0946747a01ca9e3a4133c03bfa112b13b2066dd4459191984442eff3fa46978c

Analysis

max time kernel
149s
max time network
115s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bluewing emulator.exe
Size 2.1MB
Sample260601-vr93fsbs4w
SHA256 0946747a01ca9e3a4133c03bfa112b13b2066dd4459191984442eff3fa46978c
MD5 2947929bfdfd22d93cd552ded2177e66
SHA1 f5161bfaecd35b2ea7e96b3b8d27476edbef3c3a
SHA512 405fcff1c7e8820cb8cd00b06614917dbdc409f1b922fecbe5ebd0ca180d9f043117863d3a2bb5406fec82a1f683d67dffe8b8a5c81432eded93f66d2eda8252
SSDEEP 49152:K++f0oSKLTmmK9lODbLcXS8Waaq59TxcrrlTl/u6iT:R+wAvi
TLSH
T16DA59E0566E803F9E277D1B9C9621607E6B2B8450770AADF03E05E9A1F377A05B3F712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 28 IoCs

exploit

pid	Process
3136	icacls.exe
4124	icacls.exe
3576	takeown.exe
5652	icacls.exe
1864	takeown.exe
2600	icacls.exe
1224	icacls.exe
3752	takeown.exe
3624	takeown.exe
5768	icacls.exe
2632	icacls.exe
4236	takeown.exe
2848	takeown.exe
240	icacls.exe
1004	icacls.exe
2832	takeown.exe
3832	takeown.exe
3724	icacls.exe
5352	icacls.exe
5532	takeown.exe
3620	icacls.exe
3236	takeown.exe
4748	takeown.exe
6076	icacls.exe
3048	takeown.exe
4356	takeown.exe
3516	takeown.exe
5040	icacls.exe

Modifies file permissions 1 TTPs 28 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2600	icacls.exe
3136	icacls.exe
2832	takeown.exe
5652	icacls.exe
1864	takeown.exe
3832	takeown.exe
2632	icacls.exe
3576	takeown.exe
1224	icacls.exe
1004	icacls.exe
3624	takeown.exe
3724	icacls.exe
4748	takeown.exe
4236	takeown.exe
4124	icacls.exe
2848	takeown.exe
3620	icacls.exe
3236	takeown.exe
3516	takeown.exe
5040	icacls.exe
240	icacls.exe
3752	takeown.exe
5768	icacls.exe
6076	icacls.exe
3048	takeown.exe
5352	icacls.exe
5532	takeown.exe
4356	takeown.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Riot Vanguard\vanguard.yaml	bluewing emulator.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	bluewing emulator.exe
File opened for modification	C:\Program Files\Riot Vanguard\vanguard.yaml	bluewing emulator.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3296	bluewing emulator.exe
3296	bluewing emulator.exe
3296	bluewing emulator.exe
2056	bluewing emulator.exe
2056	bluewing emulator.exe
3296	bluewing emulator.exe
3296	bluewing emulator.exe
2056	bluewing emulator.exe
2056	bluewing emulator.exe
3296	bluewing emulator.exe
3296	bluewing emulator.exe
2056	bluewing emulator.exe
2056	bluewing emulator.exe
3296	bluewing emulator.exe
3296	bluewing emulator.exe
2056	bluewing emulator.exe
2056	bluewing emulator.exe
3296	bluewing emulator.exe
3296	bluewing emulator.exe
2056	bluewing emulator.exe
2056	bluewing emulator.exe
3296	bluewing emulator.exe
3296	bluewing emulator.exe
2056	bluewing emulator.exe
2056	bluewing emulator.exe
3296	bluewing emulator.exe
3296	bluewing emulator.exe
2056	bluewing emulator.exe
2056	bluewing emulator.exe
3296	bluewing emulator.exe
3296	bluewing emulator.exe
2056	bluewing emulator.exe
2056	bluewing emulator.exe
3296	bluewing emulator.exe
3296	bluewing emulator.exe
2056	bluewing emulator.exe
2056	bluewing emulator.exe
3296	bluewing emulator.exe
3296	bluewing emulator.exe
2056	bluewing emulator.exe
2056	bluewing emulator.exe
3296	bluewing emulator.exe
3296	bluewing emulator.exe
2056	bluewing emulator.exe
2056	bluewing emulator.exe
3296	bluewing emulator.exe
3296	bluewing emulator.exe
2056	bluewing emulator.exe
2056	bluewing emulator.exe
3296	bluewing emulator.exe
3296	bluewing emulator.exe
2056	bluewing emulator.exe
2056	bluewing emulator.exe
3296	bluewing emulator.exe
3296	bluewing emulator.exe
2056	bluewing emulator.exe
2056	bluewing emulator.exe
3296	bluewing emulator.exe
3296	bluewing emulator.exe
2056	bluewing emulator.exe
2056	bluewing emulator.exe
3296	bluewing emulator.exe
3296	bluewing emulator.exe
2056	bluewing emulator.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 3624	3296	bluewing emulator.exe	80
PID 3296 wrote to memory of 5768	3296	bluewing emulator.exe	82
PID 3296 wrote to memory of 4940	3296	bluewing emulator.exe	84
PID 3296 wrote to memory of 5208	3296	bluewing emulator.exe	86
PID 3296 wrote to memory of 5700	3296	bluewing emulator.exe	88
PID 3296 wrote to memory of 2832	3296	bluewing emulator.exe	91
PID 3296 wrote to memory of 5652	3296	bluewing emulator.exe	93
PID 3296 wrote to memory of 1864	3296	bluewing emulator.exe	95
PID 3296 wrote to memory of 6076	3296	bluewing emulator.exe	97
PID 2056 wrote to memory of 3832	2056	bluewing emulator.exe	101
PID 2056 wrote to memory of 3724	2056	bluewing emulator.exe	103
PID 2056 wrote to memory of 3080	2056	bluewing emulator.exe	105
PID 2056 wrote to memory of 3048	2056	bluewing emulator.exe	108
PID 2056 wrote to memory of 5352	2056	bluewing emulator.exe	110
PID 2056 wrote to memory of 5532	2056	bluewing emulator.exe	112
PID 2056 wrote to memory of 3620	2056	bluewing emulator.exe	114
PID 3296 wrote to memory of 4356	3296	bluewing emulator.exe	116
PID 3296 wrote to memory of 2632	3296	bluewing emulator.exe	118
PID 2056 wrote to memory of 3236	2056	bluewing emulator.exe	120
PID 2056 wrote to memory of 2600	2056	bluewing emulator.exe	122
PID 3296 wrote to memory of 3516	3296	bluewing emulator.exe	124
PID 3296 wrote to memory of 5040	3296	bluewing emulator.exe	126
PID 2056 wrote to memory of 4748	2056	bluewing emulator.exe	128
PID 2056 wrote to memory of 3136	2056	bluewing emulator.exe	130
PID 3296 wrote to memory of 4236	3296	bluewing emulator.exe	132
PID 3296 wrote to memory of 4124	3296	bluewing emulator.exe	134
PID 2056 wrote to memory of 3576	2056	bluewing emulator.exe	136
PID 2056 wrote to memory of 1224	2056	bluewing emulator.exe	138
PID 3296 wrote to memory of 2848	3296	bluewing emulator.exe	140
PID 3296 wrote to memory of 240	3296	bluewing emulator.exe	142
PID 2056 wrote to memory of 3752	2056	bluewing emulator.exe	144
PID 2056 wrote to memory of 1004	2056	bluewing emulator.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bluewing emulator.exe
"C:\Users\Admin\AppData\Local\Temp\bluewing emulator.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3624
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5768
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "VgcYamlGuard"
  2⤵
  PID:4940
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /delete /tn "VgcYamlGuard" /f
  2⤵
  PID:5208
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "VgcYamlGuard" /tr "\"C:\Users\Admin\AppData\Local\Temp\bluewing emulator.exe\" --patch-yaml" /sc onstart /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5700
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2832
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5652
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1864
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:6076
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4356
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2632
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3516
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5040
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4236
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4124
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2848
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:240

C:\Users\Admin\AppData\Local\Temp\bluewing emulator.exe
"C:\Users\Admin\AppData\Local\Temp\bluewing emulator.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3832
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3724
- C:\Windows\system32\schtasks.exe
  schtasks /query /tn "VgcYamlGuard"
  2⤵
  PID:3080
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3048
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5352
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5532
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3620
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3236
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2600
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4748
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3136
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3576
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1224
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3752
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vanguard.yaml

Path C:\Program Files\Riot Vanguard\vanguard.yaml
Size 173B
SHA256 6a0379629c24895bcc96211c084ce2d466c639faad5065022f503c77807b8c1f
MD5 256b6418cc6eed39cd9170b0d40c2f70
SHA1 47d5a7a48cebe6faf5afc34c945884ed17ac5fd5
SHA512 5a310b05e24b2ad69bece050aafde71791975d36cc4b2fd16da251ed6c55dae18fc1dd1a0c932dcaebd88676d3ea1e383d86052b2b813cd88a8c9e93407f933c
TLSH
T189C08050DDE0D46C34DFB27593027F0D051059591A39047FD15753F89899CB157158F3
MD5 SHA1 SHA512 TLSH

Submit Download

vgc_debug.log

Path C:\vgc_debug.log
Size 235B
SHA256 4d21e173f31263dbebc70c07f17157f2bca0a1248b2007d910682f14ca70bd10
MD5 ac934b488b1b8b4693f057ce3fe1cfbc
SHA1 2006038dba7d976672cb1da3e5530ede4513b184
SHA512 0623001a2e28eeb82c97c4692864972b4f52e862bbf86ca93c5a9509d7b97efe0f7a3b90cb832a663d5ab9e32019d65d64b8092ee8f601889ea38612d10c3ebd
TLSH
T169D0C797718370045953F262DCADF6D204655A879C5D51C4F1BA1EC45196500DFC94B0
MD5 SHA1 SHA512 TLSH

Submit Download

vgc_debug.log

Path C:\vgc_debug.log
Size 367B
SHA256 0a19ec4fb031d52ad0965fda6c6a694f263b446d6899a8327346d566d855976e
MD5 ef26b0fddcab128fc64a26de6338fada
SHA1 c82880be5c3a6d9844b47314dc73d0dcefaf898c
SHA512 c6d3288dd607b7b985ceebbaa36d19bb77b2f2f91606c770047168ee8e397a72d0ed85521e61d90ad5d717c233241da0d3c4fbf12ea35ca4359620fd39433d25
TLSH
T177E0B897714370046853F3A2DCADF6D204555A8BDC6D55D4F2BA1EC45196500DFC9470
MD5 SHA1 SHA512 TLSH

Submit Download

vgc_debug.log

Path C:\vgc_debug.log
Size 411B
SHA256 7bba004972efa1a78ee6d73ce6427b77c1a5b8de234441fe0bf53dbd0978dc40
MD5 6c22f72f58a987e2359ba083d4640c8a
SHA1 067f298dfbebf27fda9d5834bf780f5e2f8d5a2d
SHA512 ac5edd6d85d0cb9194492bdafa36b8d9e23c8068742151cae7f1928f9999998aaca4e23339fbe265c2b4a0f269ed86aee678880c1f1c48fc323ebd9ff6e38e0e
TLSH
T118E09B97714370046853F3A2DCADF7D204555ACBDC7D55D4F2BA1EC45196500DFC9470
MD5 SHA1 SHA512 TLSH

Submit Download

vgc_debug.log

Path C:\vgc_debug.log
Size 455B
SHA256 f73416021defce5906532aed7c32686c0198c16d6c223e0a05126a49813f1846
MD5 4552b884aa9800c4af5aec27b9f3dd34
SHA1 726093985f7d4fcc23a15aa9323060afe34508ef
SHA512 eb0eb918c3f288ab09e6be0537e7917288619e2b5b6ccb580778fda6c17e3d42489dfdaf9889afdcaff4135934f65264893430dbb88508d6f20887c9f015010b
TLSH
T1DAF0C797714370046843F2A2DC5DF7D104555A8BDC7955D4F2BA1EC451A6500DFC8470
MD5 SHA1 SHA512 TLSH

Submit Download

vgc_debug.log

Path C:\vgc_debug.log
Size 499B
SHA256 c296690b04dbba34653b97547cf339020d21017d62f47fc7e3e1fa4a9739c369
MD5 4eebbf31b437d3829d165c9a77667f22
SHA1 8a17798b322b7fa95c07fe1571efb57ae4d4a0bb
SHA512 15e7790cf61c3cddc622b58868015a34903e6ee2625b5c5be08c39ba17b0671cbfb2423e74b653d4fbc01dad5c9c62cb70f9bc241c1fe812dfba44c65e4f2032
TLSH
T178F0A997714370086843F2A2DC5DF7D104555A8BDC7955D4F3BA1EC451A6510DFC8470
MD5 SHA1 SHA512 TLSH

Submit Download

vgc_debug.log

Path C:\vgc_debug.log
Size 543B
SHA256 04999362554d18ecf7359a74e09ae393602be23762310cb184f648e8c3308ba4
MD5 e0cc7d0b19da141c794078320d5af7e0
SHA1 cfc09465229a48ba2269193e7385bbdb2050d057
SHA512 e3784b88922e97de1f34f3a7c5e64cb8f29cc16210cdef36b663cf7d4e6d17339781d52864d015c619a3df7e1e00481c06ce62e6be3849fa7df5d30c6503e5d2
TLSH
T1E1F09B97714370086843F2A2DC5DF7D104556ACBDC7955D4F3BA1EC45196510DFC8470
MD5 SHA1 SHA512 TLSH

Submit Download

vgc_debug.log

Path C:\vgc_debug.log
Size 587B
SHA256 de1c52de5efa380ceb39e8b8a760038ed3020ddcd9f6a53b049985431c319d1e
MD5 efe0870dfc6ff6df6ec87c64352e2ae2
SHA1 8c348cb2e8977cefa6aad5198bd46c22105dc716
SHA512 4c9237d9621b5c8b92b30746ec58474216d83729391d4bcef776193d3cfc1a5edec32cb5d7661e94264d6e4d9133f21d863b888628e1809b07770777d89840dd
TLSH
T139F07C97714370086843F2E2DC5DFBD104556ACBDC7955D4F3BA1EC45156510DFC8470
MD5 SHA1 SHA512 TLSH

Submit Download

vgc_debug.log

Path C:\vgc_debug.log
Size 631B
SHA256 cb34ea7ef9edf4f33dfee79a56aad4ba17d3b12f1c6275183a4e71634b79a73b
MD5 b69e68b666175ed9d4e5edf4d8b6aa0f
SHA1 f69bd4613a4480d39be659bb59a929a7ca4c3fcf
SHA512 cd710e081d643b006b2088766d6f35a513b55ad2ac7ee8adb32f3d820d8ebf88c8a9875c484af8e8df7612c6c6a8987013545913c5b364cf542c1ecd3b61b580
TLSH
T138F06D97714370086843F2E2DC5DFBD104556ACBDC7955D4F3BA1EC49156510DFC8470
MD5 SHA1 SHA512 TLSH

Submit Download

vgc_debug.log

Path C:\vgc_debug.log
Size 675B
SHA256 60b52e01d43dc224882d75ee12f8057d59294000435d1ec949a566e5b3455cbd
MD5 3daaad7ea1a849feccc59aedb2b6d1ff
SHA1 6c76e895a0490dd806a2e623050b0e90c1cdb5fd
SHA512 750f4cd97428f495bfd070e7c80440e94f6a43f093437d58b87a2a97f73add63ea54e1adce95b916ceed80c326f4b0e7cf88185294f537545ad684a3c06e8fce
TLSH
T12F015E97714370086843F2E2DC5DFBD104596ACBDCB955D4F3BA1EC49156511EFC8470
MD5 SHA1 SHA512 TLSH

Submit Download