Analysis
- max time kernel
61s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 00:31
Behavioral task
behavioral1
Sample
2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.0MB
- Sample260808-avfmssen3w
- SHA256 e769f167717e866658fa4c6de0a15aaca550986fd7dcdb3d950e5e2b24cb5f86
- MD5 e301c4c5b314bc7e950ca624e5b050ba
- SHA1 be7a1de8ad9d41a03c13463cb370ffccc1b64d9f
- SHA512 8e1c9660881a308227e6fcb7b39491dfceb4be02e24a9e0fd0246f4dd440f69def4707bb83fd1a6325e4f9799e4a2d5e89f0f644ce39fdc4a3ec6d3981f8ba1d
- SSDEEP 49152:A3k03kHRJg56rV56ru56rbeW4SkZP4sz9MbE56rX:A3k03kHRzrWrbr7fkZcBrX
- TLSH T135E5E506E1A84F66D1AF8074CA965A55FA333C414F608BDB0294FF393F326D0AA75727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/4636-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c588-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5632-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4636-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bb4b-162.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001e0000000187ef-1097.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019df3-1257.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a31-1441.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000000138-2069.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c588-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000300000001bb4b-162.dat aspack_v212_v242 behavioral2/files/0x001e0000000187ef-1097.dat aspack_v212_v242 behavioral2/files/0x0003000000019df3-1257.dat aspack_v212_v242 behavioral2/files/0x0006000000018a31-1441.dat aspack_v212_v242 behavioral2/files/0x0004000000000138-2069.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5632 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4636 2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5632 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_e301c4c5b314bc7e950ca624e5b050ba_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4636
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5632
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.0MB
- SHA256 e769f167717e866658fa4c6de0a15aaca550986fd7dcdb3d950e5e2b24cb5f86
- MD5 e301c4c5b314bc7e950ca624e5b050ba
- SHA1 be7a1de8ad9d41a03c13463cb370ffccc1b64d9f
- SHA512 8e1c9660881a308227e6fcb7b39491dfceb4be02e24a9e0fd0246f4dd440f69def4707bb83fd1a6325e4f9799e4a2d5e89f0f644ce39fdc4a3ec6d3981f8ba1d
- SSDEEP 49152:A3k03kHRJg56rV56ru56rbeW4SkZP4sz9MbE56rX:A3k03kHRzrWrbr7fkZcBrX
- TLSH T135E5E506E1A84F66D1AF8074CA965A55FA333C414F608BDB0294FF393F326D0AA75727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
- Size 3.1MB
- SHA256 ef0d0d664bb2e6cbf4a6d2047f6a7845efbc282cbff61af8d585a0fb4b368680
- MD5 ac8aee0f7d4ca8c877d8caf91bdeaf26
- SHA1 005fa3c698c7032fab987fcce876126a0293cc64
- SHA512 ede1fe9a598be04cfffb7ba59ba5ddf1ed843eb681d43b52fccf1413e145f0d9b3468c2db3eb90871fa601b75650e3b41c515abfdf24a95285b11a71785e8f40
- SSDEEP 49152:A3k03kHRJg56rV56ru56rbeW4SkZP4sz9MbE56rk:A3k03kHRzrWrbr7fkZcBrk
- TLSH T16EE5F506E2A84F62D1AF8074CA965A55FA333C414F6047DB0294FF393F366D0AA79727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.5MB
- SHA256 aae4b9259787487a3689c1322d1bb34bc9e44ee4d2618176d926a5d3a93f2e6e
- MD5 c6d4646745a95da1f12044cf669c0c6d
- SHA1 7ea9c40e732444a4ea937fae2fe452030b7d6233
- SHA512 128a4d61c8249a2f23cbd0f85aa26343d91b34448a9760ebc3e23526cc159707570ac1fdd9fd12be3023ce9244acba54d338da1da49e683b5e960b245478740d
- SSDEEP 49152:A3k03kHRJg56rV56ru56rbeW4SkZP4sz9MbE56rTPji0Aj:A3k03kHRzrWrbr7fkZcBrLjo
- TLSH T1D7060616E1A84B62D06F8074CA969656FA333C414F608BDB0284FF3D3F366D19A79727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$
- Size 3.1MB
- SHA256 ba3c92e47c2dc14c33a8b7f83fac0c0fcae0d75728c0a459724ee0c640bd9b98
- MD5 0b2bb44f4c83a4a2aabedecef0b19386
- SHA1 070adabd23731d39f15023bf04cfe1e3c849dcfe
- SHA512 761b35bd891eb8f049942dd7a63d6b0233151173146b53fd3421dabee7717fc6053ad781b8567e19964e24f3544197ddb8391d0364dd56684ff754d0522b08e6
- SSDEEP 49152:A3k03kHRJg56rV56ru56rbeW4SkZP4sz9MbE56rU:A3k03kHRzrWrbr7fkZcBrU
- TLSH T1D7E5D406E1A84B66D1AF8074CA965655FA333C414FA087DB02D4FF3D3F326D0AAB5627
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$
- Size 3.0MB
- SHA256 0a0e6fd46bdb0d9aedb8512f4b150876d4b0b53f463473267e80bc9db6264c14
- MD5 f9f7ceca7edf0f19c3aa46decb32e34d
- SHA1 3c6429f582fb679b4efc7581b1e2b5471500089a
- SHA512 9b1fd0308727e07bf45be8fc9bd0c94408f0a723cada9ed4ab3890835ce81f1c0b61968d50c4ed5ca51efbd70536043479890a6bd7d3e3daf4c28eb63aed40a4
- SSDEEP 49152:A3k03kHRJg56rV56ru56rbeW4SkZP4sz9MbE56rP2:A3k03kHRzrWrbr7fkZcBru
- TLSH T15DE5E506E1A84F66D1AF8074CA965A55FA333C414F608BDB0294FF393F326D0AA75727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 3.0MB
- SHA256 045f36b21cd0e224e630c8f4baa2236096926da60640dd57757a868b31a6894f
- MD5 09199c4473346653858e2e3cf670dd6c
- SHA1 3f343e3526673f5c32350cd0661581b7a5dd24d6
- SHA512 02a64a57961791711de73d02a795012683132d688d385a5055c90e121a018d8ac8a47c3f64a9665c89e22266822da4138bc013f3639175d3db66ff553ddf91dd
- SSDEEP 49152:A3k03kHRJg56rV56ru56rbeW4SkZP4sz9MbE56r9:A3k03kHRzrWrbr7fkZcBr9
- TLSH T188E5E506E1A84F62D1AF9074CA965A55FA333C414F608BDB0294FF393F326D0AA75727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftWindows.DesktopStickerEditorCentennial.exe$
- Size 3.2MB
- SHA256 e877be80668576bf4a38da43690ffe25f625e22ea312f3a8d97c8962e5658814
- MD5 485f065409322d0e33c450b47e83b4c7
- SHA1 b322bda8d9390ee2a9908f1c53d422a5a2f52fd6
- SHA512 53747770099a6be036d53553ae2683cc10c440d8394080e87aed44c332a2e8fe99117673f74050242f794d547ca5c0df83f2f9d56ab030eef81bb29950364f97
- SSDEEP 49152:A3k03kHRJg56rV56ru56rbeW4SkZP4sz9MbE56rPi2WH3:A3k03kHRzrWrbr7fkZcBrPuX
- TLSH T19DF5F516E2A84F62D1AF8074CA965655FA333C414F608BDB0294BF3D3F326D0AA75727
- MD5 SHA1 SHA512 SSDEEP TLSH