Overview
overview
7Static
static
3NeoShell-S....0.exe
windows10-2004-x64
7NeoShell-S....0.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows11-ltsc_2024-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
3NeoShell.exe
windows10-2004-x64
7NeoShell.exe
windows11-ltsc_2024-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1ffmpeg.dll
windows11-ltsc_2024-x64
1libEGL.dll
windows10-2004-x64
1libEGL.dll
windows11-ltsc_2024-x64
1libGLESv2.dll
windows10-2004-x64
1libGLESv2.dll
windows11-ltsc_2024-x64
1resources/...trc.js
windows10-2004-x64
3resources/...trc.js
windows11-ltsc_2024-x64
3resources/...all.js
windows10-2004-x64
3resources/...all.js
windows11-ltsc_2024-x64
3resources/...nel.js
windows10-2004-x64
3resources/...nel.js
windows11-ltsc_2024-x64
3resources/...ent.js
windows10-2004-x64
3resources/...ent.js
windows11-ltsc_2024-x64
3resources/...ent.js
windows10-2004-x64
3resources/...ent.js
windows11-ltsc_2024-x64
3resources/...nts.js
windows10-2004-x64
3Analysis
- max time kernel
152s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 18:49
Static task
static1
Behavioral task
behavioral1
Sample
NeoShell-Setup-2.1.0.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
NeoShell-Setup-2.1.0.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
NeoShell.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
NeoShell.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
ffmpeg.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
ffmpeg.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral18
Sample
libEGL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral20
Sample
libGLESv2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/ssh2/.eslintrc.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/ssh2/.eslintrc.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/ssh2/install.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/ssh2/install.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/ssh2/lib/Channel.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/ssh2/lib/Channel.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/ssh2/lib/agent.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/ssh2/lib/agent.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral30
Sample
resources/app.asar.unpacked/node_modules/ssh2/lib/client.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
resources/app.asar.unpacked/node_modules/ssh2/lib/client.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral32
Sample
resources/app.asar.unpacked/node_modules/ssh2/lib/http-agents.js
Resource
win10v2004-20260911-en
windows10-2004-x64
General
- Target NeoShell.exe
- Size 164.8MB
- Sample261104-xghassed94
- SHA256 080a90993ee9b0e66b02a4f469c9a49f7c7769d6773c1456791021650520aadc
- MD5 7d4af5b3461de4bbdd5698a8b19848ed
- SHA1 8eab8df89c7bdcec6a8071fb1e9711edb619084d
- SHA512 8b321cd346dd516a911b620300e9c41012fcfe2dbfffb6bee8c69bcfbf969c8c0aefd6325ca9e3bf1e3b21fff929df7955ca3ec89cf635b9562e2106e2b1741b
- SSDEEP 1572864:kmIh9FimkfWTs6+LkanRWYS8a4lN+WTi6qSFK2u73JvPaKD2JsR2/tVBcpZOcrQD:6sFWY7ihS4kVP
- TLSH T13F888B03E29650E9F05DD1B18B978236EE72B8861738A6DF175417262F77FE02B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4748 NeoShell.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain NeoShell.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname NeoShell.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname NeoShell.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain NeoShell.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname NeoShell.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain NeoShell.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4576 NeoShell.exe 4576 NeoShell.exe 4576 NeoShell.exe 4576 NeoShell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe Token: SeShutdownPrivilege 4748 NeoShell.exe Token: SeCreatePagefilePrivilege 4748 NeoShell.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4748 wrote to memory of 6116 4748 NeoShell.exe 89 PID 4748 wrote to memory of 6116 4748 NeoShell.exe 89 PID 4748 wrote to memory of 2688 4748 NeoShell.exe 90 PID 4748 wrote to memory of 4488 4748 NeoShell.exe 91 PID 4748 wrote to memory of 4576 4748 NeoShell.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\NeoShell.exe"C:\Users\Admin\AppData\Local\Temp\NeoShell.exe"1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\NeoShell.exe"C:\Users\Admin\AppData\Local\Temp\NeoShell.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\neoshell" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,12201660669535875838,15749776191186150662,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:6116
-
-
C:\Users\Admin\AppData\Local\Temp\NeoShell.exe"C:\Users\Admin\AppData\Local\Temp\NeoShell.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\neoshell" --mojo-platform-channel-handle=2376 --field-trial-handle=1768,i,12201660669535875838,15749776191186150662,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Reads the TCP/IP host and domain name from the registry
PID:2688
-
-
C:\Users\Admin\AppData\Local\Temp\NeoShell.exe"C:\Users\Admin\AppData\Local\Temp\NeoShell.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\neoshell" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2600 --field-trial-handle=1768,i,12201660669535875838,15749776191186150662,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵PID:4488
-
-
C:\Users\Admin\AppData\Local\Temp\NeoShell.exe"C:\Users\Admin\AppData\Local\Temp\NeoShell.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\neoshell" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2988 --field-trial-handle=1768,i,12201660669535875838,15749776191186150662,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4576
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\D3DSCache\a35423ac51494916\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
- Size 64KB
- SHA256 32068f732c8b8e9034ede8c41d8cfd43d1d05fcd2b9469ada82c1229348f03f2
- MD5 d81756083aea16ecf103f3140dd31899
- SHA1 65fc74b688461ad313de930ad6ff5a7d53d9415b
- SHA512 344b028d9eed5cebb0d9af2214bf96d3ae3f8667d139d4b679e28bf80a945fd193f30d48679f4bd22b5305111c3253025dc92e1943027860ee7cab7c4d18e8a6
- SSDEEP 3:rSAll/lGlll/l/lXp9ZjrPBY0zlHeWcHpl1ZP:RF0dPBY0zbcHp5
- TLSH T18453124012A20127C442033005C606C43E7832080343081192148130D8587440572380
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\D3DSCache\a35423ac51494916\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
- Size 4B
- SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
- MD5 f49655f856acb8884cc0ace29216f511
- SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
- SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\D3DSCache\a35423ac51494916\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
- Size 992B
- SHA256 50f2b929fa115e145d6621dda840e4ffaf7b6684dbeb65498fd2aa27fcbcf860
- MD5 f6f138960dfe446eced5dca85a997894
- SHA1 880e127620feb99002102a4b35498a3edb87738e
- SHA512 c5691cbc5d103e6242cd32b62e69fab0b5ee689153cdcc094bbb48b95a00a09eb230f73b6bc24e6f7103ddce4c725df57a2feadd51fa844a05412801c31528a7
- TLSH T1281180407BDB2C70D36F7530697661181377B51109C2F10E4080C4174D31D0DC524F55
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\1ab708bf-8191-4c57-99d0-1f0b0e4d0452.tmp.node
- Size 152KB
- SHA256 b5791618385e231169bcfbaa7ad08d6a051082f8c8805f649f429035d12c441c
- MD5 0fc72f6ede88bd32d6648ee060558386
- SHA1 c825f5c1f02e43434dba700186f5a91e691b015e
- SHA512 6b447424b5767bb3d2be73f66b928326d8c141a7d611d4622e55c00cf55dfeb872cd0161690d6f3e1c9c599d24480ee490fbeda210bf5289c518ed04780f628b
- SSDEEP 3072:IuzLTrIRVX83KhSh1Wc97j5BQ83iVpZcNrhsVi:XYFhqWGBjVsE
- TLSH T143E34A57B3A110BBE566823989A34A06F372B8110371D7EF0364437E9F273D19E3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\neoshell\Code Cache\js\index-dir\temp-index
- Size 48B
- SHA256 fc26afc6c3358b9df979c978bc8c65d52e4fc932263e3a53bdefbf5e246e7ee3
- MD5 875732f5893cf8dd7389c398fecc7c6b
- SHA1 c8ce3b67373c30c52f8528246673db37b1eadf8d
- SHA512 098a1e6ccb3cc4ae0cee2fa7714c1020ac6a7a93bae70b0b135c097058d418fd7a7d044c4bceea2bf6bb998f2ad3aa3a86d91b1c0f20209d712c9e675f6e3285
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\neoshell\GPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\neoshell\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\neoshell\GPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\neoshell\GPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\neoshell\Local Storage\leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\neoshell\Network\01182e7f-6fd8-4bff-a8ce-96277995ccc4.tmp
- Size 300B
- SHA256 5da012217c87a2a8ff737b570c7badb8d72eadd46e1ce9d87d7439547300e79a
- MD5 822464d339b22b8b9127a746e946f14f
- SHA1 afcb5ee3dfdfa64d3861d14b6f42d0fef5c8439d
- SHA512 675be6c8ddd399d2bbe23a66695bfbac51639fdc4136895a835757e480e9dceb4e07bf1c86e23511f555e34fb2d8ac01d4634435c236992231abc0be1ba34742
- TLSH T127E07293C2E88CBE068583F02B252923C2BA081982182E06C9E8BB0E83B14B8491084B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\neoshell\Network\Network Persistent State
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH