742ee904158a95eb52021530b001759a26bb9a836fe222540dfcceb14461bac9

Analysis

max time kernel
39s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03-10-2024 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Test.7z
Size

318.0MB
MD5

2234c654f939adaf796aca29e1c20d22
SHA1

88bf5670852e9d067bc5ba9a300ed2ad477cccd8
SHA256

742ee904158a95eb52021530b001759a26bb9a836fe222540dfcceb14461bac9
SHA512

152bb01a137d0b43f4679af2dde3c82718facf267362cfa1112ce014f47bb47a694ff8555771a296296b2e5afba0c8aac68edcf3c67d95073bc997c2ed4c05f6
SSDEEP

6291456:QOFjXWlBwVcDcQZncnVcVmCOL9EsTs9lY3Zi1/94I3njI4DVxlPEawHKHd1GsNcA:QDlbDcQ5cneVmCeEiuO3Z2/OOblPteKr

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5196	ida64.exe

Loads dropped DLL 63 IoCs

pid	Process
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe
5196	ida64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OpenWith.exe
Key created	\Registry\User\S-1-5-21-661032028-162657920-1226909816-1000_Classes\NotificationData	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Applications\7zFM.exe\shell\open	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Applications\7zFM.exe	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "2"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Applications\7zFM.exe\shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Applications\7zFM.exe\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Applications	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 500031000000000002597d7c1000372d5a6970003c0009000400efbe02597c7c02597d7c2e0000000ca6010000001a0000000000000000000000000000009bea200137002d005a0069007000000014000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c0031000000000002593480110050524f4752417e310000740009000400efbec5525961025934802e0000003f0000000000010000000000000000004a00000000004e344300500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5196	ida64.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3604	OpenWith.exe
788	7zFM.exe
5196	ida64.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	788	7zFM.exe
Token: 35	788	7zFM.exe
Token: SeSecurityPrivilege	788	7zFM.exe
Token: SeDebugPrivilege	5196	ida64.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
788	7zFM.exe
788	7zFM.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3604	OpenWith.exe
3604	OpenWith.exe
3604	OpenWith.exe
3604	OpenWith.exe
3604	OpenWith.exe
3604	OpenWith.exe
3604	OpenWith.exe
3604	OpenWith.exe
3604	OpenWith.exe
3604	OpenWith.exe
3604	OpenWith.exe
3604	OpenWith.exe
5196	ida64.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 788	3604	OpenWith.exe	81
PID 3604 wrote to memory of 788	3604	OpenWith.exe	81

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Test.7z
1⤵
- Modifies registry class
PID:4524

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Test.7z"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:788

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5960

C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\ida64.exe
"C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\ida64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zE413FA0A7\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\python\2\PyQt5\uic\port_v2\__init__.py

Filesize
548B

MD5
71014d6369472d3184315f736d945afc

SHA1
375858f197d1403c191670a3151ea51329ee75cd

SHA256
32bd356bf7687853a140d02a5c9df551bce86656ea6cc587161887be57dc0edc

SHA512
be351c9c6ddbfc23dc0bc1791321c066d250ade7ecb393e4b17ea9357810db368065ef601e7d469031cdac710bda8e824d55c7a32403d269084aed93ee4f9e6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE413FA0A7\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\python\3\PyQt5\python_3.4\sip.pyi

Filesize
2KB

MD5
6486162cec0f9e05414c4267e207fc4a

SHA1
109873421aa30c51994d01e38630535222189459

SHA256
61bfca5a13eeb20c7f282bdf9d399fa921509b6e23d7f1169ea13c9090d1de35

SHA512
e0e6f9f7a638cc7bf04b995f1db9cad75fdb1a2676bc8c4de1c75cdd83694cd7874763dd309aaec35b948e3bf94a9b21b09bc86e54bfa14fd8d1d369822768b9

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\Qt5Core.dll

Filesize
5.9MB

MD5
4e216123b5cedcdb0184139e92f525c5

SHA1
432ca0dd2a05d84659956ecce613f60f5bc256aa

SHA256
779a0a5e1e07f8a720da7b5631933b2c44d79a57e7d067f82d82dfe6514931d6

SHA512
f103f3976247f4a137a0a489cc9e0820d6f04aaf4e75c72ea45165a937bdb8ad29af8ca62685b665d125d2e9a57317310b30abc65a3d005fddfb3280567963b6

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\Qt5Gui.dll

Filesize
6.6MB

MD5
111c29b695a398fea4d4e42b8f24eccb

SHA1
6e09545e86bdbec0b6d1f94dcb56420225bc041c

SHA256
929f92685f7fb76e8b0e74e6e4706b6af803b0368fbc1dc4787d9d5e3b095a72

SHA512
843eb94799eb702d46ebc34a09b6c879797a45af844a86b1c8be28177050cb6d3b8dad57312ea8225c67605e1dc07b0a1ecea6735c8e7a8db8b4a514c9788f47

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\Qt5PrintSupport.dll

Filesize
309KB

MD5
113d53b867e90b1ba1ddab4735acc97e

SHA1
a1b59b372126fb88af3f7a8dc615c64bdaacfaf0

SHA256
dff16fcb3bc837971a4b16c6e91200cc7516851fc91b50773f576445c79e82cf

SHA512
37064f729c4a092d9674e57153cd2adfee275dc8b61def22f79d211e1ce69d76259db12b8e6c636088c965f863565c85d15f182399e2db87bdd9b34c36e30dc3

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\Qt5Widgets.dll

Filesize
5.3MB

MD5
9aeaa3559945fb7b707f77373921186a

SHA1
08690ad6b8d700bdda907d966b35b5d3d72cdcbc

SHA256
0005d60142f9de4e2821dd559c9dd610abf767aedaf43ddb5be04ca13c836c08

SHA512
0510eef77a5cdd14933ccc302df7a32ce9a4e2f8b83e26225f7d87efd4735b6a22814cfe508bd6eb7be5eb7c7bbcf08b28d9f92a2dabc8920b1b409f73b82b4d

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\cfg\idagui.cfg

Filesize
70KB

MD5
96b5f53dc6aba0e5b8d466a096ad9169

SHA1
72ced5134c33c899a09afb481cd491857b3cc5e7

SHA256
aab42c3ca18075c75e314d9eb2242b37194bd8331199ae3f38a630ab7086213e

SHA512
349dd4380f658ca44ff155a5712e3a827707f4baf3c7d3a23fb4bac8956ac5bd90c56e2b15421260ec0236a52978cc396c508da348bf9cb15e6481fdc8b34e53

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\clp64.dll

Filesize
1.0MB

MD5
9551263c9dd81e8a42487718dbe1a17a

SHA1
9b048160efc67e8b2ef713933212edaedcb158a5

SHA256
5870149d7b091376e6a89d691a9ef4b7b889e3c3bf2516f8c7b73f6cf762fbc0

SHA512
bae732d98371157f764316e66f333d4362b0161b4a38650cc9eb23e3d01655b892b5fc86d99b45afc649257694a2cae6be563ac40193f4b546c7f36a0d31be36

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\ida.hlp

Filesize
896KB

MD5
a7c50f70b17f7814adbef8cc944fba41

SHA1
58f16aa120602d4ab9dfcce14d3d27c4384f3ebb

SHA256
93f7546bb17cc376948d7d0eac669dd4fdf29ab1b240c7235ef54f97f35edf73

SHA512
2122eecaf14a80128b960a5c9a861ce78c0f7f92fc6c3033e466268328ee822ab30c8d09d6b680b38437525ad69900006cf7c7d72684cb63fbc1e130c5ff9218

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\ida.key

Filesize
3KB

MD5
6e9ddf274ec40421635214bf2b687f36

SHA1
346be99e97e234b318d9bea179e21cd01160bbe5

SHA256
f43cafb2edcd47dea2b0d4295e1fcd8cb879226caf9954f2233d16cea0cc3c79

SHA512
b188cfef7dedcf4bef6e911ac76487e9873649dd1f513e8fbf8e3aef1330d12c6d1e78e449098141db06e4a5234ae83b4d266878a9722a6de63d2d07d9ed6bef

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\ida64.dll

Filesize
4.2MB

MD5
36e4a1a33c5b557ebfe9750990f866dd

SHA1
b68596cf0978c7cd349eb10251d2763c6f60e558

SHA256
d35e714949504f1da5e894cdedfffeff93f3b02ab8063a815d9f96b9ca064c1f

SHA512
88b4a3d34db82a81c7f2fffa88167dcd70bb8933e553dd87670bb75e46f20731e89639b698f492d9213dc5c550b5115baf4e478da7f529ca9499d78addaee800

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\ida64.exe

Filesize
4.0MB

MD5
24ba0b4e0a3445a6c2fb866d94669f05

SHA1
3b6bf89f5ec4b19266260fd488ae720a90f1865d

SHA256
70840575ebddb25412f6de60329d5d395b325b709df9202411b723d0744c9624

SHA512
dcbd7babaa0de562a0a6682c3c0b053c419ddc2e78d6a0213c081a5ca50a256a720d0c6cbf3b2de669a5410918dfeb2d7d4fc29b23ae3285103c8e3c2be8b2b0

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\idc\idc.idc

Filesize
301KB

MD5
696825b3c8b10e7d145a3528055a89c2

SHA1
406cb52b517811aec890700bdf770dd4b3a6dc07

SHA256
53f5afada28614271c193a7eeb130bfb7c5fb848f759079981df9eeb3b323095

SHA512
a3847f9011b52005868d7cda930e7d97de7d8780e3c672ffd353aa6b0d703ebe63535b4c17c094459ecbcb5a08c57d93c5a6fb97153b0d1ecafac97429f9d453

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\platforms\qwindows.dll

Filesize
1.4MB

MD5
acf7ee4cc2e776313fc01c1d603b76b0

SHA1
73a5941e62531be2ef2550d0c103b73df58e61db

SHA256
aebf5bfd4df51f3c2a90a1b6b2805635840a6932d91579b1cce8d1afcb5c261d

SHA512
2f94cf42d13c4b07ca5e67fd1cb2be25c831a6e18531eb0233fda1a4bd7d6912f6d05fabbd6ff867c211ddda9bce086185bb9ecd719133ebfc64589cc48c0338

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\arm_mac_stub64.dll

Filesize
175KB

MD5
259f8b6bb4d00e829d38ba683b5087bc

SHA1
8da2619bca55ae46741b3a8dcd79be9f76fd93c2

SHA256
0868688d6d11a464a62f77b87210a94d8dca7888846ca69c4040a254d5348789

SHA512
6a22fe4c0fe62930719a3e0eaf06c572ab4907d2f173b821df7d2b08cced9a0fe1f9f54adb8d5be6f3eae397f8251a758125b9ac766df3cf2b4d0521bd801ec8

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\armlinux_stub64.dll

Filesize
130KB

MD5
b0839735c91c2941f4c88a23eb843d72

SHA1
2837ba3c34904d5f2dd51772e98a664412bc4bf3

SHA256
e61f8fe8b0e48643a240cf6bec4993fcce508caa2144f4333def5edf12805810

SHA512
79a3803c4ce066781c6eba8c704447239d1d26ba58fa430e1daf8a9bda7cbdf5ac6c7b70a51e3b6a0e8107fe382c73bd4b76db5d8d0763e94e5419fe23821b03

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\bdescr64.dll

Filesize
20KB

MD5
3033d63f0ff0172af1349354df968a0e

SHA1
c32ac950f59e5d2e523301e0304c54ff020a8b98

SHA256
7fbf06981806b0896ced2866ffa0f3659fb71becf80403dc7f858c5b585e52b7

SHA512
cc572726cd6b28e8d567aa969df40007884271bc5a6d9af7fad58522fc4b700f0025433aa6fa4e8661e94451130e84d7ad432304343611a83c021ad58c746a27

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\bochs_user64.dll

Filesize
297KB

MD5
c131aaa3d0437c1b1c60737c2580e9f8

SHA1
2516740d729289ee8a952b22bba673245cfab4e0

SHA256
860bee54c3d43ac2dce893b5c3eceb6f13fac71dcd673e9ffd0ad75a08a19566

SHA512
86e244b4cb5748eded253a05462636b564903c7b01bdf471a1170edadc632a431e23ddf43b5979a103f4735500d3b888c8c47414487d679ee6c59d7d7907d106

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\callee64.dll

Filesize
12KB

MD5
557832a60f6a563df8626d02ef1d625b

SHA1
23387b5d204a6601b8e6d23da857a543ca27d395

SHA256
b1b3cc609bd1eb698d9995f71a97b0cbdd8a3f20eab9bad3af0f66bb972c95ab

SHA512
bd1e21703ca119188ff8406f8b12f06edca48fcea91d9ec8eb43e9412278512f05c20abbecf207b8a0c7c24a02090ba7381b10303570f5cc5500bd035daeb734

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\comhelper64.dll

Filesize
29KB

MD5
927a6539c75bab4900d6c1a5f7d47078

SHA1
04c0a58a4b389f167c0fc70f7c40069a3f216dab

SHA256
d657b1bb5ad47f1618ec985eb8cf456eca1b3b9c77bbd168863473bd53a58297

SHA512
7e4ea6a3496e2a7146625df1b12b80fe06ec31ec26457decbb9bcce80d7b8b7d813dff31c2e1fbb051e9c13eb7dba0c64af2e9d6431abfde3c6a749088aec2b3

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\dalvik_user64.dll

Filesize
324KB

MD5
ca4a7836833701be80245c7569921c41

SHA1
389c116c59bffbfaff27e9f00f3599ff453c2d72

SHA256
57de1b892b6e141a920e11077c31cc9a859220cfa518ad2f919e9c2bc7b18eac

SHA512
807c73303b7c5ec24b0f8cd776aa8d4128c4b3bbe526641bd3b128857f4ae07e899bfa564fa12691f4ec4501ceff50bed50a0277c0d27b6016e2bdc6aee5b7cc

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\dbg64.dll

Filesize
64KB

MD5
60f7d0bcf5cbc3d4dffa337066cf0aa0

SHA1
edd4c42c01b69056f7477b7d3cc560590c4417e3

SHA256
9d1eface19c37cac673d92cad73a147480c454a53b468c5d36b421e107c2f645

SHA512
979b7d98d2e0a3e038e0e65517407354fde3952d6e0a59ee479aaf362658d206eb1a42c1cb1d71e2ab6769fe0542d3a5c3bf87ddbd9d0dd6ac67428aac7ecf6c

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\dscu64.dll

Filesize
75KB

MD5
109fd06aba276cdae1ed9b2b3490dc24

SHA1
472f9dfdb27554b0cb76d7d0e3dd4525e2b30ed3

SHA256
cb66fd4850f7844fe7c7e84d88f7a161d1698fd6134b1c843483962089177e72

SHA512
acd34aaeb760661b5d85e74ca97d5e362ed60f72161058672189503daaf22665d85868114d475ba99616b6458fa77fac2f0fd88682cd5f19ad7b057beb54d6f6

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\dwarf64.dll

Filesize
475KB

MD5
a3c8d3521b77b40714b937d87a6349bd

SHA1
6cd7c46c063561fb2a27d1945a7b2a347d261c29

SHA256
e2a329a22fcfccf2bd2f01706a5874ac5e530ea8fc757059d24ab0647f4f96f1

SHA512
dd7a7b65714dcdef08138dd122bed45922d75aa1df89c4b2fe8ef2d3ed367fa39ee376b410a91fbeb5fdd6d007f0092b342685a22ca981ea4ea646487119ee9a

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\eh_parse64.dll

Filesize
135KB

MD5
d3eba16d384fbbca33988beb83bc1898

SHA1
6c83d956cb7d19b303dd2f49a20862f559234994

SHA256
8b20c5854787724c509c8df51be28e807f2c881097be93a0d01a0d8a7e3c8336

SHA512
369047cc8d6bdd4424521978efef080ed3765645f0f17aa82da30703990ee4d572207681157d2b3912a2711b97da2a6e43b3dffeff01aa0e4e76ce8ac6b2ef83

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\gdb_user64.dll

Filesize
281KB

MD5
52d8b292523d4b6e9f9109fb90380bb4

SHA1
ecad1a91c8e0ca3a3ce3f4d1df3960a3930dec78

SHA256
fca1912b61866018e6bdf0afb7cff781d7c546b071c3d67049661dc3ec8c79f9

SHA512
ea797ac9711aaec85c25c9a1cdb56c4a9e216a37e75c324253136db36607c6021e4ab528282366e144b6f92a0d16fc7efe4b75420032659f739856c8aae84c14

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\golang64.dll

Filesize
64KB

MD5
9c2cf23ce6b394b1f59d118cc5c35fec

SHA1
ff33bdf4609e6b2405834bb907b15e4ca6d6ca67

SHA256
eea1217dc317df9c781cf4f6b00362eeeb76ed82d70bef06bf685ae4927f0464

SHA512
c16c30a7d2f6c57a8b45589a6511d02f591412462da9640e76c60d004c4d9f1bb658f83c8405540052fecb5e30410d2fa8ec4f8ff15fd41bef7bc81a3ecebc1f

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\hexarm64.dll

Filesize
2.7MB

MD5
fe9afea4e43277427ce673e32d568bb3

SHA1
05d4c4192fd1d48500044e7da9071f1e7f2520e3

SHA256
a94b4825f3396f201ae1622075291c12d8a649e6312edf17edb62069d2214201

SHA512
1396a81d31d99b493951d3945df6c8f200275bb32d4c2a2d203fe4a01beed1a1577f90230043096f19b7f796c945934a83efc9dfab7b5687076339923659b3ca

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\hexppc64.dll

Filesize
3.0MB

MD5
dc973701bafe115015ed4dd37ee4ed4a

SHA1
17854c5e38c85c8c145eaf3082476a8e1aac6277

SHA256
b296a00f91facc4eff77fc58c345d0dfe603be7f3367c67d4af1f3d70bc7ea1f

SHA512
c2a25c3d7da89f4ac5c114db09e1f269d1f092b1df84984f00025093393e99eaa32efa43ab6f34e456f6681e01170db2dda2e3b89b6892932d741ecff9f0c40f

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\hexx64.dll

Filesize
2.7MB

MD5
2d668c55aa9c2f71065df0a4db16f832

SHA1
596ab0dc2ba9c90f8d4ab125695e60d4a90ac291

SHA256
be92a07b8ff5a3ef147b1b0df70dde977f2e97215d6a51e620304cc8a020ebd2

SHA512
65946ee251b117f2258f2abd27d76441a87681cd93a57381db236e94680707656d21f0e904346cf11b2d5332370a14926281dbfa26b600f05fd1a2083b0c5f06

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\idaclang64.dll

Filesize
109KB

MD5
e31dde71a2f27d4601c8d2e77838234e

SHA1
27714caa75877e26e95d93f8fb74d1b9950ec77a

SHA256
e45e8b7e1bf129de274d3c88a5cd83d352d21f8662e26b8dc3138cd2e8c4678c

SHA512
56529ca12cb34c81efe79e99da999d589f7212697224cc64d574049f38abd1cce8668abf01f423da5aeb3c9a441660eca5b9a9aa325aad9a2c3c85bd6fc8e2af

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\idapython3_64.dll

Filesize
102KB

MD5
a6725d1eb5068be4c501a5c348e5a4ff

SHA1
1e0449e30deec24f9e5619e64b54f1bf0ebc281d

SHA256
1f96d6e2264ed5fd5617cec7377d68b52435f8e7e89bef6e818bfa5a64a33388

SHA512
3a1fee527ee36f83df60831625159912617d8515e8cae923d4f1dbca6d5d84c2b80cc6bbdd491f6f7577e1d4d8ccc85951523beae2247244d7a1f90d4c7e1db1

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\plugins.cfg

Filesize
4KB

MD5
29d956afd57cdddc5e8ee8a4f3b9cd80

SHA1
76df8ff178649ef7e32a080acbd1de3fae6f1059

SHA256
59c21a32db68e02c8fcd7bbae59e05052e0eae9debcb9947e66bdbdd07aa648d

SHA512
32e569a90c1cfab11b5b5137e96639ee7925d5a11a2add92be7c43b82c5e591870cfb596e9e1c987b5912c7faffcc863dc93911c4e13ee9cef8f06bfa1e0ace5

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\plugins\styles\qwindowsvistastyle.dll

Filesize
136KB

MD5
cf345ed9ada7f58f5fb7ecf32f0795c4

SHA1
f82f0b7972cf5d0ed5a470a9ae7f096861383f81

SHA256
8117351508ec6dea8326959ca820a72abcd6517f4449d77469596e7f09f7a887

SHA512
848309a447feb636cda455cceaa3b4d5f45953c1be17b33995cc02409fe51690e80df138a87a9df4b0f79fbf52bde64d0b5ad8cae793a8dc524e71a90d768c95

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\qt.conf

Filesize
207B

MD5
afe6c730b47e00e3ff5f65b0756363f3

SHA1
bcfbc80905b6e9f597de0cc1d987d9200c446c80

SHA256
2518738eb7865283890de96021a55438468625d23e6b11fd09ae21d90265a83d

SHA512
ba82e4ddae268572b36cc1745fa39e0b468754ae2a8670f9f2ae91cecc4ccfffe7ee07b3db783a5f6a14c0e4fb744a5e89f748025872f2be7faea22d459d4407

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\themes\_base\theme.css

Filesize
11KB

MD5
04f2cc8b6c46ae80fbf9f1c8ff9b3839

SHA1
1c838c0604f66c15bfbcf100b9b9fd9357d86343

SHA256
f08d24a455ccd0a20d51bfae4005a0a9d5758bfe3701c82fa1e30ef224d18960

SHA512
1ee9d97820508e79db475c656f157151da3c54e1962a0348509dba1aec1b31ac537aa6686e5d475cd79732475881f30236a5808a9d6cc554292c5b6bf37c2c02

Download Submit
C:\Users\Admin\Desktop\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\themes\default\theme.css

Filesize
9KB

MD5
a17204d9a808905f551fb17bed094c99

SHA1
3d4e2a166242f7544ca089f868beec12c2213ef5

SHA256
fa425da8d82d2943fc3171482a1498f0f975a58dca54c26233aab6b51ed1221a

SHA512
9caed3f1495e1a16f3f224ec5b0421f4b9b6faabf56a6dbadbf0b77b6d3d443bce83e4c71c2a83f0b0c2d46f0940273ab96f5a1e255f8c9703fd4ca9605ab460

Download Submit
memory/5196-2741-0x00007FF7D1E00000-0x00007FF7D21FF000-memory.dmp

Filesize
4.0MB

Download
memory/5196-2739-0x00007FFD57A60000-0x00007FFD57FB6000-memory.dmp

Filesize
5.3MB

Download
memory/5196-2740-0x00007FF7D1E00000-0x00007FF7D21FF000-memory.dmp

Filesize
4.0MB

Download