8f81df2155ce1e6df03f99280cb428a213e39231a092d3ffa55a37709ee44fcc

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4d13e2b94981ad510da2be1491d13b8_JaffaCakes118.html
Size 46KB
Sample240613-laeesasepg
SHA256 8f81df2155ce1e6df03f99280cb428a213e39231a092d3ffa55a37709ee44fcc
MD5 a4d13e2b94981ad510da2be1491d13b8
SHA1 a60cfdbf7df867097157f7221045f50a19c50481
SHA512 d044ee9fb83404010d425065c150885f9bd61fce3b7422ccfb105cff69e236cee4834d1a31d83c523e822968853ae593256d5ac9e0f8d488627cd0b3e43e0f97
SSDEEP 768:imMqBhs/EsTxf9K5If6nqGJ/x3RbKIBK8HP8jgg9IOGm57YzpSl5P:imMqByW5TCIODYzpSlN
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
1528	msedge.exe
1528	msedge.exe
2312	identity_helper.exe
2312	identity_helper.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 5028	1528	msedge.exe	81
PID 1528 wrote to memory of 5028	1528	msedge.exe	81
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 2012	1528	msedge.exe	82
PID 1528 wrote to memory of 4620	1528	msedge.exe	83
PID 1528 wrote to memory of 4620	1528	msedge.exe	83
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84
PID 1528 wrote to memory of 1260	1528	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4d13e2b94981ad510da2be1491d13b8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe473b46f8,0x7ffe473b4708,0x7ffe473b4718
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8151162228366045638,2651732340783569097,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,8151162228366045638,2651732340783569097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,8151162228366045638,2651732340783569097,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8151162228366045638,2651732340783569097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8151162228366045638,2651732340783569097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8151162228366045638,2651732340783569097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,8151162228366045638,2651732340783569097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,8151162228366045638,2651732340783569097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8151162228366045638,2651732340783569097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8151162228366045638,2651732340783569097,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8151162228366045638,2651732340783569097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8151162228366045638,2651732340783569097,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8151162228366045638,2651732340783569097,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4692 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 448B
SHA256 32a63b6465beb022a6272b48673d8dc16a0d051a129ff64135fa10ebb7d33933
MD5 a6fe78273085164e422a6dee4ec3cd03
SHA1 4a8503ae0cecbba1c694968540bb1f9a9561e4db
SHA512 8e7a8c0c72c7f268bcb95bba9856ac4395c223046e1777cf6a900d107de9fb110b195872d08890168ed93df04ba8d7f1807d30d21f96be39c84ba8ed3fd2b061
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 16367ff23e44a00af763844e1e69748b201dd3048b72250dee82265ee5553f8c
MD5 99919e5dd1caa6463f5331569937ad09
SHA1 eb700b87e045916eaebf53a3bca0dcac455f02b9
SHA512 67d9a74e596a8ff3c5b08e6856ee5dba0db5f5829f933e2c40285edeac57034a06ee7fa464e046eeaa226092cee033abb95b329b9d52899419785c888569401d
SSDEEP 96:nYk/oxm/DQYmqT1dCmwpvWMoiVmdeH1DCUWQyV+VDCziEwb:nYkBI8HCmGWMXkro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 34edb3a0748fc58f0af9b1e5c21876310ae75b87e35af8db14a5ec841f9e6368
MD5 cf74e64fa3c15b82823217f10e4d4894
SHA1 d46d0b607208ac3ea84caaea7d505116a28d0a2a
SHA512 bcde3b62bbca0a3a0d449219177ad7e6664c456b76316483e3764f645139e9aeb974a6eca9d0edbc990f3fce024bf08ea50aa63385aaab5e136ea793e9b40029
SSDEEP 96:nYk/oxm/DnmqT1dAmwpvWMoiVmdeT21DCUWQyV+VDCAiEwb:nYkB68HAmGWMD2krV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 eaad8bc781f1456b81c2765efc0f25be27ba2645632fb3529f959b8a6edbc2ba
MD5 7034aff2a60c6d0d18a4c8167edc4e45
SHA1 736e6b9200707aa9e1fac43410f4faf87946588e
SHA512 2cf2b37288241cdba937d3013bd33d7eebbc007523eef486cbfc6b0931c5e54e63efb3931dfd17478dd556e107a87d5cc4cd8278003551e78103b73a9348f71f
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c052.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c052.TMP
Size 539B
SHA256 edc245f5c7d88a2d7086e2497b38b740d9f0f39889dfd10374600e6c67cde548
MD5 0598a80dd091217362ec45213f454e2d
SHA1 51e35641aadf0959fbc5c5344236859f45a913bb
SHA512 20d9bc2a0c6188a6555fd08780d816111f14f79bfb5db595c0ae000a7522264d421de62fd0181b50d4b913490f803bc85d361f48dc54ea43edf47fc04d6298df
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 fa36c3e52e4e246d5670e3cb49dc53205ce4e3497e986e9583fc4cb37bc0b5bd
MD5 1a1bbf1ad7cbc354333e903e5a2530e0
SHA1 16d3515546bdb36a06f1b50ae06004f5fce0ca46
SHA512 64b476e46b83f6cf17d7b62db9c9713682c8bee4b54a5963dcd50b2039728cdb2a9da093ce64bb14f034edd97725163eb497b21d248c7f2be1c1482184ed0fb1
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphtre2RUxKSRsX3z2OMDCRn:A9iIxuERzA83h09RZxYhpoGXaOMWRHqc
MD5 SHA1 SHA512 SSDEEP

Submit Download