SHA-256 hash of patch.exe — CrySome RAT client payload written to disk as patch_diag.exe, providing persistent remote access, credential theft, and C2 communication
