Indicator of Compromise

dce5df29bddff5a4ddaea5c4fec14da91f7b69063a6e1c45ed61e5da4fc6c87b

SHA-256 hash Seen in 1 report Watch this →

A SHA-256 file hash identifying a specific malicious sample. Match it against files on disk or in your EDR.

Included in the Hashes feed (live, machine-readable).

Seen in these reports

CL-STA-1062 Shows Critical Infrastructure Intrusions Still Start With Web Shells

Related indicators

Indicators that appear alongside this one in the same reporting, often shared infrastructure or the same campaign.

00e09754526d0fe836ba27e3144ae161b0ecd3774abec5560504a16a67f0087c 139[.]180[.]134[.]221202[.]182[.]102[.]545[.]32[.]113[.]17245[.]76[.]210[.]43 4e1f8888d020decd09799ec946f1bf677cac6612b24582ddbf4d8ede425d8384 9b481b69cd91b09fa7bae7428f646dd89473a4c03393e43da81fe756cde1c472 cbfe8de6ffadbb1d396f61e63eb18e8b11c29527c1528641e3223d4c516cf7c3 f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1 hxxp://139[.]180[.]134[.]221/PerfWatson2[.]exehxxp://139[.]180[.]134[.]221/sdksdk608/1[.]ziphxxp://139[.]180[.]134[.]221/sdksdk608/anydesk%5f0117[.]ziphxxp://139[.]180[.]134[.]221/sdksdk608/hamcore[.]se2hxxp://139[.]180[.]134[.]221/sdksdk608/hxxpdfhxxp://139[.]180[.]134[.]221/sdksdk608/vpn%5fbridge[.]confighxxp://139[.]180[.]134[.]221/sdksdk608/win-vpn[.]rar