afd9c8016504768f07660d881f314ab6a3a96d553df8df448a0086a660469881

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70660db76eb8a9a17ebf7e43a72ce11a_JaffaCakes118.html
Size 34KB
Sample240525-bllccshc8w
SHA256 afd9c8016504768f07660d881f314ab6a3a96d553df8df448a0086a660469881
MD5 70660db76eb8a9a17ebf7e43a72ce11a
SHA1 4ae462a8f4f6b42741d1bf9416f80a098f8c21ed
SHA512 2a572c8aa7e20f74469ff43a1bcb72847395981154e7542d13a3d3e3fd5549e73349cac17e140bf8271788a174261f5b02b27df2f51f11f5718d102cb73c1743
SSDEEP 384:9vxmVwNTOc/jAcRsEfDaCeRngDbVdJjbPqqJ1Vt5sV5awbGj9q8:9SwNTOrcRZGCeRngDlf
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4400	msedge.exe
4400	msedge.exe
4492	identity_helper.exe
4492	identity_helper.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 2708	4400	msedge.exe	85
PID 4400 wrote to memory of 2708	4400	msedge.exe	85
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 2424	4400	msedge.exe	86
PID 4400 wrote to memory of 4180	4400	msedge.exe	87
PID 4400 wrote to memory of 4180	4400	msedge.exe	87
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88
PID 4400 wrote to memory of 1788	4400	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\70660db76eb8a9a17ebf7e43a72ce11a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff935e46f8,0x7fff935e4708,0x7fff935e4718
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,3173912888218895195,5348901265757049752,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,3173912888218895195,5348901265757049752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,3173912888218895195,5348901265757049752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3173912888218895195,5348901265757049752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3173912888218895195,5348901265757049752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,3173912888218895195,5348901265757049752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,3173912888218895195,5348901265757049752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3173912888218895195,5348901265757049752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3173912888218895195,5348901265757049752,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3173912888218895195,5348901265757049752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3173912888218895195,5348901265757049752,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,3173912888218895195,5348901265757049752,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 180B
SHA256 a121c6f8b11a0682ab639049f50ef2a1b00b3a2a565d7686cc64f501056b7b19
MD5 e75179806fdb60b3337e8cd5b04cd6cf
SHA1 434a695c7607996cc4d1a0698d9214afe4d9fd38
SHA512 e1e2f888005696fb33453f369efda963c71c15270338db02d812a1ad503c1dfd2a0f693c3f6a02ca2abb7cad631524b0481141646353c7b39adf44b09bf8464f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c7a5f1b6215e9ea196c8f86ba51073d4fc5599a9a2696f4ede44742a6ac5a8ff
MD5 08b22ad177cbf50ec94443bcb8b040ef
SHA1 31d3f2651e9f7674646627c6457d3d838ece3cfe
SHA512 da498c01ec30c300ebcfed1d73147ea3371d631d3b8539e3a6ecf7085fcb395fc297a2e01afd0ad90718a1a86aaca5a0a1cd80fd800e6ec6eba011f9e1691aaa
SSDEEP 96:nsk5x1Sega9IQwpvWMoiVmdeHpCr1bOe+UWQyV+VD7ziEwb:nskHUNaCQGWMXpCbOe+rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 64be1e6f4aa95e1d35c65909e15fdf3991dc72eb0dc766eb962948c14adfc0ec
MD5 c60233a32b199864bde3cdbf475d3d3c
SHA1 799167d5c5809767fe8e155badb19f6e8072f862
SHA512 fb9cca2402968237c42e6666fcc6365fcb1831f67277fd01b752f30c31f5cbf88ad8d7fdd996e5563bcc1d7e38e618f0bb3944df1c3cccf192a1c661ffb630b2
SSDEEP 96:nskEx1SUga9IQwpvWMoiVmdeha2pCr1bOe+UWQyV+VD7AiEwb:nsk4U3aCQGWMxa2pCbOe+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 372B
SHA256 ff68d402ca260dd8fa5132a0d4aa5552967bbbcf4e04da5c8f389c56e3a0129f
MD5 28d7c77874780ead9e2af9cd756f13b1
SHA1 f23a11b35d137a03521a54e65809a2e9185ded82
SHA512 aca50b17152077cd910b100fea3ad41c8a7aa75cbef0c811a881400427e3fa02c15219122f9c0609c2ada1a9ba063145f473dfab29a63d4fb8e3bbddfb99bfde
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ded7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ded7.TMP
Size 372B
SHA256 af10d8dbe4df1381dfa041f781f69f071d7761a1284040b8201faf53b245c05f
MD5 67d97cd5a8674569b91d5eb8a0436089
SHA1 b0517b87171d92715260cf388e21cc2536ccbbaa
SHA512 6e81b940edc8251683c98aee6120c79a2fb40a41414d475070b8c68b355008238edce10ae626f82eb05c7eee8946539f4c61ee3a94d43dc108dfe493db505ef8
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5ff8d464fc3cdc3dd1b001a3fbd0080959698ece976a020948a41bbc1aa397b0
MD5 2d95d90a6cf08a45f696c3fd57bd5be7
SHA1 76302274d72286d324752fb95d6308b09c8d1e2e
SHA512 706607fb9dddd3d53c8a02ca0ba539179a94c565f7800dd3c121d8098c320a78ee26d0ec54edd15fceb23c867e04ccd8f22073008015ed7eb09f101a3dd3d463
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuptk9e2RUXy/jf7ZvM3z2OMX:A9iIxuERzA83h09RZxYtkZrLzZvMaOMX
MD5 SHA1 SHA512 SSDEEP

Submit Download