ff7f7075d9ef713cb71b4b15b4a4f7df2989a1f1d5361e2813441b16610f0127

Analysis

max time kernel
169s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2024 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IDA Pro 7.5.zip
Size

310.6MB
MD5

580e9eb59bf0179b95bb50812ae4e102
SHA1

36b552f6d7d206b621b3610f89df2ca8810b64ff
SHA256

ff7f7075d9ef713cb71b4b15b4a4f7df2989a1f1d5361e2813441b16610f0127
SHA512

85956b284b8b9aaf158a089b9c845dcfac3c5b1bd8643ee88050a880a45231f60e5837490028c7b7f24df32d140e6fa2fd9d6df42e2a101dfbac1afb87407a4d
SSDEEP

6291456:a+MpNUdO5OaXOmJJqh7ufFmlOdc011qEhz9mMetXMUd9rIvE4eH04siozJ:alNUfa+m/a7YAs11qEhIXMUd5seHNWF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2380	ida.exe
4480	win32_remote.exe
1856	win64_remote64.exe
3920	ida64.exe

Loads dropped DLL 64 IoCs

pid	Process
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
2380	ida.exe
3920	ida64.exe
3920	ida64.exe
3920	ida64.exe
3920	ida64.exe
3920	ida64.exe
3920	ida64.exe
3920	ida64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 29 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	ida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Documents"	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	ida.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	ida.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	ida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	ida.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	ida.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	ida.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2380	ida.exe
3920	ida64.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2380	ida.exe
1988	OpenWith.exe
3920	ida64.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	2604	7zG.exe
Token: 35	2604	7zG.exe
Token: SeSecurityPrivilege	2604	7zG.exe
Token: SeSecurityPrivilege	2604	7zG.exe
Token: SeDebugPrivilege	2380	ida.exe
Token: SeDebugPrivilege	4480	win32_remote.exe
Token: SeDebugPrivilege	1856	win64_remote64.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2604	7zG.exe
2604	7zG.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
2380	ida.exe
2380	ida.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
1988	OpenWith.exe
3920	ida64.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4028	1988	OpenWith.exe	104
PID 1988 wrote to memory of 4028	1988	OpenWith.exe	104

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\IDA Pro 7.5.zip"
1⤵
PID:1868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3396

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Documents\IDA Pro 7.5\" -an -ai#7zMap1059:100:7zEvent3438
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2604

C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\ida.exe
"C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\ida.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2380

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\dbgsrv\android_server64
  2⤵
  PID:4028

C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\dbgsrv\win32_remote.exe
"C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\dbgsrv\win32_remote.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\dbgsrv\win64_remote64.exe
"C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\dbgsrv\win64_remote64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\ida64.exe
"C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\ida64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\Qt5Core.dll

Filesize
2.9MB

MD5
2f645801695f47f62d89c4d03ddaa151

SHA1
f12d36aef018434e2bf3b69543ad4ee04f47e992

SHA256
2f34d43114b361fe23c77bcc76deb083b1cd97eeb500acc02ad6287c9909957e

SHA512
e5af70ed646bf28fa72155908672887786cd649be65b2d30388ea919dd32a0d4e958beb40cda8ef23396538ce1709b0641d59e61a66c8f89f627bd301c26a518

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\Qt5Core.dll

Filesize
3.8MB

MD5
739e79d276cfb97d25dbae7e8cd1a224

SHA1
1e95ecb5428b66f37b5a8b73a0755a91a8d66b5d

SHA256
ef89a65bcc2dc61ffac674c7fad13c4aad7a4ed19167ce6555c109d0b1daa744

SHA512
052da7e581e5ff04d467d3fa8c0a127826f714ea378a9209a85c5743d57c0af3fd90758720c73a18f1e5d4be18fa91ff534b81a97714bd26a922f57ae8dc614d

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\Qt5Gui.dll

Filesize
3.6MB

MD5
70c6908e2149e08f7c99920353c2ccd1

SHA1
5c8f5e5f47b4a478590800c1a57aae885902395f

SHA256
002d81539b881c64f276ec0055f6c41f234ac58cab25457ca25607c7874dec50

SHA512
9fc19bbd05ab7b5990e27ca3bfd5775cdfc125decd37bd930ccd5b50ef2359ee170eea3cb376bff6d5ebb83450d42682954b8312d7a80e26e8de137023c28d4c

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\Qt5Gui.dll

Filesize
4.1MB

MD5
cd788657495e1ff8ddbba5d415b19b1c

SHA1
9cd3514b62eca3fbafab3233118f4ca4fb4bb9a9

SHA256
e955c56e64f5451b59ffe17ce15dc300e3e86afbb44b14b8e18d361e47d435c3

SHA512
fc350cb0a4b7e4802a754f9f7fb452a66a027a888c3e97089fa4e4f0808bd4ebe616dceb918f30a49b2ff0240ecf940308729081f1519ea1b62e786418904992

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\Qt5PrintSupport.dll

Filesize
316KB

MD5
9202512581c2ecdcbc68101bd609cdb1

SHA1
1a94dd729f345e2d98c555287afda49f7a4ad377

SHA256
8f228458a99aca0f6aa5aa2f366bee096193e2d52baa4cbe88bcd17cce2518e1

SHA512
9fbc4a61bfbb60dd7de68a1c3181e7eefe34d8381ea7ca3699321aa8e990355b9ebd72c1ebd9e49e397a01108c20ff1566b95ce696aedca23b190f3c72db5de9

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\Qt5Widgets.dll

Filesize
4.9MB

MD5
a3e2105c5a6c81184d8950875f112499

SHA1
5eb17f4e1cbb101b2892a966e9321601f75d1a94

SHA256
2b60349ffd8723796030e3c02ae36050bcd28b502692c921bc3e03fd7131e5b2

SHA512
98a74889b58d735e69d9d5f1a0a4a67bcbbb90bbcbfd4b4a5ba3bc304677bf78c115efd769d2c7562ccf88e4dab7e11a67810c1045109b60aff85a299f4ef2f3

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\Qt5Widgets.dll

Filesize
2.1MB

MD5
502cd3409280f8139ec3d32f5242cfb0

SHA1
8467bde49da918f5bf0d28e6b666d5c5083de236

SHA256
340fb6a8b91283f74140f996c9104c45e4aa453d0b4524b231942e27853342c8

SHA512
569f135d55f276db6a985fc7f507535286bd098ca9ea9a2a3b7273d31a80c856c6968152e68289145efe52fe7f44cefaa4027ca3ef64303f4941d7639de359f7

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\Qt5Widgets.dll

Filesize
768KB

MD5
c629b53f1620cc911f6c993520f877f7

SHA1
0160654939c46ef77092e84d0a2461d565fb3af9

SHA256
bf51d32c19ed9733eb15a628105af32fd7d2d0c1fbda3ec5b7e432f19ef2263e

SHA512
224e953c0b2fa23d184c9d47632ff1f914179852c9c9cef3f9373d866bebcc00787a848931bf9f32fc216f12e3a49644885ee3988189668b3012e74ed44f8509

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\cfg\idagui.cfg

Filesize
66KB

MD5
57265fcf34e0323df1cfd554bbdef518

SHA1
66822b445182c1e887672b9391a4192cf8dc4206

SHA256
88de5ebaea940f43d608c135d6cc50f6abd0ab9465feea92d012133401a5e292

SHA512
2155abe5e56fd6bea0b071c177934507bcb858972ba448ad02ace05dc13f7c6d1f58563172049c18536dc1c3272920213a23f079e2b03c1b43939db803e22992

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\clp64.dll

Filesize
1.0MB

MD5
4cf33f5396e8d3c92ecedced7d476c60

SHA1
96d72eab40c347d9fd68917c281bce23d53f4c6c

SHA256
f5ff0cc9a31fdd5037ebd4becf6e56e244c9cf2098ce21ae9bc695d98072307c

SHA512
bcf1da90f01e71ebe62ad92c66c3073b8b1f1c703701b6e8292b078e544b30c4053f9616f767fa2583dc82b16cd1425c788d8d942d98bae6fccb220a59295563

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\ida.dll

Filesize
3.4MB

MD5
8159cd2a94fe336805f5bd817bafffc3

SHA1
9e0258de1eae98c100ae9aac5ab108bb633c3807

SHA256
63fb8f2dd652e727b60d37ea3eec63cc912a728f00a7c959370545f97b6d7b55

SHA512
e271ac792f0edef3b99e11aa9db2ac0946fee6765911c37ac6dac29f0cc09773ddce4bb06e283cda082a3969d3d203d75ab72072a3403083accb0e4d8a9c68b6

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\ida.exe

Filesize
4.0MB

MD5
2297a3f7cdbdfd5cb1e78b63ba6873e2

SHA1
f0b497b43e473a5d75ca12490823cd84443fa151

SHA256
8292af86d0639d67282b9277fb6876b131ea7366b6605ad08be56aaef4fb2abd

SHA512
c53312beb362ed106f6e3507b106885476047b129e4f4bc09aed68803332700ad8c99d7b9c6842f5dd6f862618502dff06756374069155efbf42e6552da491e4

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\ida.hlp

Filesize
889KB

MD5
97e53567b7672bdd0a3141ba32536f3e

SHA1
a7bbd8b8a469e5efc2c7a3f6a14f60084daf0c86

SHA256
2b1817bd177e8ffe079f45da640359fd806e12ff5f03682829894a1935199c07

SHA512
3f498445bfb6e7446fa92f7f9a734277b4b6ed05c4d77decdef6439f57f17f3f71a7eb7c6b3272295f9b23a5893626a7fa509572fbd998452fc3d81e8210d6ac

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\ida.key

Filesize
1KB

MD5
47977b40831c63ada8e115eea2fff934

SHA1
869f350d0525207401a6cad6927171314d39e041

SHA256
2a7f5cbf25324c9364c7075aa8abfe628d7ef84dc080db5d4d11ecafcd1e2579

SHA512
33951f948b85fdd0911c5b3b3db5878c2eade7f2685f84b2f2c01bf0c362cbc26a9212ffceb7cf832cb56f7a19346c41b5ebe0d77da55258de241bb982c4f43e

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\idc\idc.idc

Filesize
299KB

MD5
bf9ad247fe56790e8b2dab03a55eeed0

SHA1
cef52d9ccdabd68629f0512fadf841e3969cca6c

SHA256
3dd40aa945bfa6658411600e3b99151a4c7c82a951c0a2cd36394edd2d2c1c06

SHA512
8b735cbd688751fa8a905bfa9ffa957ca498739913096cb908251830dd536e2611678dd28520b9504044743c01206dd531ec37da85387473a5297e844fb720bf

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\platforms\qwindows.dll

Filesize
1.1MB

MD5
19b2d175eb0427773beb2f3cf02ed1cc

SHA1
62e1d07e26b89b379a777deb42434fdf023a6594

SHA256
ad1829b51a7be67ab0c4a040ee8ac0024d67e1f0e0b0b5dd819a6166a89235fa

SHA512
3bb4beb9b220999a06cf27ccb2efd0d94b0df014e14ee8ea9ec8ce699d50cd4745faf115d55687fd53f2add2db224038874530d692a1a6dab45300d9ef9a96f3

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\armlinux_stub.dll

Filesize
150KB

MD5
6c2114583e2d3dc4d8944d9d6482c82b

SHA1
52fada0aa3f8f0cb24e0c25c8c05a4e4a221b4ee

SHA256
3269063bb4df33a23c57951e4c8e31d4b2b21d03ca25ce00589d01117f9b7229

SHA512
7dbc2ef0ae8d5e0329a3afc2d2c29bed213ac9f8adb450ce549454fe9e4fe999295fdf0ecd662f76d5ff85012ca5c79c505c5ebb33ca013e0df4e06bec3ddede

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\bdescr.dll

Filesize
22KB

MD5
988b3734b76c84cd75f0758087275954

SHA1
bfc14192396ba161277d5b6d794513960966c82f

SHA256
d920c5170cc398944bbe594c55e49296048672d584dac6c37b6b2bfb56b1b905

SHA512
05b5100d961671a2a09132875f737a785240e46b552bd8f746096c1b4266bcd86d40d2725e1316ef9a1de599a9f56be5e83f65f4089139a3a1eef6260b4e932b

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\bochs_user.dll

Filesize
336KB

MD5
df9461450c7ad251bbe6338aa4a062db

SHA1
670ed23e63c7c63cfc66f0c81e9e450f05617565

SHA256
3eb86c3d02b9f40a8e093713f35e9baed2635612f9328b6aebf7aafeeec0c79a

SHA512
1a41d6e6eebcaafb128abb4ac4b24d5e3aea048f2bcd0b58b2ce8c186deede3bc7f92c3b362b65bf5dfae5acadfa5562a3433718d8e34a6c5b8ee0b02e6e7388

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\callee.dll

Filesize
13KB

MD5
2bdb4bac3f60c8a657e8eabba6257f95

SHA1
6c8e9f3dd3504bf0bb40f7d7946f1c65502a1191

SHA256
26a4267f7f45b6b793ad175e02e18469fc2b60fd32333c1bd5c18277bf35a05f

SHA512
08c938a60e5d17575aea2a1607cb6b09602bf1c75312c3c36c4147be684689f7fe72b995f5054238270e14b2c9d4953ddc69040bb4c3ef834bb216989e9d6210

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\comhelper.dll

Filesize
27KB

MD5
45d1b8a95d93093d6c5c981ddc7b1bf1

SHA1
75929c280eccfb238b0738ad4f96b682a8f8753f

SHA256
148ad6d5086266b93d9d52c56371db56b5be068cb31ceeb9cd63c19e9bad2206

SHA512
e1434ef704bf9fc4ae9118c4711ae523b7b6d002773e38b738e6df7b661cb9746a9a03ad6cbbac34daa064e5f950a71f09275cde907d01aecc6b32c57c55a603

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\dalvik_user.dll

Filesize
371KB

MD5
1e9bc603552d73784d819baf62dd6ce4

SHA1
9f3665619c14865b86039ed0513e96d1d2b6bc2e

SHA256
fea825ac23bb98be34571696ba127c3b7f4df7899f4cd877bc520fa67030ee95

SHA512
90b01e08cd34e81660577aa1063a705952b76870a7be22e1bbb54e3e9159b0b68a5a9aad0bc82067cc4c017f5ddb795079b20e049147207e910dacc59c79b9ca

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\dbg.dll

Filesize
61KB

MD5
0923698223746197ec02448c8453aa52

SHA1
9baef4180e91f0b54545b266ef9d7e40476aa5ba

SHA256
c27c5eb87b8f0b3bdeb030d11ce1862d04d80be46c0e67b3129866ca97dd062f

SHA512
0df0e1e082fb11c9d5d83e7dd0caa53f58705067797999f3ae0f2f39ad53a0da49d70f1ecf2a7f0b44b90c16d75be2152c94067ed6aa6e202181e217003d0848

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\dscu.dll

Filesize
75KB

MD5
7b432230a464887a53474e7337204ea8

SHA1
0730c1d7c8c352ae127b2d1e91cf1f8e3291041a

SHA256
59c345f633220c7a36c5761465c3ff8223693547a0427d787ea988145f2798cc

SHA512
38828cae2b9a105b222a76511d83988d89fab3dfc6940b93436f887a675ef8a9e6e4a1bcd2cce37a727fe83180471075a0696d5c3ba4c232843caadcff5a200a

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\dwarf.dll

Filesize
513KB

MD5
f7ee3fca11236c74a9c22e70cce5805a

SHA1
718c25f44d1fc1eadcc1f9268d3a3fb1efc752d4

SHA256
5350c8a2d95cd6ad2fb0c65592bbd4c832c3449519903a113319ee20a9bf105b

SHA512
5c8e009dd72bfb5b4b5c5f523abc296f2dc0b8752ba4615aca096df67337352dc75f2c277d220ea8ad3487f676caf332df689745fd35f55b15f173f2b7d888fc

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\eh_parse.dll

Filesize
110KB

MD5
2fbdef5eb1d19bc9dfc9b8c0083ad135

SHA1
4a8700e59c7756c9e1714c97440c296a5a2017cc

SHA256
3a3d3e977e183e374a32d0a46a6b4abd9a65a0a2a3e5fd3c61b3f4227fb95744

SHA512
7c38791b4e41b7bbaf886de35c957893e7e2efc14f194b5720d9653850612a2ad5eb15469e99d251de630b930617ecc094449e6bb009c76e1665a4258c4e0156

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\gdb_user.dll

Filesize
344KB

MD5
9e8c87bbeb83279f36211b1047ac3223

SHA1
5922993a75d8576aaa46ccff57a71464e9dcec0b

SHA256
d2a89eee6880942c91b402f728ecae7a040c86db96cb2347a2373711a092a5af

SHA512
0b5503a4e575b588109c31782f24eb77b5969daa529a6e0a0a20472b9f3b869442a858b851768557db2c91b1f70ef1156a9c33123dd92cf33bf006cdc79aa3c6

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\hexarm.dll

Filesize
3.0MB

MD5
e0dd6ef6368513c1d8f9816a306d9cfa

SHA1
6cb520f387ac0e6cf4dcfbbc95e0071b86e7b9f6

SHA256
f5618989b57515bf6f4ce53b31b564c217cd7524aec86bcbc08d9382e2502c1a

SHA512
a983498d73520d4d6b97fca0ebba0c1ed3087b0e37bc3edbaa6b68e6596bdd2c2290904cd45dd973dd745fc422a7e19b42ffcf4948fdf78b0a57de1d726e2e73

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\hexmips.dll

Filesize
3.0MB

MD5
e9804b2abe2e106f0a3810c500eddda3

SHA1
a28995b357f82276bb8b485d4ce5de575c119f11

SHA256
134548bb9e50f766d08f05554e7d88cceab97f243726b0f426ade02e6eb3aae2

SHA512
0c9b3a68005716eb1b72889020ee371a6c6874e1a3417ab4c4e478bb2394be47052d8169fd1160f7657fd79bb1ec1c4533c0a1be5c8553a520112aea9ddfbf70

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\hexppc.dll

Filesize
2.8MB

MD5
d319928299a54c3a015e415ca92677c2

SHA1
bf4202cf32e64183314c99178243eff7d515d7e1

SHA256
6f67e78159c6ac7feeb09158a4a294b4518b945120c8ab1d869cbc8291eeb1d3

SHA512
617265b7e7c3a4fb3b28742393e175580cbc61a48386949bc542251f7f8765bba8a920ba580383f8f8f01a0337ab33a3965842324ed9b5112a4980782b86c42c

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\hexppc.dll

Filesize
2.5MB

MD5
ca5fa14a533fd3a6fc261b1172ba8872

SHA1
8ed7b00588bc4fef48abb56ca3999dd10ed90a0f

SHA256
d1ec5495b2ba69cb5c06123244863b43262fb0801a456ea6d3f982c9eb58438b

SHA512
1a05e5e7199fdeac8c254f486bbf45eaf7445f16623f1d9e692bb6de7fccdc889bc0075342bc64f579d58e6873c373827770f31517740c14b6cd7541489388e7

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\hexrays.dll

Filesize
2.3MB

MD5
3a57295bc08344145769222aaebebe6a

SHA1
e75f97d752acf71d8d224ec768a1bee311c5bd2f

SHA256
95340734abdc5acdc1ffef59de29c52d305ffa451f586ec58a1213d704b32fb1

SHA512
28d425b31ce2d6089d3b49763457e0da3a14dbc3bb8c38aa14caace042a4a2ccffe188855234ffedfbbb0eeb2232763405ac3d9fee5fb5dfa2cef469e4ca8487

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\idapython3.dll

Filesize
113KB

MD5
815ef38bc8b1085ac704181c37bf14f6

SHA1
7b02f07ee28726a22cb43e4d96502e642c141104

SHA256
8306e46f4375e8bcd39cb7ed1112cf2fc57b0fb5871d36530791a96670d41364

SHA512
2db45989e743a98c4c0aa307af9fcb1d7db45fbeb1743c7740f386324c629f52f68b5360b475186b4386d1b470ccb0a8f4cafba228bf12feeababa07fd9c2ce2

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\ios_user.dll

Filesize
413KB

MD5
b318f36c5d9f9461890649ba68a5d864

SHA1
13b3642757c5b8edf4b56560ef9a6742cee338fa

SHA256
dbde476ca33e3d456fc714d71cd84e03ed6174b167116aeb751319b1ce0939f5

SHA512
1183ab2816f4b15dfe467c1ed599395bfb328831b4d49b27a212a99eca628bda47c8ae59357e5a21fcaafea4d1896fdf4193402ee6e588c51a7422c6f4977032

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\linux_stub.dll

Filesize
147KB

MD5
f7d01eadd6aee422cc6e5fe32c09fe9d

SHA1
072c95a227c8ea1d9afd3e96c88a24b804d5f97a

SHA256
c78024ffee0e393b0807aa8570e342a2beaf267626f1402df15c8f63e96ed73f

SHA512
b55e910a1762d85a25251687466bcab7b6cd2c1d3b1552b8d1790ecc7983499102c8705fcdee7422d92e015716b3a4169a3f6e260bdd2054d1d46c52e5df4027

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\mac_stub.dll

Filesize
192KB

MD5
3217852f3dbd63ddab6fb8579695dcb8

SHA1
7fa95d1685f35ae31ecc88fd59753261115fb07e

SHA256
23683f05c17604136703be3a2f6b067f40ff2083c442a8c5885bd2424aa462e3

SHA512
998d170d06695a1d100340256b5cf0e0bcc6912a32403cca3d4c42293b9cfcc4352579fd96858193e69ed32a52336461054d1f8623dc804a8092c72cd5f03d1f

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\plugins\makeidt.dll

Filesize
36KB

MD5
769c03e7b4119ad0d5172384576bc76b

SHA1
4c8b9d8bb5bbd7be2d62ab948ddaf42dea7141ac

SHA256
1a764b894217e82247000582917d2db460532636bc09896a4bf7c2edb053c760

SHA512
cf800ca5fbe25b6cd1e7ecd9b2c4fac3b1c0e4375d0d67eb616a1ff02deacf16d8908a590e255fdef92da76ffe633ee52c64187b799f0d62a61d90c5af5ef8a5

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\python\2\PyQt5\uic\port_v2\__init__.py

Filesize
548B

MD5
8e40717de96792f3f07cc9233be4743c

SHA1
6de35101b0ce8fdb91729d54668006f694cffd25

SHA256
4fb2f6155bfb5efd7b9f5df6f80e11fb3d7997657fc2c8282c0189a3177dfe3c

SHA512
f0072d85733febcd67d10bac289f1f90d1b929fe1aaf1e90a09b5dd1836b47f183dc8e9f671ab599c74625b984c8336ef32be44914c0c532d240c7486b951bb1

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\python\3\PyQt5\python_3.8\sip.pyi

Filesize
2KB

MD5
659c59af4841ab542bc5ae43abe187c9

SHA1
838206246c95a4b673408c78fc6b294246d53913

SHA256
618cdf56d2935c762f32b9c73e5e998ddc471f5f70c4c5a980dc22386e898279

SHA512
e88d5cba70a86aee598d14305eb92baa9f22ba3f0c06ef108334f663413ab54c8a6dd9e57b13a31834a8e80cb86e455a97bfa806a1697ea39a639dca79be4aa6

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\qt.conf

Filesize
207B

MD5
afe6c730b47e00e3ff5f65b0756363f3

SHA1
bcfbc80905b6e9f597de0cc1d987d9200c446c80

SHA256
2518738eb7865283890de96021a55438468625d23e6b11fd09ae21d90265a83d

SHA512
ba82e4ddae268572b36cc1745fa39e0b468754ae2a8670f9f2ae91cecc4ccfffe7ee07b3db783a5f6a14c0e4fb744a5e89f748025872f2be7faea22d459d4407

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\themes\_base\theme.css

Filesize
6KB

MD5
19386b9e51dda226887c2149c84c9814

SHA1
370d5ca188f31ad01cd389483e47b6b59370383e

SHA256
bafad2c7e0e569e2a0dc278f346a61274cb7c95c010a3c8d5381dcae6cac0c96

SHA512
c7bbd21fa4875aa247d9f1326f784da251aaf107f2a1a7128773587ec78e6ae599ed66259e3ecf8286fb8136375cf8eabeb6b0976e87622a33d5771e886ab27d

Download Submit
C:\Users\Admin\Documents\IDA Pro 7.5\ida75sp3\themes\default\theme.css

Filesize
5KB

MD5
edb15b0a58256a6c8cf5763154aff06e

SHA1
10d87040a16e31bb420e761e512778af2d378fdc

SHA256
393c43e96d84514121e8c6098afce5a0f1d07e22165dcbf4e1207839f44fd63a

SHA512
98a7c25e8027a74e5fa41f8f48487f42f3a9476d53838dc425197e9c0638a968e052e63fbac5098c3ca9776fcfd209e9aa06c15d320c8f4e51591f31e00b4b51

Download Submit
memory/2380-2702-0x00007FF6CE890000-0x00007FF6CECA7000-memory.dmp

Filesize
4.1MB

Download
memory/2380-2701-0x00000000688F0000-0x0000000068E4A000-memory.dmp

Filesize
5.4MB

Download
memory/2380-2699-0x00000000688F0000-0x0000000068E4A000-memory.dmp

Filesize
5.4MB

Download
memory/2380-2700-0x00007FF6CE890000-0x00007FF6CECA7000-memory.dmp

Filesize
4.1MB

Download
memory/3920-2755-0x0000000068E50000-0x00000000693AA000-memory.dmp

Filesize
5.4MB

Download
memory/3920-2754-0x00007FF759360000-0x00007FF759776000-memory.dmp

Filesize
4.1MB

Download
memory/3920-2756-0x0000000068E50000-0x00000000693AA000-memory.dmp

Filesize
5.4MB

Download
memory/3920-2757-0x00007FF759360000-0x00007FF759776000-memory.dmp

Filesize
4.1MB

Download