Overview
overview
8Static
static
3Agisoft Me...60.rar
windows10-2004-x64
7Agisoft Me...60.rar
windows11-ltsc_2024-x64
8Setup.msi
windows10-2004-x64
7Setup.msi
windows11-ltsc_2024-x64
7iphlpapi.dll
windows10-2004-x64
5iphlpapi.dll
windows11-ltsc_2024-x64
8metashape.lic
windows10-2004-x64
3metashape.lic
windows11-ltsc_2024-x64
3Analysis
- max time kernel
501s - max time network
461s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 17:11
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Agisoft Metashape Professional 2.2.2 Build 20760.rar
Resource
win10v2004-20260911-en
windows10-2004-x64
23 signatures
900 seconds
Behavioral task
behavioral2
Sample
Agisoft Metashape Professional 2.2.2 Build 20760.rar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral3
Sample
Setup.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
900 seconds
Behavioral task
behavioral4
Sample
Setup.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral5
Sample
iphlpapi.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral6
Sample
iphlpapi.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral7
Sample
metashape.lic
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral8
Sample
metashape.lic
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
General
- Target Setup.msi
- Size 187.7MB
- Sample261014-vqpp5aws5j
- SHA256 6109dfcf2e4a079d0fc1f3129ceb21e7426ded30cf7c0829bd05d309f9ebb77e
- MD5 9e4f85fc119bbeb16184e09b5df5a2a0
- SHA1 9d182b8b0d6cbee1b4e1e13af5668917c37cefbc
- SHA512 04868bc9b8d63648628ae7d58223f0aa388e7187d914a455b981d765cc08a258aad488669e8ee912eb5e63e46b291362118dda539efceb8be0106ba90909abee
- SSDEEP 3145728:nb3VLHnHn1kJAsjWSCyzRfIJp+ct8/e0l65xlWA4j6dw9n8E3jC67XEIqdtcCbAg:nbFbVKAK4yzRfIJwU8EoA4j6dwt77iN7
- TLSH T1F2983341DE41EC96F5B5823A5332E205CA73FD696786041929B8B21C5C7F7C92EBEC0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 3220 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\tix8.4.3\bitmaps\plus.xpm msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\django-stubs\django-stubs\test\selenium.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\tcl8.6\tzdata\Pacific\Fiji msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\shiboken2_generator\include\bindingmanager.h msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\third_party\2and3\jinja2\nodes.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\win32comext\axscript\Demos\client\ie\foo2.htm msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\zoneinfo\_zoneinfo.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\tcl8.6\tzdata\Chile\Continental msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\django-stubs\django-stubs\views\static.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\turtledemo\turtle.cfg msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\win32comext\axscript\Demos\client\wsh\test.pys msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\prompt_toolkit\cursor_shapes.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\debugpy\_vendored\pydevd\pydevd_attach_to_process\winappdbg\util.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\qtconsole\usage.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Doc\library\parser.rst msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\turtle.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\tcl8.6\msgs\en_bw.msg msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pygments\lexers\webmisc.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Doc\library\selectors.rst msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\django-stubs\django-stubs\contrib\messages\middleware.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\win32com\libs\pythoncom.lib msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\idlelib\history.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\third_party\2and3\slugify\__init__.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\shiboken2_generator\include\python25compat.h msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\tcl8.6\encoding\cp863.enc msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\traitlets\config\tests\test_configurable.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\ipykernel\datapub.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\django-stubs\django-stubs\views\generic\edit.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\django-stubs\django-stubs\contrib\flatpages\views.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\IPython\terminal\embed.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\3\email\header.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pexpect\utils.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\django-stubs\django-stubs\db\models\query_utils.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\tcl8.6\tclIndex msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\third_party\2and3\markdown\util.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\3\unittest\loader.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\multiprocessing\queues.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\2and3\select.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Include\cpython\initconfig.h msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\tix8.4.3\demos\samples\SGrid1.tcl msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\lib2to3\fixes\fix_exec.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\PyWin32.chm msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\wheel\__init__.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\2\distutils\msvccompiler.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\2and3\formatter.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\packaging\requirements.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\unittest\test\test_program.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\debugpy\_vendored\pydevd\pydevd_attach_to_process\winappdbg\win32\dbghelp.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\third_party\2and3\google\protobuf\type_pb2.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\ipython_genutils\tests\test_importstring.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\win32\mmapfile.pyd msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\tcl8.6\tzdata\America\Sitka msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\3\json\decoder.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\tk8.6\msgs\el.msg msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\2and3\binhex.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\third_party\2and3\werkzeug\security.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\win32comext\axscript\client\pydumper.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\ensurepip\_bundled\setuptools-58.1.0-py3-none-any.whl msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jupyter_client\py.typed msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\tcl8.6\tzdata\Mexico\BajaNorte msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\tcl\nmake\rules.vc msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pythonwin\pywin\debugger\dbgcon.py msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\django-stubs\django-stubs\template\loaders\base.pyi msiexec.exe File created C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\win32com\server\util.py msiexec.exe - Drops file in Windows directory 44 IoCs
description ioc Process File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{298426DB-4948-4D93-9699-F8A208F6DC5D} msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\SystemTemp\~DF1CC7A5B98A7BC4EF.TMP msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcomp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashapepsx.ico msiexec.exe File opened for modification C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashapepsz.ico msiexec.exe File created C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\monitor.ico msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashapepsx.ico msiexec.exe File created C:\Windows\Installer\e5a3aba.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI54E8.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashape.ico msiexec.exe File created C:\Windows\SystemTemp\~DFDAC9D874E7965ACA.TMP msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcomp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File opened for modification C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\monitor.ico msiexec.exe File created C:\Windows\Installer\e5a3ab8.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2 msiexec.exe File created C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\viewer.ico msiexec.exe File created C:\Windows\SystemTemp\~DF1E8CF06E1AD0C1EE.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5a3ab8.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashape.ico msiexec.exe File opened for modification C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\viewer.ico msiexec.exe File created C:\Windows\SystemTemp\~DFCE7937946358698E.TMP msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3 msiexec.exe File created C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashapepsz.ico msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5164 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000de3438a4f689b710000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010de3438a0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010de3438a000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30de3438a00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60de3438a00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 54 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell\open\command\ = "\"C:\\Program Files\\Agisoft\\Metashape Pro\\metashape.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psx\Metashape.psx\ShellNew msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD624892849439D469998F2A806FCDD5 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell\open\command\ = "\"C:\\Program Files\\Agisoft\\Metashape Pro\\metashape.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell\open\ = "&Open" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\DefaultIcon\ = "C:\\Windows\\Installer\\{298426DB-4948-4D93-9699-F8A208F6DC5D}\\metashapepsz.ico,0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD624892849439D469998F2A806FCDD5\MetashapeFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD624892849439D469998F2A806FCDD5\ViewerFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psz\Metashape.psz msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.psz\ = "Metashape.psz" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psx\Metashape.psx msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.psx\ = "Metashape.psx" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD624892849439D469998F2A806FCDD5\MonitorFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\ProductName = "Agisoft Metashape Professional" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell\open\ = "&Open" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell\open msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psz msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell\open\command\command = 28002800330045003100450031003f007800400049003100340048005d0062002e003800320046004d006500740061007300680061007000650046006500610074007500720065003e004700300070007d005f0038004800390045004600310062004f0079002d00760030006800600071002000220025003100220000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psx msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD624892849439D469998F2A806FCDD5\VCRedist msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\PackageCode = "F65D5439C74338741B76223E9ADA1C71" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\ = "Metashape Project" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\Version = "33685506" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D2399D4A622365E41A4E9FC7273D49CB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D2399D4A622365E41A4E9FC7273D49CB\BD624892849439D469998F2A806FCDD5 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\PackageName = "Setup.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\Clients = 3a0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell\open\command\command = 28002800330045003100450031003f007800400049003100340048005d0062002e003800320046004d006500740061007300680061007000650046006500610074007500720065003e004700300070007d005f0038004800390045004600310062004f0079002d00760030006800600071002000220025003100220000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psz\Metashape.psz\ShellNew msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\ = "Metashape Archive" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\DefaultIcon\ = "C:\\Windows\\Installer\\{298426DB-4948-4D93-9699-F8A208F6DC5D}\\metashapepsx.ico,0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\ProductIcon = "C:\\Windows\\Installer\\{298426DB-4948-4D93-9699-F8A208F6DC5D}\\metashape.ico" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5804 msiexec.exe 5804 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5164 msiexec.exe Token: SeIncreaseQuotaPrivilege 5164 msiexec.exe Token: SeSecurityPrivilege 5804 msiexec.exe Token: SeCreateTokenPrivilege 5164 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5164 msiexec.exe Token: SeLockMemoryPrivilege 5164 msiexec.exe Token: SeIncreaseQuotaPrivilege 5164 msiexec.exe Token: SeMachineAccountPrivilege 5164 msiexec.exe Token: SeTcbPrivilege 5164 msiexec.exe Token: SeSecurityPrivilege 5164 msiexec.exe Token: SeTakeOwnershipPrivilege 5164 msiexec.exe Token: SeLoadDriverPrivilege 5164 msiexec.exe Token: SeSystemProfilePrivilege 5164 msiexec.exe Token: SeSystemtimePrivilege 5164 msiexec.exe Token: SeProfSingleProcessPrivilege 5164 msiexec.exe Token: SeIncBasePriorityPrivilege 5164 msiexec.exe Token: SeCreatePagefilePrivilege 5164 msiexec.exe Token: SeCreatePermanentPrivilege 5164 msiexec.exe Token: SeBackupPrivilege 5164 msiexec.exe Token: SeRestorePrivilege 5164 msiexec.exe Token: SeShutdownPrivilege 5164 msiexec.exe Token: SeDebugPrivilege 5164 msiexec.exe Token: SeAuditPrivilege 5164 msiexec.exe Token: SeSystemEnvironmentPrivilege 5164 msiexec.exe Token: SeChangeNotifyPrivilege 5164 msiexec.exe Token: SeRemoteShutdownPrivilege 5164 msiexec.exe Token: SeUndockPrivilege 5164 msiexec.exe Token: SeSyncAgentPrivilege 5164 msiexec.exe Token: SeEnableDelegationPrivilege 5164 msiexec.exe Token: SeManageVolumePrivilege 5164 msiexec.exe Token: SeImpersonatePrivilege 5164 msiexec.exe Token: SeCreateGlobalPrivilege 5164 msiexec.exe Token: SeCreateTokenPrivilege 5164 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5164 msiexec.exe Token: SeLockMemoryPrivilege 5164 msiexec.exe Token: SeIncreaseQuotaPrivilege 5164 msiexec.exe Token: SeMachineAccountPrivilege 5164 msiexec.exe Token: SeTcbPrivilege 5164 msiexec.exe Token: SeSecurityPrivilege 5164 msiexec.exe Token: SeTakeOwnershipPrivilege 5164 msiexec.exe Token: SeLoadDriverPrivilege 5164 msiexec.exe Token: SeSystemProfilePrivilege 5164 msiexec.exe Token: SeSystemtimePrivilege 5164 msiexec.exe Token: SeProfSingleProcessPrivilege 5164 msiexec.exe Token: SeIncBasePriorityPrivilege 5164 msiexec.exe Token: SeCreatePagefilePrivilege 5164 msiexec.exe Token: SeCreatePermanentPrivilege 5164 msiexec.exe Token: SeBackupPrivilege 5164 msiexec.exe Token: SeRestorePrivilege 5164 msiexec.exe Token: SeShutdownPrivilege 5164 msiexec.exe Token: SeDebugPrivilege 5164 msiexec.exe Token: SeAuditPrivilege 5164 msiexec.exe Token: SeSystemEnvironmentPrivilege 5164 msiexec.exe Token: SeChangeNotifyPrivilege 5164 msiexec.exe Token: SeRemoteShutdownPrivilege 5164 msiexec.exe Token: SeUndockPrivilege 5164 msiexec.exe Token: SeSyncAgentPrivilege 5164 msiexec.exe Token: SeEnableDelegationPrivilege 5164 msiexec.exe Token: SeManageVolumePrivilege 5164 msiexec.exe Token: SeImpersonatePrivilege 5164 msiexec.exe Token: SeCreateGlobalPrivilege 5164 msiexec.exe Token: SeCreateTokenPrivilege 5164 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5164 msiexec.exe Token: SeLockMemoryPrivilege 5164 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5164 msiexec.exe 5164 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5164 msiexec.exe 5804 msiexec.exe 3220 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5804 wrote to memory of 3220 5804 msiexec.exe 91 PID 5804 wrote to memory of 4100 5804 msiexec.exe 97 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Setup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5164
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F56D47F2758DEADA5C0315D1E1E4D8C5 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3220
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4100
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3348
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a3ab9.rbs
- Size 1.8MB
- SHA256 4c04f77ccd3efe79d2274098ed15640fe0f0d8243909274a1cc3c4af741dd617
- MD5 a42fc5a81b7fb0e49cd4328e3a69d18f
- SHA1 c7f3c0b26863340cc5cd521a0006b7fdd1c41924
- SHA512 8b5d35c12523ef219e524b135d0a8ebbcbe67406f8ba29dbe86e950d73f0c7c0033eafdae785995d30d6db0025bfbfbf1eb6402a626ac206c86d6dc1b2f7b414
- SSDEEP 6144:I+y5DT/30QL5P+tban7rCOIxe2ZTVWCSkO/QxtXJPnfLZS4pgZYjfcjvtxtgO4Hb:8/mtz9VfLNpmsfcjMTRGz3cCg3CKV
- TLSH T17D953A02FE00D3EB721FB45593663A754A097C9AB7F514A32BBD633B5940A1B133FA60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\django-stubs\django-stubs\core\mail\backends\locmem.pyi
- Size 103B
- SHA256 ae9de027f591acfedc0ba387099c4398c0841a9c126535d313ffbdb18184eea0
- MD5 7f6526c1bbcb2aa7ba6a8cde268765bc
- SHA1 cfc87c1fd110239d47886e0c5ebcad54bd453bbe
- SHA512 3c6f26b5f0ab2bc22e72e116ffe28624e5d971a86b9d85e5f733844827e784b8349c46fa46ca5390bc972607b7fb5b37a6fb47b410e105f02b147dfe77a737c7
- TLSH T193B0924460A342810FF69AE230F431905998340B8D38980A4F0031140B30C463E0A11E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\2\ntpath.pyi
- Size 2KB
- SHA256 ba96ee35c718a0964e11e6ae5d5b9e800b9350cafd2ec0d9e84d1cf4f0ac2702
- MD5 85d6a21f1a4f58f9e3ffbeb89cf82345
- SHA1 db8ae818a67210b61b2a538d49b608825de04a31
- SHA512 995047f50de368444bad3fedb2c5b7f8efa807cdd35bb3647b1223897e4d27a94f93a48b0b12fc9121281f4f447632edf878dc54268716b67ecfb28a388c744f
- TLSH T10951A95DBD64A7F08BFE9375550A13A6AE18B3F12B69F414E09A1454084F36CA0BDBCC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\stdlib\2and3\xml\dom\pulldom.pyi
- Size 77B
- SHA256 c08fdebb51bcc9a6aab911e667d9984608f2e3334d8490b7f394e348ca1a9918
- MD5 0244548e1dba18ff5c58d98bcc50b931
- SHA1 37494fb84b8b2a811e2cfa2be49477ce29138af7
- SHA512 a88c7f3fad1047e18794184f33787b68e9c3260d47d68e6f519d99143b928aa97fcd1ebcc3b730f0c23eabb303352ba3cf9263b16e7c9f276f9108ed616a567c
- TLSH T147A0220B0038B8EC8B3C0C3C8E3F00B02A283280830A0820A0C0220823CF208CC383EC
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\jedi\third_party\typeshed\third_party\3\docutils\__init__.pyi
- Size 63B
- SHA256 ddf071712a6926be84384714a23bdf946dc47a083b96fd90a7474d41020bacfe
- MD5 84a27291937d76e46b277653002601f2
- SHA1 fe60efb40aeeee2998bb07245d4f9571ad08825f
- SHA512 e489e83fd33fdc8ba88954725f79c2132bc4162ba713c72b190b790b4a368e3ceb024d7b8bceec4544123a5435fdfd987876f1b2542da06cba899f5ac72945be
- TLSH T168A00247543970EC8B7D5D795D3F05B12925158457165921A4C4621563CB158C83536D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\packaging\_structures.py
- Size 1KB
- SHA256 ab77953666d62461bf4b40e2b7f4b7028f2a42acffe4f6135c500a0597b9cabe
- MD5 de664fedc083927d3d084f416190d876
- SHA1 fe0c3747cf14e696276cb6806c6775503de002b8
- SHA512 cff19a724fac387599d98c0a365849078dbcbea65efca1ee445f158268b9241e552212a99e7e0b34394d246e3a06c999a7f1a967f64b2724ca9b623d62996c6f
- TLSH T1A721A7B4675BF4A7D365D1364852F883E30D3D93452E306074ACF8A4BF67A14DAD00EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\packaging\specifiers.py
- Size 29KB
- SHA256 2d1434905b07ae5e6a7dc14d10426b20562c9c81d05095d8f5f22c6a44ebaea1
- MD5 7acafe408d6d5dd64238fd689638b177
- SHA1 04ffe4f1c2e6d8796ae64b8d3ccd1b9791f31445
- SHA512 b3cbe5fd1627f46f3bed6b5d12341d45f42070b5acb37266a6884d2d32e422672f656c00e99aa56894ddc12398e9f76d46c4089095df6c225e5a37f2e5d30f2f
- SSDEEP 768:ZKP01L5VlEpRuhdwhOuh0Iul8vwcKwbmVX:Z0qLT9Iul87KwC1
- TLSH T178D2877B7785963E8142433ACC56E082771EC6DF9288927D75BC802C6F0B13D86B39E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\parso\python\grammar311.txt
- Size 7KB
- SHA256 4305da1ea25c27fce08bd14001b76fd54fe42a0724bbd5168c76680a56eda5be
- MD5 663bd8e6c3008a6849caeb04b084aed8
- SHA1 bf5f44f35aa2e1649c780e87a779da4a97adae0b
- SHA512 7a61aa2176d1fe366eddf6e6c1ba87185790ec375a9a430038b618e382030b369fb67862c735191e3622f522f6760337e97e700ff40629b76d8c505beb174826
- SSDEEP 96:d8cvbzNX3X1pR3SylUHu5riFl69BFmlETSX6MckQlb99c83OiEhNhfO5ZCBv2OGf:d8cFX3X1pR3SylUrgM4B9hUF+
- TLSH T1C4F1911CA6D70B450BD150B7554CF3BA49C9D18E203B8176FBCD92FD8FCB0982622B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pip-22.2.2.dist-info\top_level.txt
- Size 4B
- SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
- MD5 365c9bfeb7d89244f2ce01c1de44cb85
- SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
- SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
- MD5 SHA1 SHA512
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pip\_vendor\packaging\version.py
- Size 14KB
- SHA256 fdf2d136b16bc5870755fca8f2f93d8fcb3a24cf0dff1b12c5516be91272728f
- MD5 8fb00e724a7af8d0b43fa3365fd3eff0
- SHA1 161edb467745642554aff7ee33a3eb69ff9e7287
- SHA512 cc785380e70f1f716079d789de11e4c6b1a5e20003beb9871efecb12c490d4ea64ba0f33d795c07d5de94c2ac66b5802474158bf71358a258b82837bbc1855d3
- SSDEEP 384:FpB0O1ceOvOvEYj7XYzStXzEjlrr6UcMn:10reOvOvEYj7ozStXzQlrr6Ub
- TLSH T125624329A747C07B83A74B6C8987F183A7296A57155C623D347CA1682F0397CC2F2DE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pip\_vendor\pyparsing\actions.py
- Size 6KB
- SHA256 c14f62df67b4cb5ca6c4a137394c121cef92148aedd61ff0bfa5acd06423a4d5
- MD5 146786b5a4aada43d8288351dc8ef13e
- SHA1 1e77e225960e39fd3ef93455425542c211f0e18d
- SHA512 9d91565bac5f66a1c3c434ba63e22d590083c55a7ffff5cf8cce9986e12efb559a16ed5b3b246d0c34ebb9dd1f5dfffc39acd4970972d142ae70cebfcd6de12f
- SSDEEP 96:Hub2SjGvsVS8/asbyQKScTYeFOPhTJJ2M/HgScYGZhlpj74SnVJBhMVC:HLvUJyQ28NjFYdj79hgC
- TLSH T19DD18322E9417AF60E97C261CCDBE4913B61C1274106A4B3BCFCC05B2F4A476C5B759E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pip\_vendor\pyparsing\common.py
- Size 12KB
- SHA256 9452fdee8a08791ef90a65b986351166ac0309382bbaa96d713099fae94b3b64
- MD5 0120420547c1fcfef162005c34d72753
- SHA1 de8dd9838210119b7befcd0946e7c9f379339d27
- SHA512 60db163a69ea1e1336e94181710dea2d7fb50794453b60cdf2ea6ac4c490a009927363cd5f444eb641f00d6945f12cde20f4da2d0710f4f05349f19a594a18cd
- SSDEEP 384:JAardEkZDU04HsfLZcQ0YYZOVhHRWk8nTh:JZ+SHgZ8Wk+
- TLSH T1A1426452E49178AC038F95424CD7A404633500FB46CC19A87DFCD6F41FA1DBA9AEBAAD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\packaging\__about__.py
- Size 661B
- SHA256 ba001220edb0d685321fcfc23aa4365ffb34ac38636e1402df2268703d378767
- MD5 68d5fc8a7ddb919bb241078b4e4db9cc
- SHA1 65369f014ea304064474d47c719401803c999ed8
- SHA512 ba9e26df6282c298bc52f7b1f3b47648118dcb65eaff1cbf0fb17007a39f46787596295e54a097e674af2565c024fb49a1e39a6e44bdfceb20295060b96f2c1f
- TLSH T17501787688184DB28A8048EDA44BC48BE764112F5ECE352BB37009DDBF0197B43F9148
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\packaging\__init__.py
- Size 497B
- SHA256 6fd2a4e4c17b2b18612e07039a2516ba437e2dab561713dd36e8348e83e11d29
- MD5 b85796f8d9d4e7556c6ad5ec9f0c5371
- SHA1 9501323e7783213ab6c7c8e8fd05cd95d7a76ba1
- SHA512 eb02053d616708ed5c51da204e1dae2072bb2263e1466024e3bc363a35ceffba509794aec153e6a36cf49474cd73e4f63f3e2daa34d6d18de83fbfb055321263
- TLSH T1BEF0E51699897D728654C5DA560BC4EBD736114F0E8E3812376009ECDF2F92F43F419C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\packaging\_musllinux.py
- Size 4KB
- SHA256 fca1a063fa9ceef84c1a9a2ab2cdb99f68622c234a46dbf3f660ab4bb824ab27
- MD5 0210636ea49cabb88154105b88045e64
- SHA1 d446d94e2b0fe0ec6286292877c3926268ecab4a
- SHA512 2ffc53a4c2b3600b20c8efe9c92d77ddac659c42c74dbc7abb2478017ac4050d7debc190b134369f4ad8e3d6c53ecf4e06c683938c5bde99dd7675739d6a1c73
- SSDEEP 96:syyas9WG17I6e+2YvMFtiboTCRhsMMkRZjgPk81iz5Sg:sA0zrlC2oTCRhjRZGksiz5Sg
- TLSH T1649165179D90F97AD381CA2CE8C5C945B73A2A67B9154D38F8AD40246F4512CC3B9FE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\packaging\tags.py
- Size 15KB
- SHA256 966b2718d889f02e03fcf7fd3db334aa06d9bc3f64981f65a590505196b747f6
- MD5 e38b04681f4e31b77b316c978f6749bd
- SHA1 1a2cecedf2686b5de23beb435957d92894bc990e
- SHA512 6eee7a6b90d1676b18eaa84fa010b348207bc88b7dc206696eba87f85b33cfced6e297e757a95891b609d7e9647b377001507853c8121d93739d20adaeef26a2
- SSDEEP 384:F1dQiA/tDvve/XYdoSwddAhy85lV37oQYKMKEpXlp1tzeVze2XzuWCUDxfvc33:Hd6dvYYdDwddAhy85lV37oQ3D6Xlpnz/
- TLSH T17B624116C692DD77C3A24E3A4CDAD146673869536A52622C7C9D81282F17CACC3F4BAC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\packaging\utils.py
- Size 4KB
- SHA256 7498de6addc14be4d89f546b505570b9f50c6ac6edccb7d8468cbf1d710d7854
- MD5 359296260a63d16f5149ccdd7ae70762
- SHA1 5979c6b8353210e327b4689a66207c56a7c8e3d1
- SHA512 f91a368431fcf74f3214dac61427a3a81188eed8ecd2dd8f3036ec32bf149b0c34837ec965c4a4102b64e37f649df4e90fe4b4104cb46e68b17079b52c5c9401
- SSDEEP 96:FxdJdP1B7ynoaWBo3EQrdip7ARAfb90Cni6excWscJY:Fbb6aTBNAPC/2r3JY
- TLSH T1F181661F9C1908B6C3E657A80DAB519427A1652B16414E2C3CCC85507F97EAE32F6ADC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\pyparsing\core.py
- Size 208KB
- SHA256 bbc1a9b5013f1fac0c925f0e661c5e2b56803c80d75cd83075284e441c01552e
- MD5 4d5ead9e8640267157f07cef2440eca0
- SHA1 ee174885aad35e095388c229e02274be0371389a
- SHA512 f29635cf1dea3acd8701e0ea91eebeae7ac39cee0ba912cf13b70eadf3e66667f7f643e359c8672393b20fec5e31e3004211cc3a2ab67249cdb1360d46565b5d
- SSDEEP 6144:xonDdvtPErcE0UpwyhLnWMh/9xVPyGGGY4WCe0dYJqEZzVxXF+vkymHa:hwGGVCezNIka
- TLSH T14424D927F9022A618A87C87A4CD7E057672AA817471C6471FDFC91A43F06935C2F7EE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\pyparsing\results.py
- Size 24KB
- SHA256 1e036f5955c17503fe43a3ed25fa0211e3899369f012f1bed8a54a0b9b06037d
- MD5 96e34a817b72247caed38833a8382a82
- SHA1 a0b0f883175cc685dcb9781126bdebdfabd5b859
- SHA512 52a1f19c1ffd8c397babe8ed502d19088dab53e7048f357a4740d84b65b1b65bf12af8705f2182eb9cfcdda8434e8782de4927bcbe23f1b5dccf14ccaa90e345
- SSDEEP 384:RmeUdaTIXT4QY87UNkeEbf7CLulGcvbYHgmx0GhAWh3Ui:RmeUgf87Oke0jl1vb0gM0Gvd
- TLSH T1B5B242626912682297879E2A5C87E807532FBC13505C3534BCBC64A43F56936E3FBDF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pkg_resources\_vendor\pyparsing\util.py
- Size 6KB
- SHA256 92aefbd8ee5849e5ce49d3fe337d445a96c7fdaca3ec1307226058a3dc4f0f93
- MD5 e2b2a33736ac783f177601797818720f
- SHA1 001eab2eabbf7018d2f36596c5c304ecd51116af
- SHA512 b18355a3a4f698929cc5b66fdd485239d1f8ff9eb10db69a965519aadee6788045c59e2b609e0e71e7232c0f770d7787e73c9d62c18811bf98b846aaf6f5647d
- SSDEEP 96:qOb7JIBwf2VAy5FY6mcP2kgbsYqCWsaRhafcntkDB/yOR/Qhb8lWIepoAHf:qAu+yjYvceklMDfctkDB/7Sb/IAoAHf
- TLSH T153E13F13E9269962EA43D67F4DD3E282671D2D27521819B9FCFC41282F06538C2F5EF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\pyparsing\helpers.py
- Size 38KB
- SHA256 42950e8d6d3ea6cbee78cc166fd6d0a54da7a2a282bfdf3fc27c35552cd2755a
- MD5 74ecbf6fbfa002c53e5aafc144b62c57
- SHA1 2ea00bcb4e8e22b0688c3cb6c8b5d711e3e7397a
- SHA512 b153d90e13a1ac5c878ba9eb045f9933de7c831204cbd47e57e189b774c3bad531c21460c9934a6069eee82537ed2bb82826bd7fc77c8b93e2763301ea04fb2b
- SSDEEP 768:UVFXTkgqBql2LXcaajVVlz8moG3xDntYl8XqDBoe76Q:GVzqgcLXcaajV7z7Fh6l8Xqtv
- TLSH T10E03F727F9911671438B822A5CDFD0406326A927974464B4BD9CC0F83F1AAB987F76FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\setuptools\_vendor\packaging\_manylinux.py
- Size 11KB
- SHA256 5dc6e25c1faa723bf76dca21a7a37df1332938fe3f8f79be88e03ca6d2b61966
- MD5 80df840e0ac823fa34bcfa543296ba35
- SHA1 0ff6c9ceb0819aef9d68cee59d7942fa0544661f
- SHA512 cd5bf95d0a51b0f6dac148f0706dc18298a4f3e5b8ed0271af0f54cda46078afe22831d29aa5ab65afa837c0e9f7dc26aaf655af9c2683714eeef0232a4a9848
- SSDEEP 192:lc/LH1a9flJKXeK6nOTp3K26nOTkJLeNNh/FUBCLlw61QQdEQjvBxRRmVpzWAa3/:lyLHYB9vOSOOL+XtUBaQIEUnOpnmR2C5
- TLSH T10E329656A844B637E363865E948FE185AB78A54F058C0438F9AE826A1F8147883F5FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\setuptools\_vendor\pyparsing\exceptions.py
- Size 8KB
- SHA256 dcb6d269f0f7d8d61bd53cedf39187364844014d5e6644ed352936e1c3cc7a6a
- MD5 f1f31bb05d818ebbc7cad0eac3c6364c
- SHA1 5cde38103af5472ed38061b38d1d2ac3f2637e85
- SHA512 d5ac511201f01675f1bee9cb671841f884522a5242f24e52ecf94715f1105f9c7a977f55654c4dcf2ebc54eed42a7fb914eb60f3c75d67b71623b308b11add79
- SSDEEP 192:AsZbAudvk/RhdULmzBB3FOzvk/OYHzoloK:AsZbr+RPUKj3HFjK
- TLSH T14A124107D9554B6781D7807D48AEA49A637A9E2712681432FEFCD2382F82635C2F2CDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\setuptools\_vendor\pyparsing\testing.py
- Size 13KB
- SHA256 eedbb801ba78b9278957437fc843d19a6354869775f1940fdc2ad7e350ccf35e
- MD5 5e9b66d292513af743fe21b61f00463d
- SHA1 dc3596cfdc8504ab6e344acf512605b00cc412ac
- SHA512 fdc0f7949c5570415981bc78d4ee672e05b651af44aecbe079b81e235b96a98a41ad2f68d2708ac0550790b260b262510e060b57e25bb86393701f8175905cbf
- SSDEEP 192:Zz3aqFdLGsdiBvo9NdnzV6SSMj7QT1hsq1aNnm58fyyhY/rMi5lLDuT0Ek:Zz35FWho93L7QTNqhwrH7ST0Ek
- TLSH T1F152611399060D226787547A5CAEE482E32AEE07624429B0FDFC151C2FC9576D1F3EEA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\setuptools\_vendor\pyparsing\unicode.py
- Size 10KB
- SHA256 7f0ba1323df4490d7ae42bfb1c9a6efab4b119b466f7790df4be048bb5467356
- MD5 c9b7c7bbc75393e592411b5f900b5372
- SHA1 44ccfc1d65fbb06d19c94f0e229d8c72de251b04
- SHA512 880660ef7e79e76b0aff96f3bee5407a6b863467e574eddaf389318c8de71fd8946c520a8aa9aad1e0efb29eafc139653f76c8d0d86dab18ee32bce42ce36c19
- SSDEEP 192:XZ/nCNjWQP79km1HKXexgRMnUM7feyM+I3ZKJlucAAR1s/HVieVslhJ9wJ0:XRCNj9TbgeUM72yT6ZQohMldi0
- TLSH T1F322A943E64909927383B12922DBBC11A61D84EBD8457D0C7F9CE3D86F0E9BC8979D2C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\shiboken2-5.15.2.1-py3.9.egg-info\dependency_links.txt
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\stack_data-0.4.0.dist-info\WHEEL
- Size 92B
- SHA256 1b5e87e00dc87a84269cead8578b9e6462928e18a95f1f3373c9eef451a5bcc0
- MD5 4d57030133e279ceb6a8236264823dfd
- SHA1 0fdc3988857c560e55d6c36dcc56ee21a51c196d
- SHA512 cd98f2a416ac1b13ba82af073d0819c0ea7c095079143cab83037d48e9a5450d410dc5cf6b6cff3f719544edf1c5f0c7e32e87b746f1c04fe56fafd614b39826
- TLSH T103B0121401404AFA0160EE038024E5311260854A94990035F0822140550BE4406C9C5A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\wheel-0.37.1.dist-info\WHEEL
- Size 110B
- SHA256 cfd8f4c406bf26650a3299b3ef62b464600b48cfe7fb04159866e5797c765478
- MD5 8cfa23cb3a9e0e9f30077848a14be857
- SHA1 e5ac311ba9eec5c0ccddc091ac7c0d62a72ecf72
- SHA512 039cb61c67f02b3b349102fa40fbb55fca46d54007309fd08b2707e2cac74fdddbb39b18730704209db4852bb9bb18078ef6a6a57acf0f0ba4951d7a249521bd
- TLSH T1CDB0122403408EFA4170FF438038E9311270C94A9CDD1136F4872180D50BE4916C9E5F
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Lib\site-packages\win32comext\axcontrol\__init__.py
- Size 135B
- SHA256 f0bb50af1caea5b284bd463e5938229e7d22cc610b2d767ee1778e92a85849b4
- MD5 f45c606ffc55fd2f41f42012d917bce9
- SHA1 ca93419cc53fb4efef251483abe766da4b8e2dfd
- SHA512 ba7bebe62a6c2216e68e2d484c098662ba3d5217b39a3156b30e776d2bb3cf5d4f31dcdc48a2eb99bc5d80fffe388b212ec707b7d10b48df601430a07608fd46
- TLSH T1EBC02B10D050224050332D9212320BE3075DACEE100690C1533C97082F111AD04D7014
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Scripts\jupyter-kernel.exe
- Size 105KB
- SHA256 d0cc7351cb75e315eac5fff92f12131beab3a93adf9b65d95f56f2f82718438d
- MD5 347e90841b2e929c6dd2a096006f2729
- SHA1 6fef1bb1b9c38e4aea02806b704790a7989d8373
- SHA512 b3c92b1e6972c6d48c782d7501fb8e77f75e7847d1219e77c41ec75563a5dccfc17eb19d33abc64ad5c7f951d70f273d02379d081830f703877dd9ea24c1fd6d
- SSDEEP 3072:CVS1/eI4pnTfEFYJE3nwzPdCNU/efHYTo+Md:aEHGnTcFYOXwJigTi
- TLSH T11DB36B4633D020FDD06A9274CDB69615D3B2BC278274934F27A47B6A5F333526D2BB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Agisoft\Metashape Pro\python\Scripts\pyside2-lupdate.exe
- Size 73KB
- SHA256 28b001bb9a72ae7a24242bfab248d767a1ac5dec981c672a3944f7a072375e9a
- MD5 d2778164ef643ba8f44cc202ec7ef157
- SHA1 31eee7114eed6b0d2fb77c9f3605057639050786
- SHA512 cb2a5a2aeba9d6f6bfc4a3a4576961244c109aafb59f02134b03ebac4d16602ee7f141cc4adc519f15030c20e7e7d6585778870706b2ea4c74c1161729101635
- SSDEEP 1536:PnDpvQm1Gk/NAIL5ZFR+Emf1rFX6YczDo87h2nO/Hda5QO6F:PDpv5tFA25ZA1J6Ho87kO/HdqQ5
- TLSH T182738D5AB39084F9C84B8275CCD16A95F372B41A0775838F072886A74F333B1AD3E366
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIDD27.tmp
- Size 61KB
- SHA256 1b046ae315f314b86d122fcde918a1334b25ac03d3953073da41a7a6e6d15154
- MD5 2883dfbf67c96e80ea7ef4482e9a3719
- SHA1 fea590dafb00576d16b2d760b7ed3136e0033985
- SHA512 81754334fb04123117db0ebe66cfd7b13e4b93fc7d5ea38c71b37d1d894117b7498e028a8666ff3bac6e75a6c0309851259f5c6ecc18ec4c8f39c4276b89eada
- SSDEEP 768:ytwE/7Tpprsq2SLGQKYWSgwM/G8uOUIPnfAq+wTjhFPMnPkUWpmnjEDsUVX3nJJS:EHZGPvwdcNnfJTldaPjVZe3nJBu
- TLSH T1AD535B117350C036E1631A34A8B8D3721E7E7C222BF585CB7F96176E5FB05C2AAB9316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 fc272f7f9e951e27c8888ed5964fc2db8b3059ccd6f3ca7ebbf7c5a4fe164256
- MD5 547e12ca0eb3228cc50beed4b5d630c2
- SHA1 bcaf2720c8822c1b424235ea1f7ea136b3673d86
- SHA512 e4870e8c01ba31a617143c33bda3c469d1ac3c47fd97546eb06e4d54ca46a207a53fd4706741bea1072d255c1cbb0359af0e6c4161857544c60cc02da1ba8ecb
- SSDEEP 24576:PFo3DMPIdoO/vvTL/SQuOCVAPbeEl7pd0josdzQ2YLAaJZP+sohm+nEf6OM:iHM
- TLSH T15757C32436F92210E7F79E3DA8F06A27893A7D5B9C15DE8D05411B4E0822F71E872F67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{8a43e30d-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{814ce6c6-5970-4cc2-9e6d-0dd250223d7d}_OnDiskSnapshotProp
- Size 6KB
- SHA256 240ad8a87920ee198b380f017f88dfa56fd1bd0255a5054260662c26a2b0e146
- MD5 70f9602d8c630e98aaaf8d241e523e45
- SHA1 06aa790e1204bbcddfee1f05c1dac223fcd9e740
- SHA512 a18e50b3b9a16937498b5d582a318e1a4ae8f90fe38c333ba4c21235b78f2614bd62c9151a09cce5189bd7cfd73f6a057054bfd2cba87be1207ae72256cb4654
- SSDEEP 96:FJYjeL1vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Ly8b++uVm
- TLSH T183D199085AF54711E2B3AB7128F14557A877B912EF33CB8E0198238E6630A10F876F5B
- MD5 SHA1 SHA512 SSDEEP TLSH