8810948c9aa0536e6f768af926f83f2b76506263808a8a63e87cc7cb9b972f90

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 07:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be2cfbda062c7a5d09b10756b8dbb845_JaffaCakes118.html
Size 34KB
Sample240824-jqnx2sscmp
SHA256 8810948c9aa0536e6f768af926f83f2b76506263808a8a63e87cc7cb9b972f90
MD5 be2cfbda062c7a5d09b10756b8dbb845
SHA1 a8883e989ef5fd8a32a39627011fd90235147cf9
SHA512 298a76cda56414a9bd6234d7534fe64542f2aa986d98bf0cc835a058ed26dbe817a5c9042f36d281c033e705286ac1e626692ae434ee923a9c705b8f86a211f5
SSDEEP 384:GOHfbNTOc/jAcR2EfDvRkRZK7QbMaAPQkL1PQnsPcWKbTjbQN:/bNTOrcR/DRkRZKg2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
1040	msedge.exe
1040	msedge.exe
4488	identity_helper.exe
4488	identity_helper.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 4628	1040	msedge.exe	84
PID 1040 wrote to memory of 4628	1040	msedge.exe	84
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 836	1040	msedge.exe	87
PID 1040 wrote to memory of 4560	1040	msedge.exe	88
PID 1040 wrote to memory of 4560	1040	msedge.exe	88
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89
PID 1040 wrote to memory of 2680	1040	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\be2cfbda062c7a5d09b10756b8dbb845_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd39046f8,0x7ffdd3904708,0x7ffdd3904718
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15224770726613126262,3658574182327710849,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,15224770726613126262,3658574182327710849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,15224770726613126262,3658574182327710849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15224770726613126262,3658574182327710849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15224770726613126262,3658574182327710849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15224770726613126262,3658574182327710849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15224770726613126262,3658574182327710849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15224770726613126262,3658574182327710849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15224770726613126262,3658574182327710849,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15224770726613126262,3658574182327710849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15224770726613126262,3658574182327710849,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15224770726613126262,3658574182327710849,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3084 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
MD5 d7114a6cd851f9bf56cf771c37d664a2
SHA1 769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA512 33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
MD5 719923124ee00fb57378e0ebcbe894f7
SHA1 cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA512 a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 180B
SHA256 a121c6f8b11a0682ab639049f50ef2a1b00b3a2a565d7686cc64f501056b7b19
MD5 e75179806fdb60b3337e8cd5b04cd6cf
SHA1 434a695c7607996cc4d1a0698d9214afe4d9fd38
SHA512 e1e2f888005696fb33453f369efda963c71c15270338db02d812a1ad503c1dfd2a0f693c3f6a02ca2abb7cad631524b0481141646353c7b39adf44b09bf8464f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 74791c57d8f82e644925ea3b4cce49b6c4f0e7434e3e2cbcdb7e22933414a3f1
MD5 54d1595bd18d24653acd6cfca0a51b40
SHA1 ca318f2b019de438a46449b7efb5ef364f7a6711
SHA512 b4b422081d44bb0ed9615463f64fabe91d0261712d04cc6e0e4960d659b18feda0db020355c1d013d5e38d5f5d96a690d2311b1fc944362d8bb4677ed310d212
SSDEEP 96:ndAk/FuI1J48LSFhPwpvWMoiVmdeH/b3FUWQyV+VDCziEwb:ndAk/7EVFhPGWMXRro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c279c7cb3f820935c825275719b1b2c64a14c6fb6ccfeb3ad49bdc4a9f03080b
MD5 db8531421874ae2946645e847bad13a6
SHA1 f9ed927207d365103b1322bd4d6ff782b2bee048
SHA512 546439456cc5ba95d8e42bed703b33efd53cbd98832d039a565a98f76e8bd2b2e88520c755fc0624eb6eb76f7599b4e3947f6f3da0199bb365d64712f51a47c6
SSDEEP 96:ndAk/guI1J4SLSFhPwpvWMoiVmdeHfm2/b3FUWQyV+VDCAiEwb:ndAk/kEzFhPGWMXfm2RrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 372B
SHA256 4851b0e8cca0c67f7090ee540056569a2ac76513c4765cea4fc7efb8b83b4027
MD5 a0189143a401a8236645d2804c050cf2
SHA1 9da6aadbd6e3b9db3f5e100e7e60797f762e17b1
SHA512 74162d2fcaf8cdb94745e03f80d332248fd91b8054e1f46167c53a9273aa520e78d8611c278764154c0d3c3f440dbebe0790f01986f370ba81ae13ee410e335c
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe580078.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580078.TMP
Size 372B
SHA256 11756df03c421a748310b6beac12d3bc58955155a7d9f0e34c571692f3be2eea
MD5 c478ad219158a63dd7876d340760df1b
SHA1 60d5eb09635b2d0b9d630811d29f720bcd5baa81
SHA512 af43e1f1fc185e5a4530d93a777dac2b740e4031e62d9e1514d4ee04972206ef045cd5e60aaec849e196b3e8a61d9c91656ef4979ebf17b05f16042f550169ce
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 96c3e4a591ece39cbdc78c45ea485cd45d7fbdc5f86277ae07dac56cdcf96dac
MD5 ac93168286c7d93a5a34a265a4a0946b
SHA1 8572482e23e4ee4c415f7c58ba31839b50f20ae5
SHA512 8fc9455fe5b29e8687b997c69a8cbf315e092b9ebd5525f8f1868d82797f3460e479b09327ebe95d0c6d26c8b802249786238eb7677387d6fc3acd6a1b93c9c9
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupG9e2RUsxNVRw5Ytj9Zklqr:A9iIxuERzA83h09RZxYGZjWkLsnmKc
MD5 SHA1 SHA512 SSDEEP

Submit Download