FG-IR-26-175

Fortinet published hashes, IPs, and an archive account named archive234. Here is a lab grep-and-hash session so you can find tenants who moved in before the patch.