healer | 26c8b7f5d0f9a0138e5ac0cd5b9d7c4ab9e9e16fbaa221117d7bf6464e85eb69

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

046959e19eb20551eb266aef192d1092.exe
Size

1.1MB
MD5

046959e19eb20551eb266aef192d1092
SHA1

6b4020aabe09be7c4092e9d4a922ab3d4ce76a01
SHA256

26c8b7f5d0f9a0138e5ac0cd5b9d7c4ab9e9e16fbaa221117d7bf6464e85eb69
SHA512

b7902b37ce53a9422d2fee3d299915c539b0d9ad94fd2f6525113288862707ff196c8cf7d2fe827d193b6d7dee395cce3789893e73b9f909daf9f4a9024a2f49
SSDEEP

24576:ryJUGlMIhS6Yx2j9c1nFXupHDCgPjNNo+IWUhJlfcq5S:e7tNYOcJF+pHDpLo+IXH9

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1424-56-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/1424-55-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/1424-58-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/1424-60-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/1424-62-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

Executes dropped EXE 5 IoCs

Processes:

z9305571.exez9491098.exez0871785.exez7937353.exeq3967074.exe

pid process

2184 z9305571.exe
3064 z9491098.exe
2636 z0871785.exe
2804 z7937353.exe
2320 q3967074.exe

pid	process
2184	z9305571.exe
3064	z9491098.exe
2636	z0871785.exe
2804	z7937353.exe
2320	q3967074.exe

Loads dropped DLL 15 IoCs

Processes:

046959e19eb20551eb266aef192d1092.exez9305571.exez9491098.exez0871785.exez7937353.exeq3967074.exeWerFault.exe

pid	process
1064	046959e19eb20551eb266aef192d1092.exe
2184	z9305571.exe
2184	z9305571.exe
3064	z9491098.exe
3064	z9491098.exe
2636	z0871785.exe
2636	z0871785.exe
2804	z7937353.exe
2804	z7937353.exe
2804	z7937353.exe
2320	q3967074.exe
2552	WerFault.exe
2552	WerFault.exe
2552	WerFault.exe
2552	WerFault.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

046959e19eb20551eb266aef192d1092.exez9305571.exez9491098.exez0871785.exez7937353.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	046959e19eb20551eb266aef192d1092.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z9305571.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z9491098.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z0871785.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z7937353.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

q3967074.exe

description pid process target process

PID 2320 set thread context of 1424 2320 q3967074.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2552 2320 WerFault.exe q3967074.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

1424 AppLaunch.exe
1424 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 1424 AppLaunch.exe

description	pid	process	target process
PID 2320 set thread context of 1424	2320	q3967074.exe	AppLaunch.exe

pid	pid_target	process	target process
2552	2320	WerFault.exe	q3967074.exe

pid	process
1424	AppLaunch.exe
1424	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1424	AppLaunch.exe

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

046959e19eb20551eb266aef192d1092.exez9305571.exez9491098.exez0871785.exez7937353.exeq3967074.exe

description	pid	process	target process
PID 1064 wrote to memory of 2184	1064	046959e19eb20551eb266aef192d1092.exe	z9305571.exe
PID 1064 wrote to memory of 2184	1064	046959e19eb20551eb266aef192d1092.exe	z9305571.exe
PID 1064 wrote to memory of 2184	1064	046959e19eb20551eb266aef192d1092.exe	z9305571.exe
PID 1064 wrote to memory of 2184	1064	046959e19eb20551eb266aef192d1092.exe	z9305571.exe
PID 1064 wrote to memory of 2184	1064	046959e19eb20551eb266aef192d1092.exe	z9305571.exe
PID 1064 wrote to memory of 2184	1064	046959e19eb20551eb266aef192d1092.exe	z9305571.exe
PID 1064 wrote to memory of 2184	1064	046959e19eb20551eb266aef192d1092.exe	z9305571.exe
PID 2184 wrote to memory of 3064	2184	z9305571.exe	z9491098.exe
PID 2184 wrote to memory of 3064	2184	z9305571.exe	z9491098.exe
PID 2184 wrote to memory of 3064	2184	z9305571.exe	z9491098.exe
PID 2184 wrote to memory of 3064	2184	z9305571.exe	z9491098.exe
PID 2184 wrote to memory of 3064	2184	z9305571.exe	z9491098.exe
PID 2184 wrote to memory of 3064	2184	z9305571.exe	z9491098.exe
PID 2184 wrote to memory of 3064	2184	z9305571.exe	z9491098.exe
PID 3064 wrote to memory of 2636	3064	z9491098.exe	z0871785.exe
PID 3064 wrote to memory of 2636	3064	z9491098.exe	z0871785.exe
PID 3064 wrote to memory of 2636	3064	z9491098.exe	z0871785.exe
PID 3064 wrote to memory of 2636	3064	z9491098.exe	z0871785.exe
PID 3064 wrote to memory of 2636	3064	z9491098.exe	z0871785.exe
PID 3064 wrote to memory of 2636	3064	z9491098.exe	z0871785.exe
PID 3064 wrote to memory of 2636	3064	z9491098.exe	z0871785.exe
PID 2636 wrote to memory of 2804	2636	z0871785.exe	z7937353.exe
PID 2636 wrote to memory of 2804	2636	z0871785.exe	z7937353.exe
PID 2636 wrote to memory of 2804	2636	z0871785.exe	z7937353.exe
PID 2636 wrote to memory of 2804	2636	z0871785.exe	z7937353.exe
PID 2636 wrote to memory of 2804	2636	z0871785.exe	z7937353.exe
PID 2636 wrote to memory of 2804	2636	z0871785.exe	z7937353.exe
PID 2636 wrote to memory of 2804	2636	z0871785.exe	z7937353.exe
PID 2804 wrote to memory of 2320	2804	z7937353.exe	q3967074.exe
PID 2804 wrote to memory of 2320	2804	z7937353.exe	q3967074.exe
PID 2804 wrote to memory of 2320	2804	z7937353.exe	q3967074.exe
PID 2804 wrote to memory of 2320	2804	z7937353.exe	q3967074.exe
PID 2804 wrote to memory of 2320	2804	z7937353.exe	q3967074.exe
PID 2804 wrote to memory of 2320	2804	z7937353.exe	q3967074.exe
PID 2804 wrote to memory of 2320	2804	z7937353.exe	q3967074.exe
PID 2320 wrote to memory of 2732	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 2732	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 2732	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 2732	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 2732	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 2732	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 2732	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 1424	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 1424	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 1424	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 1424	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 1424	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 1424	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 1424	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 1424	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 1424	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 1424	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 1424	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 1424	2320	q3967074.exe	AppLaunch.exe
PID 2320 wrote to memory of 2552	2320	q3967074.exe	WerFault.exe
PID 2320 wrote to memory of 2552	2320	q3967074.exe	WerFault.exe
PID 2320 wrote to memory of 2552	2320	q3967074.exe	WerFault.exe
PID 2320 wrote to memory of 2552	2320	q3967074.exe	WerFault.exe
PID 2320 wrote to memory of 2552	2320	q3967074.exe	WerFault.exe
PID 2320 wrote to memory of 2552	2320	q3967074.exe	WerFault.exe
PID 2320 wrote to memory of 2552	2320	q3967074.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\046959e19eb20551eb266aef192d1092.exe
"C:\Users\Admin\AppData\Local\Temp\046959e19eb20551eb266aef192d1092.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9305571.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9305571.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9491098.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9491098.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0871785.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0871785.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2636
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7937353.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7937353.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3967074.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3967074.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:2732
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 284
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9305571.exe

Filesize
980KB

MD5
12d5ad1347ebb5aacdb4f578e6f72808

SHA1
107a99c40773d6b90c5562c00a4db67017447fbb

SHA256
a8feaabd6e3b95c0d628d5276d4bb3a3ef88832a40afc86930901cffc2d72dac

SHA512
cd8e0e6aa07b0e42f8b0264508e559ca23c49d8232651677af8177b8a4b22872388c67d816223cd581ea3bf244d8c64a29fa0fb1f0884ea72a0867d67a5884ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9305571.exe

Filesize
980KB

MD5
12d5ad1347ebb5aacdb4f578e6f72808

SHA1
107a99c40773d6b90c5562c00a4db67017447fbb

SHA256
a8feaabd6e3b95c0d628d5276d4bb3a3ef88832a40afc86930901cffc2d72dac

SHA512
cd8e0e6aa07b0e42f8b0264508e559ca23c49d8232651677af8177b8a4b22872388c67d816223cd581ea3bf244d8c64a29fa0fb1f0884ea72a0867d67a5884ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9491098.exe

Filesize
800KB

MD5
6e4fc09e0c38f871dc2358c9761606fc

SHA1
f26fef552f88292e7c2e65ec5ed065737de3127e

SHA256
8b2555bf3b735f0a7290e8160a0d31e3ba3237f10ee5629d27201e915bad943b

SHA512
277c23a07dd6dd2ad2714691569bcaf67a84bac89158258ea6d6ad9fdaff55643a9bf9b614786c8165e45c28207148e6b42f2ec76a4635a60756b45a9a65e77e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9491098.exe

Filesize
800KB

MD5
6e4fc09e0c38f871dc2358c9761606fc

SHA1
f26fef552f88292e7c2e65ec5ed065737de3127e

SHA256
8b2555bf3b735f0a7290e8160a0d31e3ba3237f10ee5629d27201e915bad943b

SHA512
277c23a07dd6dd2ad2714691569bcaf67a84bac89158258ea6d6ad9fdaff55643a9bf9b614786c8165e45c28207148e6b42f2ec76a4635a60756b45a9a65e77e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0871785.exe

Filesize
617KB

MD5
3f2bbf8fcac27e1a2f0320dfd1d7318f

SHA1
a1085062cbb7ca0e415c144e4260194439e2bc9d

SHA256
7933d1493b035c02dc7e082893cfec9f980148f5c4b65875f506310bcfd143f2

SHA512
eed57637770b321092a6458e731724ef99305721bc5c9112e5bf31c087edf2de1b58872e3edddb059e80eda23dcfc27eba5d0b9be4ca4190e121bcbd700c2c4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0871785.exe

Filesize
617KB

MD5
3f2bbf8fcac27e1a2f0320dfd1d7318f

SHA1
a1085062cbb7ca0e415c144e4260194439e2bc9d

SHA256
7933d1493b035c02dc7e082893cfec9f980148f5c4b65875f506310bcfd143f2

SHA512
eed57637770b321092a6458e731724ef99305721bc5c9112e5bf31c087edf2de1b58872e3edddb059e80eda23dcfc27eba5d0b9be4ca4190e121bcbd700c2c4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7937353.exe

Filesize
346KB

MD5
0eeafe52b1c68fb9dd3fbc25b9f51532

SHA1
fe7e84707de760b0a37718e27198173cb62e1308

SHA256
0c8c7ac6ee39e72390cd4a09272302939e0ba33e1550ccfd5a71f4678bbab9c7

SHA512
d0c8ca32a6c39c841aea28a7023a47357e25b5b195c65c1b08faf5a2817b6dacb45464a3b9c288b8d1fc7e60fc96fc8f0b7fa1d2d7ad68e6b02ceaf323f7e733

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7937353.exe

Filesize
346KB

MD5
0eeafe52b1c68fb9dd3fbc25b9f51532

SHA1
fe7e84707de760b0a37718e27198173cb62e1308

SHA256
0c8c7ac6ee39e72390cd4a09272302939e0ba33e1550ccfd5a71f4678bbab9c7

SHA512
d0c8ca32a6c39c841aea28a7023a47357e25b5b195c65c1b08faf5a2817b6dacb45464a3b9c288b8d1fc7e60fc96fc8f0b7fa1d2d7ad68e6b02ceaf323f7e733

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3967074.exe

Filesize
227KB

MD5
e24272b823fe07d46d7f660b23c16145

SHA1
a2068fa6bb49560a1023e3d15ac267012c7ba871

SHA256
8ee665019ffd67355dac0a4cf8f9e3d414e4d09555e3ef38e195e7fc9705fc28

SHA512
9ea29ee409a8137d077b0184806c217bf28af0e922497102d8fbf03b2037e53418061d3caadc3868aae920e814b97fd84f1d2135b9b7cd51122c18c9b3e59fa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3967074.exe

Filesize
227KB

MD5
e24272b823fe07d46d7f660b23c16145

SHA1
a2068fa6bb49560a1023e3d15ac267012c7ba871

SHA256
8ee665019ffd67355dac0a4cf8f9e3d414e4d09555e3ef38e195e7fc9705fc28

SHA512
9ea29ee409a8137d077b0184806c217bf28af0e922497102d8fbf03b2037e53418061d3caadc3868aae920e814b97fd84f1d2135b9b7cd51122c18c9b3e59fa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3967074.exe

Filesize
227KB

MD5
e24272b823fe07d46d7f660b23c16145

SHA1
a2068fa6bb49560a1023e3d15ac267012c7ba871

SHA256
8ee665019ffd67355dac0a4cf8f9e3d414e4d09555e3ef38e195e7fc9705fc28

SHA512
9ea29ee409a8137d077b0184806c217bf28af0e922497102d8fbf03b2037e53418061d3caadc3868aae920e814b97fd84f1d2135b9b7cd51122c18c9b3e59fa9

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9305571.exe

Filesize
980KB

MD5
12d5ad1347ebb5aacdb4f578e6f72808

SHA1
107a99c40773d6b90c5562c00a4db67017447fbb

SHA256
a8feaabd6e3b95c0d628d5276d4bb3a3ef88832a40afc86930901cffc2d72dac

SHA512
cd8e0e6aa07b0e42f8b0264508e559ca23c49d8232651677af8177b8a4b22872388c67d816223cd581ea3bf244d8c64a29fa0fb1f0884ea72a0867d67a5884ff

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9305571.exe

Filesize
980KB

MD5
12d5ad1347ebb5aacdb4f578e6f72808

SHA1
107a99c40773d6b90c5562c00a4db67017447fbb

SHA256
a8feaabd6e3b95c0d628d5276d4bb3a3ef88832a40afc86930901cffc2d72dac

SHA512
cd8e0e6aa07b0e42f8b0264508e559ca23c49d8232651677af8177b8a4b22872388c67d816223cd581ea3bf244d8c64a29fa0fb1f0884ea72a0867d67a5884ff

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9491098.exe

Filesize
800KB

MD5
6e4fc09e0c38f871dc2358c9761606fc

SHA1
f26fef552f88292e7c2e65ec5ed065737de3127e

SHA256
8b2555bf3b735f0a7290e8160a0d31e3ba3237f10ee5629d27201e915bad943b

SHA512
277c23a07dd6dd2ad2714691569bcaf67a84bac89158258ea6d6ad9fdaff55643a9bf9b614786c8165e45c28207148e6b42f2ec76a4635a60756b45a9a65e77e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9491098.exe

Filesize
800KB

MD5
6e4fc09e0c38f871dc2358c9761606fc

SHA1
f26fef552f88292e7c2e65ec5ed065737de3127e

SHA256
8b2555bf3b735f0a7290e8160a0d31e3ba3237f10ee5629d27201e915bad943b

SHA512
277c23a07dd6dd2ad2714691569bcaf67a84bac89158258ea6d6ad9fdaff55643a9bf9b614786c8165e45c28207148e6b42f2ec76a4635a60756b45a9a65e77e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0871785.exe

Filesize
617KB

MD5
3f2bbf8fcac27e1a2f0320dfd1d7318f

SHA1
a1085062cbb7ca0e415c144e4260194439e2bc9d

SHA256
7933d1493b035c02dc7e082893cfec9f980148f5c4b65875f506310bcfd143f2

SHA512
eed57637770b321092a6458e731724ef99305721bc5c9112e5bf31c087edf2de1b58872e3edddb059e80eda23dcfc27eba5d0b9be4ca4190e121bcbd700c2c4d

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0871785.exe

Filesize
617KB

MD5
3f2bbf8fcac27e1a2f0320dfd1d7318f

SHA1
a1085062cbb7ca0e415c144e4260194439e2bc9d

SHA256
7933d1493b035c02dc7e082893cfec9f980148f5c4b65875f506310bcfd143f2

SHA512
eed57637770b321092a6458e731724ef99305721bc5c9112e5bf31c087edf2de1b58872e3edddb059e80eda23dcfc27eba5d0b9be4ca4190e121bcbd700c2c4d

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7937353.exe

Filesize
346KB

MD5
0eeafe52b1c68fb9dd3fbc25b9f51532

SHA1
fe7e84707de760b0a37718e27198173cb62e1308

SHA256
0c8c7ac6ee39e72390cd4a09272302939e0ba33e1550ccfd5a71f4678bbab9c7

SHA512
d0c8ca32a6c39c841aea28a7023a47357e25b5b195c65c1b08faf5a2817b6dacb45464a3b9c288b8d1fc7e60fc96fc8f0b7fa1d2d7ad68e6b02ceaf323f7e733

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7937353.exe

Filesize
346KB

MD5
0eeafe52b1c68fb9dd3fbc25b9f51532

SHA1
fe7e84707de760b0a37718e27198173cb62e1308

SHA256
0c8c7ac6ee39e72390cd4a09272302939e0ba33e1550ccfd5a71f4678bbab9c7

SHA512
d0c8ca32a6c39c841aea28a7023a47357e25b5b195c65c1b08faf5a2817b6dacb45464a3b9c288b8d1fc7e60fc96fc8f0b7fa1d2d7ad68e6b02ceaf323f7e733

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3967074.exe

Filesize
227KB

MD5
e24272b823fe07d46d7f660b23c16145

SHA1
a2068fa6bb49560a1023e3d15ac267012c7ba871

SHA256
8ee665019ffd67355dac0a4cf8f9e3d414e4d09555e3ef38e195e7fc9705fc28

SHA512
9ea29ee409a8137d077b0184806c217bf28af0e922497102d8fbf03b2037e53418061d3caadc3868aae920e814b97fd84f1d2135b9b7cd51122c18c9b3e59fa9

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3967074.exe

Filesize
227KB

MD5
e24272b823fe07d46d7f660b23c16145

SHA1
a2068fa6bb49560a1023e3d15ac267012c7ba871

SHA256
8ee665019ffd67355dac0a4cf8f9e3d414e4d09555e3ef38e195e7fc9705fc28

SHA512
9ea29ee409a8137d077b0184806c217bf28af0e922497102d8fbf03b2037e53418061d3caadc3868aae920e814b97fd84f1d2135b9b7cd51122c18c9b3e59fa9

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3967074.exe

Filesize
227KB

MD5
e24272b823fe07d46d7f660b23c16145

SHA1
a2068fa6bb49560a1023e3d15ac267012c7ba871

SHA256
8ee665019ffd67355dac0a4cf8f9e3d414e4d09555e3ef38e195e7fc9705fc28

SHA512
9ea29ee409a8137d077b0184806c217bf28af0e922497102d8fbf03b2037e53418061d3caadc3868aae920e814b97fd84f1d2135b9b7cd51122c18c9b3e59fa9

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3967074.exe

Filesize
227KB

MD5
e24272b823fe07d46d7f660b23c16145

SHA1
a2068fa6bb49560a1023e3d15ac267012c7ba871

SHA256
8ee665019ffd67355dac0a4cf8f9e3d414e4d09555e3ef38e195e7fc9705fc28

SHA512
9ea29ee409a8137d077b0184806c217bf28af0e922497102d8fbf03b2037e53418061d3caadc3868aae920e814b97fd84f1d2135b9b7cd51122c18c9b3e59fa9

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3967074.exe

Filesize
227KB

MD5
e24272b823fe07d46d7f660b23c16145

SHA1
a2068fa6bb49560a1023e3d15ac267012c7ba871

SHA256
8ee665019ffd67355dac0a4cf8f9e3d414e4d09555e3ef38e195e7fc9705fc28

SHA512
9ea29ee409a8137d077b0184806c217bf28af0e922497102d8fbf03b2037e53418061d3caadc3868aae920e814b97fd84f1d2135b9b7cd51122c18c9b3e59fa9

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3967074.exe

Filesize
227KB

MD5
e24272b823fe07d46d7f660b23c16145

SHA1
a2068fa6bb49560a1023e3d15ac267012c7ba871

SHA256
8ee665019ffd67355dac0a4cf8f9e3d414e4d09555e3ef38e195e7fc9705fc28

SHA512
9ea29ee409a8137d077b0184806c217bf28af0e922497102d8fbf03b2037e53418061d3caadc3868aae920e814b97fd84f1d2135b9b7cd51122c18c9b3e59fa9

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3967074.exe

Filesize
227KB

MD5
e24272b823fe07d46d7f660b23c16145

SHA1
a2068fa6bb49560a1023e3d15ac267012c7ba871

SHA256
8ee665019ffd67355dac0a4cf8f9e3d414e4d09555e3ef38e195e7fc9705fc28

SHA512
9ea29ee409a8137d077b0184806c217bf28af0e922497102d8fbf03b2037e53418061d3caadc3868aae920e814b97fd84f1d2135b9b7cd51122c18c9b3e59fa9

Download Submit
memory/1424-57-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1424-58-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1424-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1424-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1424-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1424-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1424-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1424-53-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download