6287c1d00f8e1777bd47c273c7dea2438321a5147aa0b9d722a8671718701cc0

Resubmissions

18-05-2024 04:34

240518-e647raca7y 10

18-05-2024 03:15

240518-dr9cgshf31 10

18-05-2024 02:50

240518-db116sgh24 10

Analysis

max time kernel
253s
max time network
229s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IDA Pro 8.3.230608 (Windows) (x86,x64).7z
Size

318.7MB
MD5

211af170bc614586b519f84016371947
SHA1

360c884543126771156d1350d1cc49fb10d2ef34
SHA256

6287c1d00f8e1777bd47c273c7dea2438321a5147aa0b9d722a8671718701cc0
SHA512

1145cbb8be6979a083d28593c99dd43d48a1506e576304a2eb19dd4f0cdf86e442cc97b5560d46f22cfbf707e713b2fd097830fab117258554f19ee2add5e821
SSDEEP

6291456:nrGwUH5LKNEc1OcBQHItZlEA63n4kPqJOrjkXkAJHnT8EepsclNjd/b:n/UH5LKivSQQEAaHqJOrIJxngEe+i

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

ida64.exeida.exeida.exe

pid process

272 ida64.exe
912 ida.exe
2588 ida.exe

pid	process
272	ida64.exe
912	ida.exe
2588	ida.exe

Loads dropped DLL 64 IoCs

Processes:

ida64.exeida.exe

pid	process
1152
1152
1152
1152
1152
1152
1152
1152
1152
1152
272	ida64.exe
272	ida64.exe
272	ida64.exe
272	ida64.exe
272	ida64.exe
272	ida64.exe
272	ida64.exe
272	ida64.exe
272	ida64.exe
272	ida64.exe
272	ida64.exe
1152
1152
1152
1152
1152
1152
1152
1152
1152
1152
1152
1152
1152
1152
1152
1152
1152
1152
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe
912	ida.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 43 IoCs

Processes:

ida.exeida.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	ida.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	ida.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	ida.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ida.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	ida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	ida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ida.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	ida.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ida.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	ida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	ida.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ida.exe

Opens file in notepad (likely ransom note) 2 IoCs
ransomware

Processes:

NOTEPAD.EXENOTEPAD.EXE

pid process

1276 NOTEPAD.EXE
2076 NOTEPAD.EXE
Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

ida64.exeida.exeida.exe

pid process

272 ida64.exe
912 ida.exe
2588 ida.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

ida.exeida.exe

pid process

912 ida.exe
912 ida.exe
2588 ida.exe
Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

7zFM.exeida.exeida.exe

pid process

2524 7zFM.exe
912 ida.exe
2588 ida.exe

pid	process
1276	NOTEPAD.EXE
2076	NOTEPAD.EXE

pid	process
272	ida64.exe
912	ida.exe
2588	ida.exe

pid	process
912	ida.exe
912	ida.exe
2588	ida.exe

pid	process
2524	7zFM.exe
912	ida.exe
2588	ida.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zFM.exeida.exe

description	pid	process
Token: SeRestorePrivilege	2524	7zFM.exe
Token: 35	2524	7zFM.exe
Token: SeSecurityPrivilege	2524	7zFM.exe
Token: SeDebugPrivilege	912	ida.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zFM.exe

pid process

2524 7zFM.exe
2524 7zFM.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

ida64.exeida.exeida.exe

pid process

272 ida64.exe
912 ida.exe
912 ida.exe
2588 ida.exe
2588 ida.exe

pid	process
2524	7zFM.exe
2524	7zFM.exe

pid	process
272	ida64.exe
912	ida.exe
912	ida.exe
2588	ida.exe
2588	ida.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2040 wrote to memory of 2524	2040	cmd.exe	7zFM.exe
PID 2040 wrote to memory of 2524	2040	cmd.exe	7zFM.exe
PID 2040 wrote to memory of 2524	2040	cmd.exe	7zFM.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\IDA Pro 8.3.230608 (Windows) (x86,x64).7z"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\IDA Pro 8.3.230608 (Windows) (x86,x64).7z"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2524

C:\Users\Admin\Desktop\IDA\ida64.exe
"C:\Users\Admin\Desktop\IDA\ida64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:272

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\cracked\idacfg.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:2076

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\cracked\idacfg.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:1276

C:\Users\Admin\Desktop\IDA\ida.exe
"C:\Users\Admin\Desktop\IDA\ida.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:912

C:\Users\Admin\Desktop\IDA\ida.exe
"C:\Users\Admin\Desktop\IDA\ida.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zECD989516\IDA\python\3\PyQt5\python_3.12\sip.pyi

Filesize
2KB

MD5
659c59af4841ab542bc5ae43abe187c9

SHA1
838206246c95a4b673408c78fc6b294246d53913

SHA256
618cdf56d2935c762f32b9c73e5e998ddc471f5f70c4c5a980dc22386e898279

SHA512
e88d5cba70a86aee598d14305eb92baa9f22ba3f0c06ef108334f663413ab54c8a6dd9e57b13a31834a8e80cb86e455a97bfa806a1697ea39a639dca79be4aa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zECD989516\IDA\python\3\PyQt5\uic\port_v2\__init__.py

Filesize
548B

MD5
71014d6369472d3184315f736d945afc

SHA1
375858f197d1403c191670a3151ea51329ee75cd

SHA256
32bd356bf7687853a140d02a5c9df551bce86656ea6cc587161887be57dc0edc

SHA512
be351c9c6ddbfc23dc0bc1791321c066d250ade7ecb393e4b17ea9357810db368065ef601e7d469031cdac710bda8e824d55c7a32403d269084aed93ee4f9e6d

Download Submit
C:\Users\Admin\Desktop\IDA\Qt5Widgets.dll

Filesize
5.3MB

MD5
8b786869feb36930f8d6fd7be98ced2c

SHA1
f6fc979919df931af8fbeae54eff502663b2793c

SHA256
af337b316a39107944bdeb117798fd8ce02c3307fb415a371b6bc431d470a3e5

SHA512
9eaa2390abcceb7d69958be99c75dfd60edc464ea8018d3657a39846f40ecd6c6e48bfd750c48264047cff82b6aec398f63df5f70f0c95484a052913e845384a

Download Submit
C:\Users\Admin\Desktop\IDA\ida.hlp

Filesize
932KB

MD5
024b0555d7a5740272ee805b0f32ea8a

SHA1
c48488c4e525f9f8a2a1cfa1cbab42698c1c67a5

SHA256
2291a8037a0ebba9b9f63b34af0d4cc43402a0cacdcc3cab27d83bb3ddc6025f

SHA512
3d4c4ec4c2c851b353d4f17f102c1e8ee22b93822c99655d94ffa781572de58ab5253c638e116924816b85ab55f473f17b2a85cbf2ce159278033dec9840047f

Download Submit
C:\Users\Admin\Desktop\IDA\idc\idc.idc

Filesize
303KB

MD5
7a35fe7e93d9326b7274cdf5785bf301

SHA1
050b1f071db96d544b84be5f1eb068cca02b3928

SHA256
477f87e0736cab14a40c15c4315cd7d01a2cd94cf497729ad58f8e857932077a

SHA512
a785284dbc0185135d3987ef7c3fc7f5cf940acaf578c85f8e01f11436895c296458adc95dd926404958fb6f75ab0556b601c43a13a99b7727d3dac1d0afce71

Download Submit
C:\Users\Admin\Desktop\IDA\plugins\iconengines\qsvgicon.dll

Filesize
35KB

MD5
ed973fa567bc9c2b14ce5be86679f08b

SHA1
31f66ade30fddb3be4bed51bec2358f52acedd03

SHA256
2766cf3d89a52b10b8b3432b3a0b991a9a4b36a127bf00ee7cde995a50c46fb0

SHA512
4392c9d8a941e7a4d99f76a7f4572da43808141e57c3cc09df32740c6cd947e58de74a2db8b2ce9923b11ffa961fa1eb792b830ada5d797ae0ea7e746668fda1

Download Submit
C:\Users\Admin\Desktop\IDA\plugins\styles\qwindowsvistastyle.dll

Filesize
136KB

MD5
32e85e3303bb5675747fef26fc744089

SHA1
f5b5a1c9834a244ca73368c3ffda1e7aeed1dd04

SHA256
b7bb8a6ce946cd9fd74644aac3152ee8130875201ff174662a7f5fc28d1588ef

SHA512
413c5cec9a198bc43769fa33da7843ebfa4e73d676132d08c8ba076c37477c2c4cdb2cf2ef73905bb805d5348577e61187bae6ef61227c104703f00a193e99f0

Download Submit
C:\Users\Admin\Desktop\IDA\qt.conf

Filesize
212B

MD5
b94a2770e638de7b863b8edf907e9b1b

SHA1
7ffa722fc4db9b413f9a2364ce8dfd4afcf678de

SHA256
2b946593df3a65ab7d2bc4d5ab26606a829260de2b2441299e1bbcebc33f4722

SHA512
fad27a4cf44b45e39fa2d03a5fd9ebb8c4119ee00d3d0b58cc712492a3b5d1fac31cfd02480b7e2249eddb9a3cf873c1fa84c531242d00266df69e7dcd15fa44

Download Submit
C:\Users\Admin\Desktop\IDA\themes\_base\theme.css

Filesize
35KB

MD5
acc0c5c4213f7c376fd4fd82006882bf

SHA1
329edc4045a01381d7dc3f3c90304e130c5322d7

SHA256
6d673709dc4abfd2c1c6699213d55c521bc91420e420789e0e3672071e9195ab

SHA512
4147d570a14c055240d43adda9858c285077e00660b7d06548c12f4983c773ec23bf69b36ff88986ad63d1d403f19ec51d9c8ae22c88b544d3503433d17542e1

Download Submit
C:\Users\Admin\Desktop\IDA\themes\default\theme.css

Filesize
9KB

MD5
d9d5e3099c39b18ba9b60093ca2c0f02

SHA1
fb37de4a3302550acf8fc300dcb6e8914d1e24ee

SHA256
c7c0c39c5bb03d6689cbb4067787cb59327d2c065c736bde7eebd14ca2ed95a4

SHA512
a744442c01302727d4216e4176d29fb01a30e9efcdc9cd67b98bee280e069a6822894ec2ffc9a8a0efcf8e2373ed329043c73c0222979539ef634251f46c4c29

Download Submit
C:\Users\Admin\Desktop\cracked\idacfg.ini

Filesize
1KB

MD5
0c2fa0524a19dd4f624461331d0840ad

SHA1
88ed57a3bb18092543da4e5b68a0b18cb18632ca

SHA256
af0b6489255ed81adf89d2ca2b5c6ced767d5023ab0dd32d97bf7e462d04e89e

SHA512
0fbaea1566ed389b3b5b70bf988a85704b2656fc770f4b042a6a11bd1ec1c657c6a62fff13d1aa63ad9ba2edf0e89eacc544c239dcb4b5ca2fd8b14ef2f41192

Download Submit
\Users\Admin\Desktop\IDA\Qt5Core.dll

Filesize
5.9MB

MD5
fd80d43e803c146d0718b811e96ef21b

SHA1
2d53fc58d9e752b9577fe1e78ac117d9d0703469

SHA256
695307903ccc11dd4972015bebb160b7f0ba414a95e8323e5788476e69e3f83c

SHA512
01c8a7c1b5fe6d752e237837e448cde3d52888d3d3bc2185bbbdd11557b512f1175ff7c2d3260cea7c7600f6ff263c730d7149fea25f334817541782eb3c1c13

Download Submit
\Users\Admin\Desktop\IDA\Qt5Gui.dll

Filesize
6.6MB

MD5
367ada59863dde5902ac813c765c718b

SHA1
1c30b98f93d5fcb49a15ae22ac9ab1792a0cbfa4

SHA256
2b8df2fa3a3f75be898ad826e3698a562cd3cce71096ce0b0abf362be6ba57e2

SHA512
7d57df5c3a9d7de2969074a4ef59cbca6d51fa84de1bc76d5fa4e633b6aeef9f00351ea1774b67ac3565ae6c48e18f0e561487c60027326defb166f3229db057

Download Submit
\Users\Admin\Desktop\IDA\Qt5PrintSupport.dll

Filesize
309KB

MD5
4cd655f4d826e8437b0415aa6c8d6550

SHA1
7611161c774c7c72b189b420772d2c65e2634e4a

SHA256
7b105ebf20c0b52259c00ff645f95f584bbe60b91c90de583785ac88b448e26d

SHA512
82745e4139f72f6843d0f4b588c2744b60a405e398f158319ee336758c09abfbced2f0ecc4e0a6d3e535384a9cbe69f89935b11a9b5857cc8f7deec00f044c6d

Download Submit
\Users\Admin\Desktop\IDA\Qt5Svg.dll

Filesize
324KB

MD5
f3cd456d5fb9685304dbb53cc7b9ebaa

SHA1
8eadfaf8b8e8df16fba9e1dcc36d0ab3eb6c9f42

SHA256
62089b5a811c7c0cc408335dbafa0c7060cc9324c01595e011abd6ac2e868442

SHA512
03c3c24a95042b5e4337f2e093d219ebe3a3a05b8a78a8029550f1470c51b4433a60ca7d1000e238a3bfed51b6e6b112788a0663ea6618b4d052214749b4035c

Download Submit
\Users\Admin\Desktop\IDA\ida.exe

Filesize
4.0MB

MD5
05c7e465d9d88e94e064a99dc36f4ce1

SHA1
e87ccd7bcfa05a30aa283c5e5953ba368ff75bed

SHA256
d2650a12440bdc4f1b34456956221764c249060e808194b79152e9f679dd4e85

SHA512
a9af650ea3518f88c5f8d9e1d059fd039c88d70b733ccec4107f75b14b6d9489a79dffa3ff5fbd7343ebeeb0ae90d26cdac64b79da006b5cb0c25316a66aacc4

Download Submit
\Users\Admin\Desktop\IDA\ida64.dll

Filesize
4.7MB

MD5
0b3c6dfcf57281ae74f12329af23cdbc

SHA1
fb0239d88be8f5b8ba6ba8d9a31b1b3ed53ed392

SHA256
d6435627bc2668b3571f5ee1f9beb88391af4a8d88d7e1a09c4c466cb5a7bd72

SHA512
5d64819938c4bec3188c1b361b755375f9b94c8076efed9958434e3ac94eb00847fbf264129592497a3f58a1d7f445325be3f7f3fee30d919b8549c4b11a7a53

Download Submit
\Users\Admin\Desktop\IDA\ida64.exe

Filesize
4.0MB

MD5
23fe02467fb05b85cc78bcaaf1b015da

SHA1
79399bce20c07e0845197f4b5ef3d2a2d780ef6a

SHA256
c695b8de0b3cb3b152890625ec3e0495bad2cd1b257c89de3169b35e3d67b44c

SHA512
cb38da2a0366c73ddcac2a7024d302b80ecb36e5d4dea4a161e468e989e94b8db31cef8326a6a4837a7e3ff59808bd90829311431007aa93b5a521490a1b1c63

Download Submit
\Users\Admin\Desktop\IDA\plugins\imageformats\qgif.dll

Filesize
32KB

MD5
69c91874901919939fd596b09ca4885c

SHA1
5d328548b7457d4a60ebfa0b1baefacded626db3

SHA256
2580357f70041ba91a0da045e74bba8909bb1bbcd85e65c941bdc0ea38176bba

SHA512
7ede554c246d000e7e3a793cfb4319c9877d9e3a49eff81ca47e44df4f3ffa120ac7a34b15c8e4fe1229616934cb1042e621f53ce5016b36567be4c8ab6af153

Download Submit
\Users\Admin\Desktop\IDA\plugins\imageformats\qjpeg.dll

Filesize
405KB

MD5
2755b62dcd497e2b2caea16e49c231b4

SHA1
930d1432c58ea717d058369a63f4e49998af8b29

SHA256
ac85edeacd9d45beb81101c47120c3828d8d62b5d19dbda926466efc18e14261

SHA512
1df860d2a95e205f916c0005405cebac3b9c779abb7e748688ec14cd21cc2e49e31db46d53b03c131b9d1ba687de77d1876a5044ba4e4b80a875ce4d3e48d5ec

Download Submit
\Users\Admin\Desktop\IDA\plugins\imageformats\qsvg.dll

Filesize
25KB

MD5
10be44153141b7f342a98371464e9327

SHA1
6d2b21d0a28382d85a1872ca964c0693a3caff0d

SHA256
9cc9cfb7db2cbd70e199c32456186e7ded266fe30e450207387494101a44a99b

SHA512
05c615b9866c63bf56270e844f83d0feb6483b38bdb1f6ad0b3f56070c6b29a118bf78711f9256d3b1c5ee20292d88332f00b89ec9a6e943ba2c80f108385f63

Download Submit
\Users\Admin\Desktop\IDA\plugins\platforms\qwindows.dll

Filesize
1.4MB

MD5
d806c1f1e1ae1f2a4481d15d57035d19

SHA1
bd3b915558020550736946de5c06cb635a706a0c

SHA256
49f621f2e5a8b3907099ec0ecc65f3519a5105b8446d7ac451a0ad7359fb7d22

SHA512
8df43f5da8dbf6961b2f592e2a1fb2b5ee279b44129a6f732e932d00e41eb7ffd083e5013a33860a791a769282011d23e86196e0a85a207b46afe2d7ed07a341

Download Submit
\Users\Admin\Desktop\cracked\secur32.dll

Filesize
30KB

MD5
95db8555c8644d80506e6b44996cd4e5

SHA1
08110eeb9e1af3080ac80dd98f0ea11ea0d91bd2

SHA256
c0a620b2315fbd91c2f53aac5097bdaf06eb3f1a01b654103956154538d8bdc0

SHA512
0bbb9a555fdbde272886753cec5b4598f9ceb9b1787f2b06adfa9add04a98ff84d0b8dc7dc50ebb085704d5338ae7562e8e3c14d6d5bbbe23ad2ac776eab5dd1

Download Submit
memory/272-2798-0x0000000005240000-0x000000000524A000-memory.dmp

Filesize
40KB

Download
memory/272-2799-0x0000000005240000-0x000000000524A000-memory.dmp

Filesize
40KB

Download
memory/272-2778-0x000000013FF30000-0x0000000140332000-memory.dmp

Filesize
4.0MB

Download
memory/272-2775-0x000007FEF5F70000-0x000007FEF64C8000-memory.dmp

Filesize
5.3MB

Download
memory/912-2842-0x00000000040E0000-0x000000000410B000-memory.dmp

Filesize
172KB

Download
memory/912-2852-0x00000000081A0000-0x00000000082C6000-memory.dmp

Filesize
1.1MB

Download
memory/912-2829-0x00000000040E0000-0x0000000004170000-memory.dmp

Filesize
576KB

Download
memory/912-2832-0x00000000040E0000-0x0000000004106000-memory.dmp

Filesize
152KB

Download
memory/912-2831-0x00000000040E0000-0x000000000412A000-memory.dmp

Filesize
296KB

Download
memory/912-2834-0x00000000040E0000-0x000000000413C000-memory.dmp

Filesize
368KB

Download
memory/912-2843-0x00000000040E0000-0x000000000410F000-memory.dmp

Filesize
188KB

Download
memory/912-2845-0x00000000040E0000-0x00000000040EA000-memory.dmp

Filesize
40KB

Download
memory/912-2844-0x00000000040E0000-0x00000000040EA000-memory.dmp

Filesize
40KB

Download
memory/912-2824-0x000007FEF5050000-0x000007FEF55A8000-memory.dmp

Filesize
5.3MB

Download
memory/912-2841-0x00000000040E0000-0x0000000004107000-memory.dmp

Filesize
156KB

Download
memory/912-2840-0x00000000040E0000-0x0000000004102000-memory.dmp

Filesize
136KB

Download
memory/912-2839-0x00000000040E0000-0x0000000004107000-memory.dmp

Filesize
156KB

Download
memory/912-2838-0x00000000040E0000-0x000000000414F000-memory.dmp

Filesize
444KB

Download
memory/912-2837-0x00000000040E0000-0x000000000410C000-memory.dmp

Filesize
176KB

Download
memory/912-2836-0x00000000040E0000-0x0000000004110000-memory.dmp

Filesize
192KB

Download
memory/912-2835-0x00000000040E0000-0x0000000004104000-memory.dmp

Filesize
144KB

Download
memory/912-2833-0x00000000040E0000-0x00000000040FF000-memory.dmp

Filesize
124KB

Download
memory/912-2830-0x00000000040E0000-0x0000000004104000-memory.dmp

Filesize
144KB

Download
memory/912-2828-0x00000000040E0000-0x0000000004133000-memory.dmp

Filesize
332KB

Download
memory/912-2827-0x00000000040E0000-0x000000000412E000-memory.dmp

Filesize
312KB

Download
memory/912-2826-0x00000000040E0000-0x0000000004105000-memory.dmp

Filesize
148KB

Download
memory/912-2846-0x00000000089E0000-0x00000000089F0000-memory.dmp

Filesize
64KB

Download
memory/912-2825-0x000000013F520000-0x000000013F920000-memory.dmp

Filesize
4.0MB

Download
memory/912-2854-0x00000000081A0000-0x00000000082AA000-memory.dmp

Filesize
1.0MB

Download
memory/912-2864-0x0000000004F60000-0x0000000004F76000-memory.dmp

Filesize
88KB

Download
memory/912-2865-0x00000000040E0000-0x00000000040E2000-memory.dmp

Filesize
8KB

Download
memory/2588-2884-0x0000000005260000-0x000000000526A000-memory.dmp

Filesize
40KB

Download
memory/2588-2870-0x0000000005260000-0x00000000052AE000-memory.dmp

Filesize
312KB

Download
memory/2588-2874-0x0000000005260000-0x00000000052AA000-memory.dmp

Filesize
296KB

Download
memory/2588-2873-0x0000000005260000-0x0000000005284000-memory.dmp

Filesize
144KB

Download
memory/2588-2877-0x0000000005260000-0x0000000005284000-memory.dmp

Filesize
144KB

Download
memory/2588-2872-0x0000000005260000-0x0000000005279000-memory.dmp

Filesize
100KB

Download
memory/2588-2871-0x0000000005260000-0x0000000005274000-memory.dmp

Filesize
80KB

Download
memory/2588-2866-0x000007FEF49B0000-0x000007FEF4F08000-memory.dmp

Filesize
5.3MB

Download
memory/2588-2868-0x0000000005260000-0x000000000527F000-memory.dmp

Filesize
124KB

Download
memory/2588-2867-0x000000013F4A0000-0x000000013F8A0000-memory.dmp

Filesize
4.0MB

Download
memory/2588-2883-0x0000000005260000-0x000000000528F000-memory.dmp

Filesize
188KB

Download
memory/2588-2881-0x0000000005260000-0x0000000005287000-memory.dmp

Filesize
156KB

Download
memory/2588-2880-0x0000000005260000-0x0000000005279000-memory.dmp

Filesize
100KB

Download
memory/2588-2879-0x0000000005260000-0x0000000005287000-memory.dmp

Filesize
156KB

Download
memory/2588-2878-0x0000000005260000-0x0000000005290000-memory.dmp

Filesize
192KB

Download
memory/2588-2876-0x0000000005260000-0x00000000052BC000-memory.dmp

Filesize
368KB

Download
memory/2588-2875-0x0000000005260000-0x0000000005280000-memory.dmp

Filesize
128KB

Download
memory/2588-2885-0x0000000005260000-0x000000000526A000-memory.dmp

Filesize
40KB

Download
memory/2588-2869-0x0000000005260000-0x0000000005285000-memory.dmp

Filesize
148KB

Download
memory/2588-2882-0x0000000005260000-0x000000000528B000-memory.dmp

Filesize
172KB

Download