Analysis
- user interaction
yes - max time kernel
149s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 13:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MsDtcProxy.exe
Resource
win11-20260911-en
windows11-21h2-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
MsDtcProxy.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target MsDtcProxy.exe
- Size 486KB
- Sample261102-qcewjsas5v
- SHA256 ba8b0b9d2549ef68fea99dba9f69e8e9d735de35ae83fc36866b094289ad5a32
- MD5 6a437336441e4e27bea7acc5de0aa888
- SHA1 ccab6f36fa8a8fa715d381c30a49b737fc2de158
- SHA512 ce034ee3e12105e1b8dcaac75de316b2d4d57367ea79dc76fe777627f55b842bf9745de7b642b344618639529857eb67eb2c3b12fd6f518bd4f7aedda489ad3f
- SSDEEP 6144:yCX43NbEGO25mPcwz07hsn1oyDtADJY3tpOc8HpiwitHfG8MC0tsgcsrhKXLFFWZ:uOEA2yDtAF8LBwitHfG8N0tjXrPZ
- TLSH T1F9B44B16F2A500FAF577C57CC9939A06EB7278450730DADF07A0466A2F23BD49D3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MsDtcProxy.exe," MsDtcProxy.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" MsDtcProxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" MsDtcProxy.exe - Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" MsDtcProxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" MsDtcProxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" MsDtcProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection MsDtcProxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" MsDtcProxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" MsDtcProxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" MsDtcProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection MsDtcProxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" MsDtcProxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" MsDtcProxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" MsDtcProxy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" MsDtcProxy.exe - Windows security bypass 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes MsDtcProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths MsDtcProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes MsDtcProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths MsDtcProxy.exe - Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 2956 bcdedit.exe 2380 bcdedit.exe 8092 bcdedit.exe 8372 bcdedit.exe - Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\MsDtcHealthGuard.sys MsDtcProxy.exe File opened for modification C:\Windows\system32\drivers\MsDtcHealthGuard.sys MsDtcProxy.exe - Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Modify Registry: Disable Windows Driver Blocklist 2 TTPs 2 IoCs
Disable Windows Driver Blocklist via Registry.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0" MsDtcProxy.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0" MsDtcProxy.exe - Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MsDtcHealthNet\Parameters\ServiceDll = "C:\\Windows\\system32\\MsDtcHelper.dll" MsDtcProxy.exe - Executes dropped EXE 13 IoCs
pid Process 4940 MsDtcProxy.exe 980 Process not Found 3504 Process not Found 4984 Process not Found 4404 Process not Found 4444 Process not Found 5152 Process not Found 2208 Process not Found 3648 Process not Found 1220 Process not Found 1948 Process not Found 5136 Process not Found 4164 Process not Found - Loads dropped DLL 64 IoCs
pid Process 4584 Process not Found 2748 Process not Found 5456 Process not Found 2076 Process not Found 4868 Process not Found 3932 Process not Found 5284 Process not Found 5716 Process not Found 5548 Process not Found 4000 Process not Found 3184 Process not Found 2940 Process not Found 1572 Process not Found 5584 Process not Found 720 Process not Found 5004 Process not Found 3704 Process not Found 4892 Process not Found 5744 Process not Found 5580 Process not Found 4416 Process not Found 5904 Process not Found 3748 Process not Found 4672 Process not Found 1348 Process not Found 5244 Process not Found 4704 Process not Found 4740 Process not Found 3900 Process not Found 5048 Process not Found 2680 Process not Found 5988 Process not Found 2588 Process not Found 2172 Process not Found 4180 Process not Found 2796 Process not Found 1564 Process not Found 6124 Process not Found 4512 Process not Found 5160 Process not Found 1788 Process not Found 4104 Process not Found 2984 Process not Found 3644 Process not Found 3176 Process not Found 1992 Process not Found 6008 Process not Found 3568 Process not Found 5264 Process not Found 1512 Process not Found 2604 Process not Found 4832 Process not Found 5512 Process not Found 1608 Process not Found 4872 Process not Found 5360 Process not Found 6192 Process not Found 6200 Process not Found 6244 Process not Found 6276 Process not Found 6344 Process not Found 6368 Process not Found 6424 Process not Found 6496 Process not Found - Windows security modification 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions MsDtcProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths MsDtcProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes MsDtcProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions MsDtcProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths MsDtcProxy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes MsDtcProxy.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MsDtcProxy = "\"C:\\Windows\\system32\\MsDtcProxy.exe\"" MsDtcProxy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\MsDtcProxy = "\"C:\\Windows\\system32\\MsDtcProxy.exe\" /quiet" MsDtcProxy.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\MsDtcHelper.dll MsDtcProxy.exe File created C:\Windows\system32\MsDtcProxy.exe MsDtcProxy.exe File opened for modification C:\Windows\system32\MsDtcProxy.exe MsDtcProxy.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml Process not Found - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname MsDtcProxy.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain MsDtcProxy.exe - Modifies data under HKEY_USERS 13 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe Process not Found Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={C98D5C3B-5DBC-4580-8327-91D8507AE867}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" Process not Found Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269" Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100" Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1793624828" Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 30 Oct 2026 22:03:35 GMT" Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4940 MsDtcProxy.exe 4940 MsDtcProxy.exe 980 Process not Found 980 Process not Found 2208 Process not Found 2208 Process not Found 5136 Process not Found 5136 Process not Found 4940 MsDtcProxy.exe 4940 MsDtcProxy.exe 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 4940 MsDtcProxy.exe 4940 MsDtcProxy.exe 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 2748 Process not Found 2748 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found 5136 Process not Found - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeRestorePrivilege 5068 MsDtcProxy.exe Token: SeBackupPrivilege 5068 MsDtcProxy.exe Token: SeTakeOwnershipPrivilege 5068 MsDtcProxy.exe Token: SeDebugPrivilege 5068 MsDtcProxy.exe Token: SeImpersonatePrivilege 5068 MsDtcProxy.exe Token: SeAssignPrimaryTokenPrivilege 5068 MsDtcProxy.exe Token: SeManageVolumePrivilege 5068 MsDtcProxy.exe Token: SeRestorePrivilege 4940 MsDtcProxy.exe Token: SeBackupPrivilege 4940 MsDtcProxy.exe Token: SeTakeOwnershipPrivilege 4940 MsDtcProxy.exe Token: SeDebugPrivilege 4940 MsDtcProxy.exe Token: SeImpersonatePrivilege 4940 MsDtcProxy.exe Token: SeAssignPrimaryTokenPrivilege 4940 MsDtcProxy.exe Token: SeManageVolumePrivilege 4940 MsDtcProxy.exe Token: SeRestorePrivilege 4940 MsDtcProxy.exe Token: SeBackupPrivilege 4940 MsDtcProxy.exe Token: SeTakeOwnershipPrivilege 4940 MsDtcProxy.exe Token: SeDebugPrivilege 4940 MsDtcProxy.exe Token: SeImpersonatePrivilege 4940 MsDtcProxy.exe Token: SeAssignPrimaryTokenPrivilege 4940 MsDtcProxy.exe Token: SeManageVolumePrivilege 4940 MsDtcProxy.exe Token: SeSystemEnvironmentPrivilege 4940 MsDtcProxy.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5068 wrote to memory of 4940 5068 MsDtcProxy.exe 89 PID 4940 wrote to memory of 2956 4940 MsDtcProxy.exe 91 PID 4940 wrote to memory of 2380 4940 MsDtcProxy.exe 96 PID 4940 wrote to memory of 8092 4940 MsDtcProxy.exe 201 PID 4940 wrote to memory of 8372 4940 MsDtcProxy.exe 209 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\MsDtcProxy.exe"C:\Users\Admin\AppData\Local\Temp\MsDtcProxy.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Modify Registry: Disable Windows Driver Blocklist
- Windows security modification
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\system32\MsDtcProxy.exe"C:\Windows\system32\MsDtcProxy.exe" /mason-daemon2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Drops file in Drivers directory
- Modify Registry: Disable Windows Driver Blocklist
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\system32\bcdedit.exebcdedit.exe /set testsigning on3⤵
- Modifies boot configuration data using bcdedit
PID:2956
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set testsigning on3⤵
- Modifies boot configuration data using bcdedit
PID:2380
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set testsigning on3⤵
- Modifies boot configuration data using bcdedit
PID:8092
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set nointegritychecks on3⤵
- Modifies boot configuration data using bcdedit
PID:8372
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s MsDtcHealthNet1⤵PID:7908
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1AppInit DLLs
1Server Software Component
1Terminal Services DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\MsDtcDbg.txt
- Size 357B
- SHA256 c1b392fa66698ebb9649e64ad8e3ec182dadbf240488eaeead2dcc9c54196b01
- MD5 f722036a7a91709b1f75afabe7dc5d2f
- SHA1 d7990751234ac89c8c55948261752c1ef7c1fe3b
- SHA512 22bf51f41f6d0db53c358fcf5fafeabc69f91b39a209724cc16c0ce984d2dc0a0a0f690fc282fb8f5e4004a4fa6f15de1419d20911f727b49eb8e7a33715017b
- TLSH T18BE0DFA934C55211D6B207A649A239E0A4887FE13AEC2810BBEFB1766783015046A988
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MsDtcHealth.cfg
- Size 10B
- SHA256 10e07dced572dc4d556676547d01a014c504e76762dc7f94ac12265be918adc6
- MD5 45d49b66e7d8b13a1299aafc8d9e98fa
- SHA1 e2bfcb3ffba92412f6192d7e007fc92179aef469
- SHA512 a97599b88319c92b6c972b575c3ccf9162dc09dca97df733d7d17c66ef119b5791a2aab677a050d382c1311ac224d0d5c1543093f70e8421f37715c4805bd521
- MD5 SHA1 SHA512
- Path C:\ProgramData\MsDtcHealth.log
- Size 2KB
- SHA256 a82bd0629033d9eb64e73dabc2520ce46b22add71d0e481c6e04268529983eb0
- MD5 461c86f4837b016b7e2a63095fa191f7
- SHA1 7535fb6c95613c65c3f8cb7d57e63c77bed0ece9
- SHA512 2d53761bcbc7a0cfda297a2b97d80275b5e2ea8047a9bf705169b271e012f3b6079eed172d9e2e75a4b7dc6bb94db9b16b31a1bd51ba1a215a0940a18f6ab8cd
- TLSH T1A641FE4278694343DEB25403410577F59348F5872A5CA31D23DE70DAE8867CFCDAA8E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\MsDtcHelper.dll
- Size 149KB
- SHA256 624963655f299b49a66675bea71e2f15387d01c8d585037f0c63fa353937bc69
- MD5 992954c3e227323e60625a3a5cee8656
- SHA1 9992410d6e473b356464b3018b5b805634b08c32
- SHA512 76f802754e383d14c95f1e64071672b1657ec5c3bba7901fb9c3c843a85c749151c1848240ccaec716ff06778a8726192885ec664f5b15624dd2a61958a7af1e
- SSDEEP 3072:odkir5HfsAouECMDO0c+y//KtLrFcsB5CqHLnqsxfQXW9+vRt:9itHfG8MC0tsgcsrhKXL
- TLSH T101E33A07B2E500BBE1739178CDA34616E77678115B209AEF036447762F63BD1EE3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\MsDtcProxy.exe
- Size 486KB
- SHA256 ba8b0b9d2549ef68fea99dba9f69e8e9d735de35ae83fc36866b094289ad5a32
- MD5 6a437336441e4e27bea7acc5de0aa888
- SHA1 ccab6f36fa8a8fa715d381c30a49b737fc2de158
- SHA512 ce034ee3e12105e1b8dcaac75de316b2d4d57367ea79dc76fe777627f55b842bf9745de7b642b344618639529857eb67eb2c3b12fd6f518bd4f7aedda489ad3f
- SSDEEP 6144:yCX43NbEGO25mPcwz07hsn1oyDtADJY3tpOc8HpiwitHfG8MC0tsgcsrhKXLFFWZ:uOEA2yDtAF8LBwitHfG8N0tjXrPZ
- TLSH T1F9B44B16F2A500FAF577C57CC9939A06EB7278450730DADF07A0466A2F23BD49D3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH