Analysis
- max time kernel
116s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
30/05/2026, 14:24
Behavioral task
behavioral1
Sample
2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.3MB
- Sample260530-rqzzbaez21
- SHA256 95074a704ef83442b81c981013160455855856099def7847a934f37c354eb180
- MD5 4244726cc5e97c22944640c748e86dfd
- SHA1 6e905da165fb2b73dc9ea1a9b77b20bdb29c7174
- SHA512 d2225f4534de02e374afd9437155c3b5485361f84596fa42d742bdbbd8ffbb4cd72ebc3b57ef9fdcbda7f7a1d9c5cd810be8a11a9fe90ad5e4a6f3d5b02d7ac6
- SSDEEP 49152:A3k03kHRJzeW4SkZP4sz9MbE56rIeW4SkZP4sz9MbBPji0Aj:A3k03kHRpfkZcBr0fkZcRjo
- TLSH T15AF53B16F6788722D0B7C0B9C5D6AA9AFA3238455F308ACB0345D72C3E277D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/3964-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b462-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4268-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a33d-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3964-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4268-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000002787f-1285.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a3e8-1539.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a8e5-1624.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002d000000000476-2070.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b462-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a33d-12.dat aspack_v212_v242 behavioral2/files/0x000500000002787f-1285.dat aspack_v212_v242 behavioral2/files/0x000300000002a3e8-1539.dat aspack_v212_v242 behavioral2/files/0x000200000002a8e5-1624.dat aspack_v212_v242 behavioral2/files/0x002d000000000476-2070.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4268 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3964 2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4268 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-30_4244726cc5e97c22944640c748e86dfd_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3964
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4268
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.3MB
- SHA256 95074a704ef83442b81c981013160455855856099def7847a934f37c354eb180
- MD5 4244726cc5e97c22944640c748e86dfd
- SHA1 6e905da165fb2b73dc9ea1a9b77b20bdb29c7174
- SHA512 d2225f4534de02e374afd9437155c3b5485361f84596fa42d742bdbbd8ffbb4cd72ebc3b57ef9fdcbda7f7a1d9c5cd810be8a11a9fe90ad5e4a6f3d5b02d7ac6
- SSDEEP 49152:A3k03kHRJzeW4SkZP4sz9MbE56rIeW4SkZP4sz9MbBPji0Aj:A3k03kHRpfkZcBr0fkZcRjo
- TLSH T15AF53B16F6788722D0B7C0B9C5D6AA9AFA3238455F308ACB0345D72C3E277D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
- Size 3.7MB
- SHA256 ce066ef47d020c9f2995098232efd3834006af843def8f979b07f19494e835d8
- MD5 60a2bed64af6fb6e8b5641d4f3b577dd
- SHA1 89517adc057bd5907057b8da848c5b4da2465f05
- SHA512 f672cbee48b42bd047c151a77d6b6465398466063913238600b0dbf50832e7c888c19c96171f07ff8de5290873142853495f75746f529b176541edfce8635c80
- SSDEEP 49152:A3k03kHRJzeW4SkZP4sz9MbE56rIeW4SkZP4sz9MbBPji0AjoTd9CHKyao:A3k03kHRpfkZcBr0fkZcRjoKCqo
- TLSH T1B9064C16F6B84762D0B7C079C5D6AA5AFA3238451F308ACB0345D72C2F277D58A3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$
- Size 3.4MB
- SHA256 9e843714281e4875f1af46a550a4ca04c1dfb8744ae6bb7b7486883014e9078a
- MD5 cd489678774396d4010b1d55c035130f
- SHA1 45ac6164e791a8028a5a58f558181bde7d58d456
- SHA512 ee3ae35d19fe17411bcbf03195c08a6b51be13d7eadf47e7c33fb08537665e77e20a4548a9ac7b471a2c26c199ced8a02b1b6f759185693246ffcbb270547d83
- SSDEEP 49152:A3k03kHRJzeW4SkZP4sz9MbE56rIeW4SkZP4sz9MbBPji0Ajow:A3k03kHRpfkZcBr0fkZcRjoB
- TLSH T125F53B16F6788722D0B7C0B9C5D6AA5AFA3238455F308ACB0345D72C3E277D58A36736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.8MB
- SHA256 2cca59a05f8350ad0ce684eec2fabdc82d4183c3d4af39753e7a00e38c011c26
- MD5 7a3a9ed6efaa1ff13762e428678de14e
- SHA1 a4521a9db15400d7b1d7f1a81a448189c3daefe4
- SHA512 21b527e73143674b216a7d2d6680087b3f542f597ba228ae80958dc1b244937649c516c985d10ce6331aff40ae9f3edbb0086f34fca8cec99407152fb4189d2e
- SSDEEP 49152:A3k03kHRJzeW4SkZP4sz9MbE56rIeW4SkZP4sz9MbBPji0AjKPji0Aj:A3k03kHRpfkZcBr0fkZcRjo0jo
- TLSH T174062A16F6788722D0B7C0B9C5D6AA9AFA3238455F308ACB0345D72C3E277D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 3.4MB
- SHA256 3ceeb082472f3399138f80ab8f88c8daab45b24ff36a736c7e3aa56664827a22
- MD5 3df53d93880610d6df43c7449e819379
- SHA1 abe9866afdbed1aebba4f4b8b4edc57594fb571b
- SHA512 8c0093b10875137beb75f28066bf9d52e4d884e36110d7c57d0fbe1fd2176db338d4c2f3992a65624bbbc25f1af89258dc8711e8e99f6301a9c6c5f5b4e04e0d
- SSDEEP 49152:A3k03kHRJzeW4SkZP4sz9MbE56rIeW4SkZP4sz9MbBPji0Ajq:A3k03kHRpfkZcBr0fkZcRjo2
- TLSH T19EF51916F5788722D0B7C0B9C5D6AA9AFA323C451F308ACB0245E72C2E377D59636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
- Size 3.5MB
- SHA256 74ffc6e3a105f2c2960916b555e7c9e2415e81e6810dff9c23eadf45024ef59b
- MD5 54772154d2fec4a801d5ed054a4724e6
- SHA1 da1a50bc5a6720583ce389cb5e31fcb4b5ffa377
- SHA512 adf248240a2689fd88b16b92c0816baad35205a186acdaf871150bbcbfbb508f388b0c39683beaf2d3938d83e16498b1e1b4ae6b0983de5e6eae9d186da68e4d
- SSDEEP 49152:A3k03kHRJzeW4SkZP4sz9MbE56rIeW4SkZP4sz9MbBPji0AjYi2WH3:A3k03kHRpfkZcBr0fkZcRjoMuX
- TLSH T1C5063B16F6788732D0B7C0B9C5D6AA9AFA3238455F308ACB0345D72C2E277D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH