d9fa3220f922c5bc96ab7d2a3959af8af4c490a148a3d1779fb99fa3b4b910cb

Analysis

max time kernel
324s
max time network
370s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
27-07-2024 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IDA830.rar
Size

386.9MB
MD5

a759459c5c78fcb00420b2aeca7d408a
SHA1

ed79cda10d56d0517323c7b9fc9337408cf67bba
SHA256

d9fa3220f922c5bc96ab7d2a3959af8af4c490a148a3d1779fb99fa3b4b910cb
SHA512

7717f5d95a1dc49dce8a29a03bb003ca92516c6de84a9339aba9012af43646fd6d496376b173fc75cf349d56acd587fe332a0e768808e629b345faf5544e696e
SSDEEP

6291456:5YynX9PFbTmlM6GjFYmNjReTMskyMxqmMvxQv4H5gWKQOgf4GnvfCQLBZlJ5:5YaX5FbT8GjFYC9aMsUqfZQSvvtCQtj

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
5156	winrar-x64-701.exe
2180	winrar-x64-701.exe
5940	7z2407-x64.exe
4568	7zFM.exe
1196	ida.exe
4264	ida64.exe

Loads dropped DLL 64 IoCs

pid	Process
4568	7zFM.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe
1196	ida.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2407-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2407-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2407-x64.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2407-x64.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2407-x64.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	ida.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2407-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Generic"	ida.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2407-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Applications\7zFM.exe	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2407-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	ida64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2407-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Applications\7zFM.exe\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	ida64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2407-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 54003100000000003d58ad1e100049444138333000003e0009000400efbefb581abdfb5822bd2e0000005bab0200000002000000000000000000000000000000d6266800490044004100380033003000000016000000	ida.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	ida.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	ida.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	ida64.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	ida64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	ida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ida64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	ida64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	ida64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ida64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2407-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	ida.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	ida64.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	ida.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Generic"	ida64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0 = 5000310000000000fb5811bd1000372d5a6970003c0009000400efbee9583087fb5811bd2e0000000a9d0200000005000000000000000000000000000000fea5470037002d005a0069007000000014000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "8"	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	ida.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	ida64.exe
Key created	\REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2407-x64.exe:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1196	ida.exe
4264	ida64.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
4844	OpenWith.exe
4568	7zFM.exe
1196	ida.exe
4264	ida64.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1592	firefox.exe
Token: SeDebugPrivilege	1592	firefox.exe
Token: SeDebugPrivilege	1592	firefox.exe
Token: SeDebugPrivilege	1592	firefox.exe
Token: SeDebugPrivilege	1592	firefox.exe
Token: SeDebugPrivilege	5940	7z2407-x64.exe
Token: SeDebugPrivilege	5940	7z2407-x64.exe
Token: SeDebugPrivilege	5940	7z2407-x64.exe
Token: SeDebugPrivilege	5940	7z2407-x64.exe
Token: SeDebugPrivilege	5940	7z2407-x64.exe
Token: SeRestorePrivilege	4568	7zFM.exe
Token: 35	4568	7zFM.exe
Token: SeSecurityPrivilege	4568	7zFM.exe
Token: 33	6260	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6260	AUDIODG.EXE
Token: SeDebugPrivilege	1592	firefox.exe
Token: SeDebugPrivilege	1196	ida.exe
Token: SeDebugPrivilege	4264	ida64.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
4568	7zFM.exe
4568	7zFM.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe

Suspicious use of SetWindowsHookEx 45 IoCs

pid	Process
2056	OpenWith.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
5156	winrar-x64-701.exe
5156	winrar-x64-701.exe
5156	winrar-x64-701.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
2180	winrar-x64-701.exe
2180	winrar-x64-701.exe
2180	winrar-x64-701.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
5940	7z2407-x64.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
1196	ida.exe
1196	ida.exe
4264	ida64.exe
4264	ida64.exe
4264	ida64.exe
4264	ida64.exe
4264	ida64.exe
4264	ida64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1592	3020	firefox.exe	85
PID 3020 wrote to memory of 1592	3020	firefox.exe	85
PID 3020 wrote to memory of 1592	3020	firefox.exe	85
PID 3020 wrote to memory of 1592	3020	firefox.exe	85
PID 3020 wrote to memory of 1592	3020	firefox.exe	85
PID 3020 wrote to memory of 1592	3020	firefox.exe	85
PID 3020 wrote to memory of 1592	3020	firefox.exe	85
PID 3020 wrote to memory of 1592	3020	firefox.exe	85
PID 3020 wrote to memory of 1592	3020	firefox.exe	85
PID 3020 wrote to memory of 1592	3020	firefox.exe	85
PID 3020 wrote to memory of 1592	3020	firefox.exe	85
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 5064	1592	firefox.exe	86
PID 1592 wrote to memory of 3412	1592	firefox.exe	87
PID 1592 wrote to memory of 3412	1592	firefox.exe	87
PID 1592 wrote to memory of 3412	1592	firefox.exe	87
PID 1592 wrote to memory of 3412	1592	firefox.exe	87
PID 1592 wrote to memory of 3412	1592	firefox.exe	87
PID 1592 wrote to memory of 3412	1592	firefox.exe	87
PID 1592 wrote to memory of 3412	1592	firefox.exe	87
PID 1592 wrote to memory of 3412	1592	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IDA830.rar
1⤵
PID:1784

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2056

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1932 -parentBuildID 20240401114208 -prefsHandle 1860 -prefMapHandle 1852 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2b3afa1-35df-480d-87af-c2d39d1300ec} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" gpu
    3⤵
    PID:5064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2332 -parentBuildID 20240401114208 -prefsHandle 2324 -prefMapHandle 2320 -prefsLen 25787 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c5c1d83-4e88-46ac-932d-bce7a23190fa} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" socket
    3⤵
    PID:3412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3656 -childID 1 -isForBrowser -prefsHandle 3664 -prefMapHandle 3152 -prefsLen 25928 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b9464da-047c-47ae-8c50-b8c25c4fb910} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" tab
    3⤵
    PID:672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4020 -childID 2 -isForBrowser -prefsHandle 4004 -prefMapHandle 4000 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bdbbb10d-cf8f-4adc-8dec-c6d46e526d4a} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" tab
    3⤵
    PID:1032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5032 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 3224 -prefMapHandle 4844 -prefsLen 29195 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3dba0f3-1b29-4e7f-87b3-0fc7e7f66ba2} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" utility
    3⤵
    - Checks processor information in registry
    PID:5460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5108 -childID 3 -isForBrowser -prefsHandle 5100 -prefMapHandle 4988 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f34f2cd6-05cc-481f-87da-6e8de3eb4bd8} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" tab
    3⤵
    PID:5488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5132 -childID 4 -isForBrowser -prefsHandle 5124 -prefMapHandle 5116 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90a459a8-34e5-4d88-ae55-5624b4f13759} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" tab
    3⤵
    PID:5500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5548 -childID 5 -isForBrowser -prefsHandle 5580 -prefMapHandle 5576 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3107a838-991f-4fc0-8c66-267d07a4f7e3} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" tab
    3⤵
    PID:5600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5836 -childID 6 -isForBrowser -prefsHandle 5996 -prefMapHandle 5992 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85b080bd-8aa9-4f2e-81d2-bbd54513a56e} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" tab
    3⤵
    PID:1204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6880 -childID 7 -isForBrowser -prefsHandle 6872 -prefMapHandle 6868 -prefsLen 28293 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d66b333a-0191-46d2-a620-68e5ad7a90d8} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" tab
    3⤵
    PID:3480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7024 -childID 8 -isForBrowser -prefsHandle 7080 -prefMapHandle 7092 -prefsLen 28293 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6a5123c-bf9e-4f6e-9573-6528c2a9faa2} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" tab
    3⤵
    PID:788
- - C:\Users\Admin\Downloads\winrar-x64-701.exe
    "C:\Users\Admin\Downloads\winrar-x64-701.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5156
- - C:\Users\Admin\Downloads\winrar-x64-701.exe
    "C:\Users\Admin\Downloads\winrar-x64-701.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6788 -childID 9 -isForBrowser -prefsHandle 6516 -prefMapHandle 6768 -prefsLen 28633 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6e360db-0bed-45a4-9601-21c4625ddc0e} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" tab
    3⤵
    PID:3556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4924 -childID 10 -isForBrowser -prefsHandle 6764 -prefMapHandle 5800 -prefsLen 28633 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e3e5919-3ef5-430d-8ec2-0a572dc379de} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" tab
    3⤵
    PID:6020
- - C:\Users\Admin\Downloads\7z2407-x64.exe
    "C:\Users\Admin\Downloads\7z2407-x64.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5940

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4792

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\6502fd3c5de544e190552aa74ff380f5 /t 3540 /p 5156
1⤵
PID:1860

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\6006da48b6ba4ad988e8d6e9f684b913 /t 6004 /p 2180
1⤵
PID:5820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4844
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\IDA830.rar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4568

C:\Users\Admin\Desktop\IDA830\ida.exe
"C:\Users\Admin\Desktop\IDA830\ida.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1196

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6260

C:\Users\Admin\Desktop\IDA830\ida64.exe
"C:\Users\Admin\Desktop\IDA830\ida64.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
0009bd5e13766d11a23289734b383cbe

SHA1
913784502be52ce33078d75b97a1c1396414cf44

SHA256
3691adcefc6da67eedd02a1b1fc7a21894afd83ecf1b6216d303ed55a5f8d129

SHA512
d92cd55fcef5b15975c741f645f9c3cc53ae7cd5dffd5d5745adecf098b9957e8ed379e50f3d0855d54598e950b2dbf79094da70d94dfd7fc40bda7163a09b2b

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
548KB

MD5
1d1b0349f970c8de7fae7a94520e21f7

SHA1
8787ce498c9f1628665dd17004676a9cc5e8f99a

SHA256
f63a2d492d7a20e7ae6ace725da0320b05a6250794c9b449e1bc48d3f63cef56

SHA512
2ff084ca8b7bd05e156fcce6faaffd861ee09e09821e8f3325093a0aec46d54481d18d61d84b35fc2c760d93aeda70648201c740fb429f6f75dbd6708774f0f2

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
960KB

MD5
79e8ca28aef2f3b1f1484430702b24e1

SHA1
76087153a547ce3f03f5b9de217c9b4b11d12f22

SHA256
5bc65256b92316f7792e27b0111e208aa6c27628a79a1dec238a4ad1cc9530f7

SHA512
b8426b44260a3adcbeaa38c5647e09a891a952774ecd3e6a1b971aef0e4c00d0f2a2def9965ee75be6c6494c3b4e3a84ce28572e376d6c82db0b53ccbbdb1438

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
691KB

MD5
ef0279a7884b9dd13a8a2b6e6f105419

SHA1
755af3328261b37426bc495c6c64bba0c18870b2

SHA256
0cee5cb3da5dc517d2283d0d5dae69e9be68f1d8d64eca65c81daef9b0b8c69b

SHA512
9376a91b8fb3f03d5a777461b1644049eccac4d77b44334d3fe292debed16b4d40601ebe9accb29b386f37eb3ccc2415b92e5cc1735bcce600618734112d6d0e

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
14KB

MD5
1ae18a5934322b0b23da7c5678e2dbec

SHA1
a1ae84c861f338e8f8c2a7c0102d8b0ef9aa6da1

SHA256
e5db8a72bd2901a877c67b3acba60f386b9d6e8d3e485372f7180fb76652b93a

SHA512
01e660e2dc2ec9d4d64c4f981804f252f77bee400eb21a43077681a2fc51bc564fd5749ea8f25a4b3da0500bbf33dd3cd27ebbe3cab96e333dbd6b57966fc151

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4i9bphnb.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
d8e7b25f3fd67dc5340bb160c70182e9

SHA1
c7d0b83263dc8a8ac1f2fc6ddf2804fb383df1dd

SHA256
2913841a7993b9be0d93d5ee3b9068d882168ebdd685f7d2a88879fd17006395

SHA512
4d820372f0c6cb7c9638e6358ea16e3aaeb74f02bffe1c7603707d14603190a781fceb7702b47255f8da1bb2dcc1ebaa9e09e8ed40884796aa11fa16923dae9b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4i9bphnb.default-release\cache2\entries\F927FB65690E87A5435ED94334FAB5AC05916CC0

Filesize
60KB

MD5
f34b18d3cbe8719783f07c363ade5535

SHA1
d204983cebc785ab2944633e87b7bcaad7f903b0

SHA256
173e2e68bdc6b848a4f2c9103f1bb0a0f4d097dcba8f3840a43a740e2378c007

SHA512
c53a56006837b3ffb4f935a083f24dbe5d58854761f3afb9dedd8f009b2a99c3c058ab80b38f93c320e4bef5caca6cfa3c6e5e05e84db0012b3497e40d98ea96

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE8D12CEEB\IDA830\python\3\PyQt5\python_3.12\sip.pyi

Filesize
2KB

MD5
659c59af4841ab542bc5ae43abe187c9

SHA1
838206246c95a4b673408c78fc6b294246d53913

SHA256
618cdf56d2935c762f32b9c73e5e998ddc471f5f70c4c5a980dc22386e898279

SHA512
e88d5cba70a86aee598d14305eb92baa9f22ba3f0c06ef108334f663413ab54c8a6dd9e57b13a31834a8e80cb86e455a97bfa806a1697ea39a639dca79be4aa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE8D12CEEB\IDA830\python\3\PyQt5\uic\port_v2\__init__.py

Filesize
548B

MD5
71014d6369472d3184315f736d945afc

SHA1
375858f197d1403c191670a3151ea51329ee75cd

SHA256
32bd356bf7687853a140d02a5c9df551bce86656ea6cc587161887be57dc0edc

SHA512
be351c9c6ddbfc23dc0bc1791321c066d250ade7ecb393e4b17ea9357810db368065ef601e7d469031cdac710bda8e824d55c7a32403d269084aed93ee4f9e6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
274a360206374a780e47f2e5a14d799a

SHA1
18992db9e278e1c19cea7385d09088692cc24609

SHA256
931cf3fbf5ba065d1b09ae00594c206ed59fa89dd6b6bdecc704c229213265c9

SHA512
2a81585d8ce64e92d1b474a8dccc738e8db34b97ecc0971b2d8f49e4205a1ec82d664e6bf1f91f0c8dde260e6ceb1d1d5b6aec71184b8123210465b643906181

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
19KB

MD5
3996341f458f30102ddefb9c9eb41727

SHA1
839ea705d70c1b160032e1491f8aa78a185d24c0

SHA256
fce7bb506285fa5834c4f13a92a46ad1dece6a7c56d36961cb49ad5e7f7337cc

SHA512
b49681f4975a1bd5d1e822b02038c27b87fd23725ca21232c98b1b7095aa4fec70610658a65def37ca4af3c4ebf2f3b348b392c5732ecffd46fc93016b2fcf83

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\AlternateServices.bin

Filesize
7KB

MD5
bb9820337ae37c42352afbb21fabfb43

SHA1
98dd0fc32e804e4cd03471f3c9465d82f16bc6f3

SHA256
3f8e8cb575fff56a487a5375e4e76e189ccadbf875b0a1c9418513873ee39bb7

SHA512
af48b6a11b445ee1d464642592f5e5851af09749ed6084dbfbe40f7ea349081ff437ae3a21dee3f140892f5d34e2ff766a0cc2e3e8ff82c6b91cdccfe82d7bd9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\AlternateServices.bin

Filesize
12KB

MD5
8f23764342315a0126ad68000c49cf4c

SHA1
6a3efaa2946acc524c63d0a2345e6360a5c54294

SHA256
6462f7dc31360cb28932525d12b4b2167244d56b90c79011bac021b7b50a6869

SHA512
606f950ee310521769d123ead1a80f1bdeae6e7c668890b3c50e71c39889cb80ced2fed63f6e184b728d3020e4eb89da780492ef5c27abae1a047f8a7583a376

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
9ccccba4fba92d3be6c5c34efb989624

SHA1
f9190b6f305b9f49b27367d96f98f5339d92ddfa

SHA256
1e6705badbc3de66e750d76214ed8ed28122cc0b9d5879a81384979d5ea8462e

SHA512
64afb3745716ecf7a4eebc0981311a2fd9c5967288a7c1a407875dbf6bc4d3f3a335b72263558fc9318fef058f6b773c5b3b244b7d1c973d008bdd5d4d3a7537

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
b8e4de7fb02307b8029e32d23446d850

SHA1
6b1bf2cd6928878826d02ce7f2376cc8928ff111

SHA256
088bd1926302248843fb655d5c0a4b55f37967dc1c4b73ad4faa6b4467d7edd2

SHA512
d373f3be1c91add2261ec430b9af07f1bd6ba8fb7a18034a345fd1396507af873cccd3e5cf187a47bea5d05482822231ecfa79d26d2e843a3a9bdb599a75f84d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
87abbfd972dd7e5a622baebc32b56aba

SHA1
9853a035246a3d15c13b77e9c2f86a2b87843bd0

SHA256
7f9d7f56924be018bc19f827bb8e03801c47f48834f151aa5144c1a24ddbec47

SHA512
e5e7b7bba55f08f833ab0bc4260c041bc7ff4f4e806ac0d21a6e68b11b2de5c8d018bf6da4031030532e5d363acf0016259722b12b922e6318372f719c176af8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\datareporting\glean\pending_pings\8ce3dfd8-af9c-4017-9ce8-d3576c475ca6

Filesize
25KB

MD5
92382b24d27f20ef9e45b27bd31dc66d

SHA1
4a3f92178242d75852ccb7b2c53aff6d0403d27f

SHA256
f5fca8762c536485f6f66b7b037a7ff29b8c2cbd6934c944330e0d0fca133794

SHA512
6608e2c9e2bdd02400d5844b2eea3d8d01e344c748c2c6c4fdbe870a4f38ba240f7d5e0f53d07df60decea239b155c8b1c2d3929fd44e466303a5268472454b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\datareporting\glean\pending_pings\9d7c01c9-2fac-46b0-86f3-4b2e06b24636

Filesize
671B

MD5
efdf2f23d64dda4e15d5a95d960c1b5b

SHA1
1574048c5faacba3e5ebfe178bbe2e002cb4a83f

SHA256
2704911cd77f8e3e08b86d22efe673e62091af2e406a97d8f4a7cbc090d731b9

SHA512
b2dfef5f97c6c8554ea989e71bbefdf32133a67eb4b07bed03d0a2122c34a5c2c92cc053d04676efd2adf8eea87d5b1fad6c45a4e72bcc405318848742f06e08

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\datareporting\glean\pending_pings\be0ea61f-377e-43c0-b724-472d65e0fce3

Filesize
982B

MD5
83d3c49dcc3f59e2c9037269345e6e86

SHA1
141a198e2ea067da47ca7034704e0c2ee48f290a

SHA256
017effec044130baab46f05e336d886ffa96bf2c244d2b33e47a27f40c147c7a

SHA512
9124e19c1771e867ab67e7a0199cf0ac85780d2bcfa7bd66b65f60139698c2505740663887937143cadeb886f8fa0fffba14ea46df861818c60a574241919f77

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\prefs-1.js

Filesize
11KB

MD5
9c0bea0b965efb82e6c780ab09753a5a

SHA1
4280366cb0e49a68bc0c18ec873e2fb869eb7ec5

SHA256
143dc2351c686737d0f86e4aecc7026d627257ebf9ec1f2b99a4033aca74f55c

SHA512
5113f5d8b9cd7418183bcdd79029b82a68f2621e648129d227861feb383605e1fea7ec8c7dab5243ef1bfb6596fc9f6b64ab4c0594d45b2142c1989a74679730

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\prefs-1.js

Filesize
13KB

MD5
44fdfc3a60d15f24e7d591dbb9e1b51d

SHA1
c31e1272b53007d6b81262c060edc68f045b033b

SHA256
3256f826331615e31a63d1039aa85ad7661126f2277d98c1588faae21e4cd83a

SHA512
7766d3e4c61c946c6e0556bed8cd75bbc3c77968a15d08a8d97313978d0c2cacf32fb90b3adfabfac84828351f4895795bac523cc71e9d994a35400874c3ac6a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\prefs.js

Filesize
11KB

MD5
3aae2cf9805fade1f84b86e611bb8003

SHA1
bb4085840b633adcd95fa461bd0d6663c7827520

SHA256
488a373a85ff7ba590847a281c8c689090d692ba6a6ec8cef326c6e81547b296

SHA512
4965d356b551b35a0b5a36f5e4c600c7070e4c79e86b6bba2d158d5bd0d3b3ccda95a4a8b038a3e48b636ba5dae5c4fc732976e99b1fbffdef9fe9e8555ce598

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\prefs.js

Filesize
12KB

MD5
e49c8325c7b230faa5e0b163b1158b3f

SHA1
8485e31ec09e045242a93efbdff4c555e73a5963

SHA256
43a34003cff44b4263467958c22edfa3d6599fd8f0c7d4889eed32244454bff3

SHA512
84ec0fd14cdd0cd508dfabd83d4a62b488012b7624095d58c7af52962006daec1e305ed1eebc16107dfeaa004a1d7e3bca49d6ecd9fd88204a2effcbfc07d873

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
e31accd5d556ba83fef4de2135f55279

SHA1
e7c92b7aff51fed93473933787dae3b0c881960e

SHA256
30815fcb190beddf6c6eba55d05b63a3ed2b7dbc9467e5b21ae7cbad760ae50e

SHA512
ba8b1d202dd0f51a3a03859f11068714fa3ee6ad6395230b4111541c120d927806668180b60cb77d6f6907b876fe1764006e69d4851da5246590f95e573ef9ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
e0bb25980c515379aa12de2ab40dfe58

SHA1
9c61efd78b239436b6aac80f348e32ce21768be0

SHA256
143af4f7b0e2e77870d9eef4e711bf7775e7ace4184559c502ab855c4093759c

SHA512
c30e9a3eaab3c26938ec7f308947da8bf47dd6010ef234aa626f2e1f49e4ec42a7b53ff6d2ece3aa904a8ea665f99dbed6adc9030706e930b68314135a7db5e6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
11b1485da7fb8ef3a2d5f557ee95fa2c

SHA1
bd7b17070b0a7869b60579c5299bf8ff29617241

SHA256
4a70bdd02104e97c5f486531d9a2c7095b0d3ef39c9fc6954da0056d50a35ed3

SHA512
4cff9fd769d005f45b3aa11f33628c1656a07da5719f893478c652400aa5da066c952c25941279600a868060d6cd06a2d803c04c24de9b531f1b7e80de14d5ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
3e4f959f1be7dc296c01cce953319858

SHA1
4afbb90299543ec298fe81c7e0dcd8cf80c4a866

SHA256
a5c9cfbb8d96a345e8f1d3a4362c15c66789b76f09648cdfb35b811604d21359

SHA512
c9257f8cf43f3c86a26b3357d01055232cdfe615032f9c3a2edd49446c8280b3e41ecdc217183b4b9f749e9965c4cb623503c2005704dbd8695162e25f60c4a8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
77149ced43de045dd1e32ded381e4bb8

SHA1
dbc83f53a63307db26158128fd30f520026f9ded

SHA256
3b588584ceaa509d41d8c7e33b6702a7716f63a3033cd2083c1dbd083a8e425d

SHA512
b0136c8877bcb8bce108aa3097d45c1a35f28d8b2c1d349b6868b1963eb828aad38d567682c2db2aef10bf52da2b0dcd56f4b4b43f78486c0a817e6f1fe864b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\sessionstore-backups\recovery.baklz4

Filesize
13KB

MD5
bde3008373c1cf38d394cfed52861fef

SHA1
4d811d0b23ecb13f8c99f7124c159b540b1ebede

SHA256
0dc498758e5b77707adc5017ea884b1329c3fc61746c8d2bdd845c36cc2471ec

SHA512
7a8127267ade0e6db74b2e717ccde7a28214a92437e1e842771fe7e9056eff7fdda879b0b31d2b0cee9bff3675eafd7198d5c09a79e827a602b08e3e892adc6d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
cfda4d3ae493fb701cbb4dba2489bbac

SHA1
bae79eff478145faa21e1ae3a284c0c40ee1e27e

SHA256
4bfcf9f698cfd713b6072b0137a91294f2d97e87aaf5b9d2fd5173ed4e6cf346

SHA512
6e4872e8b908099ad64b2a342cefafda122e38dd8de26ee53522fc11df2ba08a3c289f297643832fd4065b9926df1d2173c8182afde4f5923e6eca5400724796

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
a24a957122ec86363fbec0c682876dc0

SHA1
0da5cec80013245114050c1afa4edb21f90b99be

SHA256
eff044b4b7ad43051fc1f7f2c3cbef00b13ff16b04139974c572e458e6fa4afe

SHA512
5c65d06e556419c942655a14cdd7356c6b95c459c783c52003627ee768b96d001e4e076c9de67627e22a9d2e1275d8456d8c7f316e27b36d9cf4d9634da9e28d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4i9bphnb.default-release\sessionstore-backups\recovery.baklz4

Filesize
10KB

MD5
c76cb26a3a229de5b94eccf1f6bb6977

SHA1
b09ccad5518d829f2204c02afbf7b2cf88f268cd

SHA256
100d9cfb7f0e1e18703b4493047017f53dc9405fc44763c9925c64514e58c79b

SHA512
e67cbafe37a61d4231e459bee7cd2c491598fb616de6ea4110cd93d02db4c454158bb7056b41843afe9e400a1f90341792a6b100fd0801a461de0f007e4e6ee7

Download Submit
C:\Users\Admin\Desktop\IDA830\Qt5Core.dll

Filesize
5.9MB

MD5
fd80d43e803c146d0718b811e96ef21b

SHA1
2d53fc58d9e752b9577fe1e78ac117d9d0703469

SHA256
695307903ccc11dd4972015bebb160b7f0ba414a95e8323e5788476e69e3f83c

SHA512
01c8a7c1b5fe6d752e237837e448cde3d52888d3d3bc2185bbbdd11557b512f1175ff7c2d3260cea7c7600f6ff263c730d7149fea25f334817541782eb3c1c13

Download Submit
C:\Users\Admin\Desktop\IDA830\Qt5Gui.dll

Filesize
6.6MB

MD5
367ada59863dde5902ac813c765c718b

SHA1
1c30b98f93d5fcb49a15ae22ac9ab1792a0cbfa4

SHA256
2b8df2fa3a3f75be898ad826e3698a562cd3cce71096ce0b0abf362be6ba57e2

SHA512
7d57df5c3a9d7de2969074a4ef59cbca6d51fa84de1bc76d5fa4e633b6aeef9f00351ea1774b67ac3565ae6c48e18f0e561487c60027326defb166f3229db057

Download Submit
C:\Users\Admin\Desktop\IDA830\Qt5PrintSupport.dll

Filesize
309KB

MD5
4cd655f4d826e8437b0415aa6c8d6550

SHA1
7611161c774c7c72b189b420772d2c65e2634e4a

SHA256
7b105ebf20c0b52259c00ff645f95f584bbe60b91c90de583785ac88b448e26d

SHA512
82745e4139f72f6843d0f4b588c2744b60a405e398f158319ee336758c09abfbced2f0ecc4e0a6d3e535384a9cbe69f89935b11a9b5857cc8f7deec00f044c6d

Download Submit
C:\Users\Admin\Desktop\IDA830\Qt5Svg.dll

Filesize
324KB

MD5
f3cd456d5fb9685304dbb53cc7b9ebaa

SHA1
8eadfaf8b8e8df16fba9e1dcc36d0ab3eb6c9f42

SHA256
62089b5a811c7c0cc408335dbafa0c7060cc9324c01595e011abd6ac2e868442

SHA512
03c3c24a95042b5e4337f2e093d219ebe3a3a05b8a78a8029550f1470c51b4433a60ca7d1000e238a3bfed51b6e6b112788a0663ea6618b4d052214749b4035c

Download Submit
C:\Users\Admin\Desktop\IDA830\Qt5Widgets.dll

Filesize
5.3MB

MD5
8b786869feb36930f8d6fd7be98ced2c

SHA1
f6fc979919df931af8fbeae54eff502663b2793c

SHA256
af337b316a39107944bdeb117798fd8ce02c3307fb415a371b6bc431d470a3e5

SHA512
9eaa2390abcceb7d69958be99c75dfd60edc464ea8018d3657a39846f40ecd6c6e48bfd750c48264047cff82b6aec398f63df5f70f0c95484a052913e845384a

Download Submit
C:\Users\Admin\Desktop\IDA830\cfg\idagui.cfg

Filesize
69KB

MD5
f1e5310867f39f4a8e7edd765bc61575

SHA1
f5e6085c620d7deea0e258e05ee88d0a0cf055dc

SHA256
03991893b93944228374178b51c6187b31b1da53858cfca10d326621ee9becf7

SHA512
d2fe8950b3a98e5fd838a4e386534803150c7600e5a6ad32f177381e5e599bccec77efd33c8815ff25f08d2948e125387f4950d6d6e82c52bdfac437cd25b7b3

Download Submit
C:\Users\Admin\Desktop\IDA830\ida-orig.dll

Filesize
4.6MB

MD5
7beee9243a47c478f40a2b911a7129bc

SHA1
969dccb6355158f727a2755d626a12c6a49c60d3

SHA256
11db9b79adbc5b725a137e178ce6d15428b9b6201052e96536ac42b83df6f015

SHA512
df454880aff3c7733c1dfbe00949999d297ea545cc23262dbbf015e17e6f7d72858da1a063a2b79accf47b84d2c07423f990f3d999eb2c5f7a7ddc2e13e4e7af

Download Submit
C:\Users\Admin\Desktop\IDA830\ida.dll

Filesize
101KB

MD5
8946f5e638025f714faaa874004dc9be

SHA1
98c871a7da5de5752495ac30d5f0d53fb13edd44

SHA256
c7f3e20ee45f8fdbc08b210088c80bdc9a700d2e2e45c5807b3b9cf6791fc711

SHA512
1a5992021e4866117c7ab531612615fc5e2a2081c6709ed6918975b1dab9208090d40c96d5487cd71fc36b2aef5e2329222d508d05bb62ea2f9c66b5d7b26ffc

Download Submit
C:\Users\Admin\Desktop\IDA830\ida.exe

Filesize
4.0MB

MD5
05c7e465d9d88e94e064a99dc36f4ce1

SHA1
e87ccd7bcfa05a30aa283c5e5953ba368ff75bed

SHA256
d2650a12440bdc4f1b34456956221764c249060e808194b79152e9f679dd4e85

SHA512
a9af650ea3518f88c5f8d9e1d059fd039c88d70b733ccec4107f75b14b6d9489a79dffa3ff5fbd7343ebeeb0ae90d26cdac64b79da006b5cb0c25316a66aacc4

Download Submit
C:\Users\Admin\Desktop\IDA830\ida.hlp

Filesize
932KB

MD5
024b0555d7a5740272ee805b0f32ea8a

SHA1
c48488c4e525f9f8a2a1cfa1cbab42698c1c67a5

SHA256
2291a8037a0ebba9b9f63b34af0d4cc43402a0cacdcc3cab27d83bb3ddc6025f

SHA512
3d4c4ec4c2c851b353d4f17f102c1e8ee22b93822c99655d94ffa781572de58ab5253c638e116924816b85ab55f473f17b2a85cbf2ce159278033dec9840047f

Download Submit
C:\Users\Admin\Desktop\IDA830\ida.key

Filesize
1KB

MD5
2532a463e9ac23b006de047688ab1922

SHA1
7cac7416616bb0771306a4ca0c4ec7889bd1adc9

SHA256
4ade8a33b07a641e38fc498c7705ef14aec76256d6337c47cd15c4ad70a06eed

SHA512
c9332b1e8a1d6b06ad824c52b3ade136c9d04d0e9a7edf92e34add8066850f6f714f1160ba99461e3b86e40ba9abb25966b446112a62cde8267fa8ba4338cc0b

Download Submit
C:\Users\Admin\Desktop\IDA830\ida64.dll.id0

Filesize
16KB

MD5
c4d1ccd6d1ed0276b6b3529441acc387

SHA1
3f8f1ec2600be3c051f8fdb0502b936bfaa945fd

SHA256
49a4367f6db737ceecd36e3a2721dba22bbd806d39720d92e44c2413af80b3f1

SHA512
b1372c47fafcb583bcfe178ff0b9cf66b774e0164975d1bfdbad243e1edfb704cfd1c7372adef21979561683450adb6d37ad60aa925d0a4a8f6168addb81fc95

Download Submit
C:\Users\Admin\Desktop\IDA830\ida64.dll.id2

Filesize
42B

MD5
5f0b0a0e58e5089479d6d54c2057e30d

SHA1
4622006e6c9ab36240b6261acdf22d00e1963106

SHA256
eeb8014bf4759efc7a886f492557fb83302182aac290f75bf627a068e49e135d

SHA512
db63037423150323cae12c6f568baf6113bfb609cfda6ca6abfb9da4be895738043c01c00bca61ae1496766d41f03c983aadb14cb7fb8cedd6c128a150f50561

Download Submit
C:\Users\Admin\Desktop\IDA830\idc\idc.idc

Filesize
303KB

MD5
7a35fe7e93d9326b7274cdf5785bf301

SHA1
050b1f071db96d544b84be5f1eb068cca02b3928

SHA256
477f87e0736cab14a40c15c4315cd7d01a2cd94cf497729ad58f8e857932077a

SHA512
a785284dbc0185135d3987ef7c3fc7f5cf940acaf578c85f8e01f11436895c296458adc95dd926404958fb6f75ab0556b601c43a13a99b7727d3dac1d0afce71

Download Submit
C:\Users\Admin\Desktop\IDA830\plugins\armlinux_stub.dll

Filesize
128KB

MD5
9daeb28b79f2a6716e742949f200a5cc

SHA1
f409d3de6ae8079336c2ede077dd8397e20fe80f

SHA256
4f96ed1affb5c0d704777f2587713053509a4ec86a05b4ccf737f31f4e1d8f18

SHA512
27a9e5dbdf5a0ff9cadb993f1f8c23d0e8575c17bbe2d10fafbbf5fa24e3d24627bc86ebdb323c3b309f573d49e1668126e333e8af0412e7f938f110cb22337b

Download Submit
C:\Users\Admin\Desktop\IDA830\plugins\bdescr.dll

Filesize
20KB

MD5
a08a59f112c0129927c5995d80b90cee

SHA1
d0d253d47ecdeb2d8adb2881cc5e7b1d1c760134

SHA256
9c16892e8ae5cbc34a7771ca0dfc76d1c38dabd5ec991740409a914bf15ead60

SHA512
fd96fd7296e9f96ceb411362d2be17b34a3521ab3f9ec43a07926538978fd70d327362ab23151d1db79c21437f6eb31780c5af4ada6e78d5622e86de36aa97c4

Download Submit
C:\Users\Admin\Desktop\IDA830\plugins\bindiff8_ida.dll

Filesize
3.3MB

MD5
4da0785e1e0bf81324c4c5ddadf2edae

SHA1
05f3c66192707f279558ba143eea7a9d5148ebaa

SHA256
0908c1e7ee2a6e327e8adc7d7f4c7b8fa50252578b2c87781ddd9582fda3153e

SHA512
6b224db03dfa46b971e9f5965cfe7fc7df34b6a70223a4fae9c56cd7e22e086847df7c5a59b06a074d2aa5dedd216f447b653b4ddf7c94558c202c246d039ee5

Download Submit
C:\Users\Admin\Desktop\IDA830\plugins\binexport12_ida.dll

Filesize
2.0MB

MD5
3a9699c4f2ed4e24b8d41762d0e1e3a8

SHA1
af9feebd7992d6c223048ab0c4a63806ad57f74e

SHA256
a34176842fe80f4c156da81f247500881f0c9aef9155331920ee3c03942d53b1

SHA512
a9e92d671b7e827814ca9cb1af29f45c3ad5db7813ea6237da8b04266b03d4656a2260c5c720636d890c4beb832f93d4fea609b246188109d6c8b306a072f68e

Download Submit
C:\Users\Admin\Desktop\IDA830\plugins\bochs_user.dll

Filesize
285KB

MD5
b67766eab30cb4cca57d68d714ee50b1

SHA1
809a5839df919e1a0cc0d975b86013dc06d26e48

SHA256
315dfad00d4433172abf40fe7358a6ada560a2c7c0a637481511ac5c13f96b0b

SHA512
cc4fd490f57aa340a12c808653bbd06dfbf09c0fbe903deba0d6b775a0c95be4885d0d977ca43b5d307e0f79ab79907258385f184c18fe17ae1e23724da4ba5c

Download Submit
C:\Users\Admin\Desktop\IDA830\plugins\callee.dll

Filesize
12KB

MD5
b56daf4058e08c8ee6046aa7fc9c0f5c

SHA1
06c9940b1de19d0b36e9929061548f87f48df336

SHA256
bfc73ffadeb75dde8a68e16f2bffbacdbe8806904b73353567d5a53bf493bc7d

SHA512
bbc5b457bf0edbc2e2828aa76f46baebf0120a11bb821cf43417cd52a2a3e2de2de8966923d1581b577f30236aa16ee024145435e3a63898fb96a3c109c6f005

Download Submit
C:\Users\Admin\Desktop\IDA830\plugins\comhelper.dll

Filesize
24KB

MD5
c4c771b519b96e1c92e8a5eb8e6f6ea0

SHA1
6ab5fa41fec60832b175672983bed5a6bc1bc89a

SHA256
8782c7d012dcc0923ebba695e58586d7d06ec3afcbaf2a49910ea7866e202a8d

SHA512
085cf7d57f498b3e3dc5a39ecd32871dc891651425075d91d9c89f31400abe4609501b47f12799963e76a6a04fb520b8562c604f9240991dad8136b172b0c1a8

Download Submit
C:\Users\Admin\Desktop\IDA830\plugins\iconengines\qsvgicon.dll

Filesize
35KB

MD5
ed973fa567bc9c2b14ce5be86679f08b

SHA1
31f66ade30fddb3be4bed51bec2358f52acedd03

SHA256
2766cf3d89a52b10b8b3432b3a0b991a9a4b36a127bf00ee7cde995a50c46fb0

SHA512
4392c9d8a941e7a4d99f76a7f4572da43808141e57c3cc09df32740c6cd947e58de74a2db8b2ce9923b11ffa961fa1eb792b830ada5d797ae0ea7e746668fda1

Download Submit
C:\Users\Admin\Desktop\IDA830\plugins\idapython3.dll

Filesize
108KB

MD5
ba8fafb9ec64a8dc8e03ad7ff7a826ef

SHA1
2a7d81bec5f477c4b59e164ce18eb2453e07af54

SHA256
5d9d864a8a6e120d41e4a0214f5de16654a15f56e0c225a769a6378d3391fd10

SHA512
ffd08e78cade358887a96a705df591b9579b340dce0f011358f98a3f1637ad5763962d5dba7091ad73df3cc0081acdd8a6423c5810c5f2ab85c840222be6fc67

Download Submit
C:\Users\Admin\Desktop\IDA830\plugins\imageformats\qgif.dll

Filesize
32KB

MD5
69c91874901919939fd596b09ca4885c

SHA1
5d328548b7457d4a60ebfa0b1baefacded626db3

SHA256
2580357f70041ba91a0da045e74bba8909bb1bbcd85e65c941bdc0ea38176bba

SHA512
7ede554c246d000e7e3a793cfb4319c9877d9e3a49eff81ca47e44df4f3ffa120ac7a34b15c8e4fe1229616934cb1042e621f53ce5016b36567be4c8ab6af153

Download Submit
C:\Users\Admin\Desktop\IDA830\plugins\imageformats\qjpeg.dll

Filesize
405KB

MD5
2755b62dcd497e2b2caea16e49c231b4

SHA1
930d1432c58ea717d058369a63f4e49998af8b29

SHA256
ac85edeacd9d45beb81101c47120c3828d8d62b5d19dbda926466efc18e14261

SHA512
1df860d2a95e205f916c0005405cebac3b9c779abb7e748688ec14cd21cc2e49e31db46d53b03c131b9d1ba687de77d1876a5044ba4e4b80a875ce4d3e48d5ec

Download Submit
C:\Users\Admin\Desktop\IDA830\plugins\imageformats\qsvg.dll

Filesize
25KB

MD5
10be44153141b7f342a98371464e9327

SHA1
6d2b21d0a28382d85a1872ca964c0693a3caff0d

SHA256
9cc9cfb7db2cbd70e199c32456186e7ded266fe30e450207387494101a44a99b

SHA512
05c615b9866c63bf56270e844f83d0feb6483b38bdb1f6ad0b3f56070c6b29a118bf78711f9256d3b1c5ee20292d88332f00b89ec9a6e943ba2c80f108385f63

Download Submit
C:\Users\Admin\Desktop\IDA830\plugins\platforms\qwindows.dll

Filesize
1.4MB

MD5
d806c1f1e1ae1f2a4481d15d57035d19

SHA1
bd3b915558020550736946de5c06cb635a706a0c

SHA256
49f621f2e5a8b3907099ec0ecc65f3519a5105b8446d7ac451a0ad7359fb7d22

SHA512
8df43f5da8dbf6961b2f592e2a1fb2b5ee279b44129a6f732e932d00e41eb7ffd083e5013a33860a791a769282011d23e86196e0a85a207b46afe2d7ed07a341

Download Submit
C:\Users\Admin\Desktop\IDA830\plugins\plugins.cfg

Filesize
4KB

MD5
f69ec7d00578dbce648edbbfdb4f296b

SHA1
cafa50ea8ce972e3772876c19aacdc81ab42720e

SHA256
421e951db259414aa04704972c14eebdadbbb3309d21c6cc72c00d7da3ba4aa5

SHA512
e91ad97977307341049dba1dea8ee1c9370224a702792def65cf7864d273b193739ae13f519bea35879c31d1ff769279fd2aeebc3c891e2470d0c7c913b14855

Download Submit
C:\Users\Admin\Desktop\IDA830\plugins\styles\qwindowsvistastyle.dll

Filesize
136KB

MD5
32e85e3303bb5675747fef26fc744089

SHA1
f5b5a1c9834a244ca73368c3ffda1e7aeed1dd04

SHA256
b7bb8a6ce946cd9fd74644aac3152ee8130875201ff174662a7f5fc28d1588ef

SHA512
413c5cec9a198bc43769fa33da7843ebfa4e73d676132d08c8ba076c37477c2c4cdb2cf2ef73905bb805d5348577e61187bae6ef61227c104703f00a193e99f0

Download Submit
C:\Users\Admin\Desktop\IDA830\qt.conf

Filesize
212B

MD5
b94a2770e638de7b863b8edf907e9b1b

SHA1
7ffa722fc4db9b413f9a2364ce8dfd4afcf678de

SHA256
2b946593df3a65ab7d2bc4d5ab26606a829260de2b2441299e1bbcebc33f4722

SHA512
fad27a4cf44b45e39fa2d03a5fd9ebb8c4119ee00d3d0b58cc712492a3b5d1fac31cfd02480b7e2249eddb9a3cf873c1fa84c531242d00266df69e7dcd15fa44

Download Submit
C:\Users\Admin\Desktop\IDA830\themes\_base\theme.css

Filesize
35KB

MD5
acc0c5c4213f7c376fd4fd82006882bf

SHA1
329edc4045a01381d7dc3f3c90304e130c5322d7

SHA256
6d673709dc4abfd2c1c6699213d55c521bc91420e420789e0e3672071e9195ab

SHA512
4147d570a14c055240d43adda9858c285077e00660b7d06548c12f4983c773ec23bf69b36ff88986ad63d1d403f19ec51d9c8ae22c88b544d3503433d17542e1

Download Submit
C:\Users\Admin\Desktop\IDA830\themes\default\theme.css

Filesize
9KB

MD5
d9d5e3099c39b18ba9b60093ca2c0f02

SHA1
fb37de4a3302550acf8fc300dcb6e8914d1e24ee

SHA256
c7c0c39c5bb03d6689cbb4067787cb59327d2c065c736bde7eebd14ca2ed95a4

SHA512
a744442c01302727d4216e4176d29fb01a30e9efcdc9cd67b98bee280e069a6822894ec2ffc9a8a0efcf8e2373ed329043c73c0222979539ef634251f46c4c29

Download Submit
C:\Users\Admin\Downloads\7z2407-x64.exe

Filesize
1.5MB

MD5
f1320bd826092e99fcec85cc96a29791

SHA1
c0fa3b83cf9f9ec5e584fbca4a0afa9a9faa13ed

SHA256
ad12cec3a3957ff73a689e0d65a05b6328c80fd76336a1b1a6285335f8dab1ba

SHA512
c6ba7770de0302dd90b04393a47dd7d80a0de26fab0bc11e147bf356e3e54ec69ba78e3df05f4f8718ba08ccaefbd6ea0409857973af3b6b57d271762685823a

Download Submit
C:\Users\Admin\Downloads\7z2407-x64.exe:Zone.Identifier

Filesize
621B

MD5
6aa4363dada0600539078f2472efa04c

SHA1
83432cc1e3a5e53c7da5eb7fec42c29ef0f14923

SHA256
7eb8d02647487be9041992f504400ff0461eb474d8531c99806d0e9b35b89abc

SHA512
06bae3112f6796076cb4bbc861530f10b08bf5bfef8c9ca531d0a400f866ed4d77365f596dbfceff2d09f638a61b619fe6eea4b660b03b42ce3ea21842052940

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier

Filesize
171B

MD5
e6556655a7d88a93605f5e6af98def56

SHA1
498d46d1d2914dfe2a50efd0aad5b964d51504da

SHA256
18f8507ecde6885b7459b08c573e3cb35c35bf700bebf4d8fa5a04606b929d03

SHA512
d1c74f4e9ad54d3b72b98cdcf0e07f73e3fb8aa7554473d112e4c9d2a00bd2e3571ff74608bb208348b8b5781629095b51a8379921a07bd20dc89343e41110c8

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.j3gXqWXI.exe.part

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit
memory/1196-3982-0x00007FFF8E3D0000-0x00007FFF8E928000-memory.dmp

Filesize
5.3MB

Download
memory/1196-4024-0x00007FFF70730000-0x00007FFF70740000-memory.dmp

Filesize
64KB

Download
memory/1196-3986-0x00007FF62B070000-0x00007FF62B470000-memory.dmp

Filesize
4.0MB

Download
memory/1196-3985-0x00007FF62B070000-0x00007FF62B470000-memory.dmp

Filesize
4.0MB

Download
memory/4264-4056-0x00007FF63B880000-0x00007FF63BC82000-memory.dmp

Filesize
4.0MB

Download
memory/4264-4055-0x00007FF63B880000-0x00007FF63BC82000-memory.dmp

Filesize
4.0MB

Download
memory/4264-4054-0x00007FFF8E3D0000-0x00007FFF8E928000-memory.dmp

Filesize
5.3MB

Download
memory/4264-4057-0x00007FFF70730000-0x00007FFF70740000-memory.dmp

Filesize
64KB

Download
memory/4264-4063-0x00007FFF8B060000-0x00007FFF8B210000-memory.dmp

Filesize
1.7MB

Download
memory/4264-4078-0x00007FFF8B060000-0x00007FFF8B210000-memory.dmp

Filesize
1.7MB

Download