\system32\wincrt32.exe -meltserver "C:\Windows\SysWOW64\wincrt32.exe"
        83⤵
        
        PID:1012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\wincrt32.exe

Filesize
99KB

MD5
ab42c7165a538aaa28723eb93386d0be

SHA1
6eea65c0d5a60dade22d4963ead0d9a87ece38d2

SHA256
f7c24bfa19a9e2b3b39b5b12583efcde2441f81a66dd9d282fa073586cb60f25

SHA512
188e2aa9dd298a4c0288563f9b03a8c7abf9938d52915e3b5022ee22cec6a050ced1f2b4c0148bea7331e447c2517bed0b07879c3cd76d96e87ea15002614ca8

Download Submit
C:\Windows\SysWOW64\wincrt32.exe

Filesize
244KB

MD5
5fef4d3374fa2fd1a14f132ea71ef466

SHA1
c3acbcbb1321311fe8e0cd71fc74323dda44438e

SHA256
29c5a12c1a907fc49adfb5d160db96d84b89107831f48a5eaad72eaa7dde039f

SHA512
acd248d47b7c57283c116dff5bd52e2ac4a3033c21b8a6aa7359b268399b15fe5451f57d9a21b4eaa0d7805017df03308fcdd0221d152d0a248d288e59d3b888

Download Submit
C:\Windows\SysWOW64\wincrt32.exe

Filesize
92KB

MD5
9bb2d01775b77fbb5acaa23056c8a9fd

SHA1
f6a3a61406b06809492197b5b3cff888982486bd

SHA256
e5a3820d6d19e8e2b3ef95de1a8e094d736a1a7896f7bf1e078bdd61fcf1771e

SHA512
d7bf0acfebf9e4868392a216ab0305111fc485fbd8fbb3540e61083e984c6e679183c2d248f9bdceecd72cf7ed388fbec99b074aa2b0bded6be82cd962196c3a

Download Submit
memory/392-77-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/392-79-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/864-37-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/864-39-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/940-42-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/940-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1268-13-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1284-83-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1284-85-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1364-14-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1364-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1372-49-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1372-51-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1448-19-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1448-17-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1596-74-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1596-72-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1604-86-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1604-88-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1728-8-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1728-4-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2220-20-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2220-22-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2236-60-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2236-62-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2272-97-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2272-95-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2332-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2332-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2388-80-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2388-82-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2908-31-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2908-29-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3232-54-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3232-52-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3352-55-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3352-57-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3392-65-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3392-63-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3440-68-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3440-66-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3448-36-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4236-92-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4236-94-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4324-45-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4324-43-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4328-9-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4328-11-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4352-59-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4384-46-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4384-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4596-71-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4596-69-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4640-76-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4868-26-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4868-28-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4908-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4908-34-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5004-98-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5004-100-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5088-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5088-91-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5112-25-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5112-23-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download