healer | 216e2221b99ee5579841f6a626348a6a8db8df0e2eb844b2618dc0164ace6489

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

780d2e800f96ba58754479f096830f21.exe
Size

1.1MB
MD5

780d2e800f96ba58754479f096830f21
SHA1

c69e55688d443d68d4aa791b036ee26aaef2dadb
SHA256

216e2221b99ee5579841f6a626348a6a8db8df0e2eb844b2618dc0164ace6489
SHA512

223327592e70027d6b36b607d3cfd20dc7f519ad960ad9104ad6537bb7312f4cc32e718e9d1d8cea2831cc6cd8e29f160df2e9f10a76bccbc495bade0e988c4e
SSDEEP

24576:MyV+svCgyP3BNNDcvRER1hc3rCv6T8L2ngcg:7VTvCDRN+UaWNan5

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2560-55-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/2560-56-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/2560-58-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/2560-60-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/2560-62-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe

Executes dropped EXE 5 IoCs

Processes:

z7138597.exez6997040.exez1681933.exez8352291.exeq9120009.exe

pid process

1432 z7138597.exe
2540 z6997040.exe
2596 z1681933.exe
2588 z8352291.exe
2480 q9120009.exe

pid	process
1432	z7138597.exe
2540	z6997040.exe
2596	z1681933.exe
2588	z8352291.exe
2480	q9120009.exe

Loads dropped DLL 15 IoCs

Processes:

780d2e800f96ba58754479f096830f21.exez7138597.exez6997040.exez1681933.exez8352291.exeq9120009.exeWerFault.exe

pid	process
2412	780d2e800f96ba58754479f096830f21.exe
1432	z7138597.exe
1432	z7138597.exe
2540	z6997040.exe
2540	z6997040.exe
2596	z1681933.exe
2596	z1681933.exe
2588	z8352291.exe
2588	z8352291.exe
2588	z8352291.exe
2480	q9120009.exe
2488	WerFault.exe
2488	WerFault.exe
2488	WerFault.exe
2488	WerFault.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

z6997040.exez1681933.exez8352291.exe780d2e800f96ba58754479f096830f21.exez7138597.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z6997040.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z1681933.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z8352291.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	780d2e800f96ba58754479f096830f21.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z7138597.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

q9120009.exe

description pid process target process

PID 2480 set thread context of 2560 2480 q9120009.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2488 2480 WerFault.exe q9120009.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

2560 AppLaunch.exe
2560 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 2560 AppLaunch.exe

description	pid	process	target process
PID 2480 set thread context of 2560	2480	q9120009.exe	AppLaunch.exe

pid	pid_target	process	target process
2488	2480	WerFault.exe	q9120009.exe

pid	process
2560	AppLaunch.exe
2560	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2560	AppLaunch.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

780d2e800f96ba58754479f096830f21.exez7138597.exez6997040.exez1681933.exez8352291.exeq9120009.exe

description	pid	process	target process
PID 2412 wrote to memory of 1432	2412	780d2e800f96ba58754479f096830f21.exe	z7138597.exe
PID 2412 wrote to memory of 1432	2412	780d2e800f96ba58754479f096830f21.exe	z7138597.exe
PID 2412 wrote to memory of 1432	2412	780d2e800f96ba58754479f096830f21.exe	z7138597.exe
PID 2412 wrote to memory of 1432	2412	780d2e800f96ba58754479f096830f21.exe	z7138597.exe
PID 2412 wrote to memory of 1432	2412	780d2e800f96ba58754479f096830f21.exe	z7138597.exe
PID 2412 wrote to memory of 1432	2412	780d2e800f96ba58754479f096830f21.exe	z7138597.exe
PID 2412 wrote to memory of 1432	2412	780d2e800f96ba58754479f096830f21.exe	z7138597.exe
PID 1432 wrote to memory of 2540	1432	z7138597.exe	z6997040.exe
PID 1432 wrote to memory of 2540	1432	z7138597.exe	z6997040.exe
PID 1432 wrote to memory of 2540	1432	z7138597.exe	z6997040.exe
PID 1432 wrote to memory of 2540	1432	z7138597.exe	z6997040.exe
PID 1432 wrote to memory of 2540	1432	z7138597.exe	z6997040.exe
PID 1432 wrote to memory of 2540	1432	z7138597.exe	z6997040.exe
PID 1432 wrote to memory of 2540	1432	z7138597.exe	z6997040.exe
PID 2540 wrote to memory of 2596	2540	z6997040.exe	z1681933.exe
PID 2540 wrote to memory of 2596	2540	z6997040.exe	z1681933.exe
PID 2540 wrote to memory of 2596	2540	z6997040.exe	z1681933.exe
PID 2540 wrote to memory of 2596	2540	z6997040.exe	z1681933.exe
PID 2540 wrote to memory of 2596	2540	z6997040.exe	z1681933.exe
PID 2540 wrote to memory of 2596	2540	z6997040.exe	z1681933.exe
PID 2540 wrote to memory of 2596	2540	z6997040.exe	z1681933.exe
PID 2596 wrote to memory of 2588	2596	z1681933.exe	z8352291.exe
PID 2596 wrote to memory of 2588	2596	z1681933.exe	z8352291.exe
PID 2596 wrote to memory of 2588	2596	z1681933.exe	z8352291.exe
PID 2596 wrote to memory of 2588	2596	z1681933.exe	z8352291.exe
PID 2596 wrote to memory of 2588	2596	z1681933.exe	z8352291.exe
PID 2596 wrote to memory of 2588	2596	z1681933.exe	z8352291.exe
PID 2596 wrote to memory of 2588	2596	z1681933.exe	z8352291.exe
PID 2588 wrote to memory of 2480	2588	z8352291.exe	q9120009.exe
PID 2588 wrote to memory of 2480	2588	z8352291.exe	q9120009.exe
PID 2588 wrote to memory of 2480	2588	z8352291.exe	q9120009.exe
PID 2588 wrote to memory of 2480	2588	z8352291.exe	q9120009.exe
PID 2588 wrote to memory of 2480	2588	z8352291.exe	q9120009.exe
PID 2588 wrote to memory of 2480	2588	z8352291.exe	q9120009.exe
PID 2588 wrote to memory of 2480	2588	z8352291.exe	q9120009.exe
PID 2480 wrote to memory of 2560	2480	q9120009.exe	AppLaunch.exe
PID 2480 wrote to memory of 2560	2480	q9120009.exe	AppLaunch.exe
PID 2480 wrote to memory of 2560	2480	q9120009.exe	AppLaunch.exe
PID 2480 wrote to memory of 2560	2480	q9120009.exe	AppLaunch.exe
PID 2480 wrote to memory of 2560	2480	q9120009.exe	AppLaunch.exe
PID 2480 wrote to memory of 2560	2480	q9120009.exe	AppLaunch.exe
PID 2480 wrote to memory of 2560	2480	q9120009.exe	AppLaunch.exe
PID 2480 wrote to memory of 2560	2480	q9120009.exe	AppLaunch.exe
PID 2480 wrote to memory of 2560	2480	q9120009.exe	AppLaunch.exe
PID 2480 wrote to memory of 2560	2480	q9120009.exe	AppLaunch.exe
PID 2480 wrote to memory of 2560	2480	q9120009.exe	AppLaunch.exe
PID 2480 wrote to memory of 2560	2480	q9120009.exe	AppLaunch.exe
PID 2480 wrote to memory of 2488	2480	q9120009.exe	WerFault.exe
PID 2480 wrote to memory of 2488	2480	q9120009.exe	WerFault.exe
PID 2480 wrote to memory of 2488	2480	q9120009.exe	WerFault.exe
PID 2480 wrote to memory of 2488	2480	q9120009.exe	WerFault.exe
PID 2480 wrote to memory of 2488	2480	q9120009.exe	WerFault.exe
PID 2480 wrote to memory of 2488	2480	q9120009.exe	WerFault.exe
PID 2480 wrote to memory of 2488	2480	q9120009.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\780d2e800f96ba58754479f096830f21.exe
"C:\Users\Admin\AppData\Local\Temp\780d2e800f96ba58754479f096830f21.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7138597.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7138597.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6997040.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6997040.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1681933.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1681933.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8352291.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8352291.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9120009.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9120009.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 276
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7138597.exe

Filesize
982KB

MD5
16725760f83e92f0d7d6bdb61c9d5d0e

SHA1
05569c3352579f408b81c40277edebee045b24c0

SHA256
abab3e8a1212dca5f085153572cdb13d7b3d4860a4233c31023d11e8a4e54946

SHA512
b99d2ab1c02d98b963a5e7ab74dd42c11a712851c06f8918f0a28a8ae3c55d16e250c1a58845413c544dc0248ce2c7d93199788d070d0ba9cecf421f17264c0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7138597.exe

Filesize
982KB

MD5
16725760f83e92f0d7d6bdb61c9d5d0e

SHA1
05569c3352579f408b81c40277edebee045b24c0

SHA256
abab3e8a1212dca5f085153572cdb13d7b3d4860a4233c31023d11e8a4e54946

SHA512
b99d2ab1c02d98b963a5e7ab74dd42c11a712851c06f8918f0a28a8ae3c55d16e250c1a58845413c544dc0248ce2c7d93199788d070d0ba9cecf421f17264c0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6997040.exe

Filesize
799KB

MD5
c4dcb89104e412507fae11413d813963

SHA1
0c9c95531e45999a340e65d08bbed3dc402d7661

SHA256
1eb0b16b2fa363efadbeeebffdf6668feefe11191298a049f7ff601a69ccbc92

SHA512
98e843eaa3fa3d7c7b59d13d48b2494a514a85970cf1c85a7d3e762595d89a4c669728789ef4b3cad63037e9a1b50f6c41ed39911d89bab213b759558a9419a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6997040.exe

Filesize
799KB

MD5
c4dcb89104e412507fae11413d813963

SHA1
0c9c95531e45999a340e65d08bbed3dc402d7661

SHA256
1eb0b16b2fa363efadbeeebffdf6668feefe11191298a049f7ff601a69ccbc92

SHA512
98e843eaa3fa3d7c7b59d13d48b2494a514a85970cf1c85a7d3e762595d89a4c669728789ef4b3cad63037e9a1b50f6c41ed39911d89bab213b759558a9419a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1681933.exe

Filesize
617KB

MD5
b49d1c392f3b0d2d1bfe327d3b9cb33a

SHA1
087ec3d463eeaba188af47852cbf939620d077f7

SHA256
90ce200489e93e4e68d34dfb4d038a63edd75eea0dcccb56ef5d2e828918c15d

SHA512
d570bb5485d85c672cfcf89e7683b09a60c170c513fc8cb118c42dc6ec068c8711f2b67d527286a5923ada43c80b538f3fdc26206f1441d89d69fecc4b219403

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1681933.exe

Filesize
617KB

MD5
b49d1c392f3b0d2d1bfe327d3b9cb33a

SHA1
087ec3d463eeaba188af47852cbf939620d077f7

SHA256
90ce200489e93e4e68d34dfb4d038a63edd75eea0dcccb56ef5d2e828918c15d

SHA512
d570bb5485d85c672cfcf89e7683b09a60c170c513fc8cb118c42dc6ec068c8711f2b67d527286a5923ada43c80b538f3fdc26206f1441d89d69fecc4b219403

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8352291.exe

Filesize
346KB

MD5
fc4aa1b0db20564691f039838b2069df

SHA1
674d739920cfab2cbee81ad4f30ba77516ecb0d3

SHA256
716280878a7702b9b020a1811e648faa28f8f42bb2ffcca8da7fc51c27f7d673

SHA512
5a288d74ef3a4f8a4f7cc7475cbfe2edf2eb871bd39ec808735ded64e63162c0030fdd7a68afad0975cff5b3fc37c7aa97a9bcd4f6331b0e42be604ba2c868c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8352291.exe

Filesize
346KB

MD5
fc4aa1b0db20564691f039838b2069df

SHA1
674d739920cfab2cbee81ad4f30ba77516ecb0d3

SHA256
716280878a7702b9b020a1811e648faa28f8f42bb2ffcca8da7fc51c27f7d673

SHA512
5a288d74ef3a4f8a4f7cc7475cbfe2edf2eb871bd39ec808735ded64e63162c0030fdd7a68afad0975cff5b3fc37c7aa97a9bcd4f6331b0e42be604ba2c868c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9120009.exe

Filesize
227KB

MD5
a5e53fa0fcea4ed545f3e11d739ad0c3

SHA1
d47a6e93c1cf7047685077ca4fc3f6593cdd1124

SHA256
a5939cc661cc072349cc2a9fd5d787c629aa50f1a59867509cff727255eb4f29

SHA512
c4da562a202fc744a4e1bdfdf3cb8df57f6fef8eb989dcdf128a64de04698fa62b5ee74594b7e861d2328e2ada0a0df21184ab940a01c0884770295a3894ff88

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9120009.exe

Filesize
227KB

MD5
a5e53fa0fcea4ed545f3e11d739ad0c3

SHA1
d47a6e93c1cf7047685077ca4fc3f6593cdd1124

SHA256
a5939cc661cc072349cc2a9fd5d787c629aa50f1a59867509cff727255eb4f29

SHA512
c4da562a202fc744a4e1bdfdf3cb8df57f6fef8eb989dcdf128a64de04698fa62b5ee74594b7e861d2328e2ada0a0df21184ab940a01c0884770295a3894ff88

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9120009.exe

Filesize
227KB

MD5
a5e53fa0fcea4ed545f3e11d739ad0c3

SHA1
d47a6e93c1cf7047685077ca4fc3f6593cdd1124

SHA256
a5939cc661cc072349cc2a9fd5d787c629aa50f1a59867509cff727255eb4f29

SHA512
c4da562a202fc744a4e1bdfdf3cb8df57f6fef8eb989dcdf128a64de04698fa62b5ee74594b7e861d2328e2ada0a0df21184ab940a01c0884770295a3894ff88

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7138597.exe

Filesize
982KB

MD5
16725760f83e92f0d7d6bdb61c9d5d0e

SHA1
05569c3352579f408b81c40277edebee045b24c0

SHA256
abab3e8a1212dca5f085153572cdb13d7b3d4860a4233c31023d11e8a4e54946

SHA512
b99d2ab1c02d98b963a5e7ab74dd42c11a712851c06f8918f0a28a8ae3c55d16e250c1a58845413c544dc0248ce2c7d93199788d070d0ba9cecf421f17264c0e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7138597.exe

Filesize
982KB

MD5
16725760f83e92f0d7d6bdb61c9d5d0e

SHA1
05569c3352579f408b81c40277edebee045b24c0

SHA256
abab3e8a1212dca5f085153572cdb13d7b3d4860a4233c31023d11e8a4e54946

SHA512
b99d2ab1c02d98b963a5e7ab74dd42c11a712851c06f8918f0a28a8ae3c55d16e250c1a58845413c544dc0248ce2c7d93199788d070d0ba9cecf421f17264c0e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6997040.exe

Filesize
799KB

MD5
c4dcb89104e412507fae11413d813963

SHA1
0c9c95531e45999a340e65d08bbed3dc402d7661

SHA256
1eb0b16b2fa363efadbeeebffdf6668feefe11191298a049f7ff601a69ccbc92

SHA512
98e843eaa3fa3d7c7b59d13d48b2494a514a85970cf1c85a7d3e762595d89a4c669728789ef4b3cad63037e9a1b50f6c41ed39911d89bab213b759558a9419a7

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z6997040.exe

Filesize
799KB

MD5
c4dcb89104e412507fae11413d813963

SHA1
0c9c95531e45999a340e65d08bbed3dc402d7661

SHA256
1eb0b16b2fa363efadbeeebffdf6668feefe11191298a049f7ff601a69ccbc92

SHA512
98e843eaa3fa3d7c7b59d13d48b2494a514a85970cf1c85a7d3e762595d89a4c669728789ef4b3cad63037e9a1b50f6c41ed39911d89bab213b759558a9419a7

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1681933.exe

Filesize
617KB

MD5
b49d1c392f3b0d2d1bfe327d3b9cb33a

SHA1
087ec3d463eeaba188af47852cbf939620d077f7

SHA256
90ce200489e93e4e68d34dfb4d038a63edd75eea0dcccb56ef5d2e828918c15d

SHA512
d570bb5485d85c672cfcf89e7683b09a60c170c513fc8cb118c42dc6ec068c8711f2b67d527286a5923ada43c80b538f3fdc26206f1441d89d69fecc4b219403

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1681933.exe

Filesize
617KB

MD5
b49d1c392f3b0d2d1bfe327d3b9cb33a

SHA1
087ec3d463eeaba188af47852cbf939620d077f7

SHA256
90ce200489e93e4e68d34dfb4d038a63edd75eea0dcccb56ef5d2e828918c15d

SHA512
d570bb5485d85c672cfcf89e7683b09a60c170c513fc8cb118c42dc6ec068c8711f2b67d527286a5923ada43c80b538f3fdc26206f1441d89d69fecc4b219403

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8352291.exe

Filesize
346KB

MD5
fc4aa1b0db20564691f039838b2069df

SHA1
674d739920cfab2cbee81ad4f30ba77516ecb0d3

SHA256
716280878a7702b9b020a1811e648faa28f8f42bb2ffcca8da7fc51c27f7d673

SHA512
5a288d74ef3a4f8a4f7cc7475cbfe2edf2eb871bd39ec808735ded64e63162c0030fdd7a68afad0975cff5b3fc37c7aa97a9bcd4f6331b0e42be604ba2c868c8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8352291.exe

Filesize
346KB

MD5
fc4aa1b0db20564691f039838b2069df

SHA1
674d739920cfab2cbee81ad4f30ba77516ecb0d3

SHA256
716280878a7702b9b020a1811e648faa28f8f42bb2ffcca8da7fc51c27f7d673

SHA512
5a288d74ef3a4f8a4f7cc7475cbfe2edf2eb871bd39ec808735ded64e63162c0030fdd7a68afad0975cff5b3fc37c7aa97a9bcd4f6331b0e42be604ba2c868c8

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9120009.exe

Filesize
227KB

MD5
a5e53fa0fcea4ed545f3e11d739ad0c3

SHA1
d47a6e93c1cf7047685077ca4fc3f6593cdd1124

SHA256
a5939cc661cc072349cc2a9fd5d787c629aa50f1a59867509cff727255eb4f29

SHA512
c4da562a202fc744a4e1bdfdf3cb8df57f6fef8eb989dcdf128a64de04698fa62b5ee74594b7e861d2328e2ada0a0df21184ab940a01c0884770295a3894ff88

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9120009.exe

Filesize
227KB

MD5
a5e53fa0fcea4ed545f3e11d739ad0c3

SHA1
d47a6e93c1cf7047685077ca4fc3f6593cdd1124

SHA256
a5939cc661cc072349cc2a9fd5d787c629aa50f1a59867509cff727255eb4f29

SHA512
c4da562a202fc744a4e1bdfdf3cb8df57f6fef8eb989dcdf128a64de04698fa62b5ee74594b7e861d2328e2ada0a0df21184ab940a01c0884770295a3894ff88

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9120009.exe

Filesize
227KB

MD5
a5e53fa0fcea4ed545f3e11d739ad0c3

SHA1
d47a6e93c1cf7047685077ca4fc3f6593cdd1124

SHA256
a5939cc661cc072349cc2a9fd5d787c629aa50f1a59867509cff727255eb4f29

SHA512
c4da562a202fc744a4e1bdfdf3cb8df57f6fef8eb989dcdf128a64de04698fa62b5ee74594b7e861d2328e2ada0a0df21184ab940a01c0884770295a3894ff88

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9120009.exe

Filesize
227KB

MD5
a5e53fa0fcea4ed545f3e11d739ad0c3

SHA1
d47a6e93c1cf7047685077ca4fc3f6593cdd1124

SHA256
a5939cc661cc072349cc2a9fd5d787c629aa50f1a59867509cff727255eb4f29

SHA512
c4da562a202fc744a4e1bdfdf3cb8df57f6fef8eb989dcdf128a64de04698fa62b5ee74594b7e861d2328e2ada0a0df21184ab940a01c0884770295a3894ff88

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9120009.exe

Filesize
227KB

MD5
a5e53fa0fcea4ed545f3e11d739ad0c3

SHA1
d47a6e93c1cf7047685077ca4fc3f6593cdd1124

SHA256
a5939cc661cc072349cc2a9fd5d787c629aa50f1a59867509cff727255eb4f29

SHA512
c4da562a202fc744a4e1bdfdf3cb8df57f6fef8eb989dcdf128a64de04698fa62b5ee74594b7e861d2328e2ada0a0df21184ab940a01c0884770295a3894ff88

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9120009.exe

Filesize
227KB

MD5
a5e53fa0fcea4ed545f3e11d739ad0c3

SHA1
d47a6e93c1cf7047685077ca4fc3f6593cdd1124

SHA256
a5939cc661cc072349cc2a9fd5d787c629aa50f1a59867509cff727255eb4f29

SHA512
c4da562a202fc744a4e1bdfdf3cb8df57f6fef8eb989dcdf128a64de04698fa62b5ee74594b7e861d2328e2ada0a0df21184ab940a01c0884770295a3894ff88

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9120009.exe

Filesize
227KB

MD5
a5e53fa0fcea4ed545f3e11d739ad0c3

SHA1
d47a6e93c1cf7047685077ca4fc3f6593cdd1124

SHA256
a5939cc661cc072349cc2a9fd5d787c629aa50f1a59867509cff727255eb4f29

SHA512
c4da562a202fc744a4e1bdfdf3cb8df57f6fef8eb989dcdf128a64de04698fa62b5ee74594b7e861d2328e2ada0a0df21184ab940a01c0884770295a3894ff88

Download Submit
memory/2560-57-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2560-58-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2560-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2560-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2560-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2560-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2560-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2560-53-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download