Analysis
- max time kernel
83s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/07/2026, 14:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe
- Size 1.2MB
- Sample260727-sa6ycsv1fz
- SHA256 470aeb78dad18ed9381f6705f259f44a0bfb55c07da6bc18b32c20c7e1148925
- MD5 0fce6d6f55cc466b8b4633163e542783
- SHA1 330caddc3f076cc8556388eac1f48ccb65b2c184
- SHA512 69b0563b6ecd12ac31c109df75227f88e27afc57a651a16d0099ddd1f82e792a13cba92a7738d9c147789add0e14f68d7d2d89e1183630586ceae356c968b3f0
- SSDEEP 24576:a6Mnt6xDxsxzJl2roAlavMaP0Le5ji0hmxNrM:aaDqnoroAkPji0Aj
- TLSH T1F6555B66EAB483A1C177C474C9D29749EA313D910B308ADB8295F36C6E337E19E36731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4332 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe$ 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe$ 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe$ 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2580 2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe 4332 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_0fce6d6f55cc466b8b4633163e542783_amadey_cobalt-strike_elex_glassworm_hijackloader_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2580
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4332
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.2MB
- SHA256 470aeb78dad18ed9381f6705f259f44a0bfb55c07da6bc18b32c20c7e1148925
- MD5 0fce6d6f55cc466b8b4633163e542783
- SHA1 330caddc3f076cc8556388eac1f48ccb65b2c184
- SHA512 69b0563b6ecd12ac31c109df75227f88e27afc57a651a16d0099ddd1f82e792a13cba92a7738d9c147789add0e14f68d7d2d89e1183630586ceae356c968b3f0
- SSDEEP 24576:a6Mnt6xDxsxzJl2roAlavMaP0Le5ji0hmxNrM:aaDqnoroAkPji0Aj
- TLSH T1F6555B66EAB483A1C177C474C9D29749EA313D910B308ADB8295F36C6E337E19E36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 1.5MB
- SHA256 00105bf4f51e65deb017d032b87b7f962ef76771c5b151d21d7a0aa655b2ec35
- MD5 946bc4a2d094ee81d94213750bc8ea2e
- SHA1 ac4ac031495276a9e8eb1f499203ae2a0ad9cad2
- SHA512 56b1d43e1029342ed0044a6f338f11af0e224bf608021466fd57d25543585686bc5638008d8b2f32588f57abc5b812c85e277547c961eaafb3fb1071400e72d6
- SSDEEP 24576:a6Mnt6xDxsxzJl2roAlavMaP0Le5ji0hmxNrMR3UNUpEisI:aaDqnoroAkPji0AjyUN+Eir
- TLSH T113754B66EA6886E2D1778078C9D28745EB327C910B308ACB5294F33D6E337E59D36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
- Size 1.7MB
- SHA256 d9612a2d37c4e9534771d5820fcb2330e1f3ca709a9b42fee6ffddbca89ae0ac
- MD5 183ceb5157f3be8bb20ee8eaf12c29e9
- SHA1 e27da9a64c0e95b79f81862b3e376466d3134e81
- SHA512 cbd711c099a21d56d4983c2995cafa3bec4f1e70cbb9f88d44defee8c8fec1a43cca665402a36ad81b3f5e5f8cd82fea739d2711e5e4e435a00b56110edb0209
- SSDEEP 24576:a6Mnt6xDxsxzJl2roAlavMaP0Le5ji0hmxNrMX3Td9CHKy7GZO:aaDqnoroAkPji0AjoTd9CHKyao
- TLSH T1AE857C66FAB442A1D1B7C474C9E29645EA327C910B308ACF4294F36D6E337D19E36B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
- Size 1.3MB
- SHA256 9b8d9a7e9160739e374083190af1588219675acc58f77cb9737f086993c8e033
- MD5 4639f849d996082d443f37036e140f65
- SHA1 4a34b1398215be6188688a6d860d2cb804910581
- SHA512 0f5c5a440bf754edaad91d4b4abd33b0709dd9975032257e53383b8419f0e3d9005dd3187c5c547c42b1ab5241e0915e116a1aef5a91d2eb3c543e5858b57074
- SSDEEP 24576:a6Mnt6xDxsxzJl2roAlavMaP0Le5ji0hmxNrMeGen:aaDqnoroAkPji0AjMI
- TLSH T12F655B26EAB482A1D177C474C9D29749EB313D910B308ADB8295F36C6E337D19E36B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe
- Size 1.3MB
- SHA256 9ff6a38fd2c5c2771d8cceb430fea02a6ac5363b07fa19a9d7b39f6236191fbe
- MD5 96d0a647ba8f4c09ff75913c78ea813f
- SHA1 63d2020c780d4c2c0f421924f4204a9bed21a1d4
- SHA512 6149493781cf56e4855962905452bcedf64bc64d0f7ff44860356153d5a55c433ee914332fb627bcb671d35e8d8310d10fe4f19d564bea5ce62a5f1533646543
- SSDEEP 24576:a6Mnt6xDxsxzJl2roAlavMaP0Le5ji0hmxNrMfUwjBXG:aaDqnoroAkPji0AjpwFXG
- TLSH T167556B26FAA482A1C1B7C474C9D29745EA317D910B308ADB9295F33C6E337D19E36B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.8MB
- SHA256 e3045bb934435bd14b78dd4eb47d80eb136ff209af84ba22938ede22e2f1890a
- MD5 a14a84fc088e91b4ebc5182b9774628f
- SHA1 50f5196d84d75f8597ad54ba5c992264ddd544ec
- SHA512 fc4f747e719b125165895b3b3070393926c21e41b7c8b7ed8b73cf812d3528e5b9ebaf61fa24ec9e57781ccbf9d09e65447b065b6246b47785339b845b70c2e1
- SSDEEP 24576:a6Mnt6xDxsxzJl2roAlavMaP0Le5ji0hmxNrMD0Le5ji0hmxNrM:aaDqnoroAkPji0AjKPji0Aj
- TLSH T12F853A26F9748361D073C0B9C9D2964AEA313D910B308ACB4295F77C6E377E69A36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$
- Size 2.0MB
- SHA256 e639db179cd7daead9c659b67eaf61af18b2d5619993c67ef83c36a41932a5b2
- MD5 72bd5e165244fa00da70ee1be14dd85a
- SHA1 6feb9b3aae1ce31dc6388355d0fe0fb65bcc3292
- SHA512 64dec801d514d069a31524e6164d7defadd0d94510ebd12d0538d4899490e08c3d751bf130977cf29bc5da3c8eecc1fd1f0e3daea661d762e3f337f6170825fe
- SSDEEP 24576:a6Mnt6xDxsxzJl2roAlavMaP0Le5ji0hmxNrM2zWj8PSeWygmNWZcb1pEKdUnHB1:aaDqnoroAkPji0AjruygmUSbHDUnT
- TLSH T104A54A56EBF842E5E1B39574C9A28665FA727C520B3086DF4290E32E1E337D09D36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe
- Size 1.3MB
- SHA256 33a5b264d81e95855d8c64c5027b8808a9e64c1d4ddce48866437d2d55dd4988
- MD5 b323e31f06e31cc802b30bd23951d23b
- SHA1 3d14e59ba657b45fa65ae1e0e7f6fd2c1f0925df
- SHA512 831746878e3f7210810a83d193da78a603762d9dc7bab3af8dfbbdc7bc5b95b7dd2274975fb9f1abcab211b616850b0fb7052506651698709dcd7472157c8155
- SSDEEP 24576:a6Mnt6xDxsxzJl2roAlavMaP0Le5ji0hmxNrMPF:aaDqnoroAkPji0Ajq
- TLSH T1DC555B66E9A483A1C1B78474CDD29745EA313D910B308AEB4294F77CAE337D1AE36731
- MD5 SHA1 SHA512 SSDEEP TLSH