Analysis

  • max time kernel
    98s
  • max time network
    114s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28-04-2024 15:46

General

  • Target

    AppNee.com.IDA.Pro.v8.3.PFR.SDK.7z

  • Size

    427.0MB

  • MD5

    3c3dc5d69f703e9d84424075b3907ef3

  • SHA1

    cdae8781b0b7fb350a69afc5873a588a99fc06fe

  • SHA256

    ae2736ff68fe8e91a0d263f0f1d810f435969a4f35124f0f0e0505c94ae02c49

  • SHA512

    083ebf8ebce5439c5988d4a6e5e8f09be0232c48f91c0ecfcf1515074f87f909e4f818d041dff05bc0f845c83864bd52ba0310a3d3e8ae302455a48a23fcf1d1

  • SSDEEP

    12582912:ULfysOy+1rU3M91VBX2fbECDoOvOFWQ6g+xd72lE:ULKf1UkanUgkO

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 23 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\AppNee.com.IDA.Pro.v8.3.PFR.SDK.7z
    1⤵
    • Modifies registry class
    PID:2876
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:780
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\AppNee.com.IDA.Pro.v8.3.PFR.SDK.7z"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\AppNee.com.IDA.Pro.v8.3.PFR.SDK.7z
        3⤵
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3032
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1584 -prefsLen 25455 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fb24003-aa84-4219-be1c-26189d3ec076} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" gpu
          4⤵
            PID:672
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2396 -prefsLen 26375 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1161dfd3-18e3-43c1-9566-1443312cb443} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" socket
            4⤵
              PID:4964
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2996 -childID 1 -isForBrowser -prefsHandle 2768 -prefMapHandle 3212 -prefsLen 26516 -prefMapSize 244658 -jsInitHandle 1176 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52b1b81c-acb8-497e-83d9-f72c9c5cf417} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" tab
              4⤵
                PID:4284
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2912 -childID 2 -isForBrowser -prefsHandle 3636 -prefMapHandle 3424 -prefsLen 30865 -prefMapSize 244658 -jsInitHandle 1176 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30ad1561-b15c-480e-8a07-10016d554947} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" tab
                4⤵
                  PID:3688
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4460 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4416 -prefMapHandle 4408 -prefsLen 30865 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8887867-ae90-42fb-8541-293a1dbc75f8} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" utility
                  4⤵
                  • Checks processor information in registry
                  PID:3480
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5420 -childID 3 -isForBrowser -prefsHandle 5432 -prefMapHandle 5424 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1176 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2e0f9b1-2002-4f83-bbaf-9ab35f1bce75} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" tab
                  4⤵
                    PID:3208
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5652 -childID 4 -isForBrowser -prefsHandle 5572 -prefMapHandle 5576 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1176 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17062211-4056-4576-9368-20fc1a6d9205} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" tab
                    4⤵
                      PID:588
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5852 -childID 5 -isForBrowser -prefsHandle 5772 -prefMapHandle 5780 -prefsLen 26990 -prefMapSize 244658 -jsInitHandle 1176 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bded5457-8c36-4cc5-b636-154a5a75079a} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" tab
                      4⤵
                        PID:2780
                • C:\Windows\System32\rundll32.exe
                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                  1⤵
                    PID:1100
                  • C:\Windows\system32\OpenWith.exe
                    C:\Windows\system32\OpenWith.exe -Embedding
                    1⤵
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:3660
                  • C:\Program Files\7-Zip\7zFM.exe
                    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\AppNee.com.IDA.Pro.v8.3.PFR.SDK.7z"
                    1⤵
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    PID:3172
                  • C:\Windows\System32\DataExchangeHost.exe
                    C:\Windows\System32\DataExchangeHost.exe -Embedding
                    1⤵
                      PID:3800
                    • C:\Users\Admin\Desktop\IDA Pro 8.3\ida64.exe
                      "C:\Users\Admin\Desktop\IDA Pro 8.3\ida64.exe"
                      1⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious behavior: AddClipboardFormatListener
                      • Suspicious behavior: GetForegroundWindowSpam
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      PID:7840

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pz5zwzp5.default-release\activity-stream.discovery_stream.json.tmp

                      Filesize

                      18KB

                      MD5

                      45ab86205e2d780c5db5c39413d9fa8d

                      SHA1

                      d88130ae229708cd30615524af621caf6f7db591

                      SHA256

                      1512f8eb81ac6f4c230ea487acf5c9f2c9fa6d1e217a1eca01d26c135db75109

                      SHA512

                      5b2f4150d73ac92b4ff4cee8fa7a2660e6ca4c6b22fac725e5ada6c1d511619a2fef6493db41f23c8f2cd94df9d475f776caebce39ea7a789e71167ee15ff36f

                    • C:\Users\Admin\AppData\Local\Temp\7zE46CFF4B8\IDA Pro 8.3\python\3\PyQt5\python_3.12\sip.pyi

                      Filesize

                      2KB

                      MD5

                      659c59af4841ab542bc5ae43abe187c9

                      SHA1

                      838206246c95a4b673408c78fc6b294246d53913

                      SHA256

                      618cdf56d2935c762f32b9c73e5e998ddc471f5f70c4c5a980dc22386e898279

                      SHA512

                      e88d5cba70a86aee598d14305eb92baa9f22ba3f0c06ef108334f663413ab54c8a6dd9e57b13a31834a8e80cb86e455a97bfa806a1697ea39a639dca79be4aa6

                    • C:\Users\Admin\AppData\Local\Temp\7zE46CFF4B8\IDA Pro 8.3\python\3\PyQt5\uic\port_v2\__init__.py

                      Filesize

                      548B

                      MD5

                      71014d6369472d3184315f736d945afc

                      SHA1

                      375858f197d1403c191670a3151ea51329ee75cd

                      SHA256

                      32bd356bf7687853a140d02a5c9df551bce86656ea6cc587161887be57dc0edc

                      SHA512

                      be351c9c6ddbfc23dc0bc1791321c066d250ade7ecb393e4b17ea9357810db368065ef601e7d469031cdac710bda8e824d55c7a32403d269084aed93ee4f9e6d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pz5zwzp5.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      5KB

                      MD5

                      3a498421ebb8fe645334df1129a76b44

                      SHA1

                      2a01356f126e07057d5c60c2ee58c86e8c95e66a

                      SHA256

                      1ec6a7afb324a94527eb46dcc326d4d34da8b7433440dec4bfb1e2cdcf182554

                      SHA512

                      356965c1f87461fd56a03f3130fa2d871952d7638bbc3b86970daecda328dc341bc6891e8dc7f4a81c31e719e83933ef84d72bba12a0164192e80d0ca9c6eaf2

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pz5zwzp5.default-release\datareporting\glean\db\data.safe.tmp

                      Filesize

                      6KB

                      MD5

                      04ad79d75625a1804910d425ada84b34

                      SHA1

                      b84fbfa9a3587e0496e7ff12ed22562294af3d5e

                      SHA256

                      69d74125a3e9e69386f2fcf8bcdab142763acaf8a7be5d2e451413fad895db46

                      SHA512

                      3fa0013f85b66a5c655433efc9d661ea58dc57414257e41f8cbe83165c0ea83242609f9296a9fbdb82a79a63caadccb77bb4149e2189ac4d80117feabadbc85d

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pz5zwzp5.default-release\datareporting\glean\pending_pings\2095645a-a41a-48d7-8f35-a0af09e01e37

                      Filesize

                      982B

                      MD5

                      7248e7bed3f7bc4adc5e759d689b2f03

                      SHA1

                      fd6763611fb2096a9cc8a88265903d34607eb687

                      SHA256

                      12bfd9e7c769a41775ef1cc1d7abd1541723aef31e0f97213a76529db969330f

                      SHA512

                      dd3e409ffc16c20ca7cb3d02763a311f500d993055a85cff0d36e2112373a3e78247176cecd597e23b5064a7a68d4d0af842609d3d0d7ed3720064c6fc893059

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pz5zwzp5.default-release\datareporting\glean\pending_pings\bf7bb97a-472d-4057-8fdb-f53d4f118142

                      Filesize

                      671B

                      MD5

                      1ac05674ab63fae6fb380db03136fd11

                      SHA1

                      081931af2b63a6ad24f2cdde2fbf84dcebdded3a

                      SHA256

                      053e8f51197067839a9dc06029a2c3910aba8a36e098d496e0dde7daa8c8c5f8

                      SHA512

                      2d1e3294198924db2a10b58d3bccabb64ecf5b2a86225aac09ae03e81ac529b67b9a9bfee15af71d6b244fcdb11f0773fde81536ffee31e1237b9628da4f0ebe

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pz5zwzp5.default-release\datareporting\glean\pending_pings\ddf118a5-8517-43f4-a9c0-bf17ae08f150

                      Filesize

                      25KB

                      MD5

                      a3ae74a96b43a38c71002dea09de2a19

                      SHA1

                      35c1c474ec4440ae286fcdeb89b63d074d413f07

                      SHA256

                      937a61d71c54083e4519ee62cf493f3e421f25f180594fb06086980471ca48f1

                      SHA512

                      957658f4e5a92bd27eac5078bd2b1bfd2b7cde82846902e17f2e6f431d8c4b3c43a3e36929b7afaeac2e92266cfc9c595b759d9a31f58b097dd64078d93032c8

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pz5zwzp5.default-release\prefs-1.js

                      Filesize

                      8KB

                      MD5

                      95a0a545e888b1703c5ec6fe359ac08a

                      SHA1

                      aa54f74564b32bb7377dcbf461445d61c397337b

                      SHA256

                      24eba7fb363ec6635789f796784297aae62c1a2388c6a12fbe3cac77f3e1e51e

                      SHA512

                      042248f99b58857ec940e8158e84588a914c518957160801ffdcd86fa3ce3c5070db3b9757bf2f111ad36cf19e6be83f55fa37635ad91c57fed55c46acf8ec84

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pz5zwzp5.default-release\prefs-1.js

                      Filesize

                      9KB

                      MD5

                      f53cf2ca01026af440db76d727417d6f

                      SHA1

                      2d69ca9cf9dea868deef4c6a5866700533a9318c

                      SHA256

                      4a6986a59ff3ca82ae2ca36ab4d01c4d14135a67fc615ff9598824e6d50e497b

                      SHA512

                      866f4933b5af5750d021afaebd00f174e257d999b888cdd2296da032b8e6299bdcd810a503fdcc0fb3f863b219c930e28ec676d335227d588a020b9cd049ab7f

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pz5zwzp5.default-release\prefs.js

                      Filesize

                      8KB

                      MD5

                      7fe1f8ed681867bfa51e4c7200fe4bc7

                      SHA1

                      9ab3152699e9341b8b0706421d93985b853c5c5a

                      SHA256

                      7c98ad7cfa474b5d50ffd60023f2d867d2053c7349f5575eeaf8f8e596fdd217

                      SHA512

                      a5d149d5e8c10fe3fd894590c5b1cf9caff4222eb81c50b108bc4adff0e02bd8e0103eef7c2e0d5facedec4e339b50bf2578411fd74b3d75501883eea16d4e5b

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pz5zwzp5.default-release\prefs.js

                      Filesize

                      8KB

                      MD5

                      7d1fc93bb19b496c212ee19fb240a270

                      SHA1

                      092c72a1c1c8da007c9316262dd28c05d817b0a4

                      SHA256

                      149c3e16522304854ec531fd3c51ed0651ef7dc3fd1e133b2337b6959ef938c1

                      SHA512

                      0399f0084bd692ed417f964b0c3c131e635ad55fa12904649d077cb44f7479f2a9da28370a092af502864f98da445115537c31b818b1b39b36f2245646b1add7

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\Qt5Core.dll

                      Filesize

                      5.9MB

                      MD5

                      fd80d43e803c146d0718b811e96ef21b

                      SHA1

                      2d53fc58d9e752b9577fe1e78ac117d9d0703469

                      SHA256

                      695307903ccc11dd4972015bebb160b7f0ba414a95e8323e5788476e69e3f83c

                      SHA512

                      01c8a7c1b5fe6d752e237837e448cde3d52888d3d3bc2185bbbdd11557b512f1175ff7c2d3260cea7c7600f6ff263c730d7149fea25f334817541782eb3c1c13

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\Qt5Gui.dll

                      Filesize

                      6.6MB

                      MD5

                      367ada59863dde5902ac813c765c718b

                      SHA1

                      1c30b98f93d5fcb49a15ae22ac9ab1792a0cbfa4

                      SHA256

                      2b8df2fa3a3f75be898ad826e3698a562cd3cce71096ce0b0abf362be6ba57e2

                      SHA512

                      7d57df5c3a9d7de2969074a4ef59cbca6d51fa84de1bc76d5fa4e633b6aeef9f00351ea1774b67ac3565ae6c48e18f0e561487c60027326defb166f3229db057

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\Qt5PrintSupport.dll

                      Filesize

                      309KB

                      MD5

                      4cd655f4d826e8437b0415aa6c8d6550

                      SHA1

                      7611161c774c7c72b189b420772d2c65e2634e4a

                      SHA256

                      7b105ebf20c0b52259c00ff645f95f584bbe60b91c90de583785ac88b448e26d

                      SHA512

                      82745e4139f72f6843d0f4b588c2744b60a405e398f158319ee336758c09abfbced2f0ecc4e0a6d3e535384a9cbe69f89935b11a9b5857cc8f7deec00f044c6d

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\Qt5Svg.dll

                      Filesize

                      324KB

                      MD5

                      f3cd456d5fb9685304dbb53cc7b9ebaa

                      SHA1

                      8eadfaf8b8e8df16fba9e1dcc36d0ab3eb6c9f42

                      SHA256

                      62089b5a811c7c0cc408335dbafa0c7060cc9324c01595e011abd6ac2e868442

                      SHA512

                      03c3c24a95042b5e4337f2e093d219ebe3a3a05b8a78a8029550f1470c51b4433a60ca7d1000e238a3bfed51b6e6b112788a0663ea6618b4d052214749b4035c

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\Qt5Widgets.dll

                      Filesize

                      5.3MB

                      MD5

                      8b786869feb36930f8d6fd7be98ced2c

                      SHA1

                      f6fc979919df931af8fbeae54eff502663b2793c

                      SHA256

                      af337b316a39107944bdeb117798fd8ce02c3307fb415a371b6bc431d470a3e5

                      SHA512

                      9eaa2390abcceb7d69958be99c75dfd60edc464ea8018d3657a39846f40ecd6c6e48bfd750c48264047cff82b6aec398f63df5f70f0c95484a052913e845384a

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\cfg\idagui.cfg

                      Filesize

                      69KB

                      MD5

                      f1e5310867f39f4a8e7edd765bc61575

                      SHA1

                      f5e6085c620d7deea0e258e05ee88d0a0cf055dc

                      SHA256

                      03991893b93944228374178b51c6187b31b1da53858cfca10d326621ee9becf7

                      SHA512

                      d2fe8950b3a98e5fd838a4e386534803150c7600e5a6ad32f177381e5e599bccec77efd33c8815ff25f08d2948e125387f4950d6d6e82c52bdfac437cd25b7b3

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\ida.hlp

                      Filesize

                      932KB

                      MD5

                      024b0555d7a5740272ee805b0f32ea8a

                      SHA1

                      c48488c4e525f9f8a2a1cfa1cbab42698c1c67a5

                      SHA256

                      2291a8037a0ebba9b9f63b34af0d4cc43402a0cacdcc3cab27d83bb3ddc6025f

                      SHA512

                      3d4c4ec4c2c851b353d4f17f102c1e8ee22b93822c99655d94ffa781572de58ab5253c638e116924816b85ab55f473f17b2a85cbf2ce159278033dec9840047f

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\ida.key

                      Filesize

                      1KB

                      MD5

                      2532a463e9ac23b006de047688ab1922

                      SHA1

                      7cac7416616bb0771306a4ca0c4ec7889bd1adc9

                      SHA256

                      4ade8a33b07a641e38fc498c7705ef14aec76256d6337c47cd15c4ad70a06eed

                      SHA512

                      c9332b1e8a1d6b06ad824c52b3ade136c9d04d0e9a7edf92e34add8066850f6f714f1160ba99461e3b86e40ba9abb25966b446112a62cde8267fa8ba4338cc0b

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\ida64.dll

                      Filesize

                      4.7MB

                      MD5

                      69551df3a8a4660f913670905a548475

                      SHA1

                      a089c76c505a27412e2322005b99efb37ba065bc

                      SHA256

                      8ce8bd089e049c8c3dec2c7da0bd9af47aeb1ffe4c93192698a3234c3b02c2e9

                      SHA512

                      ca59a5960e5f9c37e03e0a5659e84b49c60672634dbe957c78af730a23727dc5ad3830df27dd1aafb4d58ce648a57d195b2c9b135f1cb6501acb72a83f7acbb3

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\ida64.exe

                      Filesize

                      4.0MB

                      MD5

                      23fe02467fb05b85cc78bcaaf1b015da

                      SHA1

                      79399bce20c07e0845197f4b5ef3d2a2d780ef6a

                      SHA256

                      c695b8de0b3cb3b152890625ec3e0495bad2cd1b257c89de3169b35e3d67b44c

                      SHA512

                      cb38da2a0366c73ddcac2a7024d302b80ecb36e5d4dea4a161e468e989e94b8db31cef8326a6a4837a7e3ff59808bd90829311431007aa93b5a521490a1b1c63

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\idc\idc.idc

                      Filesize

                      303KB

                      MD5

                      7a35fe7e93d9326b7274cdf5785bf301

                      SHA1

                      050b1f071db96d544b84be5f1eb068cca02b3928

                      SHA256

                      477f87e0736cab14a40c15c4315cd7d01a2cd94cf497729ad58f8e857932077a

                      SHA512

                      a785284dbc0185135d3987ef7c3fc7f5cf940acaf578c85f8e01f11436895c296458adc95dd926404958fb6f75ab0556b601c43a13a99b7727d3dac1d0afce71

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\arm_mac_stub64.dll

                      Filesize

                      177KB

                      MD5

                      2f24e118c31576d35869a81f60e59535

                      SHA1

                      ad98a09729a8dba6ca98c5faeeaade8503c156d6

                      SHA256

                      01aee797cecaaf0ed0db8494de0676c24213364281efaf7371fda06757156308

                      SHA512

                      223d07a783e7c67ab9196557e2b599fa48e37767f5b0eba98f68a90b0d0e9fa26e0f13bd31a135a4482f40bb8d1f1cd03e4061f22d570a49ae45cb4eefe1c26c

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\armlinux_stub64.dll

                      Filesize

                      130KB

                      MD5

                      bbd4fc0158e35417ee1f78c1e12700bf

                      SHA1

                      f1fd4f5b58f49e09bb17339db33784aaef1fe3bb

                      SHA256

                      6e54a71a5bede53c4962c6b8b83da631ef869360acbbc6297af40729c285e7d4

                      SHA512

                      9be8a400cbdefec6dc70430b47462eeef3db588d16a70e2a2e7dc37558ebb5c98264b1a7c97885c309ebd5a364d570c55d0678d1c3165c2bcfc47f0517c46ef4

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\bdescr64.dll

                      Filesize

                      20KB

                      MD5

                      6e2c9591ad675cc8e4c4ecec88585318

                      SHA1

                      b280878bbc204abb6ba65496d094596d62c2edce

                      SHA256

                      d2f2975ee507b2280dc44e94ff25363d609a6fcec8807bc93d960e75dfd1b995

                      SHA512

                      f7de2ef65795368c4a70eff8fbd2ba330da2c62d0f645fc79ccf6ed528435756d2ef3d8f13c9e1423b150447283988b639a2df89491517cb1b174751e284128f

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\bindiff8_ida64.dll

                      Filesize

                      3.3MB

                      MD5

                      73ded7ffc06f31f4d0add31571557c98

                      SHA1

                      a646013423b8aa07251b207dd6f704327c8b7385

                      SHA256

                      9e3bf772f5f0a2f6eac4213d93b55e94bbe9a0d180eeab9e9610a93161498d37

                      SHA512

                      11d2029a9c6973c95d9b4e0f8767ba5533623a5986c51489758fa2f348d3fa283ff3d3e11d30ac825ae0bacf1c27271b2dbbd4240d6dea1e6d3c051d2ab5732a

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\binexport12_ida64.dll

                      Filesize

                      2.0MB

                      MD5

                      50ac9ff64204834bf5d771776e628b52

                      SHA1

                      541305187bb7bb3b0d3effd1453e4ad64587ed84

                      SHA256

                      e3d9cd7b9c6158f9c923db761fba03b2cc789372f699830180cc8151ba606561

                      SHA512

                      def6febac28b663691ddcf4faa9c676e4f3b24e0974febf2eaa740d41782e8fc476b2371768f68346dc5dcbbfe124064e6d4cdde009458c54762d5ba39eee60b

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\bochs_user64.dll

                      Filesize

                      299KB

                      MD5

                      e443470236794b8f9dd453d625df1513

                      SHA1

                      1058b03ef229f50ca766622ef667869eb4df9242

                      SHA256

                      519daf3c9e61f9f558551568eda3855e8a797f931c70eb3424da1e38e59f0ac3

                      SHA512

                      68b5c96c9e964e179256ab5ef438072688cbd748769362374669b316ef1c2247de1752763ecd84061a942c0abe59d2c04fa87ec64f78f0dc51f5488cbf268580

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\callee64.dll

                      Filesize

                      12KB

                      MD5

                      6bcba2ec458894f0e70fb2463229f02b

                      SHA1

                      74f045bae2b4dea027a0d7ff418776bf616fc247

                      SHA256

                      aea8a36cf29a2ac986d5dfcf2d6d34fd31c503079c94fee11082dcd75c8991a7

                      SHA512

                      719f8b396baf5abda4e9e486beae6279e00636364a18e23ad8e4f3e8eba927c663bf3dc8cba6abcc8cd15e2fadca5d1b618ac4a86fc45a0134a1d33e49a2d358

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\comhelper64.dll

                      Filesize

                      25KB

                      MD5

                      474c457220078356a8599f6d00846154

                      SHA1

                      095dbced2fc4acf371bd9c1180a504c705a6013a

                      SHA256

                      2841e224c0096f3ec4ee642d2e8e2a9edd06e2acd06d12329340e7126eb062b0

                      SHA512

                      14483d4fc2847615998ab88c1c5b1351555d823f4065bdd392bba4b738a90dea7f0c68552161cc796601c3176d3972cfb067eee8fbc33e9ca698f885328a4afc

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\dalvik_user64.dll

                      Filesize

                      318KB

                      MD5

                      c6325d285b404efd9c2cf33f1296e5d6

                      SHA1

                      9b32fbda552e32d8ecb3b0fe4fd31351c5057cf7

                      SHA256

                      075d0980ff735a21788d897ac1b83df9d0f217d148dd58b4a0b43be011b80813

                      SHA512

                      fb6598e75946eb84a89b5eeb5bce0a4d8720c374ba6f4113665771aa9c3c52c04798e2f5084d4418532cb6a43c02f36cb405f67a6bc943d7b65afdfe783869ad

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\dbg64.dll

                      Filesize

                      64KB

                      MD5

                      97c1adb970a49bfc88610f3d8a368f59

                      SHA1

                      8e9637acd5c92ab1dc7e719ef68d2c4a3e98c10b

                      SHA256

                      15e1ad0e44e053f546fe9d2da2ac90eedf0fccbf4bbc401dc33cccf58c7ca651

                      SHA512

                      61198817f8e5255d01951c6671e194199f2a5c82eed988a175ac31a7f1e6a3f673556b38540610ae74203475340a349852e5099a8fd321a818e680a12d4594a3

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\dscu64.dll

                      Filesize

                      88KB

                      MD5

                      5c49a3b0b0afdaffcf7199ae0718e690

                      SHA1

                      285295513989f2c35ca4da8d1194f87b6e5c4a33

                      SHA256

                      cc0233b19f6e12f09c73d1c079184d713b1dcbe97de024887b944a1eebd174db

                      SHA512

                      c5c76c1a4629deb8c67f12d9d92cc0c1c78ec952e3b429f2fda95dc412d4f448ba606b94402e42f84006f09ec66e14020a53845c8da0654502681179e7356af5

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\dwarf64.dll

                      Filesize

                      548KB

                      MD5

                      50861c8892d58f9a9a5fd67f1de44ca4

                      SHA1

                      8817cb52146f0f4829c05c5d332e5cacf503b027

                      SHA256

                      39c2b63000eb5a36ecdfddfb4cfd896437afe3fab754d5eb0787ea0754ee7202

                      SHA512

                      36c2e4c04bee7fd16c437ec338b6a790e3b35be4c0836925d57a924068f747a65545530a24677b7e9c4275012c17072001a95213c6f03ba291d564be3f8bd98e

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\eh_parse64.dll

                      Filesize

                      135KB

                      MD5

                      97a05a036270dc5a725159855335fde4

                      SHA1

                      d88b6b4cf620ef115cb114399224508f0df78293

                      SHA256

                      473af36dfadca688a7b3be8bbb566d04446c4b3d8a4faa6c43e452738843b251

                      SHA512

                      3dd26e3d1627ddd2c3eab991201711a066b780bf55967e0d2136290285ae98314c232ce4fd15d8ae5e3dc00e9f874f0668d606a06861c3b7410a1e6ca5d059e6

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\gdb_user64.dll

                      Filesize

                      277KB

                      MD5

                      9dbb935748d843f8c65dd1cc2fb4d800

                      SHA1

                      4191d51ed094ea937078627dcd0840d4f2057115

                      SHA256

                      26c4cf041ab8f621e47901906d11fe46e8ebdb756c29406af857685f04d2ab20

                      SHA512

                      8b35fe418b9f59a60ac50372a7bc8b78930837048914578ff667b5e425243d4afa07a7d3d3f1a8c3fb5ed550b5fdfb267da87374d79b29bdf3ef57a1ad26a7f8

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\iconengines\qsvgicon.dll

                      Filesize

                      35KB

                      MD5

                      ed973fa567bc9c2b14ce5be86679f08b

                      SHA1

                      31f66ade30fddb3be4bed51bec2358f52acedd03

                      SHA256

                      2766cf3d89a52b10b8b3432b3a0b991a9a4b36a127bf00ee7cde995a50c46fb0

                      SHA512

                      4392c9d8a941e7a4d99f76a7f4572da43808141e57c3cc09df32740c6cd947e58de74a2db8b2ce9923b11ffa961fa1eb792b830ada5d797ae0ea7e746668fda1

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\idapython3_64.dll

                      Filesize

                      108KB

                      MD5

                      14a7175bfd847c4ebc8433722cd069d8

                      SHA1

                      c9d3f7b5b392aa18ceaa24bc08a6543cedad63dd

                      SHA256

                      71825fa1b53312d6d5a49a1c4aeea4983315850786bf85653a618e70d1336d38

                      SHA512

                      b8cd1e8fdef040a99a9eb27a2bf9abd218063f323653b9038aeeddfa8aaa00ec2c821435fdea9e81dbcb27563a1becc2dbff055435cfab531c5653b870e9944a

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\imageformats\qgif.dll

                      Filesize

                      32KB

                      MD5

                      69c91874901919939fd596b09ca4885c

                      SHA1

                      5d328548b7457d4a60ebfa0b1baefacded626db3

                      SHA256

                      2580357f70041ba91a0da045e74bba8909bb1bbcd85e65c941bdc0ea38176bba

                      SHA512

                      7ede554c246d000e7e3a793cfb4319c9877d9e3a49eff81ca47e44df4f3ffa120ac7a34b15c8e4fe1229616934cb1042e621f53ce5016b36567be4c8ab6af153

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\imageformats\qjpeg.dll

                      Filesize

                      405KB

                      MD5

                      2755b62dcd497e2b2caea16e49c231b4

                      SHA1

                      930d1432c58ea717d058369a63f4e49998af8b29

                      SHA256

                      ac85edeacd9d45beb81101c47120c3828d8d62b5d19dbda926466efc18e14261

                      SHA512

                      1df860d2a95e205f916c0005405cebac3b9c779abb7e748688ec14cd21cc2e49e31db46d53b03c131b9d1ba687de77d1876a5044ba4e4b80a875ce4d3e48d5ec

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\imageformats\qsvg.dll

                      Filesize

                      25KB

                      MD5

                      10be44153141b7f342a98371464e9327

                      SHA1

                      6d2b21d0a28382d85a1872ca964c0693a3caff0d

                      SHA256

                      9cc9cfb7db2cbd70e199c32456186e7ded266fe30e450207387494101a44a99b

                      SHA512

                      05c615b9866c63bf56270e844f83d0feb6483b38bdb1f6ad0b3f56070c6b29a118bf78711f9256d3b1c5ee20292d88332f00b89ec9a6e943ba2c80f108385f63

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\platforms\qwindows.dll

                      Filesize

                      1.4MB

                      MD5

                      d806c1f1e1ae1f2a4481d15d57035d19

                      SHA1

                      bd3b915558020550736946de5c06cb635a706a0c

                      SHA256

                      49f621f2e5a8b3907099ec0ecc65f3519a5105b8446d7ac451a0ad7359fb7d22

                      SHA512

                      8df43f5da8dbf6961b2f592e2a1fb2b5ee279b44129a6f732e932d00e41eb7ffd083e5013a33860a791a769282011d23e86196e0a85a207b46afe2d7ed07a341

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\plugins.cfg

                      Filesize

                      4KB

                      MD5

                      f69ec7d00578dbce648edbbfdb4f296b

                      SHA1

                      cafa50ea8ce972e3772876c19aacdc81ab42720e

                      SHA256

                      421e951db259414aa04704972c14eebdadbbb3309d21c6cc72c00d7da3ba4aa5

                      SHA512

                      e91ad97977307341049dba1dea8ee1c9370224a702792def65cf7864d273b193739ae13f519bea35879c31d1ff769279fd2aeebc3c891e2470d0c7c913b14855

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\plugins\styles\qwindowsvistastyle.dll

                      Filesize

                      136KB

                      MD5

                      32e85e3303bb5675747fef26fc744089

                      SHA1

                      f5b5a1c9834a244ca73368c3ffda1e7aeed1dd04

                      SHA256

                      b7bb8a6ce946cd9fd74644aac3152ee8130875201ff174662a7f5fc28d1588ef

                      SHA512

                      413c5cec9a198bc43769fa33da7843ebfa4e73d676132d08c8ba076c37477c2c4cdb2cf2ef73905bb805d5348577e61187bae6ef61227c104703f00a193e99f0

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\qt.conf

                      Filesize

                      212B

                      MD5

                      b94a2770e638de7b863b8edf907e9b1b

                      SHA1

                      7ffa722fc4db9b413f9a2364ce8dfd4afcf678de

                      SHA256

                      2b946593df3a65ab7d2bc4d5ab26606a829260de2b2441299e1bbcebc33f4722

                      SHA512

                      fad27a4cf44b45e39fa2d03a5fd9ebb8c4119ee00d3d0b58cc712492a3b5d1fac31cfd02480b7e2249eddb9a3cf873c1fa84c531242d00266df69e7dcd15fa44

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\themes\_base\theme.css

                      Filesize

                      35KB

                      MD5

                      acc0c5c4213f7c376fd4fd82006882bf

                      SHA1

                      329edc4045a01381d7dc3f3c90304e130c5322d7

                      SHA256

                      6d673709dc4abfd2c1c6699213d55c521bc91420e420789e0e3672071e9195ab

                      SHA512

                      4147d570a14c055240d43adda9858c285077e00660b7d06548c12f4983c773ec23bf69b36ff88986ad63d1d403f19ec51d9c8ae22c88b544d3503433d17542e1

                    • C:\Users\Admin\Desktop\IDA Pro 8.3\themes\default\theme.css

                      Filesize

                      9KB

                      MD5

                      d9d5e3099c39b18ba9b60093ca2c0f02

                      SHA1

                      fb37de4a3302550acf8fc300dcb6e8914d1e24ee

                      SHA256

                      c7c0c39c5bb03d6689cbb4067787cb59327d2c065c736bde7eebd14ca2ed95a4

                      SHA512

                      a744442c01302727d4216e4176d29fb01a30e9efcdc9cd67b98bee280e069a6822894ec2ffc9a8a0efcf8e2373ed329043c73c0222979539ef634251f46c4c29

                    • C:\Users\Admin\Downloads\AppNee.FLnq8Wkd.com.IDA.Pro.v8.3.PFR.SDK.7z.part

                      Filesize

                      427.0MB

                      MD5

                      3c3dc5d69f703e9d84424075b3907ef3

                      SHA1

                      cdae8781b0b7fb350a69afc5873a588a99fc06fe

                      SHA256

                      ae2736ff68fe8e91a0d263f0f1d810f435969a4f35124f0f0e0505c94ae02c49

                      SHA512

                      083ebf8ebce5439c5988d4a6e5e8f09be0232c48f91c0ecfcf1515074f87f909e4f818d041dff05bc0f845c83864bd52ba0310a3d3e8ae302455a48a23fcf1d1

                    • memory/7840-2922-0x00007FFE56BF0000-0x00007FFE57148000-memory.dmp

                      Filesize

                      5.3MB

                    • memory/7840-2921-0x00007FF6DA8C0000-0x00007FF6DACC2000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/7840-2923-0x00007FF6DA8C0000-0x00007FF6DACC2000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/7840-2975-0x00007FFE39CB0000-0x00007FFE39CC0000-memory.dmp

                      Filesize

                      64KB