healer | ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222.exe
Size

1.1MB
MD5

8fbf1d99509e54ac8b85f735a9ab887b
SHA1

32193019b419b3e025f1ae410904d4ec6571f7b9
SHA256

ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222
SHA512

7926b4b71180853a7bef35758a828c8ef3e4d0488e15fadb930b312c1afe7cacd94ae3d82fea1b1aefa6bdd2ebfa0fc6257473141d16efde427d32811c28df71
SSDEEP

24576:jyYOGei01O9+fSBzKLaCvuFqqV6U9VuT0bWDXADQb3B:2YOTy9+cymnVeT0bOQu3

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3060-55-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/3060-56-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/3060-58-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/3060-62-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/3060-60-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe

Executes dropped EXE 5 IoCs

Processes:

z5539034.exez9569581.exez0307593.exez0682251.exeq9594554.exe

pid process

844 z5539034.exe
2344 z9569581.exe
2672 z0307593.exe
2676 z0682251.exe
2792 q9594554.exe

pid	process
844	z5539034.exe
2344	z9569581.exe
2672	z0307593.exe
2676	z0682251.exe
2792	q9594554.exe

Loads dropped DLL 15 IoCs

Processes:

ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222.exez5539034.exez9569581.exez0307593.exez0682251.exeq9594554.exeWerFault.exe

pid	process
1204	ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222.exe
844	z5539034.exe
844	z5539034.exe
2344	z9569581.exe
2344	z9569581.exe
2672	z0307593.exe
2672	z0307593.exe
2676	z0682251.exe
2676	z0682251.exe
2676	z0682251.exe
2792	q9594554.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222.exez5539034.exez9569581.exez0307593.exez0682251.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z5539034.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z9569581.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z0307593.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z0682251.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

q9594554.exe

description pid process target process

PID 2792 set thread context of 3060 2792 q9594554.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2576 2792 WerFault.exe q9594554.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

3060 AppLaunch.exe
3060 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 3060 AppLaunch.exe

description	pid	process	target process
PID 2792 set thread context of 3060	2792	q9594554.exe	AppLaunch.exe

pid	pid_target	process	target process
2576	2792	WerFault.exe	q9594554.exe

pid	process
3060	AppLaunch.exe
3060	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	3060	AppLaunch.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222.exez5539034.exez9569581.exez0307593.exez0682251.exeq9594554.exe

description	pid	process	target process
PID 1204 wrote to memory of 844	1204	ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222.exe	z5539034.exe
PID 1204 wrote to memory of 844	1204	ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222.exe	z5539034.exe
PID 1204 wrote to memory of 844	1204	ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222.exe	z5539034.exe
PID 1204 wrote to memory of 844	1204	ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222.exe	z5539034.exe
PID 1204 wrote to memory of 844	1204	ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222.exe	z5539034.exe
PID 1204 wrote to memory of 844	1204	ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222.exe	z5539034.exe
PID 1204 wrote to memory of 844	1204	ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222.exe	z5539034.exe
PID 844 wrote to memory of 2344	844	z5539034.exe	z9569581.exe
PID 844 wrote to memory of 2344	844	z5539034.exe	z9569581.exe
PID 844 wrote to memory of 2344	844	z5539034.exe	z9569581.exe
PID 844 wrote to memory of 2344	844	z5539034.exe	z9569581.exe
PID 844 wrote to memory of 2344	844	z5539034.exe	z9569581.exe
PID 844 wrote to memory of 2344	844	z5539034.exe	z9569581.exe
PID 844 wrote to memory of 2344	844	z5539034.exe	z9569581.exe
PID 2344 wrote to memory of 2672	2344	z9569581.exe	z0307593.exe
PID 2344 wrote to memory of 2672	2344	z9569581.exe	z0307593.exe
PID 2344 wrote to memory of 2672	2344	z9569581.exe	z0307593.exe
PID 2344 wrote to memory of 2672	2344	z9569581.exe	z0307593.exe
PID 2344 wrote to memory of 2672	2344	z9569581.exe	z0307593.exe
PID 2344 wrote to memory of 2672	2344	z9569581.exe	z0307593.exe
PID 2344 wrote to memory of 2672	2344	z9569581.exe	z0307593.exe
PID 2672 wrote to memory of 2676	2672	z0307593.exe	z0682251.exe
PID 2672 wrote to memory of 2676	2672	z0307593.exe	z0682251.exe
PID 2672 wrote to memory of 2676	2672	z0307593.exe	z0682251.exe
PID 2672 wrote to memory of 2676	2672	z0307593.exe	z0682251.exe
PID 2672 wrote to memory of 2676	2672	z0307593.exe	z0682251.exe
PID 2672 wrote to memory of 2676	2672	z0307593.exe	z0682251.exe
PID 2672 wrote to memory of 2676	2672	z0307593.exe	z0682251.exe
PID 2676 wrote to memory of 2792	2676	z0682251.exe	q9594554.exe
PID 2676 wrote to memory of 2792	2676	z0682251.exe	q9594554.exe
PID 2676 wrote to memory of 2792	2676	z0682251.exe	q9594554.exe
PID 2676 wrote to memory of 2792	2676	z0682251.exe	q9594554.exe
PID 2676 wrote to memory of 2792	2676	z0682251.exe	q9594554.exe
PID 2676 wrote to memory of 2792	2676	z0682251.exe	q9594554.exe
PID 2676 wrote to memory of 2792	2676	z0682251.exe	q9594554.exe
PID 2792 wrote to memory of 3060	2792	q9594554.exe	AppLaunch.exe
PID 2792 wrote to memory of 3060	2792	q9594554.exe	AppLaunch.exe
PID 2792 wrote to memory of 3060	2792	q9594554.exe	AppLaunch.exe
PID 2792 wrote to memory of 3060	2792	q9594554.exe	AppLaunch.exe
PID 2792 wrote to memory of 3060	2792	q9594554.exe	AppLaunch.exe
PID 2792 wrote to memory of 3060	2792	q9594554.exe	AppLaunch.exe
PID 2792 wrote to memory of 3060	2792	q9594554.exe	AppLaunch.exe
PID 2792 wrote to memory of 3060	2792	q9594554.exe	AppLaunch.exe
PID 2792 wrote to memory of 3060	2792	q9594554.exe	AppLaunch.exe
PID 2792 wrote to memory of 3060	2792	q9594554.exe	AppLaunch.exe
PID 2792 wrote to memory of 3060	2792	q9594554.exe	AppLaunch.exe
PID 2792 wrote to memory of 3060	2792	q9594554.exe	AppLaunch.exe
PID 2792 wrote to memory of 2576	2792	q9594554.exe	WerFault.exe
PID 2792 wrote to memory of 2576	2792	q9594554.exe	WerFault.exe
PID 2792 wrote to memory of 2576	2792	q9594554.exe	WerFault.exe
PID 2792 wrote to memory of 2576	2792	q9594554.exe	WerFault.exe
PID 2792 wrote to memory of 2576	2792	q9594554.exe	WerFault.exe
PID 2792 wrote to memory of 2576	2792	q9594554.exe	WerFault.exe
PID 2792 wrote to memory of 2576	2792	q9594554.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222.exe
"C:\Users\Admin\AppData\Local\Temp\ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5539034.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5539034.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9569581.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9569581.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0307593.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0307593.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0682251.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0682251.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9594554.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9594554.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 276
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5539034.exe

Filesize
980KB

MD5
d18a1ce04ff845129fc1b4d47a7560f7

SHA1
d4532424719e0f146435264e3410a96c2d3dca0c

SHA256
b236b8c0936a79376dd15ec11b18c949cc18a76cb5f74845542f2fd61fc3dc94

SHA512
4a3652c8c6e4663a1e8b6ea47c0ac2f52594678f61cd52ac4c8bc90627723eada1c9153ac02080f56a3b9c50b14392cbadb3c73f06df67bc022902a0d954eaa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5539034.exe

Filesize
980KB

MD5
d18a1ce04ff845129fc1b4d47a7560f7

SHA1
d4532424719e0f146435264e3410a96c2d3dca0c

SHA256
b236b8c0936a79376dd15ec11b18c949cc18a76cb5f74845542f2fd61fc3dc94

SHA512
4a3652c8c6e4663a1e8b6ea47c0ac2f52594678f61cd52ac4c8bc90627723eada1c9153ac02080f56a3b9c50b14392cbadb3c73f06df67bc022902a0d954eaa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9569581.exe

Filesize
798KB

MD5
f2643d44655c9fcab20a08855a715021

SHA1
9b548ac7985d73ee0d6966fa22b3913754083b55

SHA256
b89a60f4b3d4a2b8f274f99ec4585750bdd9c171f2bc3ffe89e7ea455692ab65

SHA512
fb6eab197a5abc7a6e56c3414af49d347c886ae80d9563bcd75222598589c566c852315199d0e7efe304ce48dfaf7578dae749ec34b7c688fe9710524a1ff613

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9569581.exe

Filesize
798KB

MD5
f2643d44655c9fcab20a08855a715021

SHA1
9b548ac7985d73ee0d6966fa22b3913754083b55

SHA256
b89a60f4b3d4a2b8f274f99ec4585750bdd9c171f2bc3ffe89e7ea455692ab65

SHA512
fb6eab197a5abc7a6e56c3414af49d347c886ae80d9563bcd75222598589c566c852315199d0e7efe304ce48dfaf7578dae749ec34b7c688fe9710524a1ff613

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0307593.exe

Filesize
615KB

MD5
f8fb5566235a8f5798458326904a5662

SHA1
6995b26622e637620db04d923a5e9ea6c51ebe58

SHA256
11738e002fa8cbdc0584393adc886dfe867925246f1e4f0797b827cc2dcff134

SHA512
4068c225e1f1cc210cda2f173edc51f9dadb4c9838674f10f227f33230514b58aca829d6aa0ce202ec43421e2facb60c34406fa9348e0f010941e75622aa491b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0307593.exe

Filesize
615KB

MD5
f8fb5566235a8f5798458326904a5662

SHA1
6995b26622e637620db04d923a5e9ea6c51ebe58

SHA256
11738e002fa8cbdc0584393adc886dfe867925246f1e4f0797b827cc2dcff134

SHA512
4068c225e1f1cc210cda2f173edc51f9dadb4c9838674f10f227f33230514b58aca829d6aa0ce202ec43421e2facb60c34406fa9348e0f010941e75622aa491b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0682251.exe

Filesize
344KB

MD5
4034e062268a2d641ed328648d400e73

SHA1
f791ab230c90a23e6f40ebd234bcdc92b577d6e6

SHA256
ca4ee3399398a4cfd603a339c01fcda7b3aa67be5a6bfe5538816dc44723338e

SHA512
4132fd9b3e8b4a241ee9111de3728d6b8b802017289925b98ff7c3e8a2a3573165aa2590afa469e332dd6c165e0b73d67c25f6d522763b1702dde1458074cfe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0682251.exe

Filesize
344KB

MD5
4034e062268a2d641ed328648d400e73

SHA1
f791ab230c90a23e6f40ebd234bcdc92b577d6e6

SHA256
ca4ee3399398a4cfd603a339c01fcda7b3aa67be5a6bfe5538816dc44723338e

SHA512
4132fd9b3e8b4a241ee9111de3728d6b8b802017289925b98ff7c3e8a2a3573165aa2590afa469e332dd6c165e0b73d67c25f6d522763b1702dde1458074cfe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9594554.exe

Filesize
227KB

MD5
8041ba30885862c52fec155aa7e4ce64

SHA1
4e379017a46a769173a5e819247786a61aff4e63

SHA256
4b235b76a90e08ff83b24be83d171fac8a265317154f1eb6a7163563b8c396c9

SHA512
e123c88c31dc21a2e699d42894bf997b4aa6536ad74e2e96f4073130fc902e89b0b7d4d0260554e0dc6b2302103a3bf031ab9c34f0e1d5fb7f085a41cf298d9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9594554.exe

Filesize
227KB

MD5
8041ba30885862c52fec155aa7e4ce64

SHA1
4e379017a46a769173a5e819247786a61aff4e63

SHA256
4b235b76a90e08ff83b24be83d171fac8a265317154f1eb6a7163563b8c396c9

SHA512
e123c88c31dc21a2e699d42894bf997b4aa6536ad74e2e96f4073130fc902e89b0b7d4d0260554e0dc6b2302103a3bf031ab9c34f0e1d5fb7f085a41cf298d9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9594554.exe

Filesize
227KB

MD5
8041ba30885862c52fec155aa7e4ce64

SHA1
4e379017a46a769173a5e819247786a61aff4e63

SHA256
4b235b76a90e08ff83b24be83d171fac8a265317154f1eb6a7163563b8c396c9

SHA512
e123c88c31dc21a2e699d42894bf997b4aa6536ad74e2e96f4073130fc902e89b0b7d4d0260554e0dc6b2302103a3bf031ab9c34f0e1d5fb7f085a41cf298d9f

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5539034.exe

Filesize
980KB

MD5
d18a1ce04ff845129fc1b4d47a7560f7

SHA1
d4532424719e0f146435264e3410a96c2d3dca0c

SHA256
b236b8c0936a79376dd15ec11b18c949cc18a76cb5f74845542f2fd61fc3dc94

SHA512
4a3652c8c6e4663a1e8b6ea47c0ac2f52594678f61cd52ac4c8bc90627723eada1c9153ac02080f56a3b9c50b14392cbadb3c73f06df67bc022902a0d954eaa9

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5539034.exe

Filesize
980KB

MD5
d18a1ce04ff845129fc1b4d47a7560f7

SHA1
d4532424719e0f146435264e3410a96c2d3dca0c

SHA256
b236b8c0936a79376dd15ec11b18c949cc18a76cb5f74845542f2fd61fc3dc94

SHA512
4a3652c8c6e4663a1e8b6ea47c0ac2f52594678f61cd52ac4c8bc90627723eada1c9153ac02080f56a3b9c50b14392cbadb3c73f06df67bc022902a0d954eaa9

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9569581.exe

Filesize
798KB

MD5
f2643d44655c9fcab20a08855a715021

SHA1
9b548ac7985d73ee0d6966fa22b3913754083b55

SHA256
b89a60f4b3d4a2b8f274f99ec4585750bdd9c171f2bc3ffe89e7ea455692ab65

SHA512
fb6eab197a5abc7a6e56c3414af49d347c886ae80d9563bcd75222598589c566c852315199d0e7efe304ce48dfaf7578dae749ec34b7c688fe9710524a1ff613

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9569581.exe

Filesize
798KB

MD5
f2643d44655c9fcab20a08855a715021

SHA1
9b548ac7985d73ee0d6966fa22b3913754083b55

SHA256
b89a60f4b3d4a2b8f274f99ec4585750bdd9c171f2bc3ffe89e7ea455692ab65

SHA512
fb6eab197a5abc7a6e56c3414af49d347c886ae80d9563bcd75222598589c566c852315199d0e7efe304ce48dfaf7578dae749ec34b7c688fe9710524a1ff613

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0307593.exe

Filesize
615KB

MD5
f8fb5566235a8f5798458326904a5662

SHA1
6995b26622e637620db04d923a5e9ea6c51ebe58

SHA256
11738e002fa8cbdc0584393adc886dfe867925246f1e4f0797b827cc2dcff134

SHA512
4068c225e1f1cc210cda2f173edc51f9dadb4c9838674f10f227f33230514b58aca829d6aa0ce202ec43421e2facb60c34406fa9348e0f010941e75622aa491b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0307593.exe

Filesize
615KB

MD5
f8fb5566235a8f5798458326904a5662

SHA1
6995b26622e637620db04d923a5e9ea6c51ebe58

SHA256
11738e002fa8cbdc0584393adc886dfe867925246f1e4f0797b827cc2dcff134

SHA512
4068c225e1f1cc210cda2f173edc51f9dadb4c9838674f10f227f33230514b58aca829d6aa0ce202ec43421e2facb60c34406fa9348e0f010941e75622aa491b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0682251.exe

Filesize
344KB

MD5
4034e062268a2d641ed328648d400e73

SHA1
f791ab230c90a23e6f40ebd234bcdc92b577d6e6

SHA256
ca4ee3399398a4cfd603a339c01fcda7b3aa67be5a6bfe5538816dc44723338e

SHA512
4132fd9b3e8b4a241ee9111de3728d6b8b802017289925b98ff7c3e8a2a3573165aa2590afa469e332dd6c165e0b73d67c25f6d522763b1702dde1458074cfe2

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0682251.exe

Filesize
344KB

MD5
4034e062268a2d641ed328648d400e73

SHA1
f791ab230c90a23e6f40ebd234bcdc92b577d6e6

SHA256
ca4ee3399398a4cfd603a339c01fcda7b3aa67be5a6bfe5538816dc44723338e

SHA512
4132fd9b3e8b4a241ee9111de3728d6b8b802017289925b98ff7c3e8a2a3573165aa2590afa469e332dd6c165e0b73d67c25f6d522763b1702dde1458074cfe2

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9594554.exe

Filesize
227KB

MD5
8041ba30885862c52fec155aa7e4ce64

SHA1
4e379017a46a769173a5e819247786a61aff4e63

SHA256
4b235b76a90e08ff83b24be83d171fac8a265317154f1eb6a7163563b8c396c9

SHA512
e123c88c31dc21a2e699d42894bf997b4aa6536ad74e2e96f4073130fc902e89b0b7d4d0260554e0dc6b2302103a3bf031ab9c34f0e1d5fb7f085a41cf298d9f

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9594554.exe

Filesize
227KB

MD5
8041ba30885862c52fec155aa7e4ce64

SHA1
4e379017a46a769173a5e819247786a61aff4e63

SHA256
4b235b76a90e08ff83b24be83d171fac8a265317154f1eb6a7163563b8c396c9

SHA512
e123c88c31dc21a2e699d42894bf997b4aa6536ad74e2e96f4073130fc902e89b0b7d4d0260554e0dc6b2302103a3bf031ab9c34f0e1d5fb7f085a41cf298d9f

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9594554.exe

Filesize
227KB

MD5
8041ba30885862c52fec155aa7e4ce64

SHA1
4e379017a46a769173a5e819247786a61aff4e63

SHA256
4b235b76a90e08ff83b24be83d171fac8a265317154f1eb6a7163563b8c396c9

SHA512
e123c88c31dc21a2e699d42894bf997b4aa6536ad74e2e96f4073130fc902e89b0b7d4d0260554e0dc6b2302103a3bf031ab9c34f0e1d5fb7f085a41cf298d9f

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9594554.exe

Filesize
227KB

MD5
8041ba30885862c52fec155aa7e4ce64

SHA1
4e379017a46a769173a5e819247786a61aff4e63

SHA256
4b235b76a90e08ff83b24be83d171fac8a265317154f1eb6a7163563b8c396c9

SHA512
e123c88c31dc21a2e699d42894bf997b4aa6536ad74e2e96f4073130fc902e89b0b7d4d0260554e0dc6b2302103a3bf031ab9c34f0e1d5fb7f085a41cf298d9f

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9594554.exe

Filesize
227KB

MD5
8041ba30885862c52fec155aa7e4ce64

SHA1
4e379017a46a769173a5e819247786a61aff4e63

SHA256
4b235b76a90e08ff83b24be83d171fac8a265317154f1eb6a7163563b8c396c9

SHA512
e123c88c31dc21a2e699d42894bf997b4aa6536ad74e2e96f4073130fc902e89b0b7d4d0260554e0dc6b2302103a3bf031ab9c34f0e1d5fb7f085a41cf298d9f

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9594554.exe

Filesize
227KB

MD5
8041ba30885862c52fec155aa7e4ce64

SHA1
4e379017a46a769173a5e819247786a61aff4e63

SHA256
4b235b76a90e08ff83b24be83d171fac8a265317154f1eb6a7163563b8c396c9

SHA512
e123c88c31dc21a2e699d42894bf997b4aa6536ad74e2e96f4073130fc902e89b0b7d4d0260554e0dc6b2302103a3bf031ab9c34f0e1d5fb7f085a41cf298d9f

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9594554.exe

Filesize
227KB

MD5
8041ba30885862c52fec155aa7e4ce64

SHA1
4e379017a46a769173a5e819247786a61aff4e63

SHA256
4b235b76a90e08ff83b24be83d171fac8a265317154f1eb6a7163563b8c396c9

SHA512
e123c88c31dc21a2e699d42894bf997b4aa6536ad74e2e96f4073130fc902e89b0b7d4d0260554e0dc6b2302103a3bf031ab9c34f0e1d5fb7f085a41cf298d9f

Download Submit
memory/3060-58-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3060-57-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3060-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3060-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3060-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3060-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3060-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3060-53-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download