7eccaa002bdafed62e1171c054a7068a9128a6228f7fe9c9d08e0b1a980831cb

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/crocotile3d.exe
Size 6.5MB
Sample260415-twtetsfz71
SHA256 7eccaa002bdafed62e1171c054a7068a9128a6228f7fe9c9d08e0b1a980831cb
MD5 465203b858f36f08aa69726bccfc947f
SHA1 3c92d73ea31a0df7102341fb29831315ada08da7
SHA512 0fd34608038fac960d322cca62e7725ba0d330b55e5cf9c3970c9d965894d4c84667f1fa4fc0b4ae475055818d49ff2566262a1dfc0a68561ccd04013ab43e4f
SSDEEP 98304:6AlfLQyyshkCtCtNn5xftWw1fz/qPk+zSQNCqsOd3Nmt7NC+Bl:7fLQy7hXtCtV55tWmi7QZ7zl
TLSH
T18466E007A55450DAE59DE070CE459221EB723C6C47F632FF32B2AAE92D73AC13B75620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	crocotile3d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	crocotile3d.exe

Loads dropped DLL 3 IoCs

pid	Process
6036	crocotile3d.exe
6036	crocotile3d.exe
6036	crocotile3d.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nw4512_1679040972\cameraIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\disableVertexSelectionIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\drawIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\folders.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\icon-collapsed.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\js\mousetrap-pause.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\rotatePartLeftIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\roundingDownCustomIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\boneIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\crocIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\hslIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\lockedUVCrosshairIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\plusIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\render.html	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\resizeIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\rgbIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\finalize.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\js\SceneUtils.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\minusIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\rotatePartCWiseIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\sceneButtonIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\selectWFNRIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\stoppedIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\tilesetFinalize.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\clockIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\deselectUsingVertexColorIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\examples\jsm\libs\fflate.module.min.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\index.html	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\js\GLTFLoader.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\moveSelectionBackwardIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\panel.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\tilesList.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\capture.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\centerGizmoIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\redditIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\ruler.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\singleUVsIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\timeline.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\vertexColorIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\wrapRepeatIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\checkerOnIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\combineVertsIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\decalOffIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\examples\jsm\utils\BufferGeometryUtils.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\gridIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\paint.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\sticky.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\tilesetStructure.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\addActorIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\js\readase\package.json	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\only3dIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\pencilIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\transparentOffIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\undoIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\editIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\examples\jsm\lines\LineMaterial.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\input.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\js\AngleVertexNormals.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\lighting.js	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\selectAllObjectsIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\toggleActiveModeIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\actorIcon.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\cursor-subtract.png	crocotile3d.exe
File created	C:\Program Files\nw4512_1679040972\planeYIcon.png	crocotile3d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	crocotile3d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	crocotile3d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	crocotile3d.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	crocotile3d.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207442491879921"	crocotile3d.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5312	crocotile3d.exe
5312	crocotile3d.exe
5312	crocotile3d.exe
5312	crocotile3d.exe
4512	crocotile3d.exe
4512	crocotile3d.exe
5312	crocotile3d.exe
5312	crocotile3d.exe
5312	crocotile3d.exe
5312	crocotile3d.exe
5884	crocotile3d.exe
5884	crocotile3d.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe
Token: SeShutdownPrivilege	4512	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4512	crocotile3d.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4512	crocotile3d.exe
4512	crocotile3d.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 5312	4512	crocotile3d.exe	84
PID 5312 wrote to memory of 5480	5312	crocotile3d.exe	85
PID 4512 wrote to memory of 2748	4512	crocotile3d.exe	86
PID 4512 wrote to memory of 1464	4512	crocotile3d.exe	87
PID 4512 wrote to memory of 688	4512	crocotile3d.exe	88
PID 4512 wrote to memory of 6036	4512	crocotile3d.exe	89
PID 4512 wrote to memory of 4668	4512	crocotile3d.exe	91
PID 4512 wrote to memory of 1736	4512	crocotile3d.exe	96
PID 4512 wrote to memory of 2212	4512	crocotile3d.exe	102
PID 4512 wrote to memory of 1980	4512	crocotile3d.exe	103
PID 4512 wrote to memory of 5884	4512	crocotile3d.exe	104

C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
"C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --annotation=plat=Win64 "--annotation=prod=Crocotile 3D" --annotation=ver=1.0.0 --initial-client-data=0x290,0x294,0x298,0x28c,0x29c,0x7ffd8e51fa70,0x7ffd8e51fa80,0x7ffd8e51fa90
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
    C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad" --annotation=plat=Win64 "--annotation=prod=Crocotile 3D" --annotation=ver=1.0.0 --initial-client-data=0x1b0,0x1b4,0x1b8,0x11c,0x1bc,0x1401f8290,0x1401f82a0,0x1401f82b0
    3⤵
    PID:5480
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=gpu-process --no-sandbox --disable-logging --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw4512_1679040972" --disable-breakpad --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAcAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --disable-logging --mojo-platform-channel-handle=1972 --field-trial-handle=1992,i,5114826640963040705,8815295839680828724,262144 /prefetch:2
  2⤵
  PID:2748
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw4512_1679040972" --start-stack-profiler --disable-logging --mojo-platform-channel-handle=2132 --field-trial-handle=1992,i,5114826640963040705,8815295839680828724,262144 /prefetch:8
  2⤵
  PID:1464
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw4512_1679040972" --disable-logging --mojo-platform-channel-handle=2328 --field-trial-handle=1992,i,5114826640963040705,8815295839680828724,262144 /prefetch:8
  2⤵
  PID:688
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw4512_1679040972" --nwjs --extension-process --disable-nacl --first-renderer-process --no-sandbox --disable-logging --file-url-path-alias="/gen=C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\gen" --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1992,i,5114826640963040705,8815295839680828724,262144 /prefetch:1
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  PID:6036
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw4512_1679040972" --disable-logging --mojo-platform-channel-handle=3900 --field-trial-handle=1992,i,5114826640963040705,8815295839680828724,262144 /prefetch:8
  2⤵
  PID:4668
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw4512_1679040972" --disable-logging --mojo-platform-channel-handle=4056 --field-trial-handle=1992,i,5114826640963040705,8815295839680828724,262144 /prefetch:8
  2⤵
  PID:1736
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw4512_1679040972" --disable-logging --mojo-platform-channel-handle=4232 --field-trial-handle=1992,i,5114826640963040705,8815295839680828724,262144 /prefetch:8
  2⤵
  PID:2212
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw4512_1679040972" --disable-logging --mojo-platform-channel-handle=408 --field-trial-handle=1992,i,5114826640963040705,8815295839680828724,262144 /prefetch:8
  2⤵
  PID:1980
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --disable-logging --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Program Files\nw4512_1679040972" --disable-breakpad --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAcAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --disable-logging --mojo-platform-channel-handle=408 --field-trial-handle=1992,i,5114826640963040705,8815295839680828724,262144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

box.bin

Path C:\Program Files\nw4512_1679040972\box.bin
Size 264KB
SHA256 8b6cf6ffacf7a3d69322189a38ac3698c010b4a736f130ed8d3c04a340875ea6
MD5 bb587d01f604d4af895e5369a99983b9
SHA1 6eed5c80be6b516e670bd767c290f7ca10087302
SHA512 8878733ab91f9de045939b7ecbdd9cca89a114a81df9edd66c789c7ded9de2938e6f9b5e155a4a648bf4867d12c6ed1ade4b441dbd5c52b27d5c3112a43e78ec
SSDEEP 3072:6BAjwhiVBVnCQbdFFCukTLQio6BczfoExpgJPusYXPvxB2Krnn9RZ+:SG2ixCwsuk3otfoEUssYfveKjn9R8
TLSH
T11B44BF82A3677F7FDC5AC07769A6C0B32B21DD4A4893E7875A14937233C32D59D4EA80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

three.module.js

Path C:\Program Files\nw4512_1679040972\build\three.module.js
Size 1.1MB
SHA256 69b859e1e556b803fb2a77eb59a763bf430dfd01dbfa5a89cb66d6804021eaf7
MD5 64c116b8be48d1b5c13ab9c93b717c45
SHA1 4c7a0aa7a4b4d81e6558eb2585ab16a110a0bc8b
SHA512 8c88624ca22721d9807a1f7a1d0d0f85159aa3bd039b0dc84785dd89ab7f3c32b00398592beca049b7cbe306b3f87c31d5b8310d043552830b1f53e708cbd882
SSDEEP 24576:1TjWY8dy6kdazW/XzFv1kBL/6LAg+IDQj2FUUhNo6p6QdGovl0Dv:Wdy6kdazW/XzFv1kBL/6LAg+IDQoUUkv
TLSH
T15145D7852BBD122E8B667199886C05C5663C9473B502C4FFBC0C59EA68D143CC7BEF7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3dicon.png

Path C:\Program Files\nw4512_1679040972\c3dicon.png
Size 12KB
SHA256 180337998a2c6a7d141aee116e17d908d8a9c8595fbc8ad9f4e887f9a7edd479
MD5 2bf570d04b39995c2b16e9fd10c4f1b3
SHA1 967c2997f97a04299df469c975716d761889b1d0
SHA512 c4e7e3cda9455646492eed1f7dd2d989076e958d630f038e618834694a69e1d083ba371e23e563229f24abb525a7ce32c3aca31bec4f2ac0c2bdf1f11d0ecccd
SSDEEP 192:NSDS0tKg9E05TiqLbFHlbNDUYduJxd8xAn+yJlo8aAKWHIWltzQodWQjoT0Bx8QD:MJXE05+4pHng3a5yQLAZH9UoJET035/f
TLSH
T1CB42BFC1B5B8FC8C29BEBD13C6EC418F7732643864953970A49469BB1D92B9BDC94431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

greenworks.js

Path C:\Program Files\nw4512_1679040972\greenworks.js
Size 7KB
SHA256 0e614f1526c4c3f2effb6dd6d8927d5c46c983072962316655ae874e51bc2888
MD5 30b906831a14a37b6566dc95311e5117
SHA1 e45a4c613880b748316fa87cf427b81d8072071a
SHA512 061a2a01589eaa7ea646e9d4bed7a89844fa7c6aa58abb195ca6886173d7ca9469fae1c28fdf72f18adc242f649c34a8dbb5e2439b9174de3008c77f709996c3
SSDEEP 192:70jXU22YSYUMewiaVwdr/AEt860/a+9UcGTf8jYtOpjXxl:7uXU22YSYUMewiaVwdr4k86Ya+9ZWntK
TLSH
T192F122324EA3A0D648F2BAABCA4B170575BBC093071D596A348DD38C5F44434E7EFA4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

greenworks-win64.node

Path C:\Program Files\nw4512_1679040972\lib\greenworks-win64.node
Size 1.3MB
SHA256 2e9e1385f88c77f2bb596951e3f548019f012027a381716b092c98cf83440458
MD5 f3dbfc232ff83089b99a268a1c7cebf1
SHA1 94cada9ffc70ec9a2a672c5b5e55aa99a5e3686e
SHA512 e969503186909ec1a0040242282cffb061f34c110688f189c40c09b8fc27d719ec588f3bd5c9b545e23775606b2c430c99b37378ec6cd555a355333fbd27f27c
SSDEEP 24576:atRIzeXIPDpw+7RUWnTOvSgwtHTCzkqrTC:atROeXIbRWvS1HTLWC
TLSH
T108558D03B39501A9D4B7D239CA479A16EA7278454731BBCB03E49BA63F237F8563E341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sdkencryptedappticket64.dll

Path C:\Program Files\nw4512_1679040972\lib\sdkencryptedappticket64.dll
Size 778KB
SHA256 8ca8efbbd8d51acfede84d7c97462c76f555233a33138ddf95537cfb3019c27b
MD5 b5d48fc98be086eda0defefc9259bb78
SHA1 bd3f5a18d46a8a43c4eac9fa8a760c1067dba045
SHA512 1cfec1bd1c234e6addb1924ffe4818b5e2f3de10d0371be20c2c03ab9c93082636607b7aa32532894e3e6127779eb0dec6132d0aa16854181477f043956f57dc
SSDEEP 24576:TcbnnHLRDKPsf2k5Q+exLKUxPCrhFUMJY:YbrROSjPmWUxPCrhFBJY
TLSH
T150055B19BEA481B5C077C17E965B8287FBF274051B359ADF52A1432F6F37BE01A3A210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_api64.dll

Path C:\Program Files\nw4512_1679040972\lib\steam_api64.dll
Size 258KB
SHA256 67b094d16ab0f1216ed94fc95db1281b75c2ebf1e71e583bb0545a0fb73d7765
MD5 3e86835c23c2865ce4bae0890816aa42
SHA1 079f0750b2feb90eb447858fa51dbabd56240404
SHA512 86d446e2617f146698274326a93e78c201e8ddc4e998faa5b6f42a992fd1082fdc4d526b2a287cd61b6d1782727a6e3d26a80990ee935b48b638034840cb6015
SSDEEP 6144:T3Z4rQ8sCJ935KFs2z4iUqy7BCcM3tJRwG:bYhPpKFsFYy7BCVtp
TLSH
T11C44383A72750CF5D1B6C139C9961E0BF671304B23219DEF276053368E636E22A3BA95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Program Files\nw4512_1679040972\package.json
Size 467B
SHA256 5a5a595c33eef8f0f62ab4af9be35c45ab52cc85fbc9d35e63877168d6aa92bd
MD5 744634bacde76470f778a541c646b0d7
SHA1 73b92a5054c131c4386b2c02ca551bdaa3d406a5
SHA512 5fc65d0154d1b539bc4f2f3df739230cf59cc2ecfa4bf0439c418abf00f01d6f2b2d3bb0d3629ab9d3fdc0e647ce89be7511babb040d3cc9e7d2090eb5e277b9
TLSH
T115F05C12C1A1BD3B467C9D83B9714BC6F34A1A2F11299C1E7170352C57FB97A8181764
MD5 SHA1 SHA512 TLSH

Submit Download

workerThread.js

Path C:\Program Files\nw4512_1679040972\workerThread.js
Size 16KB
SHA256 4171b36c8f939fe4d09a510ef85cdbf8fbea5b034d3c2c9eff46c115efab4389
MD5 d00bd459d4686569d53f453d19766fa6
SHA1 95e571226bfd2edd98a9fcb2ab455f2eb2f5de2e
SHA512 0ac4be6aa0c7bc85e5c8ace06183e8d6670135599cd8d3571074db5aa736aff4b186d9f0172991ccd3cb991c16db6b1d7993586ca3e26d686849d8a7931f486b
SSDEEP 96:xZRqAgEA2SYKriJnew56PJ1SPza8RuNe5sFeCwkk3eNoo5WLa7HyCzQ0U+duGZuK:xZh8OG4R8ksKVaWItc0nCd5bLHYRX
TLSH
T1827200C8734ECC8A86DB1299143C9595EF7CE0338121079FB62F6C527599CB483EBB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad\metadata
Size 114B
SHA256 fe7ff5c3c1e06943de0bdb1f9c87f20dbd95d8dc2bab598fad28735089b8ef31
MD5 4517086efc138048ae6b8bda86943c10
SHA1 f6c460949040a08d1ef5b2f8a6b317ed22258750
SHA512 f147f057e9e7823dec954b10ff9658933c8abc6ac4f317ea76d1015bf1c2cc4f9dc3b7305ff3c1d6f8f3205f47478a32598b8c0b5669cfbe3bdbda2b128e3ce6
TLSH
T103B0127276010823E295C1F415C5C3C021A0F33009312BDB011291E80D009928A50000
MD5 SHA1 SHA512 TLSH

Submit Download

8440347f-eaa0-41e0-a7f9-12bee528319e.dmp

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad\reports\8440347f-eaa0-41e0-a7f9-12bee528319e.dmp
Size 33.9MB
SHA256 e8fde8ca1f995c24064494b1ab3b51ec101fe2ecddcbe254164e8d0ca4cb5fb3
MD5 1cd8cd0fbf5c9a5ecb3b96fa57a367fb
SHA1 e76e06370d9be44418692b605dbbc768beafe328
SHA512 d57d50424dab2a3dc249679b32e89886ddbd8bbfa5716559fa07f171489b4555395a5f72c630db8b5cb4ebd92ef31fd253d81cb5fc217e0e24b328f752db7cc4
SSDEEP 12288:8iBdYc4U35hiXQzq9zfItmwnHWFuQwLEJ1dqmd:84+kYX2q9rID361dqmd
TLSH
T157771826B75A469BF81AE27488DB5721FBF2F8054B3207CB535017AA2E733D81F35A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b58b7fbd-3d3b-4933-8c96-5a24a915c3d4.dmp

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad\reports\b58b7fbd-3d3b-4933-8c96-5a24a915c3d4.dmp
Size 1.9MB
SHA256 0ce2af14d398526394becd53fc659511376f7d872023dfb1ab49b639f3e8cb23
MD5 3637670eff82b625e823fea986e138eb
SHA1 22922eec8ec188f3a2be295323336b8f6701652d
SHA512 dfa5fa05d98008577a537936429068772fc8c4662821d726e4fad45cb3089f7dcca4b2a898c3ff2cba626020302d448beac7e747fd8385831db0a3fef6e9f6d5
SSDEEP 12288:Jj5dHy0KjgpfFjILkK3A+p4b5RTyYS+/GmiyoPhL4GDSEr:JmTkrRTyYJ/GJhLHDSEr
TLSH
T19D95282FBBA689A2F139827495D65B24EFF3F854075247CB03606A691EB37D04F34B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad\settings.dat
Size 40B
SHA256 7026cfd7b3d4814340847fcb42ae91ae4dd455c9aa333759a1930fdb64ce2613
MD5 8789ada3ccc3bf2a3bce17af6bc0bc5f
SHA1 aefda1ecf49ec95d8f3581d92cb6e4af779521ce
SHA512 fafab98d8e12da9168aec1b413ec5cd753d360071a90e358f3af8ed8367d5c4bd8f1045b9d7e7ad834fa4c0436550c391b8dca7ac79dc72ee962f326c1983ba1
MD5 SHA1 SHA512

Submit Download

64d92227-f930-479a-8440-3cc3d3117af2.tmp

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\64d92227-f930-479a-8440-3cc3d3117af2.tmp
Size 148KB
SHA256 d98e226bea7a9c56bfdfab3c484a8e6a0fb173519c43216d3a1115415b166d20
MD5 728fe78292f104659fea5fc90570cc75
SHA1 11b623f76f31ec773b79cdb74869acb08c4052cb
SHA512 91e81b91b29d613fdde24b010b1724be74f3bae1d2fb4faa2c015178248ed6a0405e2b222f4a557a6b895663c159f0bf0dc6d64d21259299e36f53d95d7067aa
SSDEEP 12:YcFpCkgfvMbb555555555555555555555555555555555555555555555555555O:YepCb8bBvK
TLSH
T1FCE3AB8237F0C86CC264123CDD1AC3FB1E5DFD525665D20331A5BE3B3D57528591A785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Network\Network Persistent State
Size 405B
SHA256 123c990f2020c9252575b0c7ef76f8017a2d2a46fa624f534013196e93732b65
MD5 579a64627024f8552275563084026894
SHA1 8d50738888808998b5fa864a99e65cc66fd22a7b
SHA512 e687fc293a465d5c0f95ee4e70d9a2e7dadd00995cc90f51494784a8d53cb74eed727916fb02136034c666aa9dc925989102965eb92cdd8a30281441975ae44a
TLSH
T199E0F1A2C3E495BD4B5542F427647A07CB3D080543183D6AC5F46F0A83D106485148CF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5953c3.TMP

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Network\Network Persistent State~RFe5953c3.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 5407ff6bc7df19b10a40b0f8cbd2e989e96eaf8e1fc244b7dd40bebc3db33ef3
MD5 e959b4ae03fadd08e9f04ec7fe70ce94
SHA1 197c6af3b68a18311a042198beefeabedeae2ed3
SHA512 cab40504a5be8998daec7081ff66e8fd6932c911bcc264d30f6bef71ef606e36fa250fccf86b81346e98654303c23ac35cb6b8aa7e055067697d9311d73cc4a3
TLSH
T13CC012A540BEA47620E80D255984AD455E3EA93441C1D8FC967B456951905666303193
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 59b2abf0309888607eed5b5a7112cfc247e0d3bf4db1d7caabb3771992f03652
MD5 c920341b62b3571e8366d38672410057
SHA1 d2af129ec1068046215434c427166b1da4a54c0d
SHA512 a46a1854c0e9d2229ea6ddfd16ef02ac94f8e36976c66457903ef069aa8c315812e5f3c251af88e44e24b1087e7dbe6fe53ef3e617ce0e6b9279e2bafb248969
TLSH
T1C4C022A1006AF47720A805361D80EDC0DF3AA438008155E88272023852644EA6203452
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5892d5.TMP

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Network\TransportSecurity~RFe5892d5.TMP
Size 188B
SHA256 e1701ee76c309e2910643f019857ef4b1dc5437b244792ae5c878ee385f6e94f
MD5 c79c34fec91dfbe945d09ad9d155ed12
SHA1 186c1997dea771ce37231b7996518daf79e954a7
SHA512 ccf1c80ae56c4138596b973d34b6d15f2e03cc81d444bbb5e2c3d00cd0ac31a154d1483a60cc2dc77953b1a9ccac7089be1b9a63c89e4d767aa66f9cd8992972
TLSH
T153C012B254AAF6B620A805351E84ED45AF3AF135058154E8976A456861601A67603056
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Preferences
Size 4KB
SHA256 a30f7e692c59de29115a53c8f2169ef9d55d2595cce01c4022fc43b53a044690
MD5 d7a8e8316f53ce0803ab086b5730b4ea
SHA1 e34917317cf838d7729455186204941a4b313c6d
SHA512 71f431a1ec1406e6813ab6dae16b7bbda74186c5de0a5e741d4b3013a822a7ce39e48294a631800bac07060c2faf4856683f82c8a7690b0825d1a183c4f82b59
SSDEEP 96:rGn9UiWJAjfs5Hh6NL7/x+6MhmueqCwA42M+OwQ:rGnmPJx5CLV+FpK4PEQ
TLSH
T15491B65B6D68EAB78CC7C61CBE197EA3D6F614301AC01D449BFC8A1C089EBDD2207919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Preferences
Size 4KB
SHA256 b5d37aba0cd360addded3e1bf0a9ed8a65c64ca287c321c699c18784c3d29ced
MD5 fc82ef5b2444bd56b9100fe4f866ad98
SHA1 ba9a03ddd3e1b7919f45b6555f9be5f04fd05b46
SHA512 21f63baf39ecbe6209407d7047b563edea1592dfc04c54172a767ebcce57b95f48f9a9dff5be02d491c6bf796168f514a4e074c393897f334edbf2f97a280753
SSDEEP 96:rGn9UiWJAjfs5Hh6NL7/x+6MhmueqCkA42M+OwQ:rGnmPJx5CLV+FpK4PEQ
TLSH
T1AE91D71E7D68EAB78CC6C61C7F197E93D6F214302AC11C4497FC8A1C085EBDD2207919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58c927.TMP

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Preferences~RFe58c927.TMP
Size 3KB
SHA256 8ba48e4e00aa535255eddff1bdb4cd350cef5304db2b18123185718c41dd7e1c
MD5 e465f8812aeca9fb2150d69eeca9ecba
SHA1 a910b71f4a22f7e986d10f46912de42e11e074e6
SHA512 04a3fa88b1c3ba356b879f6fef90922628254a07c55a6b949895937fc4f9c11d05e600917970dd1e8bfe0dd0c9f1bfed6edfc747a2137a2205a31b5baab041a4
TLSH
T1D081DA5E6D68EAB74CC6D61C7E197D93D6F714302AC11C449BFC8A1C085EEDD220791A
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Local State
Size 2KB
SHA256 f9983f32fd0a63cec3153ebae7cb5a6404d26b054c685df1d4ce68c01d603ffa
MD5 e55bc05b757739e30aa604b2ec0af7fc
SHA1 406d9387f01d87099183d2669c975a6fe5bb0dc3
SHA512 a603fd2d58baf6f48e5f2e0622a9c21fb9dff3742aa8270a6d2e9ca0ef368a900cd421bc42e3ee2200e65d74dd4b9037c10b41cc8c5044ad0a45335945d02a4c
TLSH
T13351947668BCEC33ABB3E641B4422A039FB97457A5606F80CBEC5B1C51EB6D41387017
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe585399.TMP

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Local State~RFe585399.TMP
Size 866B
SHA256 d8a5772f10f5a71830905adcfdd18bd979240145112064287d6c35611bbfc3b5
MD5 1043a65ea0be44f9792f466cbae28ea9
SHA1 11346f97f82b5d738daf12851cab6651f367e426
SHA512 f6ef6b83e69ff7c3a3ee2895fe05d579622ccfd7ee124cc8d32e95d46204014ecfb86aaaa0fb81b18720d562a645a0925c692d2e6141b9090f005992365277e4
TLSH
T14B1152339C3C9713FD935565F54A6E23AD60B03711520A829BCD463C20FB08C095B432
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1464-847-0x0000000009EC0000-0x0000000009EC8000-memory.dmp

Download

memory/4512-833-0x0000000014110000-0x000000001414B000-memory.dmp

Download

memory/4512-831-0x0000000000C50000-0x0000000000C58000-memory.dmp

Download

memory/4512-832-0x00000000140E0000-0x0000000014107000-memory.dmp

Download

memory/5312-846-0x00000000044F0000-0x000000000459C000-memory.dmp

Download

memory/5312-969-0x00000000044F0000-0x000000000459C000-memory.dmp

Download

memory/5884-953-0x0000000008B50000-0x0000000008B51000-memory.dmp

Download

memory/5884-946-0x0000000008B50000-0x0000000008B51000-memory.dmp

Download

memory/5884-947-0x0000000008B50000-0x0000000008B51000-memory.dmp

Download

memory/5884-952-0x0000000008B50000-0x0000000008B51000-memory.dmp

Download

memory/5884-958-0x0000000008B50000-0x0000000008B51000-memory.dmp

Download

memory/5884-957-0x0000000008B50000-0x0000000008B51000-memory.dmp

Download

memory/5884-956-0x0000000008B50000-0x0000000008B51000-memory.dmp

Download

memory/5884-955-0x0000000008B50000-0x0000000008B51000-memory.dmp

Download

memory/5884-954-0x0000000008B50000-0x0000000008B51000-memory.dmp

Download

memory/5884-948-0x0000000008B50000-0x0000000008B51000-memory.dmp

Download