Analysis

  • max time kernel
    129s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-02-2025 18:26

General

  • Target

    IDA Professional 9.0.7z

  • Size

    353.1MB

  • MD5

    1b15082e880eab231a9f898c6de91192

  • SHA1

    f5e361702ea1151a41b9ad1a7e4e31394cb68051

  • SHA256

    cb3e2b8078d1a04b7c4a508971fcd98a3a5ab57fe3d203f60e8a62121d7dcac5

  • SHA512

    7b42baf3b02fd3a6032003ba5fc30e65776427938983444628be5ae98fe82aa8f35a1178e7ed8b180787b46478e569aef6123caa7a8652761a7228c2f28e9ca7

  • SSDEEP

    6291456:x/GYZAq+Jos/sy9A1O1u14vthMe38cwurYZw4mRqoX4kFayt+cORNaMDMEhvajLx:h3w/u1O1uCHMaT7YZwtJXY7cSo6hSjt

Score
10/10

Malware Config

Signatures

  • Industroyer 1 IoCs

    Contains code associated with parsing industroyer's configuration file.

  • Industroyer family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 61 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\IDA Professional 9.0.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2592
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4960
    • C:\Users\Admin\Desktop\IDA Professional 9.0\ida.exe
      "C:\Users\Admin\Desktop\IDA Professional 9.0\ida.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:576
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x2c8 0x2f4
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2928

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\7zE02A22E28\IDA Professional 9.0\plugins\ida_feeds\view\__init__.py

      Filesize

      15B

      MD5

      4a71c8cdf8acd75a540cd6a4e99cedf6

      SHA1

      552c9dbe889b6957bc94713a73cf62ffe04f9707

      SHA256

      7376a37be5e4c2b241345d8d667055d92323dbc2791761dae58f3a2706cf95c7

      SHA512

      2ca08dec2697f2d330b555466d9587c98272e831d2d852ae714fb95dd8b9fd5f8793ae239622dbea7cfa0c247cc9e4c33005fbcd92971a009d99c31fbf26f480

    • C:\Users\Admin\AppData\Local\Temp\7zE02A22E28\IDA Professional 9.0\python\PyQt5\python_3.12\sip.pyi

      Filesize

      2KB

      MD5

      659c59af4841ab542bc5ae43abe187c9

      SHA1

      838206246c95a4b673408c78fc6b294246d53913

      SHA256

      618cdf56d2935c762f32b9c73e5e998ddc471f5f70c4c5a980dc22386e898279

      SHA512

      e88d5cba70a86aee598d14305eb92baa9f22ba3f0c06ef108334f663413ab54c8a6dd9e57b13a31834a8e80cb86e455a97bfa806a1697ea39a639dca79be4aa6

    • C:\Users\Admin\AppData\Local\Temp\7zE02A22E28\IDA Professional 9.0\python\PyQt5\uic\port_v2\__init__.py

      Filesize

      548B

      MD5

      71014d6369472d3184315f736d945afc

      SHA1

      375858f197d1403c191670a3151ea51329ee75cd

      SHA256

      32bd356bf7687853a140d02a5c9df551bce86656ea6cc587161887be57dc0edc

      SHA512

      be351c9c6ddbfc23dc0bc1791321c066d250ade7ecb393e4b17ea9357810db368065ef601e7d469031cdac710bda8e824d55c7a32403d269084aed93ee4f9e6d

    • C:\Users\Admin\AppData\Local\Temp\ida\explorer.pdb\2D5193112E5C0D5E88DDA7CC028EF2C11\explorer.pdb

      Filesize

      5.4MB

      MD5

      d8666b3b2317de24795c2c7072a32f22

      SHA1

      03a433b684a4b5f2a5967445a1f9e9d94929af07

      SHA256

      a1421a4292f3f6d6a3c533f287188b9208a917acd369cc1ecc26823bee282d3b

      SHA512

      f179f6846fc8a72eb5023c9032b05fddfce26917f85766ad6fa06bbe6e9d5d23024a01a307f9fa996d3331caf8684cd0386f1e666775cff19929245578eb5c3a

    • C:\Users\Admin\Desktop\IDA Professional 9.0\Qt5Core.dll

      Filesize

      5.9MB

      MD5

      fd80d43e803c146d0718b811e96ef21b

      SHA1

      2d53fc58d9e752b9577fe1e78ac117d9d0703469

      SHA256

      695307903ccc11dd4972015bebb160b7f0ba414a95e8323e5788476e69e3f83c

      SHA512

      01c8a7c1b5fe6d752e237837e448cde3d52888d3d3bc2185bbbdd11557b512f1175ff7c2d3260cea7c7600f6ff263c730d7149fea25f334817541782eb3c1c13

    • C:\Users\Admin\Desktop\IDA Professional 9.0\Qt5Gui.dll

      Filesize

      6.6MB

      MD5

      367ada59863dde5902ac813c765c718b

      SHA1

      1c30b98f93d5fcb49a15ae22ac9ab1792a0cbfa4

      SHA256

      2b8df2fa3a3f75be898ad826e3698a562cd3cce71096ce0b0abf362be6ba57e2

      SHA512

      7d57df5c3a9d7de2969074a4ef59cbca6d51fa84de1bc76d5fa4e633b6aeef9f00351ea1774b67ac3565ae6c48e18f0e561487c60027326defb166f3229db057

    • C:\Users\Admin\Desktop\IDA Professional 9.0\Qt5PrintSupport.dll

      Filesize

      309KB

      MD5

      4cd655f4d826e8437b0415aa6c8d6550

      SHA1

      7611161c774c7c72b189b420772d2c65e2634e4a

      SHA256

      7b105ebf20c0b52259c00ff645f95f584bbe60b91c90de583785ac88b448e26d

      SHA512

      82745e4139f72f6843d0f4b588c2744b60a405e398f158319ee336758c09abfbced2f0ecc4e0a6d3e535384a9cbe69f89935b11a9b5857cc8f7deec00f044c6d

    • C:\Users\Admin\Desktop\IDA Professional 9.0\Qt5Svg.dll

      Filesize

      324KB

      MD5

      f3cd456d5fb9685304dbb53cc7b9ebaa

      SHA1

      8eadfaf8b8e8df16fba9e1dcc36d0ab3eb6c9f42

      SHA256

      62089b5a811c7c0cc408335dbafa0c7060cc9324c01595e011abd6ac2e868442

      SHA512

      03c3c24a95042b5e4337f2e093d219ebe3a3a05b8a78a8029550f1470c51b4433a60ca7d1000e238a3bfed51b6e6b112788a0663ea6618b4d052214749b4035c

    • C:\Users\Admin\Desktop\IDA Professional 9.0\Qt5Widgets.dll

      Filesize

      5.3MB

      MD5

      8b786869feb36930f8d6fd7be98ced2c

      SHA1

      f6fc979919df931af8fbeae54eff502663b2793c

      SHA256

      af337b316a39107944bdeb117798fd8ce02c3307fb415a371b6bc431d470a3e5

      SHA512

      9eaa2390abcceb7d69958be99c75dfd60edc464ea8018d3657a39846f40ecd6c6e48bfd750c48264047cff82b6aec398f63df5f70f0c95484a052913e845384a

    • C:\Users\Admin\Desktop\IDA Professional 9.0\cfg\idagui.cfg

      Filesize

      76KB

      MD5

      a6ec833fc2f936cc9cf678413c670a72

      SHA1

      a2b460ac23f390e8b58cc2220883473df5ae7486

      SHA256

      b4459f8d591ce8ce38d64acefc9563e85cfe8cb91fe6f68b3a23cbf029547bba

      SHA512

      f5e02a549fa57ca3d1aec7a8988513c8db5194e2f15174b980f480c37b3289f8ab1749d7ec68c1fc584fe243c0d95d2cca8bfa275f6bb3888a5dd65c39359955

    • C:\Users\Admin\Desktop\IDA Professional 9.0\dbgsrv\win32_remote32.exe

      Filesize

      718KB

      MD5

      8485b66af11c7a0985636e2d45e7597a

      SHA1

      862975bbdf036552d30801836de51784c8b7bd1d

      SHA256

      a99c59800e7f552a636c8402de52b00b8de00ae4abc9af404650a043a7656be9

      SHA512

      9cfbd5f40e83cbac8312003d73448657058ffa5a7fd492a05b469f3a7a3a1a8d66bac638a238ecfa0c149c76c15f2acd73fc609449c47125113bbfc8c2dfd9ef

    • C:\Users\Admin\Desktop\IDA Professional 9.0\ida.dll

      Filesize

      4.5MB

      MD5

      841ad6f0752199fbb3e1f0bed7762f62

      SHA1

      cdb78c1fb416dd02d8e331c097be547573e75243

      SHA256

      93b3014077366c1a4de5a1043a2775d66bc10d00af259b75d630e3393877ad6b

      SHA512

      e404d15f3cdd0854a83cd5b46f714c6a5084755623cb084a5b33b36d883fd250395d0410d45b5c871a69898bb18fb24563812e6f218a9ab25047f92b78ef44e1

    • C:\Users\Admin\Desktop\IDA Professional 9.0\ida.exe

      Filesize

      4.5MB

      MD5

      1f65e3ff946510525a32e5d72b1abbf7

      SHA1

      4b6b8d97aa8138b6f2bdd987e8cc3b444d58aeac

      SHA256

      9540cfe753fb5b98ebd9c54baea68834231a83844848076df07c16e95d306180

      SHA512

      cb0a3f29b6f7cd879f376ee90671aa9272b6cb58d76de3d7e9887f447214f4f6dfa7214230e1ad14e2939a847c0e7f365771054894b12f67944a56c6fa6615ec

    • C:\Users\Admin\Desktop\IDA Professional 9.0\ida.hlp

      Filesize

      1015KB

      MD5

      ea40ecdc43c8c006c97329ca4e4a236e

      SHA1

      3216379aa883d5551c0600aa648964cdf49ba336

      SHA256

      e57e9ebb7bef4a46789fc8d775f3efa55a16f9e638f3fe03bdeb9ad3a71b2386

      SHA512

      a11ba7670793fbf9e509ca7ab90a3206cca8794b3b8ea6cbe8862a4f6d75246dd1d9c77b0afeed563112254ab7cf83c3182e82861434a12243e4e6499566c3a9

    • C:\Users\Admin\Desktop\IDA Professional 9.0\idapro.hexlic

      Filesize

      2KB

      MD5

      f579b3ce020c8b1913819562adbfdc82

      SHA1

      325c78ff7a8a56e4337e65d563cedac09c16be61

      SHA256

      35325dc0914aa18c4f5d7bff456980876020ac2d5543699e4afddd1550284411

      SHA512

      0f275d9ba5cf5f9654fb0dcb2d4ac485b157cb224e647a8f535fa7554b5bc1df9564360c5a630528060102a86352f81ca44b93e8aaea765575edfffe19f7efd9

    • C:\Users\Admin\Desktop\IDA Professional 9.0\idc\idc.idc

      Filesize

      311KB

      MD5

      805b25bb68ab59fdd0dcf808ae41ad88

      SHA1

      e0b064babcf4ad826be7edc18021b94328dddaae

      SHA256

      8dc5b8591bbbac05c02a5ca3b3786f8a6492a9d9033643ff86a8ceefc9616944

      SHA512

      1de05f21dc05010878aa6633340514ddb5ca123203131bc9a6e9c2a87106f79decb1693c7fe645bb3b473f3f5967a0d94e6bff17294a5f22b884cf39f4762ee8

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\arm_mac_stub.dll

      Filesize

      181KB

      MD5

      1cceb01bdc38bb4012b594b30f63b421

      SHA1

      e26761be256aa36fc355a7eca9fb546f110cbabe

      SHA256

      ac23e37be819f3ca4af3dba570f17c57fe132abe500a37536963778fab787641

      SHA512

      85f5ec0c2f5d3ec345476a43f3a15103d5e1426818e3ddaa708db33f98a1136877dfe5e6862943c914ddcc72afd5a2fd099cd2f4d84f0ed2937de9effa008ebd

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\armlinux_stub.dll

      Filesize

      134KB

      MD5

      fecb71cdf56dfa51bbf250fa80c0b866

      SHA1

      6e1d8a92595ebe2d3a9518cba000be85b396d959

      SHA256

      0a094e451aa0be75caaee5e2e9771ef2c6d19d61fdcc3618eb4e3524e4eaf4c8

      SHA512

      5c66cfa1f99ceac12d605857b8aa26e833767e9d71c44ae32340b8dc290f26fba0871ec4c32cc4567e64937ce598e32ba1debb9749e01e3ca3ae41b1c3145a94

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\bdescr.dll

      Filesize

      20KB

      MD5

      859aa6cc652fface51bafcce57f800d3

      SHA1

      42b4033b0eb8cda96b8e8280afede3a41eb5de80

      SHA256

      f758beca47f559a38692b0ad1b33bbc76245a3cb600026f789d0534cecc7ae8d

      SHA512

      b9543fd40fdc6aa30b2593689ce86a2da98d36186d26d9b241b9df529faddc7eeda9a7e15195441eeb7ea1da1b9cd3b0472ae9837c3f9c6d6ff5f0e549579edc

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\bochs_user.dll

      Filesize

      300KB

      MD5

      6c4ab8e939dcd454eff73feec8fa738f

      SHA1

      9f30bf63684584baba4e26b730bbe70586f08717

      SHA256

      3739b0ca22084b74d8018cd7baae34cf0c58a4cacba76f1af577185819a15246

      SHA512

      4fcdeec28a845275a1209539871d9352e03deeb459e44d802bc06eadd16e81984654c0bed691a71490f14d78d285e353048c733d04080bd9305f37cf91c2c33b

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\callee.dll

      Filesize

      12KB

      MD5

      d29f77513d0e135cdf0c7f2d388ba7f9

      SHA1

      0d94ed69b515db48a7cd59c276b639d4de2b5cb5

      SHA256

      04dcc1205cc71db448536cf9be411f3a125769a29fffc2676400b908c7b77629

      SHA512

      a5c13c6dc82b33525144e379f8ca9a77f79462978b27d646dab9fe63f2337b03ea1548ff8ddd097fce538475da5f7bdd1fcc7b4eaaf55e5034872d58384fb8e7

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\comhelper.dll

      Filesize

      27KB

      MD5

      edb32add634383633ee23ac194dda717

      SHA1

      1e72c5a85b9c9dddc6ebe7d2b27e3e1a4d68ca58

      SHA256

      f49f033982741f63cae3e8c959b10c00cd8f59a696dfd3461b77da8375a40c80

      SHA512

      68e07ff7e8926185bcd031684e5225cf2f73cbc73800d40fa62e43356c018835e389f07495e08f39734cb64c674ca0c9d085fe4775a9d3e66ff381480159de8b

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\dalvik_user.dll

      Filesize

      365KB

      MD5

      b9542b300c03397af0ec733089386d61

      SHA1

      4613701a94d4e246293a7b639486064956425f11

      SHA256

      3b1497f9b572bcbcb5ddf201ba9d669a8a4989621db7e4ef505aaac0ed64ddc9

      SHA512

      2a7631ce3359dca590566998e6d32e4efb2314b4339206b6b22ce363adecff7ef010fe379cb3bf3ee8549f7e6c11da830f6aebe946c03311e6eadc511fdfead0

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\dbg.dll

      Filesize

      65KB

      MD5

      ebb2e1ecfdea15ccca4d4c29162fb1e4

      SHA1

      50b5e091a65a7b898659b92c01544874da069c65

      SHA256

      5dc96ae712fa474b526c36d0c64a59184aa21787bb929348e513dc053fa02e1a

      SHA512

      7e35994b6f837926f3959bcf5f56bb0a7c7832e2de21dbfbda44d30804a13bcba62afe84d33fd775175cb7bf0fc4f995b7e2744d81dc66c438a7db98ec95cb20

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\dscu.dll

      Filesize

      90KB

      MD5

      4d061b3411051574039f3dbb13b5ec46

      SHA1

      4a5a4e1edbe41856a1082acc45944bd138b4871f

      SHA256

      ef1a4bf2a3d1e65e1108ceb4e9dde6f4fdc47fbfa7314e0608b9edb0e5dcc58a

      SHA512

      1384da78a772fe1e41916a8d0c2d8b2fb5276cbab01afe2402c66ba68d49e25ad66a6bce3be3db9c6e1901591dcbd62fbf99cd97a5296845e43fc3e2137efa11

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\dwarf.dll

      Filesize

      553KB

      MD5

      553d32a546f97c7fef4a037475825868

      SHA1

      de6836c14bd14c6f3a1cc24819c9ffc18cdc4025

      SHA256

      eb62e320b20bea05644cf451279831c80eb89b4cb54cc8bfd4f18da1f235522b

      SHA512

      7ccb80b6edc09a77e918b63beaa486db6449ef8d1daa02960a8f3c93356ac334091cf2eb40c648fe5874acfffcb500c959132253a18b170045149530b78cf881

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\eh34.dll

      Filesize

      424KB

      MD5

      37e40dc1bd586a89a14fff56aa56a599

      SHA1

      3640ce94215f780868d3fdfc98dce715668e9f0e

      SHA256

      47b1cd6f522e28c746027a9e70061d1d18cb0694e1d9762510c79db11b9cf868

      SHA512

      8186f38b2aa1c5b152709fc8175609b2c3cc41b198b842753e0ed3bf46c1769df16e6808ae089ee3782fd4ed13eaf910137d7476bef408652b054f9cc5083153

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\eh_parse.dll

      Filesize

      145KB

      MD5

      f0f9f59a4958291add18ac00abd878fe

      SHA1

      bfe39e9c5976a19289e5866a3f73e0d8cfb07794

      SHA256

      c325a91d7729b8ba25ce7d3f43499c90ae7782d09b7738cf99fb62fc9f534211

      SHA512

      09ad3e626286fd88903158498ae49c4863dd54441e97ed6494842d1db3e9e7bc69638fb516b2fe66cfc1bfef4995b8b28a7f92b2003f060f855cbf9539eb663d

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\gdb_user.dll

      Filesize

      278KB

      MD5

      94ee61ea9b785084007bc612adfc7df0

      SHA1

      70c8821f6fa3a58896cb238c1d29e24de7cfcfd6

      SHA256

      ed2c682b7fda7af9a3cb9fe8936670f7995e94d2b880739b19c73668c2934189

      SHA512

      9882ca3621a6c32a899b92d9da7834edace597662cdad18615e313166fc7734bb653a72cb7ea603e778ee730e275aef2d3bf98681414e2f5483a4d8ab2518a6e

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\iconengines\qsvgicon.dll

      Filesize

      35KB

      MD5

      ed973fa567bc9c2b14ce5be86679f08b

      SHA1

      31f66ade30fddb3be4bed51bec2358f52acedd03

      SHA256

      2766cf3d89a52b10b8b3432b3a0b991a9a4b36a127bf00ee7cde995a50c46fb0

      SHA512

      4392c9d8a941e7a4d99f76a7f4572da43808141e57c3cc09df32740c6cd947e58de74a2db8b2ce9923b11ffa961fa1eb792b830ada5d797ae0ea7e746668fda1

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\ida_feeds\ida-plugin.json

      Filesize

      124B

      MD5

      030598a6e04e7f04a3c65e1bb90cf862

      SHA1

      f303c40e17e134616674c0b757086049ea70e13e

      SHA256

      d5c65f1c79b034b09946b7e2ecdef844b3e51ccf6b505ef4865a51204278383f

      SHA512

      edc0f623b99bd06536df25d7ffd28aeaefc8b338fb9094d1f3bd44de0600c957a82fd7c2d26be7174919918e9235b5bc9a0025c5ab131d0e2830f9984c2b49b5

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\imageformats\qgif.dll

      Filesize

      32KB

      MD5

      69c91874901919939fd596b09ca4885c

      SHA1

      5d328548b7457d4a60ebfa0b1baefacded626db3

      SHA256

      2580357f70041ba91a0da045e74bba8909bb1bbcd85e65c941bdc0ea38176bba

      SHA512

      7ede554c246d000e7e3a793cfb4319c9877d9e3a49eff81ca47e44df4f3ffa120ac7a34b15c8e4fe1229616934cb1042e621f53ce5016b36567be4c8ab6af153

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\imageformats\qjpeg.dll

      Filesize

      405KB

      MD5

      2755b62dcd497e2b2caea16e49c231b4

      SHA1

      930d1432c58ea717d058369a63f4e49998af8b29

      SHA256

      ac85edeacd9d45beb81101c47120c3828d8d62b5d19dbda926466efc18e14261

      SHA512

      1df860d2a95e205f916c0005405cebac3b9c779abb7e748688ec14cd21cc2e49e31db46d53b03c131b9d1ba687de77d1876a5044ba4e4b80a875ce4d3e48d5ec

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\imageformats\qsvg.dll

      Filesize

      25KB

      MD5

      10be44153141b7f342a98371464e9327

      SHA1

      6d2b21d0a28382d85a1872ca964c0693a3caff0d

      SHA256

      9cc9cfb7db2cbd70e199c32456186e7ded266fe30e450207387494101a44a99b

      SHA512

      05c615b9866c63bf56270e844f83d0feb6483b38bdb1f6ad0b3f56070c6b29a118bf78711f9256d3b1c5ee20292d88332f00b89ec9a6e943ba2c80f108385f63

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\platforms\qwindows.dll

      Filesize

      1.4MB

      MD5

      d806c1f1e1ae1f2a4481d15d57035d19

      SHA1

      bd3b915558020550736946de5c06cb635a706a0c

      SHA256

      49f621f2e5a8b3907099ec0ecc65f3519a5105b8446d7ac451a0ad7359fb7d22

      SHA512

      8df43f5da8dbf6961b2f592e2a1fb2b5ee279b44129a6f732e932d00e41eb7ffd083e5013a33860a791a769282011d23e86196e0a85a207b46afe2d7ed07a341

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\plugins.cfg

      Filesize

      5KB

      MD5

      924f9a5a43200018262ee034d1432c43

      SHA1

      d3903d0f6a8a4f8d6a71af51c61bfd8ed86ff3f1

      SHA256

      e9bc059a7e7b801b4514df206329e54190cc70de66057df1607b9fe54678792a

      SHA512

      01d817b5fff3905e88b9345478642b52b3c6d7815421ad2b3045ecc5012a22664fc2c09991491bdffe752ade9d641b6163b3a8c4e01785a1283421dba91dc56f

    • C:\Users\Admin\Desktop\IDA Professional 9.0\plugins\styles\qwindowsvistastyle.dll

      Filesize

      136KB

      MD5

      32e85e3303bb5675747fef26fc744089

      SHA1

      f5b5a1c9834a244ca73368c3ffda1e7aeed1dd04

      SHA256

      b7bb8a6ce946cd9fd74644aac3152ee8130875201ff174662a7f5fc28d1588ef

      SHA512

      413c5cec9a198bc43769fa33da7843ebfa4e73d676132d08c8ba076c37477c2c4cdb2cf2ef73905bb805d5348577e61187bae6ef61227c104703f00a193e99f0

    • C:\Users\Admin\Desktop\IDA Professional 9.0\qt.conf

      Filesize

      212B

      MD5

      b94a2770e638de7b863b8edf907e9b1b

      SHA1

      7ffa722fc4db9b413f9a2364ce8dfd4afcf678de

      SHA256

      2b946593df3a65ab7d2bc4d5ab26606a829260de2b2441299e1bbcebc33f4722

      SHA512

      fad27a4cf44b45e39fa2d03a5fd9ebb8c4119ee00d3d0b58cc712492a3b5d1fac31cfd02480b7e2249eddb9a3cf873c1fa84c531242d00266df69e7dcd15fa44

    • C:\Users\Admin\Desktop\IDA Professional 9.0\themes\_base\theme.css

      Filesize

      37KB

      MD5

      f0f4720c44329562b51c001afd160631

      SHA1

      3fb9456734ec3bbfd443cb026b423f91007e2ab7

      SHA256

      6281896174b57dbc20660d94798642a6a0ce73c00ccedb2df01e160b0dfd2055

      SHA512

      f6fd38bb6976119557833cd0c4583acaa100a1d4c59b23e4714f1eb837115516a244eab46d9dca759b4768e3912beeb566dc147e5f94d45f18df8aa12d76d34c

    • C:\Users\Admin\Desktop\IDA Professional 9.0\themes\default\theme.css

      Filesize

      9KB

      MD5

      6bc29f8e1d3d7619680d7a9f7c602f11

      SHA1

      58e9fff92595fe743468d5e11fe68a76949af83e

      SHA256

      658b5a16e75bfa8cbb8da350fabbc2b34524a99072dead9c715b79277f14e324

      SHA512

      3d2e811841a7321e0df53fdcd416896e64c8098acd0e6ab24e5c281faf1bd837f4a6575f7f89dbc02505f311552a93d4c871d619cddbc78e93e1c6aece86a2a6

    • C:\Windows\explorer.exe.id0

      Filesize

      16KB

      MD5

      cc64769cac3bf5752d58e6683d6bd581

      SHA1

      c45fe8a1c32343dedab5df71c17be8210762768d

      SHA256

      bdc2d88816dc006ce36dc4633946ccd5e00676ff57a19f9262fff85724568a7f

      SHA512

      253124f1e21f5b3f50ea71c2305c05b63a888c86029885a83e506e579f8d05b52d9c2882a6011bbf2553765a6b126ab42ddb592986c5288431af777453829fc1

    • C:\Windows\explorer.exe.id0

      Filesize

      16KB

      MD5

      404220e28dc0873e753bd230e316dbfe

      SHA1

      76e5b250c1e4949a330b5c843e35fd87c1cb8c1b

      SHA256

      cfe656a0c8f075b74f5d186e7b619f0434768140fd7086e162ab2f46331532e1

      SHA512

      165377d53c27a457562d593b897f20733dbe27a1392c45d95e9168bc01783035fd35737f6b1a8fb3b249c545225f2cb011dc6c92ef6259e41243e791adc808d6

    • memory/576-2139-0x00007FF7D9C50000-0x00007FF7DA0DA000-memory.dmp

      Filesize

      4.5MB

    • memory/576-2137-0x00007FFAE2CD0000-0x00007FFAE3228000-memory.dmp

      Filesize

      5.3MB

    • memory/576-2136-0x00007FF7D9C50000-0x00007FF7DA0DA000-memory.dmp

      Filesize

      4.5MB

    • memory/576-2241-0x0000018EEBA00000-0x0000018EEC93B000-memory.dmp

      Filesize

      15.2MB