Analysis
- max time kernel
145s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
16/01/2024, 17:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.boxbe.com/
Resource
win7-20231215-en
4 signatures
150 seconds
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1376 msedge.exe 1376 msedge.exe 2816 msedge.exe 2816 msedge.exe 1160 identity_helper.exe 1160 identity_helper.exe 4464 msedge.exe 4464 msedge.exe 4464 msedge.exe 4464 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe 2816 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2816 wrote to memory of 2556 2816 msedge.exe 14 PID 2816 wrote to memory of 2556 2816 msedge.exe 14 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 3240 2816 msedge.exe 23 PID 2816 wrote to memory of 1376 2816 msedge.exe 32 PID 2816 wrote to memory of 1376 2816 msedge.exe 32 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28 PID 2816 wrote to memory of 1652 2816 msedge.exe 28
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef6e946f8,0x7ffef6e94708,0x7ffef6e947181⤵PID:2556
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.boxbe.com/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10607211923806191962,10006063743905436093,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:3240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,10607211923806191962,10006063743905436093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:82⤵PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10607211923806191962,10006063743905436093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:2116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10607211923806191962,10006063743905436093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:1764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,10607211923806191962,10006063743905436093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10607211923806191962,10006063743905436093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10607211923806191962,10006063743905436093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10607211923806191962,10006063743905436093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:82⤵PID:3708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10607211923806191962,10006063743905436093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:12⤵PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10607211923806191962,10006063743905436093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:3252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10607211923806191962,10006063743905436093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:12⤵PID:3708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10607211923806191962,10006063743905436093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:12⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10607211923806191962,10006063743905436093,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4680 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4464
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3260
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3940
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93
- MD5 4d6e17218d9a99976d1a14c6f6944c96
- SHA1 9e54a19d6c61d99ac8759c5f07b2f0d5faab447f
- SHA512 3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 264B
- SHA256 6f831f87269d35d74dce8d18bbc7fb5b5026ffbf925bfdf0cf3bfe6214c851b6
- MD5 09d43e70dd5f5519b081a80d718ac74d
- SHA1 10c6f6a4b40e19ff5b802969fb72721c11851415
- SHA512 6eda45d052db6990f869a396471edc38cef870f8f5e78924bdd501ee2714023bd2b5a04c09f3a796a6d056b30cc451d8c6149997b955ae88c7950df13005acda
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 2KB
- SHA256 202c75a2f82c0daf4966facc50f68fa20f7731dc09b9ef871c7f02d9b516dcce
- MD5 f4ccebd9a79f43c564700bc608765e48
- SHA1 f0796ea8b68a6ab289db1a0216e516e64c31773b
- SHA512 401b11fb20ce08c575fc67849ea8980f51d83d4b48afd97a34b3534ec56e399e785ec5549723713a65e3717d1650062ab767af035d735ce3ab5dae4af6a205b8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 2KB
- SHA256 6be7797a8e1188ac150e4d95358fd6db637239b88a4ea1f5a6aa91de98450cd5
- MD5 e44f5aa1ac674606b70740c23783694f
- SHA1 b861bae3d8e83f93e4be3c7bb9590b095e87a73d
- SHA512 72b712c50a9de746b8278210ae85594ff3e2ba73f3a97fa0219b74c35b872e02044231f85d7be4dec4865b00de949e8fcb672e68d14e6d6b272f9ab55c111be0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 f06ae423746bd49f3766879c3768890e600a1ac820f676c4b83f9da05e2e2644
- MD5 ad8c2994ee3d33666e90acf87e0de882
- SHA1 945a502d78b5537c8b3e47103343e2db1bd3a617
- SHA512 5a68c777a582e5bd3c162cf54e2a053bbbe3aa177bb0ef40acc7223742011061c2f1b7d70cc351178a9a876fa308ba26108cd42cb66695b639eb06991152e903
- SSDEEP 96:ndFkwN+1ech3wpvWMoiVmdequ11kElErxe7SMqR2PYqRyUWQyV+VDCAiEwb:n7k1b5GWMau1blErxe7YR2PXyrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 c6065a368685f8a9a4af487fdb4cea7f7adc1f690dbd5f745027b2b1326ca90e
- MD5 201b0abf6aa82adfad43bf3abe44d6e6
- SHA1 f602d2bbf2dc0914d4420667e93f100dbb7127cc
- SHA512 f95172951d5192590377330683b3106597dcd0562e6b09ee8c3ef6a0c7a94c6635030a952837c51ed4328b2abf7f41c4223b731df5d0f5622b9e69167ed2ed21
- SSDEEP 96:ndzkiN+1ech3wpvWMoiVmdeHPYryUWQyV+VDCzia:nxknb5GWMXPCyrj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 24KB
- SHA256 185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521
- MD5 c2ef1d773c3f6f230cedf469f7e34059
- SHA1 e410764405adcfead3338c8d0b29371fd1a3f292
- SHA512 2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549
- SSDEEP 768:nFeW8o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOLl+YrU7C:nFeW8ou1jaTLI7C
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 90119b99aff20f79a48f818bbf5ca5fde27b395c60c073ae9e201499777465ae
- MD5 12361b6cbb2bb4914c1d0703737b0429
- SHA1 db53527576defe5b07d0b24e6c0488b53340f6d3
- SHA512 262bd62fb0203e3524b3f53b31bebbb222ed41055fa42848cf84484f4895398ea8a45d2bbcb76c8fcb14753aee09681d0b970425fcb0389259f5d8a44745a776
- SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupwge2RUwovs1BRHdCnR7Dc:M9iIxuERzA83h09RZxYTB1BBcnZDc
- MD5 SHA1 SHA512 SSDEEP