healer | 4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe
Size

1.0MB
MD5

57d3c4401d3486b76c0ecb4c2ad1082d
SHA1

b60692c701b95bce619cdd9ae868cd46e37a2268
SHA256

4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a
SHA512

1da09f62f4ad6a4449e451cee34788361a156990972ef6764c2ca080ef8c7fe07f0ce5d710c47c687d10d365b7d6ecb099f0e3dc628ee546654070cbab347bac
SSDEEP

24576:XyZjdiK4Qis65bdkqXsqiDs7/vpmzpz7koLgGfqli:i67Qis0baqXsqp7/vp27PgGil

Score

10^/10

healer dropper evasion persistence trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000014f28-44.dat	healer
behavioral1/files/0x0007000000014f28-46.dat	healer
behavioral1/files/0x0007000000014f28-47.dat	healer
behavioral1/memory/2768-48-0x0000000000BB0000-0x0000000000BBA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q9762594.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q9762594.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q9762594.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q9762594.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q9762594.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q9762594.exe

Executes dropped EXE 6 IoCs

pid	Process
2360	z6602534.exe
2484	z0336532.exe
2752	z6772417.exe
2652	z1832639.exe
2768	q9762594.exe
2740	r2114704.exe

Loads dropped DLL 15 IoCs

pid	Process
2324	4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe
2360	z6602534.exe
2360	z6602534.exe
2484	z0336532.exe
2484	z0336532.exe
2752	z6772417.exe
2752	z6772417.exe
2652	z1832639.exe
2652	z1832639.exe
2652	z1832639.exe
2740	r2114704.exe
2244	WerFault.exe
2244	WerFault.exe
2244	WerFault.exe
2244	WerFault.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	q9762594.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q9762594.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z6602534.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z0336532.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z6772417.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z1832639.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2740 set thread context of 2592	2740	r2114704.exe	36

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2244	2740	WerFault.exe	33
2496	2592	WerFault.exe	36

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2768	q9762594.exe
2768	q9762594.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2768	q9762594.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2360	2324	4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe	28
PID 2324 wrote to memory of 2360	2324	4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe	28
PID 2324 wrote to memory of 2360	2324	4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe	28
PID 2324 wrote to memory of 2360	2324	4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe	28
PID 2324 wrote to memory of 2360	2324	4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe	28
PID 2324 wrote to memory of 2360	2324	4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe	28
PID 2324 wrote to memory of 2360	2324	4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe	28
PID 2360 wrote to memory of 2484	2360	z6602534.exe	29
PID 2360 wrote to memory of 2484	2360	z6602534.exe	29
PID 2360 wrote to memory of 2484	2360	z6602534.exe	29
PID 2360 wrote to memory of 2484	2360	z6602534.exe	29
PID 2360 wrote to memory of 2484	2360	z6602534.exe	29
PID 2360 wrote to memory of 2484	2360	z6602534.exe	29
PID 2360 wrote to memory of 2484	2360	z6602534.exe	29
PID 2484 wrote to memory of 2752	2484	z0336532.exe	30
PID 2484 wrote to memory of 2752	2484	z0336532.exe	30
PID 2484 wrote to memory of 2752	2484	z0336532.exe	30
PID 2484 wrote to memory of 2752	2484	z0336532.exe	30
PID 2484 wrote to memory of 2752	2484	z0336532.exe	30
PID 2484 wrote to memory of 2752	2484	z0336532.exe	30
PID 2484 wrote to memory of 2752	2484	z0336532.exe	30
PID 2752 wrote to memory of 2652	2752	z6772417.exe	31
PID 2752 wrote to memory of 2652	2752	z6772417.exe	31
PID 2752 wrote to memory of 2652	2752	z6772417.exe	31
PID 2752 wrote to memory of 2652	2752	z6772417.exe	31
PID 2752 wrote to memory of 2652	2752	z6772417.exe	31
PID 2752 wrote to memory of 2652	2752	z6772417.exe	31
PID 2752 wrote to memory of 2652	2752	z6772417.exe	31
PID 2652 wrote to memory of 2768	2652	z1832639.exe	32
PID 2652 wrote to memory of 2768	2652	z1832639.exe	32
PID 2652 wrote to memory of 2768	2652	z1832639.exe	32
PID 2652 wrote to memory of 2768	2652	z1832639.exe	32
PID 2652 wrote to memory of 2768	2652	z1832639.exe	32
PID 2652 wrote to memory of 2768	2652	z1832639.exe	32
PID 2652 wrote to memory of 2768	2652	z1832639.exe	32
PID 2652 wrote to memory of 2740	2652	z1832639.exe	33
PID 2652 wrote to memory of 2740	2652	z1832639.exe	33
PID 2652 wrote to memory of 2740	2652	z1832639.exe	33
PID 2652 wrote to memory of 2740	2652	z1832639.exe	33
PID 2652 wrote to memory of 2740	2652	z1832639.exe	33
PID 2652 wrote to memory of 2740	2652	z1832639.exe	33
PID 2652 wrote to memory of 2740	2652	z1832639.exe	33
PID 2740 wrote to memory of 2560	2740	r2114704.exe	34
PID 2740 wrote to memory of 2560	2740	r2114704.exe	34
PID 2740 wrote to memory of 2560	2740	r2114704.exe	34
PID 2740 wrote to memory of 2560	2740	r2114704.exe	34
PID 2740 wrote to memory of 2560	2740	r2114704.exe	34
PID 2740 wrote to memory of 2560	2740	r2114704.exe	34
PID 2740 wrote to memory of 2560	2740	r2114704.exe	34
PID 2740 wrote to memory of 2584	2740	r2114704.exe	35
PID 2740 wrote to memory of 2584	2740	r2114704.exe	35
PID 2740 wrote to memory of 2584	2740	r2114704.exe	35
PID 2740 wrote to memory of 2584	2740	r2114704.exe	35
PID 2740 wrote to memory of 2584	2740	r2114704.exe	35
PID 2740 wrote to memory of 2584	2740	r2114704.exe	35
PID 2740 wrote to memory of 2584	2740	r2114704.exe	35
PID 2740 wrote to memory of 2592	2740	r2114704.exe	36
PID 2740 wrote to memory of 2592	2740	r2114704.exe	36
PID 2740 wrote to memory of 2592	2740	r2114704.exe	36
PID 2740 wrote to memory of 2592	2740	r2114704.exe	36
PID 2740 wrote to memory of 2592	2740	r2114704.exe	36
PID 2740 wrote to memory of 2592	2740	r2114704.exe	36
PID 2740 wrote to memory of 2592	2740	r2114704.exe	36
PID 2740 wrote to memory of 2592	2740	r2114704.exe	36

C:\Users\Admin\AppData\Local\Temp\4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe
"C:\Users\Admin\AppData\Local\Temp\4922c24714e7c53277e075dfb8142672561900f67937ce5fb451d18110f4b34a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6602534.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6602534.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0336532.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0336532.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6772417.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6772417.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1832639.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1832639.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9762594.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9762594.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2114704.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2114704.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2740
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:2560
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:2584
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 268
        8⤵
        Program crash
        
        PID:2496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 288
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6602534.exe

Filesize
969KB

MD5
f8fafc12abae08f77efbb7b44194763a

SHA1
a60fbf3e0032a0d5dc483922e3e634b9ca877544

SHA256
0bbc32ced2ede7e7b207133be36e21798874e1595ba05dd29d5e53935d98cadb

SHA512
b22183285fb1a33449cb3f5e7f9755bc9f1590889b7d53621b19603025932f6f438534e84a4d38d6a0beab63caa09d047a9817545245c87a9a13d62d8f39c264

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6602534.exe

Filesize
969KB

MD5
f8fafc12abae08f77efbb7b44194763a

SHA1
a60fbf3e0032a0d5dc483922e3e634b9ca877544

SHA256
0bbc32ced2ede7e7b207133be36e21798874e1595ba05dd29d5e53935d98cadb

SHA512
b22183285fb1a33449cb3f5e7f9755bc9f1590889b7d53621b19603025932f6f438534e84a4d38d6a0beab63caa09d047a9817545245c87a9a13d62d8f39c264

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0336532.exe

Filesize
786KB

MD5
1650f1b5f5443269b5bf96cda9cc6dc6

SHA1
c6751c661ea68b9176d07f0a79f0cb04b47c088c

SHA256
485b9c1c5e28e2d80df34cf4dd62831fc861d3365a07e24cb2c85906b192f60b

SHA512
3600159bc8ea748a9af23f2ae67aa42fbfbe6b445b1753a6cda694633ef01b67cb06c2d05899205938fcfe4744a54a8ec2c258d5407d2097e0ee2416c31e2273

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0336532.exe

Filesize
786KB

MD5
1650f1b5f5443269b5bf96cda9cc6dc6

SHA1
c6751c661ea68b9176d07f0a79f0cb04b47c088c

SHA256
485b9c1c5e28e2d80df34cf4dd62831fc861d3365a07e24cb2c85906b192f60b

SHA512
3600159bc8ea748a9af23f2ae67aa42fbfbe6b445b1753a6cda694633ef01b67cb06c2d05899205938fcfe4744a54a8ec2c258d5407d2097e0ee2416c31e2273

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6772417.exe

Filesize
604KB

MD5
b2a3faebd7a5110fbfa3373d567c87ca

SHA1
8e43f4b0d741a0ee7ce3fca52c16074d0d36e4c7

SHA256
498efb686ef48ee328ba059515ca57afb9721cdcc8bca1d22c9fb9c5857d06f3

SHA512
86372066eb8258f74ae1707cc0ae69a5af158965e7233156134c2ec17d04e64e4d00d619064fba3e5e8b9969881de09d5a3646fc75599f7514f22fb9e3f76d4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6772417.exe

Filesize
604KB

MD5
b2a3faebd7a5110fbfa3373d567c87ca

SHA1
8e43f4b0d741a0ee7ce3fca52c16074d0d36e4c7

SHA256
498efb686ef48ee328ba059515ca57afb9721cdcc8bca1d22c9fb9c5857d06f3

SHA512
86372066eb8258f74ae1707cc0ae69a5af158965e7233156134c2ec17d04e64e4d00d619064fba3e5e8b9969881de09d5a3646fc75599f7514f22fb9e3f76d4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1832639.exe

Filesize
339KB

MD5
f0ac139fe1cb3fdca7f9609ba517c42a

SHA1
cd5bc6191ed2cab2d484cc7944b7c40ac1bd36be

SHA256
9c2403ff56933c6405d975b88fb664b4a79128eb8137a9279626ee51d998a34f

SHA512
5a166c50aec04d2050e5c06d83f62545802ef8a2ed6a2b4126bdef06ab3b36c07e7195b55bad848f5d99a5ebaa53e1919733937745dd951f63429a356858642e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1832639.exe

Filesize
339KB

MD5
f0ac139fe1cb3fdca7f9609ba517c42a

SHA1
cd5bc6191ed2cab2d484cc7944b7c40ac1bd36be

SHA256
9c2403ff56933c6405d975b88fb664b4a79128eb8137a9279626ee51d998a34f

SHA512
5a166c50aec04d2050e5c06d83f62545802ef8a2ed6a2b4126bdef06ab3b36c07e7195b55bad848f5d99a5ebaa53e1919733937745dd951f63429a356858642e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9762594.exe

Filesize
12KB

MD5
f8ef23e84fadf742be674dab9addfe9d

SHA1
6490a0f9e0050ada3bb4ef42c63899ab1295850c

SHA256
fc58f7aa025869f34b4ad7a9b976b0742a784a6aecb258a4c207b0f842bc7004

SHA512
e549bbe7e9993e95f490c6420f61ccf6faba0ebe30663563797d4413bf06b7f37252d9d9c602c25205b5e35d5f8bc4e6d22df361f5bddea92af24c83455ff33c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9762594.exe

Filesize
12KB

MD5
f8ef23e84fadf742be674dab9addfe9d

SHA1
6490a0f9e0050ada3bb4ef42c63899ab1295850c

SHA256
fc58f7aa025869f34b4ad7a9b976b0742a784a6aecb258a4c207b0f842bc7004

SHA512
e549bbe7e9993e95f490c6420f61ccf6faba0ebe30663563797d4413bf06b7f37252d9d9c602c25205b5e35d5f8bc4e6d22df361f5bddea92af24c83455ff33c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2114704.exe

Filesize
365KB

MD5
f5d3c335cdb383d0e6015e9ce0cb8e24

SHA1
eb6714b759fb58609f69f263ff083ed39de031d4

SHA256
b908bf2206e378f9aa3c46dd2bc7e18e3674106933439639094d7197ae5a7a1f

SHA512
169c5c669963dec9ab1bdcc20110df39076b2a489fd5c09694db90bf993085dd42bbaca44021584f569c537c5ba7a18308e019205195e7422455b16e43bfab5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2114704.exe

Filesize
365KB

MD5
f5d3c335cdb383d0e6015e9ce0cb8e24

SHA1
eb6714b759fb58609f69f263ff083ed39de031d4

SHA256
b908bf2206e378f9aa3c46dd2bc7e18e3674106933439639094d7197ae5a7a1f

SHA512
169c5c669963dec9ab1bdcc20110df39076b2a489fd5c09694db90bf993085dd42bbaca44021584f569c537c5ba7a18308e019205195e7422455b16e43bfab5b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6602534.exe

Filesize
969KB

MD5
f8fafc12abae08f77efbb7b44194763a

SHA1
a60fbf3e0032a0d5dc483922e3e634b9ca877544

SHA256
0bbc32ced2ede7e7b207133be36e21798874e1595ba05dd29d5e53935d98cadb

SHA512
b22183285fb1a33449cb3f5e7f9755bc9f1590889b7d53621b19603025932f6f438534e84a4d38d6a0beab63caa09d047a9817545245c87a9a13d62d8f39c264

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6602534.exe

Filesize
969KB

MD5
f8fafc12abae08f77efbb7b44194763a

SHA1
a60fbf3e0032a0d5dc483922e3e634b9ca877544

SHA256
0bbc32ced2ede7e7b207133be36e21798874e1595ba05dd29d5e53935d98cadb

SHA512
b22183285fb1a33449cb3f5e7f9755bc9f1590889b7d53621b19603025932f6f438534e84a4d38d6a0beab63caa09d047a9817545245c87a9a13d62d8f39c264

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0336532.exe

Filesize
786KB

MD5
1650f1b5f5443269b5bf96cda9cc6dc6

SHA1
c6751c661ea68b9176d07f0a79f0cb04b47c088c

SHA256
485b9c1c5e28e2d80df34cf4dd62831fc861d3365a07e24cb2c85906b192f60b

SHA512
3600159bc8ea748a9af23f2ae67aa42fbfbe6b445b1753a6cda694633ef01b67cb06c2d05899205938fcfe4744a54a8ec2c258d5407d2097e0ee2416c31e2273

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0336532.exe

Filesize
786KB

MD5
1650f1b5f5443269b5bf96cda9cc6dc6

SHA1
c6751c661ea68b9176d07f0a79f0cb04b47c088c

SHA256
485b9c1c5e28e2d80df34cf4dd62831fc861d3365a07e24cb2c85906b192f60b

SHA512
3600159bc8ea748a9af23f2ae67aa42fbfbe6b445b1753a6cda694633ef01b67cb06c2d05899205938fcfe4744a54a8ec2c258d5407d2097e0ee2416c31e2273

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6772417.exe

Filesize
604KB

MD5
b2a3faebd7a5110fbfa3373d567c87ca

SHA1
8e43f4b0d741a0ee7ce3fca52c16074d0d36e4c7

SHA256
498efb686ef48ee328ba059515ca57afb9721cdcc8bca1d22c9fb9c5857d06f3

SHA512
86372066eb8258f74ae1707cc0ae69a5af158965e7233156134c2ec17d04e64e4d00d619064fba3e5e8b9969881de09d5a3646fc75599f7514f22fb9e3f76d4a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6772417.exe

Filesize
604KB

MD5
b2a3faebd7a5110fbfa3373d567c87ca

SHA1
8e43f4b0d741a0ee7ce3fca52c16074d0d36e4c7

SHA256
498efb686ef48ee328ba059515ca57afb9721cdcc8bca1d22c9fb9c5857d06f3

SHA512
86372066eb8258f74ae1707cc0ae69a5af158965e7233156134c2ec17d04e64e4d00d619064fba3e5e8b9969881de09d5a3646fc75599f7514f22fb9e3f76d4a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1832639.exe

Filesize
339KB

MD5
f0ac139fe1cb3fdca7f9609ba517c42a

SHA1
cd5bc6191ed2cab2d484cc7944b7c40ac1bd36be

SHA256
9c2403ff56933c6405d975b88fb664b4a79128eb8137a9279626ee51d998a34f

SHA512
5a166c50aec04d2050e5c06d83f62545802ef8a2ed6a2b4126bdef06ab3b36c07e7195b55bad848f5d99a5ebaa53e1919733937745dd951f63429a356858642e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1832639.exe

Filesize
339KB

MD5
f0ac139fe1cb3fdca7f9609ba517c42a

SHA1
cd5bc6191ed2cab2d484cc7944b7c40ac1bd36be

SHA256
9c2403ff56933c6405d975b88fb664b4a79128eb8137a9279626ee51d998a34f

SHA512
5a166c50aec04d2050e5c06d83f62545802ef8a2ed6a2b4126bdef06ab3b36c07e7195b55bad848f5d99a5ebaa53e1919733937745dd951f63429a356858642e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9762594.exe

Filesize
12KB

MD5
f8ef23e84fadf742be674dab9addfe9d

SHA1
6490a0f9e0050ada3bb4ef42c63899ab1295850c

SHA256
fc58f7aa025869f34b4ad7a9b976b0742a784a6aecb258a4c207b0f842bc7004

SHA512
e549bbe7e9993e95f490c6420f61ccf6faba0ebe30663563797d4413bf06b7f37252d9d9c602c25205b5e35d5f8bc4e6d22df361f5bddea92af24c83455ff33c

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2114704.exe

Filesize
365KB

MD5
f5d3c335cdb383d0e6015e9ce0cb8e24

SHA1
eb6714b759fb58609f69f263ff083ed39de031d4

SHA256
b908bf2206e378f9aa3c46dd2bc7e18e3674106933439639094d7197ae5a7a1f

SHA512
169c5c669963dec9ab1bdcc20110df39076b2a489fd5c09694db90bf993085dd42bbaca44021584f569c537c5ba7a18308e019205195e7422455b16e43bfab5b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2114704.exe

Filesize
365KB

MD5
f5d3c335cdb383d0e6015e9ce0cb8e24

SHA1
eb6714b759fb58609f69f263ff083ed39de031d4

SHA256
b908bf2206e378f9aa3c46dd2bc7e18e3674106933439639094d7197ae5a7a1f

SHA512
169c5c669963dec9ab1bdcc20110df39076b2a489fd5c09694db90bf993085dd42bbaca44021584f569c537c5ba7a18308e019205195e7422455b16e43bfab5b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2114704.exe

Filesize
365KB

MD5
f5d3c335cdb383d0e6015e9ce0cb8e24

SHA1
eb6714b759fb58609f69f263ff083ed39de031d4

SHA256
b908bf2206e378f9aa3c46dd2bc7e18e3674106933439639094d7197ae5a7a1f

SHA512
169c5c669963dec9ab1bdcc20110df39076b2a489fd5c09694db90bf993085dd42bbaca44021584f569c537c5ba7a18308e019205195e7422455b16e43bfab5b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2114704.exe

Filesize
365KB

MD5
f5d3c335cdb383d0e6015e9ce0cb8e24

SHA1
eb6714b759fb58609f69f263ff083ed39de031d4

SHA256
b908bf2206e378f9aa3c46dd2bc7e18e3674106933439639094d7197ae5a7a1f

SHA512
169c5c669963dec9ab1bdcc20110df39076b2a489fd5c09694db90bf993085dd42bbaca44021584f569c537c5ba7a18308e019205195e7422455b16e43bfab5b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2114704.exe

Filesize
365KB

MD5
f5d3c335cdb383d0e6015e9ce0cb8e24

SHA1
eb6714b759fb58609f69f263ff083ed39de031d4

SHA256
b908bf2206e378f9aa3c46dd2bc7e18e3674106933439639094d7197ae5a7a1f

SHA512
169c5c669963dec9ab1bdcc20110df39076b2a489fd5c09694db90bf993085dd42bbaca44021584f569c537c5ba7a18308e019205195e7422455b16e43bfab5b

Download Submit
\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2114704.exe

Filesize
365KB

MD5
f5d3c335cdb383d0e6015e9ce0cb8e24

SHA1
eb6714b759fb58609f69f263ff083ed39de031d4

SHA256
b908bf2206e378f9aa3c46dd2bc7e18e3674106933439639094d7197ae5a7a1f

SHA512
169c5c669963dec9ab1bdcc20110df39076b2a489fd5c09694db90bf993085dd42bbaca44021584f569c537c5ba7a18308e019205195e7422455b16e43bfab5b

Download Submit
memory/2592-62-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2592-59-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2592-61-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2592-58-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2592-60-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2592-63-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2592-64-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2592-65-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2592-69-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2592-67-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2768-51-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

Filesize
9.9MB

Download
memory/2768-50-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

Filesize
9.9MB

Download
memory/2768-49-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmp

Filesize
9.9MB

Download
memory/2768-48-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

Filesize
40KB

Download