Malware Analysis Report

2024-10-10 12:13

Sample ID 240613-s41nfavdkh
Target a64ee9fea4c0059d84167d9591b32451_JaffaCakes118
SHA256 30bb3081ce91d763d3bec5536a317405ca0ed766e03f288ae67971a7db842cd0
Tags
upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

30bb3081ce91d763d3bec5536a317405ca0ed766e03f288ae67971a7db842cd0

Threat Level: Shows suspicious behavior

The file a64ee9fea4c0059d84167d9591b32451_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx

UPX packed file

Unsigned PE

Enumerates physical storage devices

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 15:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 15:41

Reported

2024-06-13 15:44

Platform

win7-20240611-en

Max time kernel

141s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a64ee9fea4c0059d84167d9591b32451_JaffaCakes118.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\a64ee9fea4c0059d84167d9591b32451_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a64ee9fea4c0059d84167d9591b32451_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a64ee9fea4c0059d84167d9591b32451_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a64ee9fea4c0059d84167d9591b32451_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 os.findmysoftcdn.com udp
US 8.8.8.8:53 img.findmysoft.com udp
FR 18.155.129.126:80 img.findmysoft.com tcp
US 8.8.8.8:53 os2.findmysoftcdn.com udp

Files

memory/2436-177-0x0000000001CF0000-0x0000000001E36000-memory.dmp

memory/2436-172-0x0000000001CF0000-0x0000000001E36000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ish259414936\images\Color_Button_Hover.png

MD5 ac11cac54db0b8e50857b8c9e0ed38b6
SHA1 79abddbb07090f8a202cc3bf24da90d40f3f6b7f
SHA256 adc677756d48d37b04f6037cf5bce59827f641cdc5486145d2fb2531bc716110
SHA512 d2b89a046ad3ebf761650b125820e8d0c7f7b3aae1c7bc7035ddd5cb9e8fe79b5ff66d9c158f7ab23c0ec758daa36148cbe8dac865cb97519cbef673e97b6953

C:\Users\Admin\AppData\Local\Temp\ish259414936\images\Grey_Button_Hover.png

MD5 343cc1f93470dfe85577496fbfed9f4f
SHA1 9e56ab526a5d38338ebd760f823852df5b427d57
SHA256 e3ef305484ef1ccd265f66b3d191126d3623b3332a56f1768601eae161db3273
SHA512 2afd7ccfe8336f37cc2f4ff802e808db707a1db8265c70386197f277e33a75938488cc19aa2d0a888430bed6a6af86a0c38d4f86c4bee89a714f3c8f00e622eb

C:\Users\Admin\AppData\Local\Temp\ish259414936\images\Close_Hover.png

MD5 27d0485083d69891fc70b9314443d3d7
SHA1 3af5a1298db111b424494cb2e6954963bca3d39e
SHA256 26ef55e3696f11ef9681a89902d1de534519ff34b841dfccbc72c3b7de26f4d6
SHA512 55a223a6a8ea3620878f568a872196b1401a2cb4383655edd8f0333e42735509840b095bfdb93b7fd37c27cb43e6e93b936090dd8a98a90ae86213c44960bcdf

C:\Users\Admin\AppData\Local\Temp\ish259414936\locale\EN.locale

MD5 b21463b02d9f62e12a80613f0162bda2
SHA1 c0ee51497e8d2c033815d8a55aa9ac4dadde3d9c
SHA256 2c8a3ff84272890d2108131dfb50db6379982476bb7c98259102552b29e59d93
SHA512 5f40bc689589f006ab85d6c883da9ef8e3b5c805b5eed0b6d53a9e4df620689da75a756d92b232fe60d4838a43f24b3ee2222265914789b73baa8e5e6e8c1eb3

memory/2436-159-0x0000000001CF0000-0x0000000001E36000-memory.dmp

memory/2436-158-0x0000000001CF0000-0x0000000001E36000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ish259414936\images\Progress.png

MD5 1b4b78615845f86fd9d95c6876c905df
SHA1 d4199e4d119baec3cccdfabeb9181f65051eb105
SHA256 f630e46db176536ff5db2464dc3107388e291be40bee1cb388dc27daa481e922
SHA512 8a2f273d5765b14054fc10e7502f3b1a696ab5829a02f3c2119ad2e23587475f55c21099e9b769c5340795f7b419a4e8f0b5db00e5d271a013becde79f9b352b

C:\Users\Admin\AppData\Local\Temp\ish259414936\images\ProgressBar.png

MD5 a98a91b33fc8c1c9ddb7732c0e6b29ba
SHA1 cf84f1f5e26f510d38a1c0d7ca351e2bc4b4e55d
SHA256 3834424d014a0bc65a5a2751a8ef8619d8b13772410a03a6916d994089c445c3
SHA512 55b51a08f8857660ad175daa4e8576bf3dc9cc15b767ac3450e5c5e75d7586732fd461c41be6e1eb97487bbc012e1fd9273d6c7bb7bfa35b609612e06198d9c6

C:\Users\Admin\AppData\Local\Temp\ish259414936\images\Loader.gif

MD5 57ca1a2085d82f0574e3ef740b9a5ead
SHA1 2974f4bf37231205a256f2648189a461e74869c0
SHA256 476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e
SHA512 2d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c

C:\Users\Admin\AppData\Local\Temp\ish259414936\images\Minimize.png

MD5 6995d7db5dfe576a1356648b99c6c918
SHA1 7433c1d1090f7b7006cea3646a51d62a06d58a02
SHA256 9f297975c99fec7a5252d72263ab9da224a4f039a77bb4a15a252748a3733614
SHA512 3a0f6a2be7bd8d1fbcc0d37b39babf8775bbcf8d9f9e4556ee41a3726a04251c497b64601585ba8b404f060c0343699429097719f472c5cc058d5168e73b8e1c

C:\Users\Admin\AppData\Local\Temp\ish259414936\images\Close.png

MD5 d65ed2e9d0bb66550d84fb6ab569401d
SHA1 0df6eedbb892a9dcf68121c92767e359b0092324
SHA256 8678b6a240aafa4bf2ff6928feba89ad92ec229540a2a2f889061b567fe37328
SHA512 5b3db5e33d85edb5aec7c47eb3ba1a4e2e5a31a80119bb68fd938def45e64be2b631898c84ea6602018ed2a0b1616a787b932de0632508da272866e4c83c176f

C:\Users\Admin\AppData\Local\Temp\ish259414936\images\Color_Button.png

MD5 abdd4ce79215e0921025714607d261cf
SHA1 19228559e3b02c15bd12a5a66b8566b2760faa56
SHA256 6eca7c9ff5152f1f60bd6bee19cbe719ae6f7632a6b6281a89b3865810257362
SHA512 7eea73d23532ae612718a1ada04406b0ec12a546e356d715b88958adf4245534801c0c05a2e64a18c37ee1feb52ea2adef68aed365f0293b3c7e904e8627c01c

C:\Users\Admin\AppData\Local\Temp\ish259414936\images\Close_Button.png

MD5 b80852fc14db25942c4122e457a9c5eb
SHA1 97cb368f2fd9640a797841d66d436af55a61413b
SHA256 37c9568fd0117037e586b743cdff334d03e01a14d1c6bbf9db3616427913a15f
SHA512 ccdfbab89780b2bd803060013fdf95f0955bf71401833373f81b0bbf1f4bea0ffe239be6deb442e7559e3c48e071eb326ebf6236c79ba9cba1da6172b134091c

C:\Users\Admin\AppData\Local\Temp\ish259414936\images\Grey_Button.png

MD5 cb9de40388f86b42c5fc933a0e356a54
SHA1 0309e586995caec71e039cd2bdd159577b0e9f02
SHA256 5fcf1fcef7f9d970d81e3bed101b4fa14a9a770170cd133891bc4787fc5c4bb4
SHA512 2daabc183258793aa1a62bc8740b3c2c39deca93da18822609e13c550ce188e13c8b3f17224617567fe3c8d9a09ab04becaae38120f9b5383cd7fc72a69d6166

C:\Users\Admin\AppData\Local\Temp\ish259414936\images\sponsored.png

MD5 e3758d529f93fee4807f5ea95fbc1a6c
SHA1 3a9a1ba234e613e5f808c3ffeda05a10a5dafe00
SHA256 8d46eb0c60043dcb7d79ab3d0525148fc901764620c02e4b9c5dd8b0e9026303
SHA512 e891552bee3aa10247cad1fcc510331077016a6e71d46827be2dd46017f943c5acc2c1506b41217880d35d52a94989923ad0a345f8791da4bb379eceefe3c407

C:\Users\Admin\AppData\Local\Temp\ish259414936\images\Quick_Specs.png

MD5 07cd59b954e8495ad6cd6a7c11d2de86
SHA1 787aeda3eee8053705fb208a6b399b8340820b82
SHA256 6e6b964fd79b4a3461f128e2ed145b9b641d108b8616695f36387661cae995bb
SHA512 0159aca0c2a49393fd91acd4b6819217e67f8fd01e220297eb3e0fdd8132fad794fc317f5cc5e2b761d4123da71478b97df776908de6740eb6d54187c6c00754

C:\Users\Admin\AppData\Local\Temp\ish259414936\images\BG.png

MD5 15b4c95b98b6a6eef7b273fec63cc8d3
SHA1 ccf4fe8d7accd596b731a7f0938c086a7230610e
SHA256 351d97fcea98b32c3ea217f831e046305e6bbaf63d481de6e3adb771cd93d5c1
SHA512 f6b0d1328f0c8ec07116416c6a50d479b166df271ce0cf481b9cc08bbed995c5ac085f14650c456e9bc99e708d6b6f2013a590ac87055350ed5ef89d03e0cb17

C:\Users\Admin\AppData\Local\Temp\ish259414936\images\default_wi.png

MD5 1cc2677e3e29e45e538985839cff2b42
SHA1 2dab653eb20be72b034a38dc1fcebbd18f079c86
SHA256 9216d98a6574dfadacdc8321dc435454cb72c589b3ee8326a9b946966f756d7f
SHA512 25575fea9abb1491b5a5853244a9b655ce05f64d98f4b79134674f2d9a560a5af405c1783c9da4a07cfb38b51d060c7a70890c70df6c1c8f4b01e041aa4f649f

C:\Users\Admin\AppData\Local\Temp\ish259414936\images\default_tb.png

MD5 70e70599d4b853df0f12f6cb0e04695f
SHA1 6e3a721aef65625bf99b639800476150d262dd4b
SHA256 87af4027e8f89459463bdd73df7b928b883eefb20514159d3a1a4be0d39e00c0
SHA512 1efcf8af09cf857b3850cec43a88fc8c0992e3b04f78ad2c71b84c2ac7775e745df211582694588b29217aefb1ae02b29b94c2cfe52b5d32bdafb9dce73b9920

C:\Users\Admin\AppData\Local\Temp\ish259414936\css\main.css

MD5 1f34626a3b3083a7d8bb853c9e4c62c6
SHA1 b363f2f5aa019af9d12857c6cab49ad51b566e1d
SHA256 f5c43989fd7d7c8b03c321926ae5acd0c1981fa17e7eaaa0c850edd345d658a3
SHA512 4f8f67ea21a02a2f8c5f6fe4610a0ca9d3a23b69f3cbbaccff4a00c284a3629ad3adbdcb3768e386f3e9505dd67a2bad4fe1741c655d2f7c64b45531f24d14a2

C:\Users\Admin\AppData\Local\Temp\ish259414936\css\sdk-ui\progress-bar.css

MD5 5335f1c12201b5f7cf5f8b4f5692e3d1
SHA1 13807a10369f7ff9ab3f9aba18135bccb98bec2d
SHA256 974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda
SHA512 0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df

C:\Users\Admin\AppData\Local\Temp\ish259414936\bootstrap_48679.html

MD5 1ea9e5b417811379e874ad4870d5c51a
SHA1 a4bd01f828454f3619a815dbe5423b181ec4051c
SHA256 f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
SHA512 965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

memory/2436-113-0x0000000001CF0000-0x0000000001E36000-memory.dmp

memory/2436-112-0x0000000001CF0000-0x0000000001E36000-memory.dmp

memory/2436-111-0x0000000001CF0000-0x0000000001E36000-memory.dmp

memory/2436-110-0x0000000001CF0000-0x0000000001E36000-memory.dmp

memory/2436-109-0x0000000001CF0000-0x0000000001E36000-memory.dmp

memory/2436-3-0x0000000001CF0000-0x0000000001E36000-memory.dmp

memory/2436-6-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2436-5-0x0000000000401000-0x000000000040B000-memory.dmp

memory/2436-4-0x0000000001CF0000-0x0000000001E36000-memory.dmp

memory/2436-0-0x0000000001CF0000-0x0000000001E36000-memory.dmp

memory/2436-179-0x0000000001CF0000-0x0000000001E36000-memory.dmp

memory/2436-181-0x0000000001CF0000-0x0000000001E36000-memory.dmp

memory/2436-183-0x0000000001CF0000-0x0000000001E36000-memory.dmp

memory/2436-185-0x0000000001CF0000-0x0000000001E36000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 15:41

Reported

2024-06-13 15:44

Platform

win10v2004-20240508-en

Max time kernel

141s

Max time network

60s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a64ee9fea4c0059d84167d9591b32451_JaffaCakes118.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\a64ee9fea4c0059d84167d9591b32451_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a64ee9fea4c0059d84167d9591b32451_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

memory/2724-1-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2724-0-0x0000000000401000-0x000000000040B000-memory.dmp

memory/2724-5-0x0000000002130000-0x0000000002276000-memory.dmp

memory/2724-6-0x0000000002130000-0x0000000002276000-memory.dmp

memory/2724-2-0x0000000002130000-0x0000000002276000-memory.dmp

memory/2724-109-0x0000000002130000-0x0000000002276000-memory.dmp

memory/2724-110-0x0000000002130000-0x0000000002276000-memory.dmp

memory/2724-112-0x0000000002130000-0x0000000002276000-memory.dmp

memory/2724-111-0x0000000002130000-0x0000000002276000-memory.dmp

memory/2724-113-0x0000000002130000-0x0000000002276000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ish240601765\bootstrap_21088.html

MD5 1ea9e5b417811379e874ad4870d5c51a
SHA1 a4bd01f828454f3619a815dbe5423b181ec4051c
SHA256 f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
SHA512 965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

C:\Users\Admin\AppData\Local\Temp\ish240601765\css\sdk-ui\progress-bar.css

MD5 5335f1c12201b5f7cf5f8b4f5692e3d1
SHA1 13807a10369f7ff9ab3f9aba18135bccb98bec2d
SHA256 974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda
SHA512 0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df

C:\Users\Admin\AppData\Local\Temp\ish240601765\css\main.css

MD5 1f34626a3b3083a7d8bb853c9e4c62c6
SHA1 b363f2f5aa019af9d12857c6cab49ad51b566e1d
SHA256 f5c43989fd7d7c8b03c321926ae5acd0c1981fa17e7eaaa0c850edd345d658a3
SHA512 4f8f67ea21a02a2f8c5f6fe4610a0ca9d3a23b69f3cbbaccff4a00c284a3629ad3adbdcb3768e386f3e9505dd67a2bad4fe1741c655d2f7c64b45531f24d14a2

C:\Users\Admin\AppData\Local\Temp\ish240601765\images\default_tb.png

MD5 70e70599d4b853df0f12f6cb0e04695f
SHA1 6e3a721aef65625bf99b639800476150d262dd4b
SHA256 87af4027e8f89459463bdd73df7b928b883eefb20514159d3a1a4be0d39e00c0
SHA512 1efcf8af09cf857b3850cec43a88fc8c0992e3b04f78ad2c71b84c2ac7775e745df211582694588b29217aefb1ae02b29b94c2cfe52b5d32bdafb9dce73b9920

C:\Users\Admin\AppData\Local\Temp\ish240601765\images\default_wi.png

MD5 1cc2677e3e29e45e538985839cff2b42
SHA1 2dab653eb20be72b034a38dc1fcebbd18f079c86
SHA256 9216d98a6574dfadacdc8321dc435454cb72c589b3ee8326a9b946966f756d7f
SHA512 25575fea9abb1491b5a5853244a9b655ce05f64d98f4b79134674f2d9a560a5af405c1783c9da4a07cfb38b51d060c7a70890c70df6c1c8f4b01e041aa4f649f

C:\Users\Admin\AppData\Local\Temp\ish240601765\images\Minimize.png

MD5 6995d7db5dfe576a1356648b99c6c918
SHA1 7433c1d1090f7b7006cea3646a51d62a06d58a02
SHA256 9f297975c99fec7a5252d72263ab9da224a4f039a77bb4a15a252748a3733614
SHA512 3a0f6a2be7bd8d1fbcc0d37b39babf8775bbcf8d9f9e4556ee41a3726a04251c497b64601585ba8b404f060c0343699429097719f472c5cc058d5168e73b8e1c

C:\Users\Admin\AppData\Local\Temp\ish240601765\images\Close.png

MD5 d65ed2e9d0bb66550d84fb6ab569401d
SHA1 0df6eedbb892a9dcf68121c92767e359b0092324
SHA256 8678b6a240aafa4bf2ff6928feba89ad92ec229540a2a2f889061b567fe37328
SHA512 5b3db5e33d85edb5aec7c47eb3ba1a4e2e5a31a80119bb68fd938def45e64be2b631898c84ea6602018ed2a0b1616a787b932de0632508da272866e4c83c176f

C:\Users\Admin\AppData\Local\Temp\ish240601765\images\Color_Button.png

MD5 abdd4ce79215e0921025714607d261cf
SHA1 19228559e3b02c15bd12a5a66b8566b2760faa56
SHA256 6eca7c9ff5152f1f60bd6bee19cbe719ae6f7632a6b6281a89b3865810257362
SHA512 7eea73d23532ae612718a1ada04406b0ec12a546e356d715b88958adf4245534801c0c05a2e64a18c37ee1feb52ea2adef68aed365f0293b3c7e904e8627c01c

C:\Users\Admin\AppData\Local\Temp\ish240601765\images\Close_Button.png

MD5 b80852fc14db25942c4122e457a9c5eb
SHA1 97cb368f2fd9640a797841d66d436af55a61413b
SHA256 37c9568fd0117037e586b743cdff334d03e01a14d1c6bbf9db3616427913a15f
SHA512 ccdfbab89780b2bd803060013fdf95f0955bf71401833373f81b0bbf1f4bea0ffe239be6deb442e7559e3c48e071eb326ebf6236c79ba9cba1da6172b134091c

C:\Users\Admin\AppData\Local\Temp\ish240601765\images\Grey_Button.png

MD5 cb9de40388f86b42c5fc933a0e356a54
SHA1 0309e586995caec71e039cd2bdd159577b0e9f02
SHA256 5fcf1fcef7f9d970d81e3bed101b4fa14a9a770170cd133891bc4787fc5c4bb4
SHA512 2daabc183258793aa1a62bc8740b3c2c39deca93da18822609e13c550ce188e13c8b3f17224617567fe3c8d9a09ab04becaae38120f9b5383cd7fc72a69d6166

C:\Users\Admin\AppData\Local\Temp\ish240601765\images\sponsored.png

MD5 e3758d529f93fee4807f5ea95fbc1a6c
SHA1 3a9a1ba234e613e5f808c3ffeda05a10a5dafe00
SHA256 8d46eb0c60043dcb7d79ab3d0525148fc901764620c02e4b9c5dd8b0e9026303
SHA512 e891552bee3aa10247cad1fcc510331077016a6e71d46827be2dd46017f943c5acc2c1506b41217880d35d52a94989923ad0a345f8791da4bb379eceefe3c407

C:\Users\Admin\AppData\Local\Temp\ish240601765\images\Quick_Specs.png

MD5 07cd59b954e8495ad6cd6a7c11d2de86
SHA1 787aeda3eee8053705fb208a6b399b8340820b82
SHA256 6e6b964fd79b4a3461f128e2ed145b9b641d108b8616695f36387661cae995bb
SHA512 0159aca0c2a49393fd91acd4b6819217e67f8fd01e220297eb3e0fdd8132fad794fc317f5cc5e2b761d4123da71478b97df776908de6740eb6d54187c6c00754

C:\Users\Admin\AppData\Local\Temp\ish240601765\images\Progress.png

MD5 1b4b78615845f86fd9d95c6876c905df
SHA1 d4199e4d119baec3cccdfabeb9181f65051eb105
SHA256 f630e46db176536ff5db2464dc3107388e291be40bee1cb388dc27daa481e922
SHA512 8a2f273d5765b14054fc10e7502f3b1a696ab5829a02f3c2119ad2e23587475f55c21099e9b769c5340795f7b419a4e8f0b5db00e5d271a013becde79f9b352b

C:\Users\Admin\AppData\Local\Temp\ish240601765\images\ProgressBar.png

MD5 a98a91b33fc8c1c9ddb7732c0e6b29ba
SHA1 cf84f1f5e26f510d38a1c0d7ca351e2bc4b4e55d
SHA256 3834424d014a0bc65a5a2751a8ef8619d8b13772410a03a6916d994089c445c3
SHA512 55b51a08f8857660ad175daa4e8576bf3dc9cc15b767ac3450e5c5e75d7586732fd461c41be6e1eb97487bbc012e1fd9273d6c7bb7bfa35b609612e06198d9c6

C:\Users\Admin\AppData\Local\Temp\ish240601765\images\BG.png

MD5 15b4c95b98b6a6eef7b273fec63cc8d3
SHA1 ccf4fe8d7accd596b731a7f0938c086a7230610e
SHA256 351d97fcea98b32c3ea217f831e046305e6bbaf63d481de6e3adb771cd93d5c1
SHA512 f6b0d1328f0c8ec07116416c6a50d479b166df271ce0cf481b9cc08bbed995c5ac085f14650c456e9bc99e708d6b6f2013a590ac87055350ed5ef89d03e0cb17

C:\Users\Admin\AppData\Local\Temp\ish240601765\images\Loader.gif

MD5 57ca1a2085d82f0574e3ef740b9a5ead
SHA1 2974f4bf37231205a256f2648189a461e74869c0
SHA256 476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e
SHA512 2d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c

memory/2724-154-0x0000000002130000-0x0000000002276000-memory.dmp