Malware Analysis Report

2024-10-10 12:13

Sample ID 240613-swj1qavaqa
Target a642623cb3e8ed90e0ad27f4617ba3dc_JaffaCakes118
SHA256 1097a09a80bee587b96bf2736ab10a482e9ff9617a8c4282184682adb05bfc65
Tags
upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

1097a09a80bee587b96bf2736ab10a482e9ff9617a8c4282184682adb05bfc65

Threat Level: Shows suspicious behavior

The file a642623cb3e8ed90e0ad27f4617ba3dc_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx

UPX packed file

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 15:28

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 15:28

Reported

2024-06-13 15:31

Platform

win7-20240508-en

Max time kernel

150s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a642623cb3e8ed90e0ad27f4617ba3dc_JaffaCakes118.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\a642623cb3e8ed90e0ad27f4617ba3dc_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a642623cb3e8ed90e0ad27f4617ba3dc_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a642623cb3e8ed90e0ad27f4617ba3dc_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a642623cb3e8ed90e0ad27f4617ba3dc_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 os.tokoholapisa.com udp
US 8.8.8.8:53 cdn.download2013.net udp
US 8.8.8.8:53 downloadclick.net udp
US 8.8.8.8:53 cdn.download2013.net udp
US 8.8.8.8:53 downloadclick.net udp
US 8.8.8.8:53 os2.tokoholapisa.com udp
US 8.8.8.8:53 cdn.download2013.net udp
US 8.8.8.8:53 os.tokoholapisa.com udp
US 8.8.8.8:53 os2.tokoholapisa.com udp
US 8.8.8.8:53 cdn.download2013.net udp
US 8.8.8.8:53 cdn.download2013.net udp
US 8.8.8.8:53 cdn.download2013.net udp
US 8.8.8.8:53 cdn.download2013.net udp
US 8.8.8.8:53 cdn.download2013.net udp
US 8.8.8.8:53 cdn.download2013.net udp

Files

memory/2188-0-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-5-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2188-3-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-4-0x0000000000401000-0x000000000040B000-memory.dmp

memory/2188-6-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-157-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-158-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-160-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-159-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-161-0x0000000000420000-0x000000000055E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ish259398088\bootstrap_4991.html

MD5 1ea9e5b417811379e874ad4870d5c51a
SHA1 a4bd01f828454f3619a815dbe5423b181ec4051c
SHA256 f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
SHA512 965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

C:\Users\Admin\AppData\Local\Temp\ish259398088\css\sdk-ui\progress-bar.css

MD5 5335f1c12201b5f7cf5f8b4f5692e3d1
SHA1 13807a10369f7ff9ab3f9aba18135bccb98bec2d
SHA256 974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda
SHA512 0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df

C:\Users\Admin\AppData\Local\Temp\ish259398088\css\main.css

MD5 2312d9eba55f83efc8c80eaff2314348
SHA1 3fbb9ede6222bca8236467b9f4877e82c7e5aafe
SHA256 7fefa282fae4a98f4e5468d47db401f95cbdd71791bc6df1d503c534a1e205dd
SHA512 c56c66a276a3f0e4d4ca7a6c896e67dd67def15931fef60454de6864e93838aff25285304e900b9a312caa42e46508da09ad62f62908a34d4a6d2f71257eb2f8

C:\Users\Admin\AppData\Local\Temp\ish259398088\images\default_tb.png

MD5 70e70599d4b853df0f12f6cb0e04695f
SHA1 6e3a721aef65625bf99b639800476150d262dd4b
SHA256 87af4027e8f89459463bdd73df7b928b883eefb20514159d3a1a4be0d39e00c0
SHA512 1efcf8af09cf857b3850cec43a88fc8c0992e3b04f78ad2c71b84c2ac7775e745df211582694588b29217aefb1ae02b29b94c2cfe52b5d32bdafb9dce73b9920

C:\Users\Admin\AppData\Local\Temp\ish259398088\images\default_wi.png

MD5 1cc2677e3e29e45e538985839cff2b42
SHA1 2dab653eb20be72b034a38dc1fcebbd18f079c86
SHA256 9216d98a6574dfadacdc8321dc435454cb72c589b3ee8326a9b946966f756d7f
SHA512 25575fea9abb1491b5a5853244a9b655ce05f64d98f4b79134674f2d9a560a5af405c1783c9da4a07cfb38b51d060c7a70890c70df6c1c8f4b01e041aa4f649f

C:\Users\Admin\AppData\Local\Temp\ish259398088\images\BG.png

MD5 65ad220cd1cbf9e43daaf70bc9920396
SHA1 270ad46b64298c47e2fc51d5218eac1aa2e24b25
SHA256 d3f744f95f1ee1f79e6d720ea003b07db200ae9ab0bbcc0a8b792d8c01270b1a
SHA512 2a6ed629f12827513605a916e8e6e32fbdb02c78aed467f1a42f834b46cb5516075d641ca2e31e845bab98f2e41c59b032b81ba79ce43f3ec20fdd012ac7ea41

memory/2188-185-0x0000000000420000-0x000000000055E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ish259398088\images\Quick_Specs.png

MD5 07cd59b954e8495ad6cd6a7c11d2de86
SHA1 787aeda3eee8053705fb208a6b399b8340820b82
SHA256 6e6b964fd79b4a3461f128e2ed145b9b641d108b8616695f36387661cae995bb
SHA512 0159aca0c2a49393fd91acd4b6819217e67f8fd01e220297eb3e0fdd8132fad794fc317f5cc5e2b761d4123da71478b97df776908de6740eb6d54187c6c00754

C:\Users\Admin\AppData\Local\Temp\ish259398088\images\sponsored.png

MD5 e3758d529f93fee4807f5ea95fbc1a6c
SHA1 3a9a1ba234e613e5f808c3ffeda05a10a5dafe00
SHA256 8d46eb0c60043dcb7d79ab3d0525148fc901764620c02e4b9c5dd8b0e9026303
SHA512 e891552bee3aa10247cad1fcc510331077016a6e71d46827be2dd46017f943c5acc2c1506b41217880d35d52a94989923ad0a345f8791da4bb379eceefe3c407

C:\Users\Admin\AppData\Local\Temp\ish259398088\images\Grey_Button.png

MD5 cf9f300c3fd712ca05bfc20f7c758d44
SHA1 9381f2929a81e4bda1651d1680c3bdde6a8c999c
SHA256 f65de10d313c6b1f74d867b3d7b0a6a1516db5b398b92af5c3b8bfae3169fb2b
SHA512 9607b08bb414b241ff8cf6b65ebfa389ed6390523f20f98882babc21b339bf3242ae79ad397313b7709f7a8d4d3a1036a40296f495509651ecce1747577c0977

C:\Users\Admin\AppData\Local\Temp\ish259398088\images\Color_Button.png

MD5 f6a0a0c082bc7ddc1e0e599493949e1f
SHA1 73b63bb6233e0e27b58ccdcb4ac32b05e36ce046
SHA256 b01fb9069f905b1f8ec3b72937e1a7a415fa62ee289aa79c68f65eee43bdd762
SHA512 ed5176bb258835a6346322a0ec0564557da28484a7bcc014ad1fcc337b14518b98e37475e41e6ae29cb724333e1c8471dd0f48bcf2a0d4cff522fb15e097716b

C:\Users\Admin\AppData\Local\Temp\ish259398088\images\Close.png

MD5 75a9464e6e2e2d8efc82e5285ab0d95d
SHA1 03aa7ccf18666265cef894adc30aede977116405
SHA256 7ec62b84d0c741b8e1f4c735ba37fd4dc889690590cf900073793b8d6e44cd0a
SHA512 c52d190454e7d6fbafdd18960b5c95cc76da66ce02b7d0caf1eecc3335ae60b8aeb8b014be9adfaf46cafcdb7342029ec265d64576483cfc2b2439a514d9b63c

C:\Users\Admin\AppData\Local\Temp\ish259398088\images\Loader.gif

MD5 57ca1a2085d82f0574e3ef740b9a5ead
SHA1 2974f4bf37231205a256f2648189a461e74869c0
SHA256 476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e
SHA512 2d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c

C:\Users\Admin\AppData\Local\Temp\ish259398088\images\ProgressBar.png

MD5 eabb61abba55f80af418fa1128d1548d
SHA1 a5ee1d55de2cc60966039120c830fc19cefb0351
SHA256 717f3f02f5d5fd1478b6d2ec44acef6e70bb8f1adcf2dc030c08b92e851737e1
SHA512 d232072c9540bf0e2fd56f353c2cc83518eabf8282cc02d9f8bec81c0341287ada29ba79f2a515d68722658686b6cce97be138a48f44409562d9a567af200bd6

C:\Users\Admin\AppData\Local\Temp\ish259398088\images\Pause_Button.png

MD5 84b37cb510f50c8fea812eb308d3f03f
SHA1 d141a79feb407506709f051e55c55438a12fd3b4
SHA256 7bf800336671204de36b7d1f6ceffdff830040f51d21bc44f220f68d72cf492b
SHA512 3222cb5772a4e9b20de253914c0856c7e6383567df68fcf287801f6f79248f65957515e7ec4a44db1fbe910afeae8ca3349295c4bdf03df6aabde36f2aaa6b5e

C:\Users\Admin\AppData\Local\Temp\ish259398088\images\Progress.png

MD5 35a600a752d3074501de31a516860499
SHA1 51eac62cf77a0b88a3e9cb9ee6f85def21fd4bcf
SHA256 14e064857751b23da7bbe40861ef4caf99b2496227507b8e3108fbac6d901f75
SHA512 046ec179571d239bfb2d51be9837f96d9afebf2e5db77bba0f4a25ce8716d37581a3f9753bd2dbb04c47711699a9d93987bceb71df0b8becf8c577d660320069

C:\Users\Admin\AppData\Local\Temp\ish259398088\images\Resume_Button.png

MD5 9d31583bcfad58a6b9ddeaf44549a5e6
SHA1 98f4c693af708e02201de2aee31fe094dc3b0a9c
SHA256 e466a2db2f755d9eb68619439af37ff4e45559b7a3f476e226ab2a11aeadae1a
SHA512 9ddaaad53375f4d2874fe5c98b6782202d2bd975cdd9363796986dc7567368b94d9ec1aa3e839194097838b787bbd71d574540cf5b04fd04f10fa80d6a89e695

C:\Users\Admin\AppData\Local\Temp\ish259398088\locale\EN.locale

MD5 838bb977e85d67f57ee26f454efcab3f
SHA1 ea53b761be427015efbd9ba082e16ff3f14142bb
SHA256 08cd2a5f2633780ae360e3a27c24c4c400aba19bbfc0112524b58d90a35a8869
SHA512 a585178923cc095df9d54117cbc8d7775dc6d89d03b065b07134ba9b2130c897d58012deeb1e4deb46e16f8d4b0029943ab3d4c2ba69c86717e70e1a58d2d4c5

memory/2188-208-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-210-0x0000000000420000-0x000000000055E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ish259398088\images\Grey_Button_Hover.png

MD5 61b27f16ef13d3ad95833dd3a932f307
SHA1 9e0866a07c8309b8f5fb3fbec98531f2ebfbce6f
SHA256 be3dee9b5d9f2893607ff916b3c3313987a16092230650dbaeec6e9e36c63ad2
SHA512 c3d6a15a826c990bd77c4d2581fe8791fb71346477ee360af50f96a7521e83f5ae89c520af221a737787684eb2b6a714afe9e6d770d9103de4fcc18f767283a0

C:\Users\Admin\AppData\Local\Temp\ish259398088\images\Close_Hover.png

MD5 aa5fc77754056e5cf059ae73ae3ffb93
SHA1 d6dea0e225dc926506c9c1bc8d9084cbaf7cc350
SHA256 cb4b816b428001c2756dc75791598a256ff2774c5dc9e87253ae77b5aaed8da0
SHA512 1c61531ed01bd48af185450f64f6a908784a4846085044109cf18f385592f783ae6c9b99cffe95b4d6fc1108fc2cebdfeccca30a01c682f5d47b019429b0e8a6

C:\Users\Admin\AppData\Local\Temp\ish259398088\images\Color_Button_Hover.png

MD5 aebc9f7755027a8790663b5d74088c42
SHA1 d567455a3e106cd5f456b1b0f395a0d0336aaa27
SHA256 b3f34c560de55adc8c9eadef4a7779f2d2e6ee0997c340d8f10a8dda63c86696
SHA512 53d4ce45e5c943c11d7951bc9f6563d3365ce36786ddc952bf6b3469b46a2c326410da29aff1061b21800b1cfff3088e3f3dfcad9f34a0962d069dd3a6fea3ee

memory/2188-228-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-230-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-229-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-232-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-234-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-235-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-236-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-237-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-239-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-240-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-241-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-242-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-245-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-247-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-249-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-250-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-251-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-255-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-257-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-258-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-260-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-263-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-265-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-266-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-268-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-269-0x0000000000420000-0x000000000055E000-memory.dmp

memory/2188-271-0x0000000000420000-0x000000000055E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 15:28

Reported

2024-06-13 15:31

Platform

win10v2004-20240611-en

Max time kernel

141s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a642623cb3e8ed90e0ad27f4617ba3dc_JaffaCakes118.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\a642623cb3e8ed90e0ad27f4617ba3dc_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a642623cb3e8ed90e0ad27f4617ba3dc_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 23.41.178.120:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 120.178.41.23.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/3204-2-0x0000000002180000-0x00000000022BE000-memory.dmp

memory/3204-4-0x0000000002180000-0x00000000022BE000-memory.dmp

memory/3204-6-0x0000000000400000-0x0000000000414000-memory.dmp

memory/3204-5-0x0000000000401000-0x000000000040B000-memory.dmp

memory/3204-3-0x0000000002180000-0x00000000022BE000-memory.dmp

memory/3204-157-0x0000000002180000-0x00000000022BE000-memory.dmp

memory/3204-158-0x0000000002180000-0x00000000022BE000-memory.dmp

memory/3204-159-0x0000000002180000-0x00000000022BE000-memory.dmp

memory/3204-160-0x0000000002180000-0x00000000022BE000-memory.dmp

memory/3204-161-0x0000000002180000-0x00000000022BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ish240596078\bootstrap_38972.html

MD5 1ea9e5b417811379e874ad4870d5c51a
SHA1 a4bd01f828454f3619a815dbe5423b181ec4051c
SHA256 f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
SHA512 965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

C:\Users\Admin\AppData\Local\Temp\ish240596078\css\sdk-ui\progress-bar.css

MD5 5335f1c12201b5f7cf5f8b4f5692e3d1
SHA1 13807a10369f7ff9ab3f9aba18135bccb98bec2d
SHA256 974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda
SHA512 0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df

C:\Users\Admin\AppData\Local\Temp\ish240596078\css\main.css

MD5 2312d9eba55f83efc8c80eaff2314348
SHA1 3fbb9ede6222bca8236467b9f4877e82c7e5aafe
SHA256 7fefa282fae4a98f4e5468d47db401f95cbdd71791bc6df1d503c534a1e205dd
SHA512 c56c66a276a3f0e4d4ca7a6c896e67dd67def15931fef60454de6864e93838aff25285304e900b9a312caa42e46508da09ad62f62908a34d4a6d2f71257eb2f8

C:\Users\Admin\AppData\Local\Temp\ish240596078\images\default_wi.png

MD5 1cc2677e3e29e45e538985839cff2b42
SHA1 2dab653eb20be72b034a38dc1fcebbd18f079c86
SHA256 9216d98a6574dfadacdc8321dc435454cb72c589b3ee8326a9b946966f756d7f
SHA512 25575fea9abb1491b5a5853244a9b655ce05f64d98f4b79134674f2d9a560a5af405c1783c9da4a07cfb38b51d060c7a70890c70df6c1c8f4b01e041aa4f649f

C:\Users\Admin\AppData\Local\Temp\ish240596078\images\default_tb.png

MD5 70e70599d4b853df0f12f6cb0e04695f
SHA1 6e3a721aef65625bf99b639800476150d262dd4b
SHA256 87af4027e8f89459463bdd73df7b928b883eefb20514159d3a1a4be0d39e00c0
SHA512 1efcf8af09cf857b3850cec43a88fc8c0992e3b04f78ad2c71b84c2ac7775e745df211582694588b29217aefb1ae02b29b94c2cfe52b5d32bdafb9dce73b9920

C:\Users\Admin\AppData\Local\Temp\ish240596078\images\Resume_Button.png

MD5 9d31583bcfad58a6b9ddeaf44549a5e6
SHA1 98f4c693af708e02201de2aee31fe094dc3b0a9c
SHA256 e466a2db2f755d9eb68619439af37ff4e45559b7a3f476e226ab2a11aeadae1a
SHA512 9ddaaad53375f4d2874fe5c98b6782202d2bd975cdd9363796986dc7567368b94d9ec1aa3e839194097838b787bbd71d574540cf5b04fd04f10fa80d6a89e695

memory/3204-203-0x0000000002180000-0x00000000022BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ish240596078\images\Pause_Button.png

MD5 84b37cb510f50c8fea812eb308d3f03f
SHA1 d141a79feb407506709f051e55c55438a12fd3b4
SHA256 7bf800336671204de36b7d1f6ceffdff830040f51d21bc44f220f68d72cf492b
SHA512 3222cb5772a4e9b20de253914c0856c7e6383567df68fcf287801f6f79248f65957515e7ec4a44db1fbe910afeae8ca3349295c4bdf03df6aabde36f2aaa6b5e

C:\Users\Admin\AppData\Local\Temp\ish240596078\images\Progress.png

MD5 35a600a752d3074501de31a516860499
SHA1 51eac62cf77a0b88a3e9cb9ee6f85def21fd4bcf
SHA256 14e064857751b23da7bbe40861ef4caf99b2496227507b8e3108fbac6d901f75
SHA512 046ec179571d239bfb2d51be9837f96d9afebf2e5db77bba0f4a25ce8716d37581a3f9753bd2dbb04c47711699a9d93987bceb71df0b8becf8c577d660320069

C:\Users\Admin\AppData\Local\Temp\ish240596078\images\ProgressBar.png

MD5 eabb61abba55f80af418fa1128d1548d
SHA1 a5ee1d55de2cc60966039120c830fc19cefb0351
SHA256 717f3f02f5d5fd1478b6d2ec44acef6e70bb8f1adcf2dc030c08b92e851737e1
SHA512 d232072c9540bf0e2fd56f353c2cc83518eabf8282cc02d9f8bec81c0341287ada29ba79f2a515d68722658686b6cce97be138a48f44409562d9a567af200bd6

C:\Users\Admin\AppData\Local\Temp\ish240596078\images\Loader.gif

MD5 57ca1a2085d82f0574e3ef740b9a5ead
SHA1 2974f4bf37231205a256f2648189a461e74869c0
SHA256 476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e
SHA512 2d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c

C:\Users\Admin\AppData\Local\Temp\ish240596078\images\Close.png

MD5 75a9464e6e2e2d8efc82e5285ab0d95d
SHA1 03aa7ccf18666265cef894adc30aede977116405
SHA256 7ec62b84d0c741b8e1f4c735ba37fd4dc889690590cf900073793b8d6e44cd0a
SHA512 c52d190454e7d6fbafdd18960b5c95cc76da66ce02b7d0caf1eecc3335ae60b8aeb8b014be9adfaf46cafcdb7342029ec265d64576483cfc2b2439a514d9b63c

C:\Users\Admin\AppData\Local\Temp\ish240596078\images\Color_Button.png

MD5 f6a0a0c082bc7ddc1e0e599493949e1f
SHA1 73b63bb6233e0e27b58ccdcb4ac32b05e36ce046
SHA256 b01fb9069f905b1f8ec3b72937e1a7a415fa62ee289aa79c68f65eee43bdd762
SHA512 ed5176bb258835a6346322a0ec0564557da28484a7bcc014ad1fcc337b14518b98e37475e41e6ae29cb724333e1c8471dd0f48bcf2a0d4cff522fb15e097716b

C:\Users\Admin\AppData\Local\Temp\ish240596078\images\Grey_Button.png

MD5 cf9f300c3fd712ca05bfc20f7c758d44
SHA1 9381f2929a81e4bda1651d1680c3bdde6a8c999c
SHA256 f65de10d313c6b1f74d867b3d7b0a6a1516db5b398b92af5c3b8bfae3169fb2b
SHA512 9607b08bb414b241ff8cf6b65ebfa389ed6390523f20f98882babc21b339bf3242ae79ad397313b7709f7a8d4d3a1036a40296f495509651ecce1747577c0977

C:\Users\Admin\AppData\Local\Temp\ish240596078\images\sponsored.png

MD5 e3758d529f93fee4807f5ea95fbc1a6c
SHA1 3a9a1ba234e613e5f808c3ffeda05a10a5dafe00
SHA256 8d46eb0c60043dcb7d79ab3d0525148fc901764620c02e4b9c5dd8b0e9026303
SHA512 e891552bee3aa10247cad1fcc510331077016a6e71d46827be2dd46017f943c5acc2c1506b41217880d35d52a94989923ad0a345f8791da4bb379eceefe3c407

C:\Users\Admin\AppData\Local\Temp\ish240596078\images\Quick_Specs.png

MD5 07cd59b954e8495ad6cd6a7c11d2de86
SHA1 787aeda3eee8053705fb208a6b399b8340820b82
SHA256 6e6b964fd79b4a3461f128e2ed145b9b641d108b8616695f36387661cae995bb
SHA512 0159aca0c2a49393fd91acd4b6819217e67f8fd01e220297eb3e0fdd8132fad794fc317f5cc5e2b761d4123da71478b97df776908de6740eb6d54187c6c00754

C:\Users\Admin\AppData\Local\Temp\ish240596078\images\BG.png

MD5 65ad220cd1cbf9e43daaf70bc9920396
SHA1 270ad46b64298c47e2fc51d5218eac1aa2e24b25
SHA256 d3f744f95f1ee1f79e6d720ea003b07db200ae9ab0bbcc0a8b792d8c01270b1a
SHA512 2a6ed629f12827513605a916e8e6e32fbdb02c78aed467f1a42f834b46cb5516075d641ca2e31e845bab98f2e41c59b032b81ba79ce43f3ec20fdd012ac7ea41