healer | 9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe
Size

1.1MB
MD5

a7d03b76859e68022d6e607ce2231599
SHA1

fc85348d5a1f2c83602b68f8779d0e730e25a212
SHA256

9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670
SHA512

39dd00949f684f54ca4281cffe379590b1473d90a052f27452018b7996214ea90697dd994ebd8aa0229b8ffb6cf767b63513a66570d9e343550679616115b505
SSDEEP

24576:qyCgx54gqrKq2/SSg2THTnu7Pyn+yW3Mu2SMTerrBEvF:xb6Kq26SnTy7Kn+D3VJy

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 5 IoCs

resource	yara_rule
behavioral1/memory/1800-56-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/1800-55-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/1800-58-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/1800-60-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/1800-62-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

Executes dropped EXE 5 IoCs

pid	Process
3044	z5046044.exe
2064	z0444970.exe
2792	z0686192.exe
2612	z9195991.exe
2744	q8050929.exe

Loads dropped DLL 15 IoCs

pid	Process
1300	9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe
3044	z5046044.exe
3044	z5046044.exe
2064	z0444970.exe
2064	z0444970.exe
2792	z0686192.exe
2792	z0686192.exe
2612	z9195991.exe
2612	z9195991.exe
2612	z9195991.exe
2744	q8050929.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe
2508	WerFault.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z0686192.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z9195991.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z5046044.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z0444970.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2744 set thread context of 1800	2744	q8050929.exe	34

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2508	2744	WerFault.exe	32

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1800	AppLaunch.exe
1800	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	AppLaunch.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 3044	1300	9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe	28
PID 1300 wrote to memory of 3044	1300	9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe	28
PID 1300 wrote to memory of 3044	1300	9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe	28
PID 1300 wrote to memory of 3044	1300	9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe	28
PID 1300 wrote to memory of 3044	1300	9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe	28
PID 1300 wrote to memory of 3044	1300	9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe	28
PID 1300 wrote to memory of 3044	1300	9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe	28
PID 3044 wrote to memory of 2064	3044	z5046044.exe	29
PID 3044 wrote to memory of 2064	3044	z5046044.exe	29
PID 3044 wrote to memory of 2064	3044	z5046044.exe	29
PID 3044 wrote to memory of 2064	3044	z5046044.exe	29
PID 3044 wrote to memory of 2064	3044	z5046044.exe	29
PID 3044 wrote to memory of 2064	3044	z5046044.exe	29
PID 3044 wrote to memory of 2064	3044	z5046044.exe	29
PID 2064 wrote to memory of 2792	2064	z0444970.exe	30
PID 2064 wrote to memory of 2792	2064	z0444970.exe	30
PID 2064 wrote to memory of 2792	2064	z0444970.exe	30
PID 2064 wrote to memory of 2792	2064	z0444970.exe	30
PID 2064 wrote to memory of 2792	2064	z0444970.exe	30
PID 2064 wrote to memory of 2792	2064	z0444970.exe	30
PID 2064 wrote to memory of 2792	2064	z0444970.exe	30
PID 2792 wrote to memory of 2612	2792	z0686192.exe	31
PID 2792 wrote to memory of 2612	2792	z0686192.exe	31
PID 2792 wrote to memory of 2612	2792	z0686192.exe	31
PID 2792 wrote to memory of 2612	2792	z0686192.exe	31
PID 2792 wrote to memory of 2612	2792	z0686192.exe	31
PID 2792 wrote to memory of 2612	2792	z0686192.exe	31
PID 2792 wrote to memory of 2612	2792	z0686192.exe	31
PID 2612 wrote to memory of 2744	2612	z9195991.exe	32
PID 2612 wrote to memory of 2744	2612	z9195991.exe	32
PID 2612 wrote to memory of 2744	2612	z9195991.exe	32
PID 2612 wrote to memory of 2744	2612	z9195991.exe	32
PID 2612 wrote to memory of 2744	2612	z9195991.exe	32
PID 2612 wrote to memory of 2744	2612	z9195991.exe	32
PID 2612 wrote to memory of 2744	2612	z9195991.exe	32
PID 2744 wrote to memory of 1800	2744	q8050929.exe	34
PID 2744 wrote to memory of 1800	2744	q8050929.exe	34
PID 2744 wrote to memory of 1800	2744	q8050929.exe	34
PID 2744 wrote to memory of 1800	2744	q8050929.exe	34
PID 2744 wrote to memory of 1800	2744	q8050929.exe	34
PID 2744 wrote to memory of 1800	2744	q8050929.exe	34
PID 2744 wrote to memory of 1800	2744	q8050929.exe	34
PID 2744 wrote to memory of 1800	2744	q8050929.exe	34
PID 2744 wrote to memory of 1800	2744	q8050929.exe	34
PID 2744 wrote to memory of 1800	2744	q8050929.exe	34
PID 2744 wrote to memory of 1800	2744	q8050929.exe	34
PID 2744 wrote to memory of 1800	2744	q8050929.exe	34
PID 2744 wrote to memory of 2508	2744	q8050929.exe	35
PID 2744 wrote to memory of 2508	2744	q8050929.exe	35
PID 2744 wrote to memory of 2508	2744	q8050929.exe	35
PID 2744 wrote to memory of 2508	2744	q8050929.exe	35
PID 2744 wrote to memory of 2508	2744	q8050929.exe	35
PID 2744 wrote to memory of 2508	2744	q8050929.exe	35
PID 2744 wrote to memory of 2508	2744	q8050929.exe	35

C:\Users\Admin\AppData\Local\Temp\9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe
"C:\Users\Admin\AppData\Local\Temp\9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5046044.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5046044.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0444970.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0444970.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0686192.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0686192.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9195991.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9195991.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8050929.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8050929.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 276
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5046044.exe

Filesize
982KB

MD5
54232f07249fb5a544d5720e6c62aa9d

SHA1
f52036fd339b5075901fd16505e598126b243686

SHA256
2f11640fdb9372bddf0c63932d10b5e866d0b1271f71311b38ee8bea7fd99397

SHA512
54b1876bef1ee953d6545aabd48fd4f4cac8840c307cf488d9388f880e431afa203993c50f10a68ce40bff1cd5fd617e9e5d037da29f2ef99c095fa84d7e8c08

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5046044.exe

Filesize
982KB

MD5
54232f07249fb5a544d5720e6c62aa9d

SHA1
f52036fd339b5075901fd16505e598126b243686

SHA256
2f11640fdb9372bddf0c63932d10b5e866d0b1271f71311b38ee8bea7fd99397

SHA512
54b1876bef1ee953d6545aabd48fd4f4cac8840c307cf488d9388f880e431afa203993c50f10a68ce40bff1cd5fd617e9e5d037da29f2ef99c095fa84d7e8c08

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0444970.exe

Filesize
799KB

MD5
14294c81c8b8b0386102fa9fb1469797

SHA1
17ebdcf68a21652c6f33be5cb7d0ed3ccc4887c6

SHA256
6d6e9e1eafc922f037c5688cc4b9139dedc35b5ab74a16f311bbdbcb354b26e0

SHA512
2ccfaf6b6c0f591897441cdc3011b346475ae793932d828d273ff6fcc0b073e2edacd990d24ff3eee1f38ecdaa3d81ba98966b3d942a3f63ff1e77e68ad12ef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0444970.exe

Filesize
799KB

MD5
14294c81c8b8b0386102fa9fb1469797

SHA1
17ebdcf68a21652c6f33be5cb7d0ed3ccc4887c6

SHA256
6d6e9e1eafc922f037c5688cc4b9139dedc35b5ab74a16f311bbdbcb354b26e0

SHA512
2ccfaf6b6c0f591897441cdc3011b346475ae793932d828d273ff6fcc0b073e2edacd990d24ff3eee1f38ecdaa3d81ba98966b3d942a3f63ff1e77e68ad12ef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0686192.exe

Filesize
616KB

MD5
c01b94ebadfb76bf470560b70907f450

SHA1
41431490b6ded0dd5300d4e1fcaa537ac2010917

SHA256
706b573c93b521992ea4f4d65a0e544429ca7bd1bac8fbff46d4d39956146157

SHA512
255f764d0b109fbcf6330d0fc6bef9e615f996e1ab8a205d47e2b4b7beca159cf3f6d92f8a7ca863ed2eb92183d845e33b0725907bed841c5307ab81c6899961

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0686192.exe

Filesize
616KB

MD5
c01b94ebadfb76bf470560b70907f450

SHA1
41431490b6ded0dd5300d4e1fcaa537ac2010917

SHA256
706b573c93b521992ea4f4d65a0e544429ca7bd1bac8fbff46d4d39956146157

SHA512
255f764d0b109fbcf6330d0fc6bef9e615f996e1ab8a205d47e2b4b7beca159cf3f6d92f8a7ca863ed2eb92183d845e33b0725907bed841c5307ab81c6899961

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9195991.exe

Filesize
346KB

MD5
46cf22ff85010f3465fee43c58c961e8

SHA1
d3f586af918ce224e94fe49b0d0e97eb64c38434

SHA256
b6c5a205f41c8e884e65fc69584dbbd730f1c0082d093c549c6daf22661b33f5

SHA512
0760d47fd9a3a94b5a06642f0094dffdb5044037812c11102e25ccdd4526aa45b9265824a266ea4fefb960bd8cef1d8264b600c5e352ad881f3fa02ad02283ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9195991.exe

Filesize
346KB

MD5
46cf22ff85010f3465fee43c58c961e8

SHA1
d3f586af918ce224e94fe49b0d0e97eb64c38434

SHA256
b6c5a205f41c8e884e65fc69584dbbd730f1c0082d093c549c6daf22661b33f5

SHA512
0760d47fd9a3a94b5a06642f0094dffdb5044037812c11102e25ccdd4526aa45b9265824a266ea4fefb960bd8cef1d8264b600c5e352ad881f3fa02ad02283ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8050929.exe

Filesize
227KB

MD5
714ef2707d69c2905c84b0685f602795

SHA1
66f34ac301e9ebf012556cad32ea568b78bc087a

SHA256
607189be3d5a1eae2bad2746d5bdefda2d3850b88c02b88bf3699cfef446ea15

SHA512
1696faee2aa666084611955e6a1cb014255da2b5c5c1c774698278cc6895a3936f637f28b9857c40d05984a5d69430d588149048581dfff54e835c7e333dd9a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8050929.exe

Filesize
227KB

MD5
714ef2707d69c2905c84b0685f602795

SHA1
66f34ac301e9ebf012556cad32ea568b78bc087a

SHA256
607189be3d5a1eae2bad2746d5bdefda2d3850b88c02b88bf3699cfef446ea15

SHA512
1696faee2aa666084611955e6a1cb014255da2b5c5c1c774698278cc6895a3936f637f28b9857c40d05984a5d69430d588149048581dfff54e835c7e333dd9a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8050929.exe

Filesize
227KB

MD5
714ef2707d69c2905c84b0685f602795

SHA1
66f34ac301e9ebf012556cad32ea568b78bc087a

SHA256
607189be3d5a1eae2bad2746d5bdefda2d3850b88c02b88bf3699cfef446ea15

SHA512
1696faee2aa666084611955e6a1cb014255da2b5c5c1c774698278cc6895a3936f637f28b9857c40d05984a5d69430d588149048581dfff54e835c7e333dd9a6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5046044.exe

Filesize
982KB

MD5
54232f07249fb5a544d5720e6c62aa9d

SHA1
f52036fd339b5075901fd16505e598126b243686

SHA256
2f11640fdb9372bddf0c63932d10b5e866d0b1271f71311b38ee8bea7fd99397

SHA512
54b1876bef1ee953d6545aabd48fd4f4cac8840c307cf488d9388f880e431afa203993c50f10a68ce40bff1cd5fd617e9e5d037da29f2ef99c095fa84d7e8c08

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5046044.exe

Filesize
982KB

MD5
54232f07249fb5a544d5720e6c62aa9d

SHA1
f52036fd339b5075901fd16505e598126b243686

SHA256
2f11640fdb9372bddf0c63932d10b5e866d0b1271f71311b38ee8bea7fd99397

SHA512
54b1876bef1ee953d6545aabd48fd4f4cac8840c307cf488d9388f880e431afa203993c50f10a68ce40bff1cd5fd617e9e5d037da29f2ef99c095fa84d7e8c08

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0444970.exe

Filesize
799KB

MD5
14294c81c8b8b0386102fa9fb1469797

SHA1
17ebdcf68a21652c6f33be5cb7d0ed3ccc4887c6

SHA256
6d6e9e1eafc922f037c5688cc4b9139dedc35b5ab74a16f311bbdbcb354b26e0

SHA512
2ccfaf6b6c0f591897441cdc3011b346475ae793932d828d273ff6fcc0b073e2edacd990d24ff3eee1f38ecdaa3d81ba98966b3d942a3f63ff1e77e68ad12ef2

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0444970.exe

Filesize
799KB

MD5
14294c81c8b8b0386102fa9fb1469797

SHA1
17ebdcf68a21652c6f33be5cb7d0ed3ccc4887c6

SHA256
6d6e9e1eafc922f037c5688cc4b9139dedc35b5ab74a16f311bbdbcb354b26e0

SHA512
2ccfaf6b6c0f591897441cdc3011b346475ae793932d828d273ff6fcc0b073e2edacd990d24ff3eee1f38ecdaa3d81ba98966b3d942a3f63ff1e77e68ad12ef2

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0686192.exe

Filesize
616KB

MD5
c01b94ebadfb76bf470560b70907f450

SHA1
41431490b6ded0dd5300d4e1fcaa537ac2010917

SHA256
706b573c93b521992ea4f4d65a0e544429ca7bd1bac8fbff46d4d39956146157

SHA512
255f764d0b109fbcf6330d0fc6bef9e615f996e1ab8a205d47e2b4b7beca159cf3f6d92f8a7ca863ed2eb92183d845e33b0725907bed841c5307ab81c6899961

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0686192.exe

Filesize
616KB

MD5
c01b94ebadfb76bf470560b70907f450

SHA1
41431490b6ded0dd5300d4e1fcaa537ac2010917

SHA256
706b573c93b521992ea4f4d65a0e544429ca7bd1bac8fbff46d4d39956146157

SHA512
255f764d0b109fbcf6330d0fc6bef9e615f996e1ab8a205d47e2b4b7beca159cf3f6d92f8a7ca863ed2eb92183d845e33b0725907bed841c5307ab81c6899961

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9195991.exe

Filesize
346KB

MD5
46cf22ff85010f3465fee43c58c961e8

SHA1
d3f586af918ce224e94fe49b0d0e97eb64c38434

SHA256
b6c5a205f41c8e884e65fc69584dbbd730f1c0082d093c549c6daf22661b33f5

SHA512
0760d47fd9a3a94b5a06642f0094dffdb5044037812c11102e25ccdd4526aa45b9265824a266ea4fefb960bd8cef1d8264b600c5e352ad881f3fa02ad02283ee

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9195991.exe

Filesize
346KB

MD5
46cf22ff85010f3465fee43c58c961e8

SHA1
d3f586af918ce224e94fe49b0d0e97eb64c38434

SHA256
b6c5a205f41c8e884e65fc69584dbbd730f1c0082d093c549c6daf22661b33f5

SHA512
0760d47fd9a3a94b5a06642f0094dffdb5044037812c11102e25ccdd4526aa45b9265824a266ea4fefb960bd8cef1d8264b600c5e352ad881f3fa02ad02283ee

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8050929.exe

Filesize
227KB

MD5
714ef2707d69c2905c84b0685f602795

SHA1
66f34ac301e9ebf012556cad32ea568b78bc087a

SHA256
607189be3d5a1eae2bad2746d5bdefda2d3850b88c02b88bf3699cfef446ea15

SHA512
1696faee2aa666084611955e6a1cb014255da2b5c5c1c774698278cc6895a3936f637f28b9857c40d05984a5d69430d588149048581dfff54e835c7e333dd9a6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8050929.exe

Filesize
227KB

MD5
714ef2707d69c2905c84b0685f602795

SHA1
66f34ac301e9ebf012556cad32ea568b78bc087a

SHA256
607189be3d5a1eae2bad2746d5bdefda2d3850b88c02b88bf3699cfef446ea15

SHA512
1696faee2aa666084611955e6a1cb014255da2b5c5c1c774698278cc6895a3936f637f28b9857c40d05984a5d69430d588149048581dfff54e835c7e333dd9a6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8050929.exe

Filesize
227KB

MD5
714ef2707d69c2905c84b0685f602795

SHA1
66f34ac301e9ebf012556cad32ea568b78bc087a

SHA256
607189be3d5a1eae2bad2746d5bdefda2d3850b88c02b88bf3699cfef446ea15

SHA512
1696faee2aa666084611955e6a1cb014255da2b5c5c1c774698278cc6895a3936f637f28b9857c40d05984a5d69430d588149048581dfff54e835c7e333dd9a6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8050929.exe

Filesize
227KB

MD5
714ef2707d69c2905c84b0685f602795

SHA1
66f34ac301e9ebf012556cad32ea568b78bc087a

SHA256
607189be3d5a1eae2bad2746d5bdefda2d3850b88c02b88bf3699cfef446ea15

SHA512
1696faee2aa666084611955e6a1cb014255da2b5c5c1c774698278cc6895a3936f637f28b9857c40d05984a5d69430d588149048581dfff54e835c7e333dd9a6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8050929.exe

Filesize
227KB

MD5
714ef2707d69c2905c84b0685f602795

SHA1
66f34ac301e9ebf012556cad32ea568b78bc087a

SHA256
607189be3d5a1eae2bad2746d5bdefda2d3850b88c02b88bf3699cfef446ea15

SHA512
1696faee2aa666084611955e6a1cb014255da2b5c5c1c774698278cc6895a3936f637f28b9857c40d05984a5d69430d588149048581dfff54e835c7e333dd9a6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8050929.exe

Filesize
227KB

MD5
714ef2707d69c2905c84b0685f602795

SHA1
66f34ac301e9ebf012556cad32ea568b78bc087a

SHA256
607189be3d5a1eae2bad2746d5bdefda2d3850b88c02b88bf3699cfef446ea15

SHA512
1696faee2aa666084611955e6a1cb014255da2b5c5c1c774698278cc6895a3936f637f28b9857c40d05984a5d69430d588149048581dfff54e835c7e333dd9a6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8050929.exe

Filesize
227KB

MD5
714ef2707d69c2905c84b0685f602795

SHA1
66f34ac301e9ebf012556cad32ea568b78bc087a

SHA256
607189be3d5a1eae2bad2746d5bdefda2d3850b88c02b88bf3699cfef446ea15

SHA512
1696faee2aa666084611955e6a1cb014255da2b5c5c1c774698278cc6895a3936f637f28b9857c40d05984a5d69430d588149048581dfff54e835c7e333dd9a6

Download Submit
memory/1800-57-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1800-58-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1800-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1800-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1800-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1800-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1800-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1800-53-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download