a2d6a56c8cf98e4b1f40cef7b22a8b24afee55cf8ed48c6ea1fdb0e0a0bd4733

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91107036bb2482924b8ec840ddb07434_JaffaCakes118.html
Size 89KB
Sample240603-j15csagg5w
SHA256 a2d6a56c8cf98e4b1f40cef7b22a8b24afee55cf8ed48c6ea1fdb0e0a0bd4733
MD5 91107036bb2482924b8ec840ddb07434
SHA1 3d6c593f3c475cdc63cb173238fdc5b1d335d352
SHA512 e743c50f31cbc19aabb6035741b51a1e3fa06befeb6c71503bc1b029ca9ede79d91390a3a00e82f0f1e686a5e0e284f480889aab276a3d4c12b604567e5175a4
SSDEEP 768:Y+4oyXjh7oRauBWlBhicmLPqwveJS4nf7votmtg0vtWUZZfDu8q9GHweo4D:Yzo8fctmtzND
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
3972	msedge.exe
3972	msedge.exe
2668	identity_helper.exe
2668	identity_helper.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 3016	3972	msedge.exe	83
PID 3972 wrote to memory of 3016	3972	msedge.exe	83
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 2160	3972	msedge.exe	84
PID 3972 wrote to memory of 4912	3972	msedge.exe	85
PID 3972 wrote to memory of 4912	3972	msedge.exe	85
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86
PID 3972 wrote to memory of 4036	3972	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91107036bb2482924b8ec840ddb07434_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1fe446f8,0x7fff1fe44708,0x7fff1fe44718
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,13227471370500387434,15285376698860711585,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,13227471370500387434,15285376698860711585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,13227471370500387434,15285376698860711585,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13227471370500387434,15285376698860711585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13227471370500387434,15285376698860711585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13227471370500387434,15285376698860711585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,13227471370500387434,15285376698860711585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,13227471370500387434,15285376698860711585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13227471370500387434,15285376698860711585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13227471370500387434,15285376698860711585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13227471370500387434,15285376698860711585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13227471370500387434,15285376698860711585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,13227471370500387434,15285376698860711585,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3120 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 247862ab2ac4239d0d93e66d303da682270ecfbb4c8b1422755efa4b02f1d2f5
MD5 01dd3326b4af0122fd50ea7a48198f81
SHA1 6fc78bb92837d4451a1c5c18fe4f404d657201cc
SHA512 43d10cb357a94da7cccb015a72a2c2d723925081972ed20b9a527925f06be614654a4785c82ec837eda66e2896994f5d97f2992516c9d3f8c3ce9a67ebf12172
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 1a03a7338533c70aa0c5f2dfdd3ac4dfd03429f73249396a6c7f523b370bc7b7
MD5 272e20edf8413c2ebed620565de6703c
SHA1 a1f938f0450e767b61c1c3253361de2a4fd24a47
SHA512 9ef1433ea9083ad88f6c4a05f1e4d5a19f23e9dae0433a7de13aae06b82f7e780285629336f1b646ea3b921c5d6af28b55d0b9ed23d15a10c3a69ba75f6886e7
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c3f4ec4d5a0a35d25120ab7c214422b5ce9da6a071e30152047828f763484269
MD5 772213fdf07824d97cfb4079207e5e7a
SHA1 b6f1aa88db61165f47d1ce435a5904e820697dc1
SHA512 f4f481451d9976e19438b3f5fa4e0e7b93341bedaec9b40dc844ce0738f1aff62f978e4efea1a599833396e856714f81019f8f069326f7bc2ac63b94a1d04cff
SSDEEP 96:nIkRC1e7Ej0wpvWMoiVmdeHmQIfUWQyV+VDCziEwb:nIk44Ej0GWMXUro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 09c4b4c925d5b7d6c2279a83ffecce4823566b0e26236e28d4dc817bbdb44c21
MD5 5443d5380d43015d301a574f807697a2
SHA1 c738bcf8693f6375898bcd35501f49452fd0ecae
SHA512 935490dd84314b3c5ea99822ff01979ffe9d3a4fbc00bd8eeab546f64783790157e71d29714646368872e18c481fa1508e3a2cd454236f2ee8329ada350348bc
SSDEEP 96:nIkBC1e7cj0wpvWMoiVmdexV6qhl2mQIfUWQyV+VD7AiEwb:nIkI4cj0GWMhfhl2Urg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 408419d63f9679e0d33fda59efb031f2162eb97de0c17f56ff2103158c75f15e
MD5 d9f5a4f3573d14d44957154a986354ce
SHA1 7382bb495b8e18d8bd07785146bad5f9ee7f6dd9
SHA512 8c469ce75113cf2b9b627bcd02f4ce927becc3706a25369e7a813fc9b45048eee99978a1fb57f0dddf6df84a600608a969707e88d18b09cb851f2ae14bbe4ceb
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupU475e2RUrIKbwfYOxhZHnV:A9iIxuERzA83h09RZxYU47tUOxTHqTMl
MD5 SHA1 SHA512 SSDEEP

Submit Download