30afb0f22f81cedbbe78c427ff48c18103798e24a3aa34feedf513c839ee9bcb

Analysis

user interaction
yes
max time kernel
270s
max time network
286s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/credits.html
Size 8.7MB
Sample260415-twtetsfz71
SHA256 30afb0f22f81cedbbe78c427ff48c18103798e24a3aa34feedf513c839ee9bcb
MD5 b5fd8f7212d47ca715dae4cd649664ba
SHA1 7e938e34c85e6c96de7401b8f729c623d6626cd1
SHA512 6b5ec6933a9a02ce91e559baa58cfdf48b39a9cc0c504dc5a1dd22af41e829cddd5689adeb6ec569c183d60064cd7182253bc5443137d53988c0298011577b23
SSDEEP 24576:EDZ6cF6f5kqWS2Rd/w9amfz6W6M6H676HH54Kp9b:Em1m
TLSH
T17996A52F7F48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF699
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3168	crocotile3d.exe
3168	crocotile3d.exe
3168	crocotile3d.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nw2384_775357675\sampleAlphaOnIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\sceneButtonIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\selectOverlappingFacesIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\copypaste.js	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\cursor-hand.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\deselectAllIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\gizmo.js	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\pausedIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\prefabBrush.js	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\rotatePartCWiseIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\toggleActiveModeIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\configIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\crocIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\extrudeIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\gridLinesOffIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\js\GLTFExporter.js	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\js\GLTFLoader.js	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\tilesetUVs.js	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\cursor-copy.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\cyclePrefabNextIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\js\uFuzzy.iife.min.js	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\xyzIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\examples\jsm\controls\TransformControls.js	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\addActorIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\addObjectIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\painting.js	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\playingIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\removePartIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\rotatePrefabCCWiseIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\toggleWireframeIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\alignWorldIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\cursor-subtract.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\examples\jsm\postprocessing\BokehPass.js	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\flipPartIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\licenseIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\skyboxSphere.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\youtubeIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\brushSizeIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\eraseSelectedVertexColorsIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\horizontalSymmetryOnIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\moveSelectionUpIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\removeObjectIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\tilesetFinalize.js	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\audioIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\horizontalSymmetryOffIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\nestLocalIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\selectYIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\splitIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\tilesetRightIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\deselectWFNRIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\eraserIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\lassoIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\paintingTools.js	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\toggleObjectModeIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\uniqueOnIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\decalOnIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\deselectFaceVertexIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\latticeEdge.js	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\lockedUVCrosshairIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\patreonIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\prefabIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\resizeIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\rotatePartCCWiseIcon.png	crocotile3d.exe
File created	C:\Program Files\nw2384_775357675\combineVertsIcon.png	crocotile3d.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5460	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	crocotile3d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	crocotile3d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	crocotile3d.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	crocotile3d.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207442928874256"	crocotile3d.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{FC7616A9-2B18-4E38-92F0-06E40F2058E7}	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5824	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5652	crocotile3d.exe
5652	crocotile3d.exe
5652	crocotile3d.exe
5652	crocotile3d.exe
2384	crocotile3d.exe
2384	crocotile3d.exe
5652	crocotile3d.exe
5652	crocotile3d.exe
5652	crocotile3d.exe
5652	crocotile3d.exe
944	crocotile3d.exe
944	crocotile3d.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe
Token: SeShutdownPrivilege	2384	crocotile3d.exe
Token: SeCreatePagefilePrivilege	2384	crocotile3d.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
2384	crocotile3d.exe
2384	crocotile3d.exe
2384	crocotile3d.exe
2384	crocotile3d.exe
2384	crocotile3d.exe
2384	crocotile3d.exe
2384	crocotile3d.exe
2384	crocotile3d.exe
2384	crocotile3d.exe
2384	crocotile3d.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
2384	crocotile3d.exe
2384	crocotile3d.exe
2384	crocotile3d.exe
2384	crocotile3d.exe
2384	crocotile3d.exe
2384	crocotile3d.exe
2384	crocotile3d.exe
2384	crocotile3d.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 5640 wrote to memory of 5104	5640	msedge.exe	83
PID 5640 wrote to memory of 5460	5640	msedge.exe	84
PID 5640 wrote to memory of 3900	5640	msedge.exe	85
PID 5640 wrote to memory of 3900	5640	msedge.exe	85
PID 5640 wrote to memory of 3900	5640	msedge.exe	85
PID 5640 wrote to memory of 3332	5640	msedge.exe	87
PID 5640 wrote to memory of 3332	5640	msedge.exe	87
PID 5640 wrote to memory of 5260	5640	msedge.exe	88
PID 5640 wrote to memory of 5260	5640	msedge.exe	88
PID 5640 wrote to memory of 5260	5640	msedge.exe	88
PID 5640 wrote to memory of 3552	5640	msedge.exe	89
PID 5640 wrote to memory of 3552	5640	msedge.exe	89
PID 5640 wrote to memory of 3552	5640	msedge.exe	89
PID 5640 wrote to memory of 5756	5640	msedge.exe	90
PID 5640 wrote to memory of 3680	5640	msedge.exe	91
PID 5640 wrote to memory of 5756	5640	msedge.exe	90
PID 5640 wrote to memory of 5756	5640	msedge.exe	90
PID 5640 wrote to memory of 3680	5640	msedge.exe	91
PID 5640 wrote to memory of 3680	5640	msedge.exe	91
PID 5640 wrote to memory of 5552	5640	msedge.exe	92
PID 5640 wrote to memory of 5552	5640	msedge.exe	92
PID 5640 wrote to memory of 5564	5640	msedge.exe	93
PID 5640 wrote to memory of 5564	5640	msedge.exe	93
PID 5640 wrote to memory of 1572	5640	msedge.exe	97
PID 5640 wrote to memory of 1572	5640	msedge.exe	97
PID 5640 wrote to memory of 5444	5640	msedge.exe	98
PID 5640 wrote to memory of 5444	5640	msedge.exe	98
PID 5640 wrote to memory of 5764	5640	msedge.exe	102
PID 2384 wrote to memory of 5652	2384	crocotile3d.exe	110
PID 5652 wrote to memory of 1232	5652	crocotile3d.exe	111
PID 2384 wrote to memory of 2476	2384	crocotile3d.exe	112
PID 2384 wrote to memory of 4936	2384	crocotile3d.exe	113
PID 2384 wrote to memory of 4872	2384	crocotile3d.exe	114
PID 2384 wrote to memory of 3168	2384	crocotile3d.exe	115
PID 2384 wrote to memory of 6076	2384	crocotile3d.exe	117
PID 2384 wrote to memory of 2628	2384	crocotile3d.exe	118
PID 2384 wrote to memory of 3512	2384	crocotile3d.exe	122
PID 2384 wrote to memory of 2892	2384	crocotile3d.exe	123
PID 2384 wrote to memory of 944	2384	crocotile3d.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\credits.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x174,0x23c,0x240,0x170,0x248,0x7ff95c59c188,0x7ff95c59c194,0x7ff95c59c1a0
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,17371265278916555224,6994275498170530462,524288 --field-trial-handle=2304,i,13762541298491308853,5416532113875220605,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,6563314751330309275,13196296772812964553,262144 --field-trial-handle=2304,i,13762541298491308853,5416532113875220605,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,2826947341655882094,15554074752110588763,524288 --field-trial-handle=2304,i,13762541298491308853,5416532113875220605,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,15442263434912908723,498733196832568120,2097152 --field-trial-handle=2304,i,13762541298491308853,5416532113875220605,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,9341959033943636461,6142322482967850132,2097152 --field-trial-handle=2304,i,13762541298491308853,5416532113875220605,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,4520243025921005099,11670146298025554691,2097152 --field-trial-handle=2304,i,13762541298491308853,5416532113875220605,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,4286656524224148726,832558177549590431,2097152 --field-trial-handle=2304,i,13762541298491308853,5416532113875220605,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,6169354721268719254,7222641656286284692,524288 --field-trial-handle=2304,i,13762541298491308853,5416532113875220605,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,2926130829218055812,4315605887664080337,524288 --field-trial-handle=2304,i,13762541298491308853,5416532113875220605,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,4392596635193740652,3359614213143840144,524288 --field-trial-handle=2304,i,13762541298491308853,5416532113875220605,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,14400955867329026376,11571280793341104965,524288 --field-trial-handle=2304,i,13762541298491308853,5416532113875220605,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,13144163150266423075,1992578489433226264,524288 --field-trial-handle=2304,i,13762541298491308853,5416532113875220605,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,13144163150266423075,1992578489433226264,524288 --field-trial-handle=2304,i,13762541298491308853,5416532113875220605,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:5764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5740

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4544

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5824

C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
"C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe"
1⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --annotation=plat=Win64 "--annotation=prod=Crocotile 3D" --annotation=ver=1.0.0 --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x7ff94e8cfa70,0x7ff94e8cfa80,0x7ff94e8cfa90
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5652
- - C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
    C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad" --annotation=plat=Win64 "--annotation=prod=Crocotile 3D" --annotation=ver=1.0.0 --initial-client-data=0x1cc,0x1d0,0x1d4,0x154,0x1d8,0x1401f8290,0x1401f82a0,0x1401f82b0
    3⤵
    PID:1232
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=gpu-process --no-sandbox --disable-logging --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw2384_775357675" --disable-breakpad --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAcAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --disable-logging --mojo-platform-channel-handle=1956 --field-trial-handle=1960,i,4368817555044623151,6455740364578908167,262144 /prefetch:2
  2⤵
  PID:2476
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw2384_775357675" --start-stack-profiler --disable-logging --mojo-platform-channel-handle=1964 --field-trial-handle=1960,i,4368817555044623151,6455740364578908167,262144 /prefetch:8
  2⤵
  PID:4936
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw2384_775357675" --disable-logging --mojo-platform-channel-handle=2312 --field-trial-handle=1960,i,4368817555044623151,6455740364578908167,262144 /prefetch:8
  2⤵
  PID:4872
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw2384_775357675" --nwjs --extension-process --disable-nacl --first-renderer-process --no-sandbox --disable-logging --file-url-path-alias="/gen=C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\gen" --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2776 --field-trial-handle=1960,i,4368817555044623151,6455740364578908167,262144 /prefetch:1
  2⤵
  - Loads dropped DLL
  PID:3168
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw2384_775357675" --disable-logging --mojo-platform-channel-handle=3924 --field-trial-handle=1960,i,4368817555044623151,6455740364578908167,262144 /prefetch:8
  2⤵
  PID:6076
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw2384_775357675" --disable-logging --mojo-platform-channel-handle=4336 --field-trial-handle=1960,i,4368817555044623151,6455740364578908167,262144 /prefetch:8
  2⤵
  PID:2628
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw2384_775357675" --disable-logging --mojo-platform-channel-handle=4472 --field-trial-handle=1960,i,4368817555044623151,6455740364578908167,262144 /prefetch:8
  2⤵
  PID:3512
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw2384_775357675" --disable-logging --mojo-platform-channel-handle=4180 --field-trial-handle=1960,i,4368817555044623151,6455740364578908167,262144 /prefetch:8
  2⤵
  PID:2892
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --disable-logging --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw2384_775357675" --disable-breakpad --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAcAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --disable-logging --mojo-platform-channel-handle=436 --field-trial-handle=1960,i,4368817555044623151,6455740364578908167,262144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

box.bin

Path C:\Program Files\nw2384_775357675\box.bin
Size 264KB
SHA256 8b6cf6ffacf7a3d69322189a38ac3698c010b4a736f130ed8d3c04a340875ea6
MD5 bb587d01f604d4af895e5369a99983b9
SHA1 6eed5c80be6b516e670bd767c290f7ca10087302
SHA512 8878733ab91f9de045939b7ecbdd9cca89a114a81df9edd66c789c7ded9de2938e6f9b5e155a4a648bf4867d12c6ed1ade4b441dbd5c52b27d5c3112a43e78ec
SSDEEP 3072:6BAjwhiVBVnCQbdFFCukTLQio6BczfoExpgJPusYXPvxB2Krnn9RZ+:SG2ixCwsuk3otfoEUssYfveKjn9R8
TLSH
T11B44BF82A3677F7FDC5AC07769A6C0B32B21DD4A4893E7875A14937233C32D59D4EA80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

three.module.js

Path C:\Program Files\nw2384_775357675\build\three.module.js
Size 1.1MB
SHA256 69b859e1e556b803fb2a77eb59a763bf430dfd01dbfa5a89cb66d6804021eaf7
MD5 64c116b8be48d1b5c13ab9c93b717c45
SHA1 4c7a0aa7a4b4d81e6558eb2585ab16a110a0bc8b
SHA512 8c88624ca22721d9807a1f7a1d0d0f85159aa3bd039b0dc84785dd89ab7f3c32b00398592beca049b7cbe306b3f87c31d5b8310d043552830b1f53e708cbd882
SSDEEP 24576:1TjWY8dy6kdazW/XzFv1kBL/6LAg+IDQj2FUUhNo6p6QdGovl0Dv:Wdy6kdazW/XzFv1kBL/6LAg+IDQoUUkv
TLSH
T15145D7852BBD122E8B667199886C05C5663C9473B502C4FFBC0C59EA68D143CC7BEF7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3dicon.png

Path C:\Program Files\nw2384_775357675\c3dicon.png
Size 12KB
SHA256 180337998a2c6a7d141aee116e17d908d8a9c8595fbc8ad9f4e887f9a7edd479
MD5 2bf570d04b39995c2b16e9fd10c4f1b3
SHA1 967c2997f97a04299df469c975716d761889b1d0
SHA512 c4e7e3cda9455646492eed1f7dd2d989076e958d630f038e618834694a69e1d083ba371e23e563229f24abb525a7ce32c3aca31bec4f2ac0c2bdf1f11d0ecccd
SSDEEP 192:NSDS0tKg9E05TiqLbFHlbNDUYduJxd8xAn+yJlo8aAKWHIWltzQodWQjoT0Bx8QD:MJXE05+4pHng3a5yQLAZH9UoJET035/f
TLSH
T1CB42BFC1B5B8FC8C29BEBD13C6EC418F7732643864953970A49469BB1D92B9BDC94431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

greenworks.js

Path C:\Program Files\nw2384_775357675\greenworks.js
Size 7KB
SHA256 0e614f1526c4c3f2effb6dd6d8927d5c46c983072962316655ae874e51bc2888
MD5 30b906831a14a37b6566dc95311e5117
SHA1 e45a4c613880b748316fa87cf427b81d8072071a
SHA512 061a2a01589eaa7ea646e9d4bed7a89844fa7c6aa58abb195ca6886173d7ca9469fae1c28fdf72f18adc242f649c34a8dbb5e2439b9174de3008c77f709996c3
SSDEEP 192:70jXU22YSYUMewiaVwdr/AEt860/a+9UcGTf8jYtOpjXxl:7uXU22YSYUMewiaVwdr4k86Ya+9ZWntK
TLSH
T192F122324EA3A0D648F2BAABCA4B170575BBC093071D596A348DD38C5F44434E7EFA4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

greenworks-win64.node

Path C:\Program Files\nw2384_775357675\lib\greenworks-win64.node
Size 1.3MB
SHA256 2e9e1385f88c77f2bb596951e3f548019f012027a381716b092c98cf83440458
MD5 f3dbfc232ff83089b99a268a1c7cebf1
SHA1 94cada9ffc70ec9a2a672c5b5e55aa99a5e3686e
SHA512 e969503186909ec1a0040242282cffb061f34c110688f189c40c09b8fc27d719ec588f3bd5c9b545e23775606b2c430c99b37378ec6cd555a355333fbd27f27c
SSDEEP 24576:atRIzeXIPDpw+7RUWnTOvSgwtHTCzkqrTC:atROeXIbRWvS1HTLWC
TLSH
T108558D03B39501A9D4B7D239CA479A16EA7278454731BBCB03E49BA63F237F8563E341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sdkencryptedappticket64.dll

Path C:\Program Files\nw2384_775357675\lib\sdkencryptedappticket64.dll
Size 778KB
SHA256 8ca8efbbd8d51acfede84d7c97462c76f555233a33138ddf95537cfb3019c27b
MD5 b5d48fc98be086eda0defefc9259bb78
SHA1 bd3f5a18d46a8a43c4eac9fa8a760c1067dba045
SHA512 1cfec1bd1c234e6addb1924ffe4818b5e2f3de10d0371be20c2c03ab9c93082636607b7aa32532894e3e6127779eb0dec6132d0aa16854181477f043956f57dc
SSDEEP 24576:TcbnnHLRDKPsf2k5Q+exLKUxPCrhFUMJY:YbrROSjPmWUxPCrhFBJY
TLSH
T150055B19BEA481B5C077C17E965B8287FBF274051B359ADF52A1432F6F37BE01A3A210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_api64.dll

Path C:\Program Files\nw2384_775357675\lib\steam_api64.dll
Size 258KB
SHA256 67b094d16ab0f1216ed94fc95db1281b75c2ebf1e71e583bb0545a0fb73d7765
MD5 3e86835c23c2865ce4bae0890816aa42
SHA1 079f0750b2feb90eb447858fa51dbabd56240404
SHA512 86d446e2617f146698274326a93e78c201e8ddc4e998faa5b6f42a992fd1082fdc4d526b2a287cd61b6d1782727a6e3d26a80990ee935b48b638034840cb6015
SSDEEP 6144:T3Z4rQ8sCJ935KFs2z4iUqy7BCcM3tJRwG:bYhPpKFsFYy7BCVtp
TLSH
T11C44383A72750CF5D1B6C139C9961E0BF671304B23219DEF276053368E636E22A3BA95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Program Files\nw2384_775357675\package.json
Size 467B
SHA256 5a5a595c33eef8f0f62ab4af9be35c45ab52cc85fbc9d35e63877168d6aa92bd
MD5 744634bacde76470f778a541c646b0d7
SHA1 73b92a5054c131c4386b2c02ca551bdaa3d406a5
SHA512 5fc65d0154d1b539bc4f2f3df739230cf59cc2ecfa4bf0439c418abf00f01d6f2b2d3bb0d3629ab9d3fdc0e647ce89be7511babb040d3cc9e7d2090eb5e277b9
TLSH
T115F05C12C1A1BD3B467C9D83B9714BC6F34A1A2F11299C1E7170352C57FB97A8181764
MD5 SHA1 SHA512 TLSH

Submit Download

workerThread.js

Path C:\Program Files\nw2384_775357675\workerThread.js
Size 16KB
SHA256 4171b36c8f939fe4d09a510ef85cdbf8fbea5b034d3c2c9eff46c115efab4389
MD5 d00bd459d4686569d53f453d19766fa6
SHA1 95e571226bfd2edd98a9fcb2ab455f2eb2f5de2e
SHA512 0ac4be6aa0c7bc85e5c8ace06183e8d6670135599cd8d3571074db5aa736aff4b186d9f0172991ccd3cb991c16db6b1d7993586ca3e26d686849d8a7931f486b
SSDEEP 96:xZRqAgEA2SYKriJnew56PJ1SPza8RuNe5sFeCwkk3eNoo5WLa7HyCzQ0U+duGZuK:xZh8OG4R8ksKVaWItc0nCd5bLHYRX
TLSH
T1827200C8734ECC8A86DB1299143C9595EF7CE0338121079FB62F6C527599CB483EBB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad\metadata
Size 114B
SHA256 25e67bd1602866ddb12d7aa44d3927b8e483a03eddc870c4bd142d0d90178d67
MD5 02f4587670f50e63361b2d15b2f0f237
SHA1 be0018d46fc112e87139ce81c63e4cda2019fadf
SHA512 dabb8b23bbe086fac00e7310d94b855e71d9aba83964c55d190f9945d81a49d969405f3e9f48db3acc10f6c1c52023f8b1f13a28c4199bb645112e54ead29b94
TLSH
T1E1B0120227207C13D00281B14E5DB7446310EA3045367227416458855C4B24C55C4058
MD5 SHA1 SHA512 TLSH

Submit Download

3cf58cc2-2915-4f1b-9629-18555e03647c.dmp

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad\reports\3cf58cc2-2915-4f1b-9629-18555e03647c.dmp
Size 1.9MB
SHA256 1fe61aadd6a4270a5e77aabe10bf943beb470cf971ce8081e6d4a8029dff0ee7
MD5 ac54281f3affd3610d03c66533ca12ee
SHA1 942e2bd1e128adf5aaeecf3bdefec51e4f972aee
SHA512 e47676dc65f9deecbad8a0cd56d2b85a539fd418367a27400c2dab96cd075ed95265575e678ccfb30e100212799b5d51650385135c71b1ccdb45071306500dfe
SSDEEP 12288:ZnDKDobFVbSzwvoKe5ISWxTbibgqjPS+/G4pIbqabCdS81:ZRnSzIxTbJqjPJ/GTmabCdS81
TLSH
T134951717BBA50892F0294570AAE71B14FBF6FC98171247CB026061B9AFBB3C45F35B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8947dda0-32f2-4c4e-a781-f029d5ea007d.dmp

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad\reports\8947dda0-32f2-4c4e-a781-f029d5ea007d.dmp
Size 33.9MB
SHA256 84465f82682f9f51b6b31049158045de763df681f141031370a95f5a95f386c8
MD5 7d5175d91b332fbd05a1c475bf2b01e6
SHA1 8eaba84947b976fcc04993f8170e408b94eb99af
SHA512 84bbf88e66dbb6c4b4149977c6969981509bd44b50049b51856c28e6817e56218b7e77aa722b5920f19de0234a328a3600e6cdad1d4b15d7619cf1ab51f8f1cc
SSDEEP 12288:qUVc+SF9YZFtUYv+hX1pLwZMIpcDC6HbLs3YtRdOl+gsnGwyXh1zOsbgQwZWU8nI:qTnRQlAnGwmmQDvqD
TLSH
T14E771827B7524997F819C2714BDB6B21FBF2BA540B3243CB6224237A6EB73D41B35610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad\settings.dat
Size 40B
SHA256 ffde8976b2530d90e791d9dfcc1ab34f93716ded033940cc21e4eb5dad5eb4ff
MD5 d15b81f3b4be2876403157f8632835d2
SHA1 6df841f104699aa47c7ee2ff28b8890020acb29c
SHA512 c4643d47245f13e9c3c091eb6c471ee103c3d2f1803f79eb99d6766bcfe91e5a023812eca947c6ff73a6bf4bc8e65b337d638842a82ec018a0351779347bc49a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Network\Network Persistent State
Size 405B
SHA256 73ae15a0f8eeebdaafb85cc3196f8e1f73deb35d1860be1998f358e47d6c418d
MD5 f0cc783862bb5aa156c082f5eb76a664
SHA1 5da46625cbc1887b5c7d321a738f1e83908ba91f
SHA512 c56d28a75c080df2a4a5ae4fbefb09f44d5d38db3128b6c93d47b1020adc2cc46ec0a118c752d9a6a207405209789f702dfead0edcc24a9bcc6dd818a1dd5438
TLSH
T190E0F1A2D3E856BD4B4542F42BA57A13CB3D080543183D6AC5F47F1E93D106885648CF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a50c1.TMP

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Network\Network Persistent State~RFe5a50c1.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 e4a8f72f5024412d05ed8d7ac85139a58f8e29398515962934eac771a53e2523
MD5 b71c2ec2b118356c0ebca9a67447e621
SHA1 41480590d3cfd77ff60e17e24da717ae1f3ba37e
SHA512 78ee5833965e46e28d8097b124ec5b7ff5892ad4a058236d88fb546c913bb75c2cc2da5ff899a0e36a99438ebbc8a2ff3abfa7d68ab7b9d6a956e910bb830075
TLSH
T170C080A140FDE57A30BC09655DCCFD455F7AF13C018594F99B66457C71901F65203057
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Network\TransportSecurity
Size 186B
SHA256 9b9fd100a26d20a3c6874d3ceac7a8e07adef3c7bf82ccdd3eb05726b6b1a55b
MD5 67cfc43f0cc5b1ea8c3f268037d52a8d
SHA1 7475d27a35d4833b6bb2b69995628c34402e3d95
SHA512 6c4780908d10191a848c00c0f068b9e72cdfab901868052446752f313f558108fcd1e449332e5a6b090f845abc2a07786056966c9390e8a344f367afe9b14470
TLSH
T1B0C0C0E101FEE4F620BC09231CE1BD486F3BF030008164F88363813C61508B65203093
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 045426844648113d7c8d9e41286fe415c6c3111c14c4e1b824036c110e6077dc
MD5 50064eccf11f5b13db409d06b677d200
SHA1 a6a7ba772d5107a1b9dbfcdf71648d74818ce89c
SHA512 78c24b614d20829e1d48d060ebbd2b00eae657eb6880c4c1ecc306952676db32e91b2082c023624af0c13de4baef9f8fe21a1dd85ec32eb103367b0bbc94355d
TLSH
T166C0C0A355BDEC7620BD05213DC8BD489F3FF030018090F887A20B7CD5900F65203013
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59af12.TMP

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Network\TransportSecurity~RFe59af12.TMP
Size 188B
SHA256 656bba29646d8d6f3165559abb0c47f3bf5fce2f18f5b5443af8fbdfa546da2f
MD5 e97ecdc2c44fc9fd6b390850efcd4efa
SHA1 d96fbefe252d0bd5fe2ce6ff5824f5f07e1b0690
SHA512 5275a31a5124f3ac2a730c27bd2dce9b7139f842d617e10e2d63fd162d7e5a43eca6a6ff07c0a01debd79c8a1c646dfb9be57ebf5a1d1588b7684426572fb842
TLSH
T124C022A280B9B47A30EC052118D0AD425F3AF0344284D0E8C2ABC52C50A00AA6203012
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Preferences
Size 4KB
SHA256 93f04254a77ce63753ab611bb3272257b12e9b90980fd4bc8520b3832f91c81b
MD5 540cec0c0dddd91ec1407dd67aa971e3
SHA1 bf07c09aafdbaef6ec101a3f85dd767b0e38a913
SHA512 cd37134b19825957a03281dc98098892d17626e05faf9e13f01e534a348744083542359c7999d54be951800e0e5aeb14119815f61382037bed893001836c7755
SSDEEP 96:ryTnOVfiWJeA5Hh6NL7/x+6MhmueqCncj2M+OwQ:raMPJP5CLV+FppPEQ
TLSH
T15891C81B6D28EAB74CC7D61DBD5A7A92D6F7043017D02C84A7FC8A1C089EADD330791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Preferences
Size 4KB
SHA256 fb5ed966be9bb451a9cc7586c92c77c46630bb6872fcea52326591e8630c1145
MD5 7322174e1e578080869a60c923e613ce
SHA1 3346ba83451ae14ffce088ac8351811e59ecbc88
SHA512 7c16bfcc28666e295146802b17a549032124e58408c1f4c87db230175113f7dcf3ca441e5ea71e228ceb4123ab4905595fdae40f90380153ca78b6f16a7124cf
SSDEEP 96:ryTnOVfiWJeA5Hh6NL7/x+6MhmueqCrcj2M+OwQ:raMPJP5CLV+FpZPEQ
TLSH
T10191C61B6D68EAB74CC7C61DBD567A93D6F7143017D02D88A7FC8A1C08DEADD220781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Preferences
Size 4KB
SHA256 d18618a0e5ec17aeec3727bea00a5e526cd1af9c6ca530774d3e61a9f82c8ae5
MD5 223a745a60f8e25e204f2d61a77d191a
SHA1 8d7a023600cd2fb44dc3809d0cd4c8586098e473
SHA512 c24280138d26fc6aa095374895933036f8bd34af3e9d16731da0b8b8a4b876162e1c82df8dd7489586d0aa9b9f665d64462a18c9c0a58f821114c77cb4ec7a72
SSDEEP 96:ryTnOVfiWJeA5Hh6NL7/x+6MhmueqCdcj2M+OwQ:raMPJP5CLV+FpFPEQ
TLSH
T174A1D8176D68EAB74CC7C619BD557A93D6F7143017D02D84A7FC8A1C08DEADD320790A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Preferences
Size 4KB
SHA256 aec93103d9401215521b2f0764440e8ea51809ad705cc13c4786241becfdc74c
MD5 976b007b91ce108a19ada87efc73a326
SHA1 7ba75fbe4e5cc2b3698df67bc73a0268da345c75
SHA512 53583a61fc78c21ed3ce20d799a9e9855e2166c3efda36aafc33f0d9dbd57c5cd7d9d3782044f227f9eb9eb10e6fd42c2a2b1faf33655e35efb581bbeec3cb43
SSDEEP 96:ryTnOVfiWJ85Hh6NL7/x+6MhmueqCebj2M+OwQ:raMPJ85CLV+FpbvPEQ
TLSH
T1A991DA0B6D28EAB74CC6D61DBD567A93D6F7043016D02C84EBFC8A1C089EADD330791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Preferences
Size 4KB
SHA256 e682cdaf9a7b10902704cc12a4d617af2d516b3e08858f58d853e7eaeca6244e
MD5 30eaf239c6141939289080c1c66e794a
SHA1 0fecac111fa11db0165f4a74bbd120323c6cfb23
SHA512 78020d7de246c8c9dfcbc06e649dd1fdf571f65fe2fdfe4727dbb2e3b79d75f756279cc90bbf51a0f83ad5a21da873a76f129ed00c93184cd51de49f262bf1f1
SSDEEP 96:ryTnOVfiWJeA5Hh6NL7/x+6MhmueqCCj2M+OwQ:raMPJP5CLV+Fp/PEQ
TLSH
T1A191D8176D28EAB74CC6D61DBD5A7A93D6F7043116D02C84ABFC8A1C089EADD330791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59868b.TMP

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Preferences~RFe59868b.TMP
Size 3KB
SHA256 333b62b4cc21ad100b70d08c7ca67dd39e052c5efb28e6f99c1d5603bb045e6f
MD5 bec3c95c533d5eda9c62a6907ace15a4
SHA1 9b3e426bcc51a4ca0284832a7a64da5455a8c740
SHA512 001c82207c234d77b1abee154f57debe37e0202a03232c137f9dc63fa72f38ae62470afdf031f30fbb975cb53fa667c6b3aee24c0dde4b6fbc57892edbcc19c2
TLSH
T16D81C84B6E28EAB74CC7D61DBD567B93D6F7043016D42C88EBF84A1C049AADD230781A
MD5 SHA1 SHA512 TLSH

Submit Download

c32cd422-9f4d-472f-92fe-5398c876f0ed.tmp

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\c32cd422-9f4d-472f-92fe-5398c876f0ed.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d4d6f987-7eda-4173-94a2-9f94dd63b0e7.tmp

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\d4d6f987-7eda-4173-94a2-9f94dd63b0e7.tmp
Size 148KB
SHA256 d98e226bea7a9c56bfdfab3c484a8e6a0fb173519c43216d3a1115415b166d20
MD5 728fe78292f104659fea5fc90570cc75
SHA1 11b623f76f31ec773b79cdb74869acb08c4052cb
SHA512 91e81b91b29d613fdde24b010b1724be74f3bae1d2fb4faa2c015178248ed6a0405e2b222f4a557a6b895663c159f0bf0dc6d64d21259299e36f53d95d7067aa
SSDEEP 12:YcFpCkgfvMbb555555555555555555555555555555555555555555555555555O:YepCb8bBvK
TLSH
T1FCE3AB8237F0C86CC264123CDD1AC3FB1E5DFD525665D20331A5BE3B3D57528591A785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Local State
Size 2KB
SHA256 ab5c5c91d52d968fbab6265de88b71deb17f054ec5c79339c4908d65322ddc22
MD5 c85a8e604f0c3c42ff0b78f7c3e87047
SHA1 03e446f70b730ad903dc3a214b18057d91b82d32
SHA512 6f93161a682cc79405a8c56aee31f93bff7db7e1aad1ecccc97bc2ef59a9a6897ab555a7e885348073ce7dee1794388f9992d8c5b6e0b802fe3906203bdda656
TLSH
T14051B6B221AC8D379AB7DA41B9422A038EBAB417BA506F84CBFC1F0C11E75D42396517
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Local State
Size 2KB
SHA256 c307ecf9fb4deabc73102eb2b6c321e508bc9c246f583629f7ab109311a71fea
MD5 97852f6bfaa5734982a23ef0b940d6c8
SHA1 e24810ef9dbf0c6602f7df37749661562fc11bc2
SHA512 f731591a37bc120264f7b1bbc481d0afaaa9a5f04d0fef10aac98c5778504d644ff7d7e245f249fab329e9239aed9a0b3c09300b3f349eb71a50272e8a8cfc53
TLSH
T14051C9B221EC8D3759B7DA41B9421A038FB6A81BBA506F80CBFC1F0C11E75D42397117
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe595078.TMP

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Local State~RFe595078.TMP
Size 866B
SHA256 b3971b0c8242c649ab3995b44f36dc1e2b92718a33228a15c7439999f1b35f98
MD5 7b3eb59ed17793e44f5988f5343e6c11
SHA1 28c7a951e38e02e3737abaf6a65a72605c157da7
SHA512 9332b587b55070781aa46c59a2545cf9f77649974766b021389cefa1c3e6ce094c2a303fe65f4513b4d457af10aa836fc544bf755dfaf84bc3fa7bf77fc337e6
TLSH
T120111EB794EC8B63ED934E127A526F434E12E43B77108A4593DD0B0921E34DC2627936
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a1a50b73a50c33e9fb976236a96a0d852219cabd4205dc0c2c90955572a95807
MD5 2030ed7d678cd2e532ba449f0105dc2e
SHA1 159b2b576cf62532e432577ff66dc50a27ffb9a6
SHA512 2db5b4788febb293a558645fe6a47c03cf219476d32f87be28a348a680b893a778c1558cabcce1a9928f639b3640d0d7e6ec40e1db88d0c5d5f2000090854431
TLSH
T128D02371FAF6E415D15708F1551323167F1AC6A6FE835122F011546CCC66565E7C1283
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 744c54204ec211c97f11f97113c0c235ffa3d6afdbf728f7dbf19b5ba12cc56c
MD5 902cd3ae1df45aba83a1a91b3e68bff2
SHA1 68331a1c95d01aa0f4dbc928f050d3e482b5c417
SHA512 7367d5f2f853ba5c2c80f09c69a15316b92a8249bd19ea85eb0ae6e33daac2636fd18689a18f585fbb050f4792ce5bff916cd9462a474abe60697e5ab98dab5a
TLSH
T1B861F76080819CEAEFF15171FBFD22FC32701759258B1FA2B6F2743CCA2AB131248521
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b820.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b820.TMP
Size 3KB
SHA256 8a03bbe207d7b98900bd022c55f0f6f3bd9ca71c9c35fa45e1cc6e96c82cefc8
MD5 5080161281c52b22841fd53a02e78a63
SHA1 19ac78ad2651af050434908f7a3fb39da9b96f0a
SHA512 335440f10193a95203d902e7c9c408c91affd97b3f8352f727a6de62200fdbb650aa70a9c4ab4aa9c76a848cebd62ee7de553a67bd963bcbfd16fea3e05d192f
TLSH
T16961F86040819CEAEFF14571FBFD22FC3230575915871E66B6F2343CCA2BB131244511
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e86f0f3e865d86d0f114895134906669b72f33c989c5c4c39f5b8a48a87befa5
MD5 cfc7e87a77ca2c34a6a23a96a9e77945
SHA1 ba8f119d39da38cd5556e01e73ae14fc36e4cd31
SHA512 65226c24473c06308079e1fd5152e1e8a2b0ae29a7e0998c90bb8fb02d7f5cbf0efec65faffc80d6cda5c280fe896731ddec61454fbb97107b358844648553ab
TLSH
T1F6318BF3C3E4866E895156F0AA14AE2FCE2D0A05432C3C5689E4EF5B97E2865E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 09de4889b2b55fe5538ace0381dcbba98f7b2661e9d2504cf9089e8b57682489
MD5 33ce348e16fbf15463d6c33f64123209
SHA1 b378f2a6b64cec7a69ec1ed99498a77718d7c021
SHA512 ebb899347f68856015a6b070602fc748b260d488cb875e5bb6657639a677a75372ac15e7be1e843db2e3e592e3ffb901516356eef636ffa92a41d9236552e95c
SSDEEP 192:sxZMRSWyM//K1Ml8Ikc/fQsjWpV0LVUGkEdpdVHW6+WNGYNOvFPUIgEJ:sxZMIe+c/fQsjWv0LVTbPHbG8I
TLSH
T14052EA156A38A977CDCBD20DFA557F53D6F90933D2901E44AAFC8A1C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 cb73865312e2da9c9d1b224cfae97d0851b267c6f81f9dbbbc1406aee91efbbc
MD5 9db9647dcfb433bc28a8a0aae8c088d9
SHA1 7898e04d79e16babda426c7e283b17ed56b10160
SHA512 8635ac10e1e2209e4c70e4e2e254dd4d82076e19a71bd1d6f03b83148c9c6807d5c81cf30b1262594c75a32253d5cbbc22c212a03e988cf550097c50349435b4
SSDEEP 768:+bQv2KqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFFLllnWhjroxm79:+bQv2KqWve+l+u1jaSFLfWhQx89
TLSH
T144E20B3B680CCB7E4F845E9CEC2A6F876EE801CBA6984D5447FA494C03C66EB51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 e28c2e0ec7996a48a3b393b3a136d9c9ad77d2736759dcbdb1af335d13a25683
MD5 44baa3b260d5c0f1cf206763c3557875
SHA1 d51a317b53fb273ca8183c14eb7481eec100d3d1
SHA512 ec711762dd500b26520873901971f899089b9219b6191de176ddbf1866cfc68976560e5d530470d22bfde966b7104ba3a9ec1d8e328a452c04e9619fafeade34
SSDEEP 96:KkE4Kh6C85qKagCqUAK966MgKNWeut+KWIa:Sn/p/y/9b
TLSH
T131E16811313B8A512BBD3A8E9895B81F5AC170633058A42B7BF944A54F3FE20DDFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a84b2cf3b80221d768e0bc0d555d67ff06433aeead4b4c6887c835c93b20ad03
MD5 34a17990b401a7963a3b63b7dedd3913
SHA1 1fd7031b95095e3a1d67aa2d92095986b568e63a
SHA512 312502a8975f1ebb09b89dbc6e3e64c89c1d0aa72a56126758adb08e19fdfd961ebaafea8f8ee0df7a1137b8bb73c21ca672d2c9f4b1dbc0fdf139397cb65634
SSDEEP 192:ZONn6IT0JZQmiUymXOgibFy1m6Fuc7oU6:ZONn6B3LOgi4u4oU6
TLSH
T1F302F8356C6C6C7B8EB3AE49B18B3B275FA4116FDA853F84CAE41B1C00D728C1703822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 679ff32873449579846ffbae60d613321663aabff314d88dda99da03d9f750b9
MD5 d88965227fa2e2dce44e1ebb7cbefe55
SHA1 92b37ee10f48dde82b31c4fb351175c060cfc08c
SHA512 75ed8c7b7df89dd87f0f661aa612bca7731a36c8abc6b0ed40556dafbd54d238b52f56d4f9227007b8126979b3db84637a699477699ea220408d20fa46ed9202
SSDEEP 384:n/sN+pDFDCHgD4PMlHsA8ttt1oe+Ku84e0joCk:/cAjl78whKu84e00J
TLSH
T1468229B1D4B86CFB45A2D8C9A546FA132EB8117B86C85E0CD7F9763D318F9F81302422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 117d262489d154565649c11921f88d178b4eb7e5c68dbee847b8e86cdf646ba2
MD5 b4ba8e16fc3edfd78f5f0bb557357e4e
SHA1 5b39488e887bdad7d2727c428d414b6fe475ec03
SHA512 d4b94419ab4316f6d115f3ebb49f487e0511d1a6d2863d0e831e6dfefd766c9e47f40cfb18b01f8779631584855d6a1776f8d6a4380e5c3eb0918e412f9c87f4
SSDEEP 192:XONH6IT0QQmiUyxX1gibFy1mOM+eJjh1OqWU6:XONH6IW1gi4PMTiU6
TLSH
T10F12E871A87C7C6B8FB3AD65F08B3B239FA5516BDA852F84DAD41A1C05C768C1707832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

1daef639-03bc-43fc-8b37-91166590018b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5640_379763367\1daef639-03bc-43fc-8b37-91166590018b.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-1247-0x0000000009350000-0x0000000009351000-memory.dmp

Download

memory/944-1248-0x0000000009350000-0x0000000009351000-memory.dmp

Download

memory/944-1249-0x0000000009350000-0x0000000009351000-memory.dmp

Download

memory/944-1253-0x0000000009350000-0x0000000009351000-memory.dmp

Download

memory/944-1255-0x0000000009350000-0x0000000009351000-memory.dmp

Download

memory/944-1259-0x0000000009350000-0x0000000009351000-memory.dmp

Download

memory/944-1258-0x0000000009350000-0x0000000009351000-memory.dmp

Download

memory/944-1257-0x0000000009350000-0x0000000009351000-memory.dmp

Download

memory/944-1256-0x0000000009350000-0x0000000009351000-memory.dmp

Download

memory/944-1254-0x0000000009350000-0x0000000009351000-memory.dmp

Download

memory/2384-1153-0x0000000013FA0000-0x0000000013FDB000-memory.dmp

Download

memory/2384-1152-0x0000000013F70000-0x0000000013F97000-memory.dmp

Download