Overview
overview
7Static
static
3ver2022s/V...64.msi
windows10-2004-x64
7ver2022s/V...64.msi
windows11-21h2-x64
7ver2022s/V...86.msi
windows10-2004-x64
6ver2022s/V...86.msi
windows11-21h2-x64
6ver2022s/V...64.msi
windows10-2004-x64
6ver2022s/V...64.msi
windows11-21h2-x64
6ver2022s/a...2S.dll
windows10-2004-x64
1ver2022s/a...2S.dll
windows11-21h2-x64
1ver2022s/i...2S.dll
windows10-2004-x64
3ver2022s/i...2S.dll
windows11-21h2-x64
3ver2022s/i...2S.dll
windows10-2004-x64
1ver2022s/i...2S.dll
windows11-21h2-x64
1ver2022s/setup.exe
windows10-2004-x64
7ver2022s/setup.exe
windows11-21h2-x64
7ver2022s/w...2S.dll
windows10-2004-x64
3ver2022s/w...2S.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/04/2026, 12:19
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ver2022s/Ver2022S_amd64.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
ver2022s/Ver2022S_amd64.msi
Resource
win11-20260130-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
ver2022s/Ver2022S_i386.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
ver2022s/Ver2022S_i386.msi
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
ver2022s/Ver2022S_ia64.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
ver2022s/Ver2022S_ia64.msi
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
ver2022s/amd64/Ver2022S.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
ver2022s/amd64/Ver2022S.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
ver2022s/i386/Ver2022S.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
ver2022s/i386/Ver2022S.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
ver2022s/ia64/Ver2022S.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
ver2022s/ia64/Ver2022S.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
ver2022s/setup.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral14
Sample
ver2022s/setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral15
Sample
ver2022s/wow64/Ver2022S.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
ver2022s/wow64/Ver2022S.dll
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target ver2022s/Ver2022S_amd64.msi
- Size 128KB
- Sample260422-phlqlsbs3w
- SHA256 b033c86f380c175d9f62d0d1535b42646d9054cfecd6b3765cf761eb4faaedd9
- MD5 2c637b4638c5eb4fe230aa403e454ae7
- SHA1 ae82790ed78aa508bc2fa3ab32c71af2938cf3f5
- SHA512 99143c45a7e18e370942f9a33137f4dd591ea041418fd9450e9a7f9428ce0612cd589645594ed7ef97a656a8b4e7723ab9f1ebc99d4eb028463a6f686d7759f6
- SSDEEP 1536:Ix8fEfvIjLrvvg+VXJ3lIMW10i2AinCNu0VpO:WjXInrvvgCPIMViU
- TLSH T15DD36D17B7448333D5C20232852FD7E15F3A9CA84BB24513A19EB26D2CB2B94F6B76D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 4720 MsiExec.exe 4720 MsiExec.exe 4720 MsiExec.exe 4720 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\Ver2022S.dll msiexec.exe File opened for modification C:\Windows\system32\Ver2022S.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\Ver2022S.dll msiexec.exe File created C:\Windows\system32\Ver2022S.dll msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF9DB97C1BA07FB0C2.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFDDA4AF192C9C1640.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI46F9.tmp msiexec.exe File opened for modification C:\Windows\Installer\e584522.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{A3F2520B-31FE-4F03-9381-C24471530283} msiexec.exe File opened for modification C:\Windows\Installer\MSI45CE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI465C.tmp msiexec.exe File created C:\Windows\Installer\e584524.msi msiexec.exe File created C:\Windows\SystemTemp\~DF8B9F9AAAFFF8DE01.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFD92F54A179824F42.TMP msiexec.exe File created C:\Windows\Installer\e584522.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4004 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000adcdd9a6d08c0ad30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000adcdd9a60000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900adcdd9a6000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aadcdd9a6000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dadcdd9a6000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\International\AcceptLanguage = "en-US,en;q=0.7,da;q=0.3" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4412 msiexec.exe 4412 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4004 msiexec.exe Token: SeIncreaseQuotaPrivilege 4004 msiexec.exe Token: SeSecurityPrivilege 4412 msiexec.exe Token: SeCreateTokenPrivilege 4004 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4004 msiexec.exe Token: SeLockMemoryPrivilege 4004 msiexec.exe Token: SeIncreaseQuotaPrivilege 4004 msiexec.exe Token: SeMachineAccountPrivilege 4004 msiexec.exe Token: SeTcbPrivilege 4004 msiexec.exe Token: SeSecurityPrivilege 4004 msiexec.exe Token: SeTakeOwnershipPrivilege 4004 msiexec.exe Token: SeLoadDriverPrivilege 4004 msiexec.exe Token: SeSystemProfilePrivilege 4004 msiexec.exe Token: SeSystemtimePrivilege 4004 msiexec.exe Token: SeProfSingleProcessPrivilege 4004 msiexec.exe Token: SeIncBasePriorityPrivilege 4004 msiexec.exe Token: SeCreatePagefilePrivilege 4004 msiexec.exe Token: SeCreatePermanentPrivilege 4004 msiexec.exe Token: SeBackupPrivilege 4004 msiexec.exe Token: SeRestorePrivilege 4004 msiexec.exe Token: SeShutdownPrivilege 4004 msiexec.exe Token: SeDebugPrivilege 4004 msiexec.exe Token: SeAuditPrivilege 4004 msiexec.exe Token: SeSystemEnvironmentPrivilege 4004 msiexec.exe Token: SeChangeNotifyPrivilege 4004 msiexec.exe Token: SeRemoteShutdownPrivilege 4004 msiexec.exe Token: SeUndockPrivilege 4004 msiexec.exe Token: SeSyncAgentPrivilege 4004 msiexec.exe Token: SeEnableDelegationPrivilege 4004 msiexec.exe Token: SeManageVolumePrivilege 4004 msiexec.exe Token: SeImpersonatePrivilege 4004 msiexec.exe Token: SeCreateGlobalPrivilege 4004 msiexec.exe Token: SeBackupPrivilege 4284 vssvc.exe Token: SeRestorePrivilege 4284 vssvc.exe Token: SeAuditPrivilege 4284 vssvc.exe Token: SeBackupPrivilege 4412 msiexec.exe Token: SeRestorePrivilege 4412 msiexec.exe Token: SeRestorePrivilege 4412 msiexec.exe Token: SeTakeOwnershipPrivilege 4412 msiexec.exe Token: SeRestorePrivilege 4412 msiexec.exe Token: SeTakeOwnershipPrivilege 4412 msiexec.exe Token: SeRestorePrivilege 4412 msiexec.exe Token: SeTakeOwnershipPrivilege 4412 msiexec.exe Token: SeRestorePrivilege 4412 msiexec.exe Token: SeTakeOwnershipPrivilege 4412 msiexec.exe Token: SeRestorePrivilege 4412 msiexec.exe Token: SeTakeOwnershipPrivilege 4412 msiexec.exe Token: SeRestorePrivilege 4412 msiexec.exe Token: SeTakeOwnershipPrivilege 4412 msiexec.exe Token: SeRestorePrivilege 4412 msiexec.exe Token: SeTakeOwnershipPrivilege 4412 msiexec.exe Token: SeRestorePrivilege 4412 msiexec.exe Token: SeTakeOwnershipPrivilege 4412 msiexec.exe Token: SeRestorePrivilege 4412 msiexec.exe Token: SeTakeOwnershipPrivilege 4412 msiexec.exe Token: SeRestorePrivilege 4412 msiexec.exe Token: SeTakeOwnershipPrivilege 4412 msiexec.exe Token: SeRestorePrivilege 4412 msiexec.exe Token: SeTakeOwnershipPrivilege 4412 msiexec.exe Token: SeRestorePrivilege 4412 msiexec.exe Token: SeTakeOwnershipPrivilege 4412 msiexec.exe Token: SeRestorePrivilege 4412 msiexec.exe Token: SeTakeOwnershipPrivilege 4412 msiexec.exe Token: SeRestorePrivilege 4412 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4004 msiexec.exe 4004 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4412 wrote to memory of 4416 4412 msiexec.exe 84 PID 4412 wrote to memory of 4720 4412 msiexec.exe 86 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ver2022s\Ver2022S_amd64.msi1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4004
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4416
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4449C212CD8083A8319BA545BE001D0F2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:4720
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4284
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e584523.rbs
- Size 10KB
- SHA256 6a1c88cf59e0148ac7b1bd6aaece2349355b037cbb426d7b50e53b1e52d0d63a
- MD5 5a5607a981665d262d21312ec8fdd06d
- SHA1 9c3b1a5b9c97d082e76b8e09be6661d157ac405b
- SHA512 2d59ed16a3fc0b98919425f8b9b6844b2946885dd2d78a13117073436d21a737474deb3dd7e54da8e16cf4c9305128368b1ea9d511f7b2556d75f6f9a27e90b8
- SSDEEP 96:DmWqbn62Nmit+azGGmzdUQhGmCsTlNUQhGmC6jOsUqdTlrNPb+WJ5NWM5s2/WKHA:aFu3jazGd2wG1I8wG1Jy+zupMhWY5
- TLSH T11032D104B2A08992F46A1732DA8B07183773D3E9C32533CB69CD92344E96BE95DD925F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI465C.tmp
- Size 54KB
- SHA256 a99b13b3d61026bec3f47e6a79cb0b301fe52db7320faa3a9c36d62a50061916
- MD5 45a758aa7e855f3f3d0be3997371219a
- SHA1 596f0afb1dd993c2819d84d13deead5b7274a6a6
- SHA512 e4735e42d46c67530a384a4b59961e3c4f25863502deb7227a8f62693cfe2cffd9a85ee46658db077863ef47a7a458a12da4250b5bd901deae3d9d99ea43aea1
- SSDEEP 768:H+VX3KRO3SgvI8uMW10++cPuGbBinCi6u0Vsr:H+VXJ3lIMW10i2AinCNu0Vy
- TLSH T133438E06B764D052E8E61870857AC9E2693FFDB55B21C58BE605B6AF3C353C2EE31306
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Ver2022S.dll
- Size 7KB
- SHA256 4e4cb5980a2df611af67fb6444d03cbba6edb4ca33503b20dd4541a62e219f7e
- MD5 d18c72ebd9725d0803856fdd99676383
- SHA1 7380c006f9752c906df1e359f4ab2768958396bf
- SHA512 f2997a3178a1d53182c59ea8012e891f6ffc10fb64b3c34fc7c1125651de2f5f136c0369c63bcb285642218a20e902f82aa9d63c7512856d9a7bc2d80cb95826
- SSDEEP 96:71avKxHfu4FcEmZ8GldmmKBqYUk6RVEm6BCo7:71ai5W4FceSEVdtCo
- TLSH T164F19511DBF4107EF2FFE63C69F36116A853BC2144F6D15D05800A8B5979640ABAEF3A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Ver2022S.dll
- Size 7KB
- SHA256 2405f40c8f5edcb1d8f6be9262d21e929911846407ee01974234fbb2d96e052e
- MD5 3265a3802d8940e00b5a73c49493992e
- SHA1 7cac2dbd30466aac010ea88f9fa3a9cb1eade89c
- SHA512 358b00e4078838720123cb65a630e46c91d8cc79a9e8fd6760afb292ef1af09e9ae34c5d4e9cef18641fce3ca3d134232c55f2682f6f724cf29b4f914c9eab00
- SSDEEP 96:sSO6E1JSZk341YUZKxHfu4FcEm91MWUYEC6Kcl0GHBCo/vP8vv:1O6kkA35W4FcT1FUCoHs
- TLSH T17FF19305EEF8008EF2FBCA3099E75D16681AFD218437C25E1584161F4D797406B5AB3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 9612853be3f11c5e2c49d8b9b1795fd40a0dae39268db091b17f6fe86b769cfd
- MD5 afef24458e6918c99b347352ae7ba7c7
- SHA1 f2c14088d5b849f641dcf8fba18affa90c3d50e9
- SHA512 e59c81418bb5928e7e7d26e5c9f3ce65d8235d65a11e8b9092736b9021219f9e60a3088f4ddd893bcf5e2ad077d7fa3f8658298783060216a6adf85459734a47
- SSDEEP 24576:w2gmSp1xdoO/vvTLtmmeBkH6fapdwoi82GVtHZUGvNqYUqCDY93B7r8Rh:c
- TLSH T1F247C12836F92250E7F79E3C68F06A234E3A7D5B9C159A8D05451B4E0D21FB0E872F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{a6d9cdad-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{22d17058-7f8c-4fd5-8642-9cb04f24a9ec}_OnDiskSnapshotProp
- Size 6KB
- SHA256 450d263a8a9ad5bdc1d79e71160d22d6cd5ff6ae83b62aef5477f3b5296bcea8
- MD5 d018f6640329623d71f451c3611aa3cc
- SHA1 c4851148d6a428c701575f7f2833997ad8c01dc1
- SHA512 2eaaf15b4b8d79b14ae8a900b17eafc4e60d2d41e4287b6a1353011c9d120c2a0d397f92c0de2e24b599c716633b081ba0419a5457d420f78f64695c482369b8
- SSDEEP 96:FfNhNVsvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:tRV2b++ZVm
- TLSH T143D188085AE54711E2B3AB7129F14557A877B811EF33CB8E0198238E6670A10F935FAF
- MD5 SHA1 SHA512 SSDEEP TLSH