healer | 14f3078e11370a3867502970c1590f552b57610eee8002beff6e1a091a7b2134

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce40d94599ac5d107c7307394926c3ba40229426b355943fc36b627f535d0612.exe
Size

1.3MB
MD5

0a7ebf60fb5ff5461dfb3cd9db9ff0b7
SHA1

c4b558e18b9b3c22051020e67b5956bbea5dc63b
SHA256

ce40d94599ac5d107c7307394926c3ba40229426b355943fc36b627f535d0612
SHA512

bd4fa654caec95ab7b2a4cc107b7cf25ff07bed3ea9b136ffb85050c829f9bdc26a6f4cd95418ffa1889564ee6ee12ec63efbf3b996720438510f3915747c292
SSDEEP

24576:XyzlhzBVhabCQ0ySll5IvC9y12hEg0wpnmpCJHEecYtb3725JITNze:i3zBni9Sz5IvUhE7wpECJ/9ab8Nz

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2672-57-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/2672-59-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/2672-62-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/2672-64-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/2672-66-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Executes dropped EXE 5 IoCs

Processes:

z2019760.exez9576804.exez9963970.exez3703839.exeq1627864.exe

pid process

2092 z2019760.exe
2216 z9576804.exe
1168 z9963970.exe
2660 z3703839.exe
2668 q1627864.exe

pid	process
2092	z2019760.exe
2216	z9576804.exe
1168	z9963970.exe
2660	z3703839.exe
2668	q1627864.exe

Loads dropped DLL 15 IoCs

Processes:

ce40d94599ac5d107c7307394926c3ba40229426b355943fc36b627f535d0612.exez2019760.exez9576804.exez9963970.exez3703839.exeq1627864.exeWerFault.exe

pid	process
2260	ce40d94599ac5d107c7307394926c3ba40229426b355943fc36b627f535d0612.exe
2092	z2019760.exe
2092	z2019760.exe
2216	z9576804.exe
2216	z9576804.exe
1168	z9963970.exe
1168	z9963970.exe
2660	z3703839.exe
2660	z3703839.exe
2660	z3703839.exe
2668	q1627864.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ce40d94599ac5d107c7307394926c3ba40229426b355943fc36b627f535d0612.exez2019760.exez9576804.exez9963970.exez3703839.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ce40d94599ac5d107c7307394926c3ba40229426b355943fc36b627f535d0612.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z2019760.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z9576804.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z9963970.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z3703839.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

q1627864.exe

description pid process target process

PID 2668 set thread context of 2672 2668 q1627864.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2648 2668 WerFault.exe q1627864.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

2672 AppLaunch.exe
2672 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 2672 AppLaunch.exe

description	pid	process	target process
PID 2668 set thread context of 2672	2668	q1627864.exe	AppLaunch.exe

pid	pid_target	process	target process
2648	2668	WerFault.exe	q1627864.exe

pid	process
2672	AppLaunch.exe
2672	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2672	AppLaunch.exe

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

ce40d94599ac5d107c7307394926c3ba40229426b355943fc36b627f535d0612.exez2019760.exez9576804.exez9963970.exez3703839.exeq1627864.exe

description	pid	process	target process
PID 2260 wrote to memory of 2092	2260	ce40d94599ac5d107c7307394926c3ba40229426b355943fc36b627f535d0612.exe	z2019760.exe
PID 2260 wrote to memory of 2092	2260	ce40d94599ac5d107c7307394926c3ba40229426b355943fc36b627f535d0612.exe	z2019760.exe
PID 2260 wrote to memory of 2092	2260	ce40d94599ac5d107c7307394926c3ba40229426b355943fc36b627f535d0612.exe	z2019760.exe
PID 2260 wrote to memory of 2092	2260	ce40d94599ac5d107c7307394926c3ba40229426b355943fc36b627f535d0612.exe	z2019760.exe
PID 2260 wrote to memory of 2092	2260	ce40d94599ac5d107c7307394926c3ba40229426b355943fc36b627f535d0612.exe	z2019760.exe
PID 2260 wrote to memory of 2092	2260	ce40d94599ac5d107c7307394926c3ba40229426b355943fc36b627f535d0612.exe	z2019760.exe
PID 2260 wrote to memory of 2092	2260	ce40d94599ac5d107c7307394926c3ba40229426b355943fc36b627f535d0612.exe	z2019760.exe
PID 2092 wrote to memory of 2216	2092	z2019760.exe	z9576804.exe
PID 2092 wrote to memory of 2216	2092	z2019760.exe	z9576804.exe
PID 2092 wrote to memory of 2216	2092	z2019760.exe	z9576804.exe
PID 2092 wrote to memory of 2216	2092	z2019760.exe	z9576804.exe
PID 2092 wrote to memory of 2216	2092	z2019760.exe	z9576804.exe
PID 2092 wrote to memory of 2216	2092	z2019760.exe	z9576804.exe
PID 2092 wrote to memory of 2216	2092	z2019760.exe	z9576804.exe
PID 2216 wrote to memory of 1168	2216	z9576804.exe	z9963970.exe
PID 2216 wrote to memory of 1168	2216	z9576804.exe	z9963970.exe
PID 2216 wrote to memory of 1168	2216	z9576804.exe	z9963970.exe
PID 2216 wrote to memory of 1168	2216	z9576804.exe	z9963970.exe
PID 2216 wrote to memory of 1168	2216	z9576804.exe	z9963970.exe
PID 2216 wrote to memory of 1168	2216	z9576804.exe	z9963970.exe
PID 2216 wrote to memory of 1168	2216	z9576804.exe	z9963970.exe
PID 1168 wrote to memory of 2660	1168	z9963970.exe	z3703839.exe
PID 1168 wrote to memory of 2660	1168	z9963970.exe	z3703839.exe
PID 1168 wrote to memory of 2660	1168	z9963970.exe	z3703839.exe
PID 1168 wrote to memory of 2660	1168	z9963970.exe	z3703839.exe
PID 1168 wrote to memory of 2660	1168	z9963970.exe	z3703839.exe
PID 1168 wrote to memory of 2660	1168	z9963970.exe	z3703839.exe
PID 1168 wrote to memory of 2660	1168	z9963970.exe	z3703839.exe
PID 2660 wrote to memory of 2668	2660	z3703839.exe	q1627864.exe
PID 2660 wrote to memory of 2668	2660	z3703839.exe	q1627864.exe
PID 2660 wrote to memory of 2668	2660	z3703839.exe	q1627864.exe
PID 2660 wrote to memory of 2668	2660	z3703839.exe	q1627864.exe
PID 2660 wrote to memory of 2668	2660	z3703839.exe	q1627864.exe
PID 2660 wrote to memory of 2668	2660	z3703839.exe	q1627864.exe
PID 2660 wrote to memory of 2668	2660	z3703839.exe	q1627864.exe
PID 2668 wrote to memory of 2696	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2696	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2696	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2696	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2696	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2696	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2696	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2672	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2672	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2672	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2672	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2672	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2672	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2672	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2672	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2672	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2672	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2672	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2672	2668	q1627864.exe	AppLaunch.exe
PID 2668 wrote to memory of 2648	2668	q1627864.exe	WerFault.exe
PID 2668 wrote to memory of 2648	2668	q1627864.exe	WerFault.exe
PID 2668 wrote to memory of 2648	2668	q1627864.exe	WerFault.exe
PID 2668 wrote to memory of 2648	2668	q1627864.exe	WerFault.exe
PID 2668 wrote to memory of 2648	2668	q1627864.exe	WerFault.exe
PID 2668 wrote to memory of 2648	2668	q1627864.exe	WerFault.exe
PID 2668 wrote to memory of 2648	2668	q1627864.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ce40d94599ac5d107c7307394926c3ba40229426b355943fc36b627f535d0612.exe
"C:\Users\Admin\AppData\Local\Temp\ce40d94599ac5d107c7307394926c3ba40229426b355943fc36b627f535d0612.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2019760.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2019760.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9576804.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9576804.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9963970.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9963970.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3703839.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3703839.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1627864.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1627864.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2668
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:2696
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 280
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2019760.exe

Filesize
1.2MB

MD5
d175432b92657b05ddbc660077a3fac1

SHA1
e9e03b8adc142532058577a2c1885918d8e9d8d6

SHA256
cc6f16102552285cc2d9887a23801d8084c4411aabf568918386ecf781e4e90d

SHA512
efc8318c34c547cf1f73a5ad0428a51b16f38e0667bcab5bcc0ef06a52ee66bceb8c7584c9bb17cd87d80274ab5072232f0e629e7bb5f378053caa19b3474370

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2019760.exe

Filesize
1.2MB

MD5
d175432b92657b05ddbc660077a3fac1

SHA1
e9e03b8adc142532058577a2c1885918d8e9d8d6

SHA256
cc6f16102552285cc2d9887a23801d8084c4411aabf568918386ecf781e4e90d

SHA512
efc8318c34c547cf1f73a5ad0428a51b16f38e0667bcab5bcc0ef06a52ee66bceb8c7584c9bb17cd87d80274ab5072232f0e629e7bb5f378053caa19b3474370

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9576804.exe

Filesize
1.0MB

MD5
0c6467777e2abdd618ab3072b0ede450

SHA1
790a4ebf1c75388181b0ae1a7bcf4f83bb65daa1

SHA256
f092a50378d8f606f7fc8c47de1275e2732d24c06228d684c8ea51fddb81ebcf

SHA512
9798788090f22f5fc55862d61ba63841a1cf6f2a52af713496cf03956853e732194d578a4225dc4cb1f0ec2c52ed66a39465f4a76f6be93251f071c5bad75983

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9576804.exe

Filesize
1.0MB

MD5
0c6467777e2abdd618ab3072b0ede450

SHA1
790a4ebf1c75388181b0ae1a7bcf4f83bb65daa1

SHA256
f092a50378d8f606f7fc8c47de1275e2732d24c06228d684c8ea51fddb81ebcf

SHA512
9798788090f22f5fc55862d61ba63841a1cf6f2a52af713496cf03956853e732194d578a4225dc4cb1f0ec2c52ed66a39465f4a76f6be93251f071c5bad75983

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9963970.exe

Filesize
880KB

MD5
60b7d8aac0bf7141cae3981458d0e77a

SHA1
6d901ad4fc5c4c5568bad8d93c3d4953b431a674

SHA256
7fdb994b3c0a23789fb7ff7020fd32ae23a63946e1075e1248017724846de8bd

SHA512
9e54536f09156e666416bc81ecafa1b5fe42f807ce35fc7d32ab00ac16a278c3a824f9a66a625d495c37a2c45b7a7d640c3af647544acc57d378b5220dbc7cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9963970.exe

Filesize
880KB

MD5
60b7d8aac0bf7141cae3981458d0e77a

SHA1
6d901ad4fc5c4c5568bad8d93c3d4953b431a674

SHA256
7fdb994b3c0a23789fb7ff7020fd32ae23a63946e1075e1248017724846de8bd

SHA512
9e54536f09156e666416bc81ecafa1b5fe42f807ce35fc7d32ab00ac16a278c3a824f9a66a625d495c37a2c45b7a7d640c3af647544acc57d378b5220dbc7cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3703839.exe

Filesize
490KB

MD5
d8940c0cdb4f5cd48c8af24ffbe3a658

SHA1
6a849a210aecc956cb48b6d712bdae287ec18155

SHA256
89cba7e8ab0e5125b5d78bb4f758b9946ed749bf888961e3e7af469ccb7f0258

SHA512
ba5c6e49d3798d88085c5bb4b072ed77b37ce9670e7f3b86e1e2e3e04cdd22f5af5f0da224e3c3b7741523a1ba5bd3793b6f4a0d71664637b9392f792ecdf647

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3703839.exe

Filesize
490KB

MD5
d8940c0cdb4f5cd48c8af24ffbe3a658

SHA1
6a849a210aecc956cb48b6d712bdae287ec18155

SHA256
89cba7e8ab0e5125b5d78bb4f758b9946ed749bf888961e3e7af469ccb7f0258

SHA512
ba5c6e49d3798d88085c5bb4b072ed77b37ce9670e7f3b86e1e2e3e04cdd22f5af5f0da224e3c3b7741523a1ba5bd3793b6f4a0d71664637b9392f792ecdf647

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1627864.exe

Filesize
860KB

MD5
2e1dd0d52f66f03925820ccc9815340f

SHA1
5436432984ee1fe62a5fd5bdad5b3d9a18cac511

SHA256
d338dbe1d5e31284aeaf0b178b6b9e9bba37d1fa6144d3c9fd97903c20080778

SHA512
80fd6fa48b900902ff948f0a5d2f2f64858528f478d4167e5388634a1e45018ecb4a7cd0f93a151a9879d33948c0c4a53b224ebc50324726de4b25b55e7fa108

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1627864.exe

Filesize
860KB

MD5
2e1dd0d52f66f03925820ccc9815340f

SHA1
5436432984ee1fe62a5fd5bdad5b3d9a18cac511

SHA256
d338dbe1d5e31284aeaf0b178b6b9e9bba37d1fa6144d3c9fd97903c20080778

SHA512
80fd6fa48b900902ff948f0a5d2f2f64858528f478d4167e5388634a1e45018ecb4a7cd0f93a151a9879d33948c0c4a53b224ebc50324726de4b25b55e7fa108

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1627864.exe

Filesize
860KB

MD5
2e1dd0d52f66f03925820ccc9815340f

SHA1
5436432984ee1fe62a5fd5bdad5b3d9a18cac511

SHA256
d338dbe1d5e31284aeaf0b178b6b9e9bba37d1fa6144d3c9fd97903c20080778

SHA512
80fd6fa48b900902ff948f0a5d2f2f64858528f478d4167e5388634a1e45018ecb4a7cd0f93a151a9879d33948c0c4a53b224ebc50324726de4b25b55e7fa108

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2019760.exe

Filesize
1.2MB

MD5
d175432b92657b05ddbc660077a3fac1

SHA1
e9e03b8adc142532058577a2c1885918d8e9d8d6

SHA256
cc6f16102552285cc2d9887a23801d8084c4411aabf568918386ecf781e4e90d

SHA512
efc8318c34c547cf1f73a5ad0428a51b16f38e0667bcab5bcc0ef06a52ee66bceb8c7584c9bb17cd87d80274ab5072232f0e629e7bb5f378053caa19b3474370

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2019760.exe

Filesize
1.2MB

MD5
d175432b92657b05ddbc660077a3fac1

SHA1
e9e03b8adc142532058577a2c1885918d8e9d8d6

SHA256
cc6f16102552285cc2d9887a23801d8084c4411aabf568918386ecf781e4e90d

SHA512
efc8318c34c547cf1f73a5ad0428a51b16f38e0667bcab5bcc0ef06a52ee66bceb8c7584c9bb17cd87d80274ab5072232f0e629e7bb5f378053caa19b3474370

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9576804.exe

Filesize
1.0MB

MD5
0c6467777e2abdd618ab3072b0ede450

SHA1
790a4ebf1c75388181b0ae1a7bcf4f83bb65daa1

SHA256
f092a50378d8f606f7fc8c47de1275e2732d24c06228d684c8ea51fddb81ebcf

SHA512
9798788090f22f5fc55862d61ba63841a1cf6f2a52af713496cf03956853e732194d578a4225dc4cb1f0ec2c52ed66a39465f4a76f6be93251f071c5bad75983

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9576804.exe

Filesize
1.0MB

MD5
0c6467777e2abdd618ab3072b0ede450

SHA1
790a4ebf1c75388181b0ae1a7bcf4f83bb65daa1

SHA256
f092a50378d8f606f7fc8c47de1275e2732d24c06228d684c8ea51fddb81ebcf

SHA512
9798788090f22f5fc55862d61ba63841a1cf6f2a52af713496cf03956853e732194d578a4225dc4cb1f0ec2c52ed66a39465f4a76f6be93251f071c5bad75983

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9963970.exe

Filesize
880KB

MD5
60b7d8aac0bf7141cae3981458d0e77a

SHA1
6d901ad4fc5c4c5568bad8d93c3d4953b431a674

SHA256
7fdb994b3c0a23789fb7ff7020fd32ae23a63946e1075e1248017724846de8bd

SHA512
9e54536f09156e666416bc81ecafa1b5fe42f807ce35fc7d32ab00ac16a278c3a824f9a66a625d495c37a2c45b7a7d640c3af647544acc57d378b5220dbc7cbf

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9963970.exe

Filesize
880KB

MD5
60b7d8aac0bf7141cae3981458d0e77a

SHA1
6d901ad4fc5c4c5568bad8d93c3d4953b431a674

SHA256
7fdb994b3c0a23789fb7ff7020fd32ae23a63946e1075e1248017724846de8bd

SHA512
9e54536f09156e666416bc81ecafa1b5fe42f807ce35fc7d32ab00ac16a278c3a824f9a66a625d495c37a2c45b7a7d640c3af647544acc57d378b5220dbc7cbf

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3703839.exe

Filesize
490KB

MD5
d8940c0cdb4f5cd48c8af24ffbe3a658

SHA1
6a849a210aecc956cb48b6d712bdae287ec18155

SHA256
89cba7e8ab0e5125b5d78bb4f758b9946ed749bf888961e3e7af469ccb7f0258

SHA512
ba5c6e49d3798d88085c5bb4b072ed77b37ce9670e7f3b86e1e2e3e04cdd22f5af5f0da224e3c3b7741523a1ba5bd3793b6f4a0d71664637b9392f792ecdf647

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3703839.exe

Filesize
490KB

MD5
d8940c0cdb4f5cd48c8af24ffbe3a658

SHA1
6a849a210aecc956cb48b6d712bdae287ec18155

SHA256
89cba7e8ab0e5125b5d78bb4f758b9946ed749bf888961e3e7af469ccb7f0258

SHA512
ba5c6e49d3798d88085c5bb4b072ed77b37ce9670e7f3b86e1e2e3e04cdd22f5af5f0da224e3c3b7741523a1ba5bd3793b6f4a0d71664637b9392f792ecdf647

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1627864.exe

Filesize
860KB

MD5
2e1dd0d52f66f03925820ccc9815340f

SHA1
5436432984ee1fe62a5fd5bdad5b3d9a18cac511

SHA256
d338dbe1d5e31284aeaf0b178b6b9e9bba37d1fa6144d3c9fd97903c20080778

SHA512
80fd6fa48b900902ff948f0a5d2f2f64858528f478d4167e5388634a1e45018ecb4a7cd0f93a151a9879d33948c0c4a53b224ebc50324726de4b25b55e7fa108

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1627864.exe

Filesize
860KB

MD5
2e1dd0d52f66f03925820ccc9815340f

SHA1
5436432984ee1fe62a5fd5bdad5b3d9a18cac511

SHA256
d338dbe1d5e31284aeaf0b178b6b9e9bba37d1fa6144d3c9fd97903c20080778

SHA512
80fd6fa48b900902ff948f0a5d2f2f64858528f478d4167e5388634a1e45018ecb4a7cd0f93a151a9879d33948c0c4a53b224ebc50324726de4b25b55e7fa108

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1627864.exe

Filesize
860KB

MD5
2e1dd0d52f66f03925820ccc9815340f

SHA1
5436432984ee1fe62a5fd5bdad5b3d9a18cac511

SHA256
d338dbe1d5e31284aeaf0b178b6b9e9bba37d1fa6144d3c9fd97903c20080778

SHA512
80fd6fa48b900902ff948f0a5d2f2f64858528f478d4167e5388634a1e45018ecb4a7cd0f93a151a9879d33948c0c4a53b224ebc50324726de4b25b55e7fa108

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1627864.exe

Filesize
860KB

MD5
2e1dd0d52f66f03925820ccc9815340f

SHA1
5436432984ee1fe62a5fd5bdad5b3d9a18cac511

SHA256
d338dbe1d5e31284aeaf0b178b6b9e9bba37d1fa6144d3c9fd97903c20080778

SHA512
80fd6fa48b900902ff948f0a5d2f2f64858528f478d4167e5388634a1e45018ecb4a7cd0f93a151a9879d33948c0c4a53b224ebc50324726de4b25b55e7fa108

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1627864.exe

Filesize
860KB

MD5
2e1dd0d52f66f03925820ccc9815340f

SHA1
5436432984ee1fe62a5fd5bdad5b3d9a18cac511

SHA256
d338dbe1d5e31284aeaf0b178b6b9e9bba37d1fa6144d3c9fd97903c20080778

SHA512
80fd6fa48b900902ff948f0a5d2f2f64858528f478d4167e5388634a1e45018ecb4a7cd0f93a151a9879d33948c0c4a53b224ebc50324726de4b25b55e7fa108

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1627864.exe

Filesize
860KB

MD5
2e1dd0d52f66f03925820ccc9815340f

SHA1
5436432984ee1fe62a5fd5bdad5b3d9a18cac511

SHA256
d338dbe1d5e31284aeaf0b178b6b9e9bba37d1fa6144d3c9fd97903c20080778

SHA512
80fd6fa48b900902ff948f0a5d2f2f64858528f478d4167e5388634a1e45018ecb4a7cd0f93a151a9879d33948c0c4a53b224ebc50324726de4b25b55e7fa108

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1627864.exe

Filesize
860KB

MD5
2e1dd0d52f66f03925820ccc9815340f

SHA1
5436432984ee1fe62a5fd5bdad5b3d9a18cac511

SHA256
d338dbe1d5e31284aeaf0b178b6b9e9bba37d1fa6144d3c9fd97903c20080778

SHA512
80fd6fa48b900902ff948f0a5d2f2f64858528f478d4167e5388634a1e45018ecb4a7cd0f93a151a9879d33948c0c4a53b224ebc50324726de4b25b55e7fa108

Download Submit
memory/2672-61-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2672-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2672-64-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2672-66-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2672-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2672-57-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2672-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2672-53-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download