healer | 0c4af16b40906032b21c7c3bfc454c2f013745dabe7486d44430552362c5cc10

Analysis

max time kernel
69s
max time network
40s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86ff061d2e1ce59189f88dda7f3df037.exe
Size

1.0MB
MD5

86ff061d2e1ce59189f88dda7f3df037
SHA1

0bb2028c3a7d6cae301969a7a7736c3b60d4b077
SHA256

0c4af16b40906032b21c7c3bfc454c2f013745dabe7486d44430552362c5cc10
SHA512

15c1837d8604aa76ad9e570c640239c34d7299ed2a695bae2407e3d5cae60cdc685b82cab64dc5aafbfa66f113365da8d9c7e17b7a29a25d0141a8326feda14c
SSDEEP

24576:+y7axvg1sK6gj31wk49I9RiyLgBLCWuyJfn:N7ax4+ngjl9LLc

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 5 IoCs

resource	yara_rule
behavioral1/memory/2612-55-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/2612-56-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/2612-58-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/2612-60-0x0000000000400000-0x000000000040A000-memory.dmp	healer
behavioral1/memory/2612-62-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe

Executes dropped EXE 5 IoCs

pid	Process
2904	z1871050.exe
2644	z7038107.exe
2932	z4140912.exe
2740	z0098865.exe
1976	q9728319.exe

Loads dropped DLL 15 IoCs

pid	Process
3036	86ff061d2e1ce59189f88dda7f3df037.exe
2904	z1871050.exe
2904	z1871050.exe
2644	z7038107.exe
2644	z7038107.exe
2932	z4140912.exe
2932	z4140912.exe
2740	z0098865.exe
2740	z0098865.exe
2740	z0098865.exe
1976	q9728319.exe
2572	WerFault.exe
2572	WerFault.exe
2572	WerFault.exe
2572	WerFault.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z1871050.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z7038107.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z4140912.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z0098865.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	86ff061d2e1ce59189f88dda7f3df037.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 2612	1976	q9728319.exe	35

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2572	1976	WerFault.exe	33

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2612	AppLaunch.exe
2612	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2612	AppLaunch.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2904	3036	86ff061d2e1ce59189f88dda7f3df037.exe	29
PID 3036 wrote to memory of 2904	3036	86ff061d2e1ce59189f88dda7f3df037.exe	29
PID 3036 wrote to memory of 2904	3036	86ff061d2e1ce59189f88dda7f3df037.exe	29
PID 3036 wrote to memory of 2904	3036	86ff061d2e1ce59189f88dda7f3df037.exe	29
PID 3036 wrote to memory of 2904	3036	86ff061d2e1ce59189f88dda7f3df037.exe	29
PID 3036 wrote to memory of 2904	3036	86ff061d2e1ce59189f88dda7f3df037.exe	29
PID 3036 wrote to memory of 2904	3036	86ff061d2e1ce59189f88dda7f3df037.exe	29
PID 2904 wrote to memory of 2644	2904	z1871050.exe	30
PID 2904 wrote to memory of 2644	2904	z1871050.exe	30
PID 2904 wrote to memory of 2644	2904	z1871050.exe	30
PID 2904 wrote to memory of 2644	2904	z1871050.exe	30
PID 2904 wrote to memory of 2644	2904	z1871050.exe	30
PID 2904 wrote to memory of 2644	2904	z1871050.exe	30
PID 2904 wrote to memory of 2644	2904	z1871050.exe	30
PID 2644 wrote to memory of 2932	2644	z7038107.exe	31
PID 2644 wrote to memory of 2932	2644	z7038107.exe	31
PID 2644 wrote to memory of 2932	2644	z7038107.exe	31
PID 2644 wrote to memory of 2932	2644	z7038107.exe	31
PID 2644 wrote to memory of 2932	2644	z7038107.exe	31
PID 2644 wrote to memory of 2932	2644	z7038107.exe	31
PID 2644 wrote to memory of 2932	2644	z7038107.exe	31
PID 2932 wrote to memory of 2740	2932	z4140912.exe	32
PID 2932 wrote to memory of 2740	2932	z4140912.exe	32
PID 2932 wrote to memory of 2740	2932	z4140912.exe	32
PID 2932 wrote to memory of 2740	2932	z4140912.exe	32
PID 2932 wrote to memory of 2740	2932	z4140912.exe	32
PID 2932 wrote to memory of 2740	2932	z4140912.exe	32
PID 2932 wrote to memory of 2740	2932	z4140912.exe	32
PID 2740 wrote to memory of 1976	2740	z0098865.exe	33
PID 2740 wrote to memory of 1976	2740	z0098865.exe	33
PID 2740 wrote to memory of 1976	2740	z0098865.exe	33
PID 2740 wrote to memory of 1976	2740	z0098865.exe	33
PID 2740 wrote to memory of 1976	2740	z0098865.exe	33
PID 2740 wrote to memory of 1976	2740	z0098865.exe	33
PID 2740 wrote to memory of 1976	2740	z0098865.exe	33
PID 1976 wrote to memory of 2612	1976	q9728319.exe	35
PID 1976 wrote to memory of 2612	1976	q9728319.exe	35
PID 1976 wrote to memory of 2612	1976	q9728319.exe	35
PID 1976 wrote to memory of 2612	1976	q9728319.exe	35
PID 1976 wrote to memory of 2612	1976	q9728319.exe	35
PID 1976 wrote to memory of 2612	1976	q9728319.exe	35
PID 1976 wrote to memory of 2612	1976	q9728319.exe	35
PID 1976 wrote to memory of 2612	1976	q9728319.exe	35
PID 1976 wrote to memory of 2612	1976	q9728319.exe	35
PID 1976 wrote to memory of 2612	1976	q9728319.exe	35
PID 1976 wrote to memory of 2612	1976	q9728319.exe	35
PID 1976 wrote to memory of 2612	1976	q9728319.exe	35
PID 1976 wrote to memory of 2572	1976	q9728319.exe	36
PID 1976 wrote to memory of 2572	1976	q9728319.exe	36
PID 1976 wrote to memory of 2572	1976	q9728319.exe	36
PID 1976 wrote to memory of 2572	1976	q9728319.exe	36
PID 1976 wrote to memory of 2572	1976	q9728319.exe	36
PID 1976 wrote to memory of 2572	1976	q9728319.exe	36
PID 1976 wrote to memory of 2572	1976	q9728319.exe	36

C:\Users\Admin\AppData\Local\Temp\86ff061d2e1ce59189f88dda7f3df037.exe
"C:\Users\Admin\AppData\Local\Temp\86ff061d2e1ce59189f88dda7f3df037.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1871050.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1871050.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7038107.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7038107.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4140912.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4140912.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0098865.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0098865.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9728319.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9728319.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 268
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1871050.exe

Filesize
963KB

MD5
b1d86ce7b4c53fa98c648cf0cab51789

SHA1
5f64b9c3a65b8d95412d11a1b193f817ffd2d45a

SHA256
0b571d5cc438659be9bd08173a3b1e15bd9e42cc0886e8679003a7a199a94299

SHA512
5475e7e611e63925e2149d7be0cf4e18e2ba5f525b7a9834f26cc3108eb5fe3ec71411bfb968c8550bd2ffe876836cd1abda95b18635f841470531a705881b42

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1871050.exe

Filesize
963KB

MD5
b1d86ce7b4c53fa98c648cf0cab51789

SHA1
5f64b9c3a65b8d95412d11a1b193f817ffd2d45a

SHA256
0b571d5cc438659be9bd08173a3b1e15bd9e42cc0886e8679003a7a199a94299

SHA512
5475e7e611e63925e2149d7be0cf4e18e2ba5f525b7a9834f26cc3108eb5fe3ec71411bfb968c8550bd2ffe876836cd1abda95b18635f841470531a705881b42

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7038107.exe

Filesize
781KB

MD5
0c5c04ded200194e8c1c91528bd9a932

SHA1
e9feffd99d1030eaad9876c89fbc326b7a9b2069

SHA256
95c364d8f1cb3231b1e617f633d6e4b176353db37369f2772db9465f5dcfa227

SHA512
02b71a93e37526e10543a41c6febf21450d330bdebfc98486a6c32e1f0fb6cb3824c561976b2bad6a40ca4f2886aedc5663b8db14ce19f2f378b7aac3b64e656

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7038107.exe

Filesize
781KB

MD5
0c5c04ded200194e8c1c91528bd9a932

SHA1
e9feffd99d1030eaad9876c89fbc326b7a9b2069

SHA256
95c364d8f1cb3231b1e617f633d6e4b176353db37369f2772db9465f5dcfa227

SHA512
02b71a93e37526e10543a41c6febf21450d330bdebfc98486a6c32e1f0fb6cb3824c561976b2bad6a40ca4f2886aedc5663b8db14ce19f2f378b7aac3b64e656

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4140912.exe

Filesize
599KB

MD5
5513fcdd0300493b2155151b61168c6f

SHA1
507c74d587df1495d87c352d7877f91b38f6eacb

SHA256
dfd2776842e0edcfbaf13bf3ac21d22bc84604a4600f1cdb1ab0ce7c5b40bcb3

SHA512
f32f60b6d80407db193fcd94b071a17a3c270e635906e2910091d81aac69285cf2a852e2f0fbe9da4d1c87aa6adb3945cc8f02c989383d09ee6463f836c1f37f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4140912.exe

Filesize
599KB

MD5
5513fcdd0300493b2155151b61168c6f

SHA1
507c74d587df1495d87c352d7877f91b38f6eacb

SHA256
dfd2776842e0edcfbaf13bf3ac21d22bc84604a4600f1cdb1ab0ce7c5b40bcb3

SHA512
f32f60b6d80407db193fcd94b071a17a3c270e635906e2910091d81aac69285cf2a852e2f0fbe9da4d1c87aa6adb3945cc8f02c989383d09ee6463f836c1f37f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0098865.exe

Filesize
336KB

MD5
fcbd0fdf28b8ffa7cffc1e8a67a35f73

SHA1
91409fda3d799e7db85be850853039b2ce43d89b

SHA256
f62c9ea7992104b600459fbaf43b81ad0470d7597ad63ac0732efe2db177eb99

SHA512
30da4efc7b1b23de462e8c686367317449000a3cf8e348c7b0b7b49df24eded23eca6d1e0fe712b8aaa836e67258e403c35ec65a4436d7715b78f6cd7731bde2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0098865.exe

Filesize
336KB

MD5
fcbd0fdf28b8ffa7cffc1e8a67a35f73

SHA1
91409fda3d799e7db85be850853039b2ce43d89b

SHA256
f62c9ea7992104b600459fbaf43b81ad0470d7597ad63ac0732efe2db177eb99

SHA512
30da4efc7b1b23de462e8c686367317449000a3cf8e348c7b0b7b49df24eded23eca6d1e0fe712b8aaa836e67258e403c35ec65a4436d7715b78f6cd7731bde2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9728319.exe

Filesize
217KB

MD5
371c38cce4bb7d3d599b46591d7da321

SHA1
110034ef0f527de48cd450db0cf390f22d94f71c

SHA256
bcb70587245ebd4fe1bbcabf879b63fabecae612705156b1a93cd80c2c522cfb

SHA512
63896f48ae59d7492570f3cddc2bf31fda0fd51f405f1ec31f6e4d636afe9d6080479b2f78535fdd39b104863d883503f0965b35f59d1d0be1098baed50ad286

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9728319.exe

Filesize
217KB

MD5
371c38cce4bb7d3d599b46591d7da321

SHA1
110034ef0f527de48cd450db0cf390f22d94f71c

SHA256
bcb70587245ebd4fe1bbcabf879b63fabecae612705156b1a93cd80c2c522cfb

SHA512
63896f48ae59d7492570f3cddc2bf31fda0fd51f405f1ec31f6e4d636afe9d6080479b2f78535fdd39b104863d883503f0965b35f59d1d0be1098baed50ad286

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9728319.exe

Filesize
217KB

MD5
371c38cce4bb7d3d599b46591d7da321

SHA1
110034ef0f527de48cd450db0cf390f22d94f71c

SHA256
bcb70587245ebd4fe1bbcabf879b63fabecae612705156b1a93cd80c2c522cfb

SHA512
63896f48ae59d7492570f3cddc2bf31fda0fd51f405f1ec31f6e4d636afe9d6080479b2f78535fdd39b104863d883503f0965b35f59d1d0be1098baed50ad286

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1871050.exe

Filesize
963KB

MD5
b1d86ce7b4c53fa98c648cf0cab51789

SHA1
5f64b9c3a65b8d95412d11a1b193f817ffd2d45a

SHA256
0b571d5cc438659be9bd08173a3b1e15bd9e42cc0886e8679003a7a199a94299

SHA512
5475e7e611e63925e2149d7be0cf4e18e2ba5f525b7a9834f26cc3108eb5fe3ec71411bfb968c8550bd2ffe876836cd1abda95b18635f841470531a705881b42

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1871050.exe

Filesize
963KB

MD5
b1d86ce7b4c53fa98c648cf0cab51789

SHA1
5f64b9c3a65b8d95412d11a1b193f817ffd2d45a

SHA256
0b571d5cc438659be9bd08173a3b1e15bd9e42cc0886e8679003a7a199a94299

SHA512
5475e7e611e63925e2149d7be0cf4e18e2ba5f525b7a9834f26cc3108eb5fe3ec71411bfb968c8550bd2ffe876836cd1abda95b18635f841470531a705881b42

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7038107.exe

Filesize
781KB

MD5
0c5c04ded200194e8c1c91528bd9a932

SHA1
e9feffd99d1030eaad9876c89fbc326b7a9b2069

SHA256
95c364d8f1cb3231b1e617f633d6e4b176353db37369f2772db9465f5dcfa227

SHA512
02b71a93e37526e10543a41c6febf21450d330bdebfc98486a6c32e1f0fb6cb3824c561976b2bad6a40ca4f2886aedc5663b8db14ce19f2f378b7aac3b64e656

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7038107.exe

Filesize
781KB

MD5
0c5c04ded200194e8c1c91528bd9a932

SHA1
e9feffd99d1030eaad9876c89fbc326b7a9b2069

SHA256
95c364d8f1cb3231b1e617f633d6e4b176353db37369f2772db9465f5dcfa227

SHA512
02b71a93e37526e10543a41c6febf21450d330bdebfc98486a6c32e1f0fb6cb3824c561976b2bad6a40ca4f2886aedc5663b8db14ce19f2f378b7aac3b64e656

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4140912.exe

Filesize
599KB

MD5
5513fcdd0300493b2155151b61168c6f

SHA1
507c74d587df1495d87c352d7877f91b38f6eacb

SHA256
dfd2776842e0edcfbaf13bf3ac21d22bc84604a4600f1cdb1ab0ce7c5b40bcb3

SHA512
f32f60b6d80407db193fcd94b071a17a3c270e635906e2910091d81aac69285cf2a852e2f0fbe9da4d1c87aa6adb3945cc8f02c989383d09ee6463f836c1f37f

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4140912.exe

Filesize
599KB

MD5
5513fcdd0300493b2155151b61168c6f

SHA1
507c74d587df1495d87c352d7877f91b38f6eacb

SHA256
dfd2776842e0edcfbaf13bf3ac21d22bc84604a4600f1cdb1ab0ce7c5b40bcb3

SHA512
f32f60b6d80407db193fcd94b071a17a3c270e635906e2910091d81aac69285cf2a852e2f0fbe9da4d1c87aa6adb3945cc8f02c989383d09ee6463f836c1f37f

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0098865.exe

Filesize
336KB

MD5
fcbd0fdf28b8ffa7cffc1e8a67a35f73

SHA1
91409fda3d799e7db85be850853039b2ce43d89b

SHA256
f62c9ea7992104b600459fbaf43b81ad0470d7597ad63ac0732efe2db177eb99

SHA512
30da4efc7b1b23de462e8c686367317449000a3cf8e348c7b0b7b49df24eded23eca6d1e0fe712b8aaa836e67258e403c35ec65a4436d7715b78f6cd7731bde2

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z0098865.exe

Filesize
336KB

MD5
fcbd0fdf28b8ffa7cffc1e8a67a35f73

SHA1
91409fda3d799e7db85be850853039b2ce43d89b

SHA256
f62c9ea7992104b600459fbaf43b81ad0470d7597ad63ac0732efe2db177eb99

SHA512
30da4efc7b1b23de462e8c686367317449000a3cf8e348c7b0b7b49df24eded23eca6d1e0fe712b8aaa836e67258e403c35ec65a4436d7715b78f6cd7731bde2

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9728319.exe

Filesize
217KB

MD5
371c38cce4bb7d3d599b46591d7da321

SHA1
110034ef0f527de48cd450db0cf390f22d94f71c

SHA256
bcb70587245ebd4fe1bbcabf879b63fabecae612705156b1a93cd80c2c522cfb

SHA512
63896f48ae59d7492570f3cddc2bf31fda0fd51f405f1ec31f6e4d636afe9d6080479b2f78535fdd39b104863d883503f0965b35f59d1d0be1098baed50ad286

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9728319.exe

Filesize
217KB

MD5
371c38cce4bb7d3d599b46591d7da321

SHA1
110034ef0f527de48cd450db0cf390f22d94f71c

SHA256
bcb70587245ebd4fe1bbcabf879b63fabecae612705156b1a93cd80c2c522cfb

SHA512
63896f48ae59d7492570f3cddc2bf31fda0fd51f405f1ec31f6e4d636afe9d6080479b2f78535fdd39b104863d883503f0965b35f59d1d0be1098baed50ad286

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9728319.exe

Filesize
217KB

MD5
371c38cce4bb7d3d599b46591d7da321

SHA1
110034ef0f527de48cd450db0cf390f22d94f71c

SHA256
bcb70587245ebd4fe1bbcabf879b63fabecae612705156b1a93cd80c2c522cfb

SHA512
63896f48ae59d7492570f3cddc2bf31fda0fd51f405f1ec31f6e4d636afe9d6080479b2f78535fdd39b104863d883503f0965b35f59d1d0be1098baed50ad286

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9728319.exe

Filesize
217KB

MD5
371c38cce4bb7d3d599b46591d7da321

SHA1
110034ef0f527de48cd450db0cf390f22d94f71c

SHA256
bcb70587245ebd4fe1bbcabf879b63fabecae612705156b1a93cd80c2c522cfb

SHA512
63896f48ae59d7492570f3cddc2bf31fda0fd51f405f1ec31f6e4d636afe9d6080479b2f78535fdd39b104863d883503f0965b35f59d1d0be1098baed50ad286

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9728319.exe

Filesize
217KB

MD5
371c38cce4bb7d3d599b46591d7da321

SHA1
110034ef0f527de48cd450db0cf390f22d94f71c

SHA256
bcb70587245ebd4fe1bbcabf879b63fabecae612705156b1a93cd80c2c522cfb

SHA512
63896f48ae59d7492570f3cddc2bf31fda0fd51f405f1ec31f6e4d636afe9d6080479b2f78535fdd39b104863d883503f0965b35f59d1d0be1098baed50ad286

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9728319.exe

Filesize
217KB

MD5
371c38cce4bb7d3d599b46591d7da321

SHA1
110034ef0f527de48cd450db0cf390f22d94f71c

SHA256
bcb70587245ebd4fe1bbcabf879b63fabecae612705156b1a93cd80c2c522cfb

SHA512
63896f48ae59d7492570f3cddc2bf31fda0fd51f405f1ec31f6e4d636afe9d6080479b2f78535fdd39b104863d883503f0965b35f59d1d0be1098baed50ad286

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9728319.exe

Filesize
217KB

MD5
371c38cce4bb7d3d599b46591d7da321

SHA1
110034ef0f527de48cd450db0cf390f22d94f71c

SHA256
bcb70587245ebd4fe1bbcabf879b63fabecae612705156b1a93cd80c2c522cfb

SHA512
63896f48ae59d7492570f3cddc2bf31fda0fd51f405f1ec31f6e4d636afe9d6080479b2f78535fdd39b104863d883503f0965b35f59d1d0be1098baed50ad286

Download Submit
memory/2612-58-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2612-57-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2612-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2612-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2612-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2612-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2612-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2612-53-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download