35f8d38d0e96ee078c9ed375c9ce64c84641e7adc6d3970028f53ce7502dbd57

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bootstrap.cmd
Size 8KB
Sample261102-wt3ltses4l
SHA256 35f8d38d0e96ee078c9ed375c9ce64c84641e7adc6d3970028f53ce7502dbd57
MD5 ec60765041f39b8629bcb803693c2783
SHA1 e4ea25ed522adefbc0c4ad6dc0b1354ca045e4bb
SHA512 5a0f6b84282498d3cdf15cdbdf5e82bf46c5583f342ac8da8fd70b3663a895cdff84e0eb6ea0347a01074b99821cd4d8d57e139e196e151b73dae9aae32092f7
SSDEEP 192:gSaqu477XOmrt7XVd55vWHrnzttsX1tWExgwX/BQWNrIaFbLm:gSduE7XOmrrd55vornzfsX1tWExg8VN2
TLSH
T14202A50712C507AD107106713A601483E34B825F1B26575D39ECA7187FBABA25EFF3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
15	4156	curl.exe

Executes dropped EXE 1 IoCs

pid	Process
5996	claude-2.1.316-win32-x64.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
20	raw.githubusercontent.com

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3892	cmd.exe
2308	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	claude-2.1.316-win32-x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	claude-2.1.316-win32-x64.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5492	timeout.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2008	reg.exe
2872	reg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 4260	3892	cmd.exe	89
PID 3892 wrote to memory of 5696	3892	cmd.exe	90
PID 3892 wrote to memory of 2552	3892	cmd.exe	91
PID 3892 wrote to memory of 4796	3892	cmd.exe	92
PID 3892 wrote to memory of 1740	3892	cmd.exe	93
PID 3892 wrote to memory of 1968	3892	cmd.exe	94
PID 3892 wrote to memory of 4608	3892	cmd.exe	95
PID 3892 wrote to memory of 4776	3892	cmd.exe	96
PID 3892 wrote to memory of 2548	3892	cmd.exe	97
PID 3892 wrote to memory of 2792	3892	cmd.exe	98
PID 3892 wrote to memory of 3164	3892	cmd.exe	99
PID 3892 wrote to memory of 3844	3892	cmd.exe	100
PID 3892 wrote to memory of 1376	3892	cmd.exe	101
PID 3892 wrote to memory of 4568	3892	cmd.exe	102
PID 3892 wrote to memory of 3120	3892	cmd.exe	103
PID 3892 wrote to memory of 5492	3892	cmd.exe	104
PID 3892 wrote to memory of 3460	3892	cmd.exe	105
PID 3892 wrote to memory of 5756	3892	cmd.exe	106
PID 3892 wrote to memory of 4056	3892	cmd.exe	107
PID 3892 wrote to memory of 2296	3892	cmd.exe	108
PID 3892 wrote to memory of 5508	3892	cmd.exe	109
PID 3892 wrote to memory of 6032	3892	cmd.exe	110
PID 3892 wrote to memory of 4932	3892	cmd.exe	111
PID 3892 wrote to memory of 2764	3892	cmd.exe	112
PID 3892 wrote to memory of 1784	3892	cmd.exe	113
PID 3892 wrote to memory of 2832	3892	cmd.exe	114
PID 3892 wrote to memory of 4044	3892	cmd.exe	115
PID 3892 wrote to memory of 4780	3892	cmd.exe	116
PID 3892 wrote to memory of 2360	3892	cmd.exe	117
PID 3892 wrote to memory of 4628	3892	cmd.exe	118
PID 3892 wrote to memory of 2712	3892	cmd.exe	119
PID 3892 wrote to memory of 2184	3892	cmd.exe	120
PID 3892 wrote to memory of 5848	3892	cmd.exe	121
PID 3892 wrote to memory of 4236	3892	cmd.exe	122
PID 3892 wrote to memory of 3160	3892	cmd.exe	123
PID 3892 wrote to memory of 5388	3892	cmd.exe	124
PID 3892 wrote to memory of 5244	3892	cmd.exe	125
PID 3892 wrote to memory of 5676	3892	cmd.exe	126
PID 3892 wrote to memory of 1612	3892	cmd.exe	127
PID 3892 wrote to memory of 2284	3892	cmd.exe	128
PID 3892 wrote to memory of 2072	3892	cmd.exe	129
PID 3892 wrote to memory of 4856	3892	cmd.exe	130
PID 3892 wrote to memory of 1300	3892	cmd.exe	131
PID 3892 wrote to memory of 4276	3892	cmd.exe	132
PID 3892 wrote to memory of 5624	3892	cmd.exe	133
PID 3892 wrote to memory of 5396	3892	cmd.exe	134
PID 3892 wrote to memory of 752	3892	cmd.exe	135
PID 3892 wrote to memory of 3624	3892	cmd.exe	136
PID 3892 wrote to memory of 1792	3892	cmd.exe	137
PID 3892 wrote to memory of 3668	3892	cmd.exe	138
PID 3892 wrote to memory of 3292	3892	cmd.exe	139
PID 3892 wrote to memory of 5032	3892	cmd.exe	140
PID 3892 wrote to memory of 2292	3892	cmd.exe	141
PID 3892 wrote to memory of 1636	3892	cmd.exe	142
PID 3892 wrote to memory of 5576	3892	cmd.exe	143
PID 3892 wrote to memory of 700	3892	cmd.exe	144
PID 3892 wrote to memory of 6036	3892	cmd.exe	145
PID 3892 wrote to memory of 4160	3892	cmd.exe	146
PID 3892 wrote to memory of 1948	3892	cmd.exe	147
PID 3892 wrote to memory of 4504	3892	cmd.exe	148
PID 3892 wrote to memory of 2708	3892	cmd.exe	149
PID 3892 wrote to memory of 5780	3892	cmd.exe	150
PID 3892 wrote to memory of 4288	3892	cmd.exe	151
PID 3892 wrote to memory of 4748	3892	cmd.exe	152

cURL User-Agent 3 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	3	curl/8.8.0
HTTP User-Agent header	12	curl/8.8.0
HTTP User-Agent header	15	curl/8.8.0

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bootstrap.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\system32\curl.exe
  curl --version
  2⤵
  PID:4260
- C:\Windows\system32\curl.exe
  curl -fsSL "https://downloads.claude.ai/claude-code-releases/latest" -o "C:\Users\Admin\.claude\downloads\latest"
  2⤵
  PID:5696
- C:\Windows\system32\findstr.exe
  findstr /r "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*" "C:\Users\Admin\.claude\downloads\latest"
  2⤵
  PID:2552
- C:\Windows\system32\curl.exe
  curl -fsSL "https://downloads.claude.ai/claude-code-releases/2.1.316/manifest.json" -o "C:\Users\Admin\.claude\downloads\manifest.json"
  2⤵
  PID:4796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo { "
  2⤵
  PID:1740
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:1968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "version": "2.1.316", "
  2⤵
  PID:4608
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:4776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "manifestSignatureEnforcement": "flag", "
  2⤵
  PID:2548
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "commit": "cd7ceb459c6864567b16a11f60101b24421475c1", "
  2⤵
  PID:3164
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:3844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "buildDate": "2026-10-30T23:47:48Z", "
  2⤵
  PID:1376
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "platforms": { "
  2⤵
  PID:3120
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:5492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "darwin-arm64": { "
  2⤵
  PID:3460
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:5756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "binary": "claude", "
  2⤵
  PID:4056
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:2296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "checksum": "64c327e92b2c5e0f78c0a980c5a518121e1f0d140ca771ca5dd4488d1a2dcb3f", "
  2⤵
  PID:5508
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:6032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "size": 310114176 "
  2⤵
  PID:4932
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:2764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo }, "
  2⤵
  PID:1784
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:2832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "darwin-x64": { "
  2⤵
  PID:4044
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "binary": "claude", "
  2⤵
  PID:2360
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "checksum": "203d22fbafdab9f6b0cda962ec573e32ab970894c63b1dfb0409378f28b9c344", "
  2⤵
  PID:2712
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "size": 324381312 "
  2⤵
  PID:5848
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:4236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo }, "
  2⤵
  PID:3160
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:5388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "linux-arm64": { "
  2⤵
  PID:5244
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:5676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "binary": "claude", "
  2⤵
  PID:1612
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:2284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "checksum": "55cdb8e162d190432696ea54010e0fca2e18d06fa7a7127fd563b9ffd4f22624", "
  2⤵
  PID:2072
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:4856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "size": 328459544 "
  2⤵
  PID:1300
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:4276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo }, "
  2⤵
  PID:5624
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:5396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "linux-x64": { "
  2⤵
  PID:752
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:3624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "binary": "claude", "
  2⤵
  PID:1792
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:3668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "checksum": "fd13c70000fec3f2116dfbcbb6121210b4a29328bf0e46210a59dd594a67d824", "
  2⤵
  PID:3292
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:5032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "size": 328262000 "
  2⤵
  PID:2292
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:1636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo }, "
  2⤵
  PID:5576
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "linux-arm64-musl": { "
  2⤵
  PID:6036
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:4160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "binary": "claude", "
  2⤵
  PID:1948
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:4504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "checksum": "d774cb39055cff62af476af32702f1fc4f888a7e395a37434a95d6f5a98818a0", "
  2⤵
  PID:2708
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:5780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "size": 311914480 "
  2⤵
  PID:4288
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:4748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo }, "
  2⤵
  PID:1412
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:5292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "linux-x64-musl": { "
  2⤵
  PID:4752
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:3744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "binary": "claude", "
  2⤵
  PID:3920
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:5528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "checksum": "8bc3d015479b8b87dfde3f69f9bdb96c658758a8eb31892fd8fbece8d8a08bcf", "
  2⤵
  PID:4612
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "size": 314779944 "
  2⤵
  PID:2984
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:4824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo }, "
  2⤵
  PID:5456
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:4880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "win32-x64": { "
  2⤵
  PID:3044
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "win32-x64": { "
  2⤵
  PID:5908
- C:\Windows\system32\findstr.exe
  findstr /c:"\"checksum\":"
  2⤵
  PID:5500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "win32-x64": { "
  2⤵
  PID:3576
- C:\Windows\system32\findstr.exe
  findstr /c:"}"
  2⤵
  PID:6140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "binary": "claude.exe", "
  2⤵
  PID:812
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:6016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "binary": "claude.exe", "
  2⤵
  PID:3408
- C:\Windows\system32\findstr.exe
  findstr /c:"\"checksum\":"
  2⤵
  PID:716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "binary": "claude.exe", "
  2⤵
  PID:5404
- C:\Windows\system32\findstr.exe
  findstr /c:"}"
  2⤵
  PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "checksum": "e896a9d8da519353a49bf69ca4a695ba7e09067752687c675b3969041e632d52", "
  2⤵
  PID:6104
- C:\Windows\system32\findstr.exe
  findstr /c:"\"win32-x64\":"
  2⤵
  PID:5820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "checksum": "e896a9d8da519353a49bf69ca4a695ba7e09067752687c675b3969041e632d52", "
  2⤵
  PID:2064
- C:\Windows\system32\findstr.exe
  findstr /c:"\"checksum\":"
  2⤵
  PID:2304
- C:\Windows\system32\curl.exe
  curl -fsSL "https://downloads.claude.ai/claude-code-releases/2.1.316/win32-x64/claude.exe" -o "C:\Users\Admin\.claude\downloads\claude-2.1.316-win32-x64.exe"
  2⤵
  - Downloads MZ/PE file
  PID:4156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\.claude\downloads\claude-2.1.316-win32-x64.exe" SHA256
  2⤵
  - Executes a command shell one-liner
  PID:2308
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\.claude\downloads\claude-2.1.316-win32-x64.exe" SHA256
    3⤵
    PID:4284
- C:\Users\Admin\.claude\downloads\claude-2.1.316-win32-x64.exe
  "C:\Users\Admin\.claude\downloads\claude-2.1.316-win32-x64.exe" install "latest"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:5996
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Policies\ClaudeCode /v Settings
    3⤵
    - Modifies registry key
    PID:2872
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKCU\SOFTWARE\Policies\ClaudeCode /v Settings
    3⤵
    - Modifies registry key
    PID:2008
- - C:\Windows\System32\where.exe
    C:\Windows\System32\where.exe git
    3⤵
    PID:696
- - C:\Windows\System32\where.exe
    C:\Windows\System32\where.exe npm
    3⤵
    PID:4188
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.claude.json

Path C:\Users\Admin\.claude.json
Size 558B
SHA256 f7adbc5340f004a5fedef85867d5f83edb4d9ae94a8e51418773e29fe3037e41
MD5 ff6a2467e340c4838a9f4cf3908430b2
SHA1 46674d3f80f0c714c7c0e0bcd59e6e84983ef5d0
SHA512 af50d89ab5621788b2670f810a428a5a962bcf21642420a61da98a7b0e905d096eb7fd2a0fc6c76dae0807b22c88b1a6ab94bc8c94af5dc301736bf4571cb1dd
TLSH
T196F0C0615619D0373AF4036A592C44534AB8EE6B016130B80BDF6724111DFBB337F5B6
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 84B
SHA256 fe272860c096e139e8560d37b834b8bfa4ba469c5c38695598d92603f0ad33ba
MD5 c1b9415e608b7a078d86a013e08f6b5e
SHA1 1eb4e385e2465bd85c405b803c69ae4868127efc
SHA512 bc2a6197238ae814a067d1172cf31d8d90f9460f01d75a6eaf7896eeb14576f220ac46cc6418105d0d132d34b5fd7667a2471c3228469ed535a83330b8834983
TLSH
T172A0120002114457ACD001902C7C41328F651BEA0001510C050AD30C00E06B5210F420
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 167B
SHA256 b2c595c220067e08822d46825e7eed5a27c91378c456135c2486a073ca8dae88
MD5 99ac4d673ee137a6ddfc21d923cec6db
SHA1 e5f1dc0c65c3c70b5b507cc7bb54e096d2107f98
SHA512 ccf6ede84ccb79f6170dadf4ff393b1ea315246343f590d13fa93ded64b1e7d00f0266cd7607d40599876f0e5700e8a0b2750d8383eaa9177212dd1d208e920d
TLSH
T1E8C0805441555C676CD106546C2C51314F591FDB041131E4171EB72801F86F9171F830
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 423B
SHA256 4d93f10656277b900a28cb159c75e42f411eccc6bb59f8f16b06793d3904b47a
MD5 2c845d25748fd9c5913c38c1951246b1
SHA1 66e33976071428fc9736e353b5f72cc20300b2b6
SHA512 d6a7808ca4afb1979ee7d2aaf69e8bd66a6eeca13c9bd0fd071ceda18ab568c9a05a099b86685d8f06fa303c4df914ad9465259a99de50fe5df3878424fbbcf1
TLSH
T164E0AB50122994337BF103576A1C40028EB8AE5F055030B8074F7718015CBBB362F570
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 464B
SHA256 8215f72ba4eb0b6f859a41ce9a972386a9be12d9adb73eb849e0295511f1612a
MD5 15ea98ea75b0ad9e1395b013b6781fd1
SHA1 7580c0fbb816ced9aa4d1362fb08af5e44416415
SHA512 00b22de798ce6805a40b077c68184d1ca47b7379eb7222906bf66d6db525caece7c148aa89617760b39b82ae766a642256f070f3edfc535e241fe62a1e142009
TLSH
T1CEF05C65626994337AF102676A6C40524EB8AEAF065130B8075F6714015CBB7362F575
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 203B
SHA256 653e148799a82b0cc43e7bb7d6edc763d24134ea9ac4cad7b06ef9909883ec71
MD5 a2a435d402300b2b48d6bb6c1663135f
SHA1 a58ce54c1793d44d4677519c1124054cae4c3a72
SHA512 31655d4d2be7f5c5e6e8bac0c4735b005cee5f84c983e72a4658b2f9cd0a0c8f0a4d6c9667e0480138777e152c77b1c5e7927fe421222f905ea63d75bbf5e048
TLSH
T188D02264030588336DE20399A82C51324EB82EEB000230A8575FA33902BCAFA231F835
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 242B
SHA256 d3c377db6ca8e799dd1d22dcc9850913e39d8cc1c3f3ec85bdf40c940c3fd99b
MD5 a24277d66b95f9263df6c87308844556
SHA1 b1d945de2a90c1af583f1a03beb4e4e8d8147d1d
SHA512 6d0c1b90f17f7d647c572dd676e519b96696c4a6ea37deb2b9cf0b3d1623c83c9e43ca2f66c9f744308da15a979d7104f22a55490699f6628118d1bddf17777f
TLSH
T12ED0A7540316D8375DF2435AAE5C51224EB85EEE060634B8579FA72901BCBF7331F475
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 269B
SHA256 c49d2f5b9f28ebde21964a6f8b0dcb9a4a6b875dd878649d883868a7c1b068e2
MD5 6711cfe577075df3a6801bf936dcf335
SHA1 af70e14f1eb1d148d4119eb60e4631d7eab7e24a
SHA512 80b8a860fe1a8c115ed6de6b8ed455dc7802130fe21f700a7e5f57ffd56039c955ee6384023d3ff03603bdb36e5f68e1da9a8654e9f07ab19b1d23825779f322
TLSH
T128D02B54031584731DE2035A9E5C50210DB59DAE050130A8138B9728017CBF7331F474
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 317B
SHA256 b70a16b35625cc9db2ebd7659b6e6af2e0c90c3bb7fab84fe938b66cd3c7bde3
MD5 56642d90fe6c81fa0c73abdc7290472d
SHA1 36749d4ce6c8e9d1e915b45083140d9011c6f61f
SHA512 209ca26775fdc513d024bc80618a73b298ce806a913d415b3ff5ace543a94d2c8a37e6a01eaabafa3a4425a4b37379b729e6f56857c08393b28912bc45f04a8e
TLSH
T194E07D501215D4771EF10206AD2C10120D789D9E050130BC078F6B28016CBF7332F870
MD5 SHA1 SHA512 TLSH

Submit Download

.claude.json

Path C:\Users\Admin\.claude.json
Size 343B
SHA256 137bc1fc8b9260b739fad805c4bcc136c943b1c3644ab576d5f98b90aa1324de
MD5 6f77eb99bc46b0dfa3b64ae21cf43450
SHA1 72b46691336c108a42b81e741a5c4a1500e15aba
SHA512 f2d8b6f91b7bf8142c2df11c6606c254ceb4d6ba86f9c1ec9d6addbe39f6f8031899e895d1916f23cdf7ca0405bfd0a0881058bc8bf72919ec677e2ac34f0ddc
TLSH
T18AE026A01219D476AEF20316AD6C50124EB89E9E060130BC078FAB28026CBFB332F970
MD5 SHA1 SHA512 TLSH

Submit Download

latest

Path C:\Users\Admin\.claude\downloads\latest
Size 7B
SHA256 e78053674693f774fe7cd13679afa27ae0d4c85b34aa6b693c06b3c2cc2a7028
MD5 6784fa07db87b1f503f48e00a00384e8
SHA1 f028e3c6d8d10327ac61119dc57af7f95e5783c9
SHA512 a8064663f286de61030321ee6fe5730256be14b2cd7045a1c836098008fab1aa1f92d7405026eebbcab36e39b26f970ebb6e6f8fc865f965a52bc04d6da40284
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\.claude\downloads\manifest.json
Size 1KB
SHA256 ac9d8bb6a65febbccf9e65bde2e3e4298b8d6974e96f559fbf1d740891a747db
MD5 c63d04c1cb50b5e3b5962da72da55a32
SHA1 e979aef676edd9f992673b8e104028bc60a02053
SHA512 ecc7176b9aee53fb174b642efb5480f3e067d46619834481577b846c072033359a1bbaecb120b7bc76fcd5d34e8dbd5b74d4a42d94d279d83a24eb274f7e7ca4
TLSH
T11641692FE0391EA360C96431491F286EE55156DB0F843E18338D92CE4F6D4BF1A3A5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\.claude\settings.json
Size 37B
SHA256 c0eb33614d13cccdc2db798e2a73c82af9e6f291d8261c6b711b620a8d18648d
MD5 a303e4a792338ba1128c5d9e22677aed
SHA1 df4ade37e2674a7fb00abf44cec28295a8672968
SHA512 161773fbbdf4f8468e06dd012253b84e89832380fd6a069c0358135ce4111dfe8f7c883aa667fb7a9d972b4bab871dd2d36b38bff71af2aa8b98a03bd3b4f408
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads