Analysis Overview
SHA256
4608d913042d7412cf0f135d2d75b1046913d1a5e18597ec611fc3b8b8cf5337
Threat Level: Shows suspicious behavior
The file 7537755a6b3f1882ae89f4286d40b863_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
UPX packed file
Drops file in Program Files directory
Unsigned PE
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Modifies Internet Explorer settings
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-26 10:42
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-26 10:42
Reported
2024-05-26 10:44
Platform
win7-20240221-en
Max time kernel
141s
Max time network
142s
Command Line
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\PROGRA~2\is259395841.log | C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe | N/A |
Enumerates physical storage devices
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main | C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | os.call4freeapp.com | udp |
| US | 8.8.8.8:53 | static.gol-apps.com | udp |
| DE | 64.190.63.222:80 | static.gol-apps.com | tcp |
| US | 8.8.8.8:53 | os2.all-call4freeapp.com | udp |
| DE | 64.190.63.222:80 | static.gol-apps.com | tcp |
| US | 8.8.8.8:53 | rp.call4freeapp.com | udp |
Files
memory/2976-0-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-4-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-6-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2976-5-0x0000000000401000-0x000000000040B000-memory.dmp
memory/2976-3-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-112-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-113-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-115-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-116-0x0000000001D20000-0x0000000001E92000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ish259395326\bootstrap_28735.html
| MD5 | 1ea9e5b417811379e874ad4870d5c51a |
| SHA1 | a4bd01f828454f3619a815dbe5423b181ec4051c |
| SHA256 | f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a |
| SHA512 | 965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa |
C:\Users\Admin\AppData\Local\Temp\ish259395326\css\main.css
| MD5 | e59a57532b1c21d49b6291343e65422e |
| SHA1 | ec625dbaa8901412642c0100435434991c26e356 |
| SHA256 | 17478366b4f65029495054354ab5921c821970e54fde6af7f91fd05bb67fc42b |
| SHA512 | 87a30d0e1c586b038605404c39f838adade62db2cbe3b4bafd6e449573d91833e5b6f0fbf6409c30cf176dc9b46586dea7e1755d42adde76339ae10794dadb6e |
C:\Users\Admin\AppData\Local\Temp\ish259395326\css\sdk-ui\progress-bar.css
| MD5 | 5335f1c12201b5f7cf5f8b4f5692e3d1 |
| SHA1 | 13807a10369f7ff9ab3f9aba18135bccb98bec2d |
| SHA256 | 974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda |
| SHA512 | 0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df |
memory/2976-135-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-137-0x0000000001D20000-0x0000000001E92000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ish259395326\images\Color_Button_Hover.png
| MD5 | 97dce4b9ac73486feacecd8b4a3b9186 |
| SHA1 | c9aa6bf98fcf33e423cac9585f46fb661a2431e0 |
| SHA256 | 72b1ea3e029a939c6fc0851c422787319c61d3b9a1945b82e193ed255fbcdab2 |
| SHA512 | 2a86cbd94333a4750be7a6a53f0e655f4843cd4584eef5c8f8172ba25e88c0fda4f2e7d903d5cd76ed38a714a00305b5a29a620df1ef515b6949578d3108712f |
C:\Users\Admin\AppData\Local\Temp\ish259395326\images\Grey_Button_Hover.png
| MD5 | 0430f4b4f794e57c8d2b4b3b8866d2ce |
| SHA1 | 37d5844d964a4a486d6d3c8687dae03b224e13c6 |
| SHA256 | 84dd580b596a809dc8153a492b2ee8c5f176fed8d2947eab0dc3b3a172efe0c9 |
| SHA512 | bcf902320766e08d7cb7b4b8c6b84d6533fa593f0e8ce2a799b49c3cff0d49316fee8593587c4010878b83d550d502f6fabe0f4213bd0862dba46480468a60f5 |
C:\Users\Admin\AppData\Local\Temp\ish259395326\images\Close_Hover.png
| MD5 | aa5fc77754056e5cf059ae73ae3ffb93 |
| SHA1 | d6dea0e225dc926506c9c1bc8d9084cbaf7cc350 |
| SHA256 | cb4b816b428001c2756dc75791598a256ff2774c5dc9e87253ae77b5aaed8da0 |
| SHA512 | 1c61531ed01bd48af185450f64f6a908784a4846085044109cf18f385592f783ae6c9b99cffe95b4d6fc1108fc2cebdfeccca30a01c682f5d47b019429b0e8a6 |
memory/2976-158-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-157-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-156-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-164-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-165-0x0000000001D20000-0x0000000001E92000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ish259395326\images\Close.png
| MD5 | 75a9464e6e2e2d8efc82e5285ab0d95d |
| SHA1 | 03aa7ccf18666265cef894adc30aede977116405 |
| SHA256 | 7ec62b84d0c741b8e1f4c735ba37fd4dc889690590cf900073793b8d6e44cd0a |
| SHA512 | c52d190454e7d6fbafdd18960b5c95cc76da66ce02b7d0caf1eecc3335ae60b8aeb8b014be9adfaf46cafcdb7342029ec265d64576483cfc2b2439a514d9b63c |
C:\Users\Admin\AppData\Local\Temp\ish259395326\images\BG.png
| MD5 | a31945651b2074873313c82fbc8f9d1b |
| SHA1 | fe77de187d8da58d6bdf4b94189318b9fc13ad80 |
| SHA256 | fadc73a3d095e3d8628c92480d17917547d02b9e6a01294857f4a5a9848fc3a4 |
| SHA512 | a70a60e071d03f06281bcf868aff23067acd4229e7d4f2ba1a73e34ba7a46180dbfba1545fb2e65948e51c2d9bf1b9f24df730a5fd5b4f319de98a9de323763c |
C:\Users\Admin\AppData\Local\Temp\ish259395326\images\Grey_Button.png
| MD5 | 94cff096cae7f90af8db4d4113e5dafb |
| SHA1 | bf1daf81dd18c0fc72c403514b2880088549c689 |
| SHA256 | e6d91d3be5902fdb8f296d54631499df31d8ade6299dd78e902d7578b4d15e18 |
| SHA512 | 29360549eb7a722fd357e6f0ca5d06bddd05ff096e0a8301cf8d14c0195a3b3aed9351a8f2665199ecc9538b5c954738efcffdbd33654868fd2ba8a8355cf9a3 |
C:\Users\Admin\AppData\Local\Temp\ish259395326\images\Loader.gif
| MD5 | 57ca1a2085d82f0574e3ef740b9a5ead |
| SHA1 | 2974f4bf37231205a256f2648189a461e74869c0 |
| SHA256 | 476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e |
| SHA512 | 2d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c |
C:\Users\Admin\AppData\Local\Temp\ish259395326\images\Color_Button.png
| MD5 | 60147e3f18555ea3b6a8aa7f7d5ec4f7 |
| SHA1 | 52b308ab2c723c4a95a1218cf5f6d6d376ae50c9 |
| SHA256 | b7861c8b3c8aaf75c6b915f9b0fb561949de5625e713970639c9c7f52cc157f9 |
| SHA512 | e6a3d489bad7122dc81665ca59583401f2c6659aa0f61f969dd64247adce3eeb54719392f13baf09882f3bab6b5f7f28e3f663a1a921997218d4c7f0a29d93f8 |
memory/2976-166-0x0000000001D20000-0x0000000001E92000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ish259395326\images\Logo.png
| MD5 | 45d8e7f1e721db59eca3dc36e932bf8b |
| SHA1 | 974fbb730c8c1ae66c6187f99d887f44d8a77a56 |
| SHA256 | f8cfaea0b23c976a4e7a67ffe79dd82210c5fea7d6eba2383a3cc33f8802ae05 |
| SHA512 | 85b671dc81758977e5f807af91333573e1733ce8ca6721100dbe8538a481d8811d6d36754517948ff6a5ad984bb5ed0724790f43ba30dafdafb8c94735e249bc |
C:\Users\Admin\AppData\Local\Temp\ish259395326\images\text-bg.png
| MD5 | 9949492ba54aee4340b57282e05a978d |
| SHA1 | bed6e0f47e77858d54178467e15a0829fbade193 |
| SHA256 | 8721078a45e67b58a01633cf207467ad7c096a0cf23191ebbe3660c8256bb695 |
| SHA512 | f2e5adebf9d3c74c0adb5246ec5880be05ee265844afef3eb1ee92a8c26db273f15c8a534fced1485dca61ad2f96d1c625645172b44f34388d3a6afa0efa4414 |
C:\Users\Admin\AppData\Local\Temp\ish259395326\css\sdk-ui\images\progress-bg.png
| MD5 | e9f12f92a9eeb8ebe911080721446687 |
| SHA1 | 1fb34409373b6ce2abee20d60947f1357f30e248 |
| SHA256 | c1cf449536bc2778e27348e45f0f53d04c284109199fb7a9af7a61016b91f8bc |
| SHA512 | 1b213f089da5502986da85f21673a522b36ceb4aec26bb1dffa809c58511056602cc0b99ab21ab206e2466928be0cdee7c7a95b39dc1183d8cfb529a22fe07c8 |
memory/2976-186-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-187-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-188-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-189-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-190-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-191-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-192-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-193-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-195-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-197-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-199-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-200-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-201-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-202-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-203-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-204-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-206-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-205-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-209-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-208-0x0000000001D20000-0x0000000001E92000-memory.dmp
memory/2976-211-0x0000000001D20000-0x0000000001E92000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-26 10:42
Reported
2024-05-26 10:44
Platform
win10v2004-20240508-en
Max time kernel
140s
Max time network
132s
Command Line
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\PROGRA~2\is240601203.log | C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7537755a6b3f1882ae89f4286d40b863_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | os.call4freeapp.com | udp |
| US | 8.8.8.8:53 | static.gol-apps.com | udp |
| DE | 64.190.63.222:80 | static.gol-apps.com | tcp |
| US | 8.8.8.8:53 | 222.63.190.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | os2.all-call4freeapp.com | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 97.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| DE | 64.190.63.222:80 | static.gol-apps.com | tcp |
| US | 8.8.8.8:53 | rp.call4freeapp.com | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 91.90.14.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 52.111.227.14:443 | tcp | |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
Files
memory/4964-0-0x0000000000401000-0x000000000040B000-memory.dmp
memory/4964-1-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4964-5-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-6-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-2-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-112-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-114-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-113-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-115-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-116-0x0000000002290000-0x0000000002402000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ish240600031\bootstrap_36447.html
| MD5 | 1ea9e5b417811379e874ad4870d5c51a |
| SHA1 | a4bd01f828454f3619a815dbe5423b181ec4051c |
| SHA256 | f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a |
| SHA512 | 965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa |
C:\Users\Admin\AppData\Local\Temp\ish240600031\css\sdk-ui\progress-bar.css
| MD5 | 5335f1c12201b5f7cf5f8b4f5692e3d1 |
| SHA1 | 13807a10369f7ff9ab3f9aba18135bccb98bec2d |
| SHA256 | 974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda |
| SHA512 | 0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df |
C:\Users\Admin\AppData\Local\Temp\ish240600031\css\main.css
| MD5 | e59a57532b1c21d49b6291343e65422e |
| SHA1 | ec625dbaa8901412642c0100435434991c26e356 |
| SHA256 | 17478366b4f65029495054354ab5921c821970e54fde6af7f91fd05bb67fc42b |
| SHA512 | 87a30d0e1c586b038605404c39f838adade62db2cbe3b4bafd6e449573d91833e5b6f0fbf6409c30cf176dc9b46586dea7e1755d42adde76339ae10794dadb6e |
memory/4964-132-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-134-0x0000000002290000-0x0000000002402000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ish240600031\images\Color_Button_Hover.png
| MD5 | 97dce4b9ac73486feacecd8b4a3b9186 |
| SHA1 | c9aa6bf98fcf33e423cac9585f46fb661a2431e0 |
| SHA256 | 72b1ea3e029a939c6fc0851c422787319c61d3b9a1945b82e193ed255fbcdab2 |
| SHA512 | 2a86cbd94333a4750be7a6a53f0e655f4843cd4584eef5c8f8172ba25e88c0fda4f2e7d903d5cd76ed38a714a00305b5a29a620df1ef515b6949578d3108712f |
C:\Users\Admin\AppData\Local\Temp\ish240600031\images\Grey_Button_Hover.png
| MD5 | 0430f4b4f794e57c8d2b4b3b8866d2ce |
| SHA1 | 37d5844d964a4a486d6d3c8687dae03b224e13c6 |
| SHA256 | 84dd580b596a809dc8153a492b2ee8c5f176fed8d2947eab0dc3b3a172efe0c9 |
| SHA512 | bcf902320766e08d7cb7b4b8c6b84d6533fa593f0e8ce2a799b49c3cff0d49316fee8593587c4010878b83d550d502f6fabe0f4213bd0862dba46480468a60f5 |
C:\Users\Admin\AppData\Local\Temp\ish240600031\images\Close_Hover.png
| MD5 | aa5fc77754056e5cf059ae73ae3ffb93 |
| SHA1 | d6dea0e225dc926506c9c1bc8d9084cbaf7cc350 |
| SHA256 | cb4b816b428001c2756dc75791598a256ff2774c5dc9e87253ae77b5aaed8da0 |
| SHA512 | 1c61531ed01bd48af185450f64f6a908784a4846085044109cf18f385592f783ae6c9b99cffe95b4d6fc1108fc2cebdfeccca30a01c682f5d47b019429b0e8a6 |
memory/4964-152-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-154-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-153-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-158-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-160-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-162-0x0000000002290000-0x0000000002402000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ish240600031\images\Close.png
| MD5 | 75a9464e6e2e2d8efc82e5285ab0d95d |
| SHA1 | 03aa7ccf18666265cef894adc30aede977116405 |
| SHA256 | 7ec62b84d0c741b8e1f4c735ba37fd4dc889690590cf900073793b8d6e44cd0a |
| SHA512 | c52d190454e7d6fbafdd18960b5c95cc76da66ce02b7d0caf1eecc3335ae60b8aeb8b014be9adfaf46cafcdb7342029ec265d64576483cfc2b2439a514d9b63c |
C:\Users\Admin\AppData\Local\Temp\ish240600031\images\Grey_Button.png
| MD5 | 94cff096cae7f90af8db4d4113e5dafb |
| SHA1 | bf1daf81dd18c0fc72c403514b2880088549c689 |
| SHA256 | e6d91d3be5902fdb8f296d54631499df31d8ade6299dd78e902d7578b4d15e18 |
| SHA512 | 29360549eb7a722fd357e6f0ca5d06bddd05ff096e0a8301cf8d14c0195a3b3aed9351a8f2665199ecc9538b5c954738efcffdbd33654868fd2ba8a8355cf9a3 |
C:\Users\Admin\AppData\Local\Temp\ish240600031\images\Color_Button.png
| MD5 | 60147e3f18555ea3b6a8aa7f7d5ec4f7 |
| SHA1 | 52b308ab2c723c4a95a1218cf5f6d6d376ae50c9 |
| SHA256 | b7861c8b3c8aaf75c6b915f9b0fb561949de5625e713970639c9c7f52cc157f9 |
| SHA512 | e6a3d489bad7122dc81665ca59583401f2c6659aa0f61f969dd64247adce3eeb54719392f13baf09882f3bab6b5f7f28e3f663a1a921997218d4c7f0a29d93f8 |
memory/4964-171-0x0000000002290000-0x0000000002402000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ish240600031\images\BG.png
| MD5 | a31945651b2074873313c82fbc8f9d1b |
| SHA1 | fe77de187d8da58d6bdf4b94189318b9fc13ad80 |
| SHA256 | fadc73a3d095e3d8628c92480d17917547d02b9e6a01294857f4a5a9848fc3a4 |
| SHA512 | a70a60e071d03f06281bcf868aff23067acd4229e7d4f2ba1a73e34ba7a46180dbfba1545fb2e65948e51c2d9bf1b9f24df730a5fd5b4f319de98a9de323763c |
memory/4964-172-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-173-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-174-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-175-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-176-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-177-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-179-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-178-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-180-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-181-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-182-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-184-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-185-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-186-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-187-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-188-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-189-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-190-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-191-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-194-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-195-0x0000000002290000-0x0000000002402000-memory.dmp
memory/4964-196-0x0000000002290000-0x0000000002402000-memory.dmp