778a592e3c9ed72ef9ba1c62a1d268427a88a123168f5e773990971b06bacb97

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
917ec858695f432158239a5f498d71e5_JaffaCakes118.html
Size 47KB
Sample240603-mvy6csdb45
SHA256 778a592e3c9ed72ef9ba1c62a1d268427a88a123168f5e773990971b06bacb97
MD5 917ec858695f432158239a5f498d71e5
SHA1 df21b345729380edd1a32a72a5f928873c2450fc
SHA512 9a96ab732af8775c2bec3c0fed0a14952eb42015c06eb72f41dbcfadac243f04b00fe6ab30922967875a785bd9190332d51a6c2c2423398feb5f21dd2d24771d
SSDEEP 768:NY5kZU/hv4heCAqrUEcxm1xRYoxAE4xhqxbBxhOxA1txigxsNxXqQv4QtqFAqFX6:NY5kZU/hv4oXuUEcxIx3x0xoxNxoxWx+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
1780	msedge.exe
1780	msedge.exe
1788	identity_helper.exe
1788	identity_helper.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2580	1780	msedge.exe	82
PID 1780 wrote to memory of 2580	1780	msedge.exe	82
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 800	1780	msedge.exe	83
PID 1780 wrote to memory of 2240	1780	msedge.exe	84
PID 1780 wrote to memory of 2240	1780	msedge.exe	84
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85
PID 1780 wrote to memory of 3908	1780	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\917ec858695f432158239a5f498d71e5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1f3c46f8,0x7ffb1f3c4708,0x7ffb1f3c4718
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,5073206767406425254,2971625974296801323,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,5073206767406425254,2971625974296801323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,5073206767406425254,2971625974296801323,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5073206767406425254,2971625974296801323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5073206767406425254,2971625974296801323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5073206767406425254,2971625974296801323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,5073206767406425254,2971625974296801323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,5073206767406425254,2971625974296801323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5073206767406425254,2971625974296801323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5073206767406425254,2971625974296801323,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5073206767406425254,2971625974296801323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,5073206767406425254,2971625974296801323,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,5073206767406425254,2971625974296801323,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 cc654bc946d66ad215377056cf44c7e4849658fcadd1bf501ca5b01d1f5b4147
MD5 294068b9c19a2412f0c61c92bab81768
SHA1 57857b8896e4df67f1cc6be7f48d3c671f4a14e5
SHA512 46ca126622ea1aa349bbc2c4d3c14f4473efec17e5f1dffe5fa021a0c883d3f1b97980d048d61c13ed7d0350132a29c91f3760b62f74274965bf1c04a9f6bce9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 d1ac1715760a7aff72dae648a48cba103607f1dfad52716853d43ce0a23b0ea8
MD5 8b97ce5320d04d0ab9e1e95c2dbe9511
SHA1 7fd2b7f1e970612e6a4b827dfc4babbc8c16671a
SHA512 a2c7f82b32f4d9f0d3bb02f2d938df011cb4cb1cd35192212fd25f0bd169495a3b1da736ba5c1f3290ace83262b254cdbe0185df60cd156fae62ab7a3763a4d5
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6c323da777befd7afd1613ea0ed27a955b903fa9775510425c5feaeaa18ff8b1
MD5 afc95d43a2e17c05d8b30306d9282d7d
SHA1 51d8ff323e67c103d015030b253632dec796f65c
SHA512 cdaa9be1e8a9932f793c028ab18c54ba7a210968c52a528713eb7cb399f70fea9f797b952363fd0c56fb293d7da210acc03c0b579b81df4394cd9cf21b13d8de
SSDEEP 96:n2kMFq1R73wpvWMoiVmdeHplwtzacWinUWQyV+VDCziEwb:n2kh7jGWMXpCXWUro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 6af0a9005493638b8228329fa6467c0a6aaa431924757a69ba0957733608109c
MD5 565340de115f82ccf8708e2119029005
SHA1 4ee00edd45b78982b22829f8931585db51cea404
SHA512 dce6a1798b32cbf4c0f9c3fa384a909a2c38ec9bfcf03014a03625917bee7bf7da2f96e1b83ae4a0fa3ee0a18f01a8ca11a8e48b8b9d9f3d3867a6f59ab9d905
SSDEEP 192:n2kf7TGWMF2+R6BdqM1uhvKsMXEFHp2pCXWUrg:n227CWRi5Wh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 7834f03fcd335f2cc802c149fadd2f887914e7854e1b6967c571c8ba6e4feda0
MD5 258752276a205af600639406306f3da3
SHA1 84ddeb821893ccc16af3b949e602c3aeeea260e8
SHA512 0bbf23449250a0e2c51074b165434f195ecdcee8cc00f404565148f3af38dd7e4487c104af73eeb1cd83bb94e6ad9d83ba9cc9fe30b5b0c3b386d789d3b55e9d
SSDEEP 192:n2kY7TGWMF2+R6BdqM1uhvKsMXEFHp2pCXWUrV:n2h7CWRi5Wk
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 9fd27b93d209809c8887822524b403e8ac5bc255b05920d66a4c4509d982e80b
MD5 8c9a8541ed67d5884a70332661b90ab8
SHA1 8136ce1b65b6d0581faf67c24e80a19569e7687c
SHA512 a99b14642c4220b0991655afd8e8a039f34656dc6f9ad69f24d096bc89329477e4d6acb0157063863a6110577ae0a5e9d26fcb003c21308eec350873e0bf1fbd
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupyde2RUrQ2Zq3z2OMDCRHqf:A9iIxuERzA83h09RZxYqwpqaOMWRHqlN
MD5 SHA1 SHA512 SSDEEP

Submit Download