7eccaa002bdafed62e1171c054a7068a9128a6228f7fe9c9d08e0b1a980831cb

Analysis

max time kernel
150s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/crocotile3d.exe
Size 6.5MB
Sample260415-twtetsfz71
SHA256 7eccaa002bdafed62e1171c054a7068a9128a6228f7fe9c9d08e0b1a980831cb
MD5 465203b858f36f08aa69726bccfc947f
SHA1 3c92d73ea31a0df7102341fb29831315ada08da7
SHA512 0fd34608038fac960d322cca62e7725ba0d330b55e5cf9c3970c9d965894d4c84667f1fa4fc0b4ae475055818d49ff2566262a1dfc0a68561ccd04013ab43e4f
SSDEEP 98304:6AlfLQyyshkCtCtNn5xftWw1fz/qPk+zSQNCqsOd3Nmt7NC+Bl:7fLQy7hXtCtV55tWmi7QZ7zl
TLSH
T18466E007A55450DAE59DE070CE459221EB723C6C47F632FF32B2AAE92D73AC13B75620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4716	crocotile3d.exe
4716	crocotile3d.exe
4716	crocotile3d.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\nw4144_1741245535\gridLinesOnIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\moveCrosshairRightIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\moveCrosshairUpIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\panel.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\point.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\cameraBasedOffIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\discordIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\nestedLockedIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\paintUVsOffIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\paletteIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\panelRightIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\saveAsIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\selectAllObjectsIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\adjustVertexUVUpIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\deselectVertexFaceIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\examples\jsm\loaders\ColladaLoader.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\examples\jsm\loaders\TGALoader.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\examples\jsm\postprocessing\ShaderPass.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\iFrameStyle.css	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\lassoIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\primitiveBrush.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\cameraIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\pinnedIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\redoIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\removeObjectIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\rotateUpIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\screenshotIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\tileSet.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\uvAnimation.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\actorIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\adjustVertexUVLeftIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\core.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\examples\jsm\postprocessing\EffectComposer.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\js\MTLLoader.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\roundingUpIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\vertexColorIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\wrapRepeatIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\box.bin	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\cursor-copy.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\examples\jsm\exporters\GLTFExporter.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\gizmo.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\horizontalSymmetryOnIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\tileIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\clockIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\effects.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\examples\jsm\loaders\MTLLoader.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\js\GLTFLoader.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\linkOnIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\selectWFNRIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\sticky.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\stopIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\examples\jsm\exporters\ColladaExporter.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\js\readase\package.json	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\structure.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\tilesPalette.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\undockIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\unlockedUVCrosshairIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\adjustVertexUVDownIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\boneIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\moveSelectionRightIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\nestWorldIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\scene.js	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\transparentOffIcon.png	crocotile3d.exe
File created	C:\Windows\SystemTemp\nw4144_1741245535\addObjectIcon.png	crocotile3d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	crocotile3d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	crocotile3d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	crocotile3d.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	crocotile3d.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207442499939045"	crocotile3d.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4156	crocotile3d.exe
4156	crocotile3d.exe
4156	crocotile3d.exe
4156	crocotile3d.exe
4144	crocotile3d.exe
4144	crocotile3d.exe
4156	crocotile3d.exe
4156	crocotile3d.exe
4156	crocotile3d.exe
4156	crocotile3d.exe
2816	crocotile3d.exe
2816	crocotile3d.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe
Token: SeShutdownPrivilege	4144	crocotile3d.exe
Token: SeCreatePagefilePrivilege	4144	crocotile3d.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4144	crocotile3d.exe
4144	crocotile3d.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 4156	4144	crocotile3d.exe	79
PID 4156 wrote to memory of 2920	4156	crocotile3d.exe	80
PID 4144 wrote to memory of 3352	4144	crocotile3d.exe	81
PID 4144 wrote to memory of 4616	4144	crocotile3d.exe	82
PID 4144 wrote to memory of 4372	4144	crocotile3d.exe	83
PID 4144 wrote to memory of 4716	4144	crocotile3d.exe	84
PID 4144 wrote to memory of 4708	4144	crocotile3d.exe	86
PID 4144 wrote to memory of 4808	4144	crocotile3d.exe	87
PID 4144 wrote to memory of 2024	4144	crocotile3d.exe	89
PID 4144 wrote to memory of 656	4144	crocotile3d.exe	90
PID 4144 wrote to memory of 2816	4144	crocotile3d.exe	91

C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
"C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --annotation=plat=Win64 "--annotation=prod=Crocotile 3D" --annotation=ver=1.0.0 --initial-client-data=0x234,0x254,0x258,0x238,0x25c,0x7ffe7b13fa70,0x7ffe7b13fa80,0x7ffe7b13fa90
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
    C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad" --annotation=plat=Win64 "--annotation=prod=Crocotile 3D" --annotation=ver=1.0.0 --initial-client-data=0x1bc,0x1c0,0x1c4,0x130,0x1c8,0x1401f8290,0x1401f82a0,0x1401f82b0
    3⤵
    PID:2920
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=gpu-process --no-sandbox --disable-logging --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Windows\SystemTemp\nw4144_1741245535" --disable-breakpad --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAcAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --disable-logging --mojo-platform-channel-handle=1868 --field-trial-handle=1864,i,8967151855769827186,17266314918188904089,262144 /prefetch:2
  2⤵
  PID:3352
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Windows\SystemTemp\nw4144_1741245535" --start-stack-profiler --disable-logging --mojo-platform-channel-handle=2056 --field-trial-handle=1864,i,8967151855769827186,17266314918188904089,262144 /prefetch:8
  2⤵
  PID:4616
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Windows\SystemTemp\nw4144_1741245535" --disable-logging --mojo-platform-channel-handle=2332 --field-trial-handle=1864,i,8967151855769827186,17266314918188904089,262144 /prefetch:8
  2⤵
  PID:4372
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Windows\SystemTemp\nw4144_1741245535" --nwjs --extension-process --disable-nacl --first-renderer-process --no-sandbox --disable-logging --file-url-path-alias="/gen=C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\gen" --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1864,i,8967151855769827186,17266314918188904089,262144 /prefetch:1
  2⤵
  - Loads dropped DLL
  PID:4716
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Windows\SystemTemp\nw4144_1741245535" --disable-logging --mojo-platform-channel-handle=4028 --field-trial-handle=1864,i,8967151855769827186,17266314918188904089,262144 /prefetch:8
  2⤵
  PID:4708
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Windows\SystemTemp\nw4144_1741245535" --disable-logging --mojo-platform-channel-handle=4136 --field-trial-handle=1864,i,8967151855769827186,17266314918188904089,262144 /prefetch:8
  2⤵
  PID:4808
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Windows\SystemTemp\nw4144_1741245535" --disable-logging --mojo-platform-channel-handle=3816 --field-trial-handle=1864,i,8967151855769827186,17266314918188904089,262144 /prefetch:8
  2⤵
  PID:2024
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Windows\SystemTemp\nw4144_1741245535" --disable-logging --mojo-platform-channel-handle=4140 --field-trial-handle=1864,i,8967151855769827186,17266314918188904089,262144 /prefetch:8
  2⤵
  PID:656
- C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe
  "C:\Users\Admin\AppData\Local\Temp\Crocotile.3D.v2.4.5\Crocotile.3D.v2.4.5\crocotile3d.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-sandbox --disable-logging --user-data-dir="C:\Users\Admin\AppData\Local\Crocotile 3D\User Data" --nwapp-path="C:\Windows\SystemTemp\nw4144_1741245535" --disable-breakpad --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAcAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --disable-logging --mojo-platform-channel-handle=3960 --field-trial-handle=1864,i,8967151855769827186,17266314918188904089,262144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

metadata

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad\metadata
Size 114B
SHA256 727ef87af498ecf7a1953aa0479c4667991f8152f7735715ef17c1ef25a62f0f
MD5 8474e041dd935d814d36b2066d801742
SHA1 78f8f722a1bb69a94c8f4c0188ba6e5ac20c0521
SHA512 a8e0c756c8d16628c688f92c269e82b45f9566cc68dfe2a159d59fe78055aa629d524a90e69572fe92efbc11f4a7004deddd060b09193266515fbd07599c3a45
TLSH
T183B012A53B326433CD9045780CC483702504E392470B4B05C15311467C001D45101650
MD5 SHA1 SHA512 TLSH

Submit Download

061cdba0-44e3-4cd6-94a8-1ab8769c9f16.dmp

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad\reports\061cdba0-44e3-4cd6-94a8-1ab8769c9f16.dmp
Size 33.9MB
SHA256 b7f449870e872521a2a67b007032dae31d5cd0e0e1ddb5d10b499fd8ce5996c3
MD5 51e7c20dac7d7339c37c8eec88bba9ba
SHA1 d87283e05bf7414dcff020bc71ee963ff6745a83
SHA512 61bd847924a18579b10bd5dce700ca7d0687d8172c0f45cd2e361e58e216b7e432f10138e58dca6af038df64627c1f27dd551457dde6583533ca57c669e8fd3e
SSDEEP 24576:3XLt5YccII2nuON5cWXehQHIgAEXOV1G8:LtpXpzeV1b
TLSH
T1AF77D427B7828596F815C2319FA79B21E6F2F8464F3343D72A5012292EBBBD01F35752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da3ef785-ab0b-4d12-bf20-725d13b9be12.dmp

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad\reports\da3ef785-ab0b-4d12-bf20-725d13b9be12.dmp
Size 1.9MB
SHA256 efba13373adc55f9101aae1871e3dce91a0800671b750c19f71ea7e3b25de1d9
MD5 226428c2cf34b8f5df5e1717f97fe513
SHA1 408f55b270a2d542dcb04010cc366eedbb9c5209
SHA512 b42905539360ab8a1957741ea626107ea362c8799393bc56d3c5a29bacea4ce92ffc93e952cca1b6a4900664b234546bcf6a133751c6bd0d5322738b99876809
SSDEEP 12288:t8uRtq5ZiifIm3M1mx02H8GTu47op25sLS+/G0dfHhY9XUnW+vypD6GvTp:t9tAx020p25sLJ/G0dvhY9XUnW+vyp2c
TLSH
T14395D72AB7A684B2F179827087A66758EBF2F8554B5253CB036052391D773C0DF36B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Crashpad\settings.dat
Size 40B
SHA256 7c17fea533efdb291eb699642da74b1260c8f8b884076182f9cdca8fc6f804be
MD5 704e62f81f0d038d2a08599cff29f1ec
SHA1 2c263bb12535006fba06b30686d29e68f3fc67e9
SHA512 bce0ddcea3d13b8f02200c2501f905f4c5659fd2ec081569c01d270d031d495c435f789ec331e2b18038263e6771932b21f3f3db1c4122c11ca138a5b88cd54a
MD5 SHA1 SHA512

Submit Download

57821460-dda3-4226-ad00-c1d14423d3bd.tmp

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\57821460-dda3-4226-ad00-c1d14423d3bd.tmp
Size 148KB
SHA256 d98e226bea7a9c56bfdfab3c484a8e6a0fb173519c43216d3a1115415b166d20
MD5 728fe78292f104659fea5fc90570cc75
SHA1 11b623f76f31ec773b79cdb74869acb08c4052cb
SHA512 91e81b91b29d613fdde24b010b1724be74f3bae1d2fb4faa2c015178248ed6a0405e2b222f4a557a6b895663c159f0bf0dc6d64d21259299e36f53d95d7067aa
SSDEEP 12:YcFpCkgfvMbb555555555555555555555555555555555555555555555555555O:YepCb8bBvK
TLSH
T1FCE3AB8237F0C86CC264123CDD1AC3FB1E5DFD525665D20331A5BE3B3D57528591A785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Network\Network Persistent State
Size 405B
SHA256 bd21ebdca0b5fa835740d1977154ea9f8278519a1c5a9e8bfb7859fc9c6d7b14
MD5 7d1e1a0ea8c7eb3c0cc35145cd95ae24
SHA1 9b1f21b978d430804c4d521aada9371fbcd99c45
SHA512 9dece188239b0efea29f1b356ac97b84d5bce674445c8b034217df81262f1c0edd71515127a5087229f6ace821ef69b03b39088ca13fa493f852e038799ba2b7
TLSH
T16FE0F1A2C3E455BD4B5542F42B647A03CB3E080543183D6AC5F46F4A83D1864D6149CF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe596160.TMP

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Network\Network Persistent State~RFe596160.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 41df29f4b3f41632803e27585d271f48e23b71c2bf2e0aa983fa58946afcab9c
MD5 08fc43bee7c529ba417f3801eb684b86
SHA1 673866d015f5350f1c50bd2c263036ff796f5764
SHA512 f4cde7161142c22a3963b7be426834730514c1263fb715c9c520b4d04054cc8ab13da03f77e6962eb5c40cbd0d43fb223884921baef2d3f1530696a507ee58d2
TLSH
T180C022A280BDAAB220B806252AC0AD907F7AB030008090E99362092C60502A66A03082
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 9422448b3d82cb51a997d8629dd863fdaa98fb74d179f8f4ce2fa94bf2ad8ea9
MD5 40822347f0a02dfe6a52b3ead1e3338d
SHA1 8110c507c12f4ef7033e86a2b7e5ed2e97c97d31
SHA512 b428a488c651cee6f6958b62b5d9ae207cb3c4115752f4d267055ffe3225b5fe4c895ddab76ee608531f1ff2cfab8e5ee747893efedd8268d1301c2c9d91938b
TLSH
T1C3C0C0A140FDE47270BC05211C84FE405F3AF03001C490F883EB01BC50944B75203613
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe58a6ca.TMP

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Network\TransportSecurity~RFe58a6ca.TMP
Size 188B
SHA256 a66bcdd7b1065341efa2741fa24c89a8863c6e751d7ca3985817668e111aa0dd
MD5 f8cb5f6f79a41c3dae366d920bb84730
SHA1 8d765a43a990a6fbd2828c905ff011c711af05f4
SHA512 ebd9fa94750338f4a229f975590b0f122a604fa8ffd49e6746dafc20a03e9a25c7358d123baef77f953ac136d18c15cff7e06d64d69565d4f8416f7b29b9e8ff
TLSH
T18AC022A3017DA43220B946621DC0AD489F7AE03000A0A4E89B6385A8506107A6203082
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Preferences
Size 4KB
SHA256 add8d047fc32feb26ff7c338f83ff56ee82cee4d8f0405db49a279f2014b2c6f
MD5 cec4e00cb961bce58c348856373a943c
SHA1 c4b0d3b9a3cd3a7ba179745dd07501b0ce472fdd
SHA512 d46636cb8fc9c922c3110fdce568a8aff3a0a2057757b219347682071817fc4467ac404013bc3fc08e9195b36be633000aec0a7ff11f5c96ba55872da01b0daf
SSDEEP 96:rH/9kiWJ88BB5Hh6NL7/x+6MhmueqC6P2M+OwQ:rH/iPJH75CLV+FpDPEQ
TLSH
T13391C91A7D58D9B74CC6C61D7E593A93D6F614205AD01C84B7FC891C089EADD2307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Preferences
Size 4KB
SHA256 539e79e8e4e5684d3b7617453a0c92dfc6101fd2cb16d018d3fbb7b5dadacbbe
MD5 997fd139e2a462f42f446d147bc7ed87
SHA1 c4da9994b5beec29ef391a31f3316c787732da26
SHA512 fbb998db677a85a903a74b4c28af84826baaf3f5227f013a5daeb64f19b9369df2b3eeea0377d5448dcd7bfd1da9d2b3d1195135b5553bb68255d7881b15807b
SSDEEP 96:rH/9kiWJ88BB5Hh6NL7/x+6MhmueqCyP2M+OwQ:rH/iPJH75CLV+Fp9PEQ
TLSH
T1BAA1D71A6D68DAB78CC7C61DBE593A93D2F614205BD01D84B7FC891C08AEADD230791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58d6d3.TMP

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Default\Preferences~RFe58d6d3.TMP
Size 4KB
SHA256 c25b3dfaa325e795c493dda6196cedac642b42d6dec9401134a483e97d03d232
MD5 4962f2f8b705c8309a0999c55000a24e
SHA1 2536d99eaed3f3e59a6620ecf76945692b30fc86
SHA512 9171088b1580f57314bd12bc7ebfe40522834fc3198583a97080e19cd50d3d04e2748f941eba85fe557f736704a182d80e7631450aa4cf052919f4b28e548fd6
SSDEEP 96:rH/9kiWJ88p5Hh6NL7/x+6MhmueqCXg2M+OwQ:rH/iPJHp5CLV+FpqgPEQ
TLSH
T17391E91A7E68E9B74CC6C60E7E593A93D6F704206AD11C84BBFCC91C049EADD230791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Local State
Size 2KB
SHA256 378bf0a201760086ef2a76bf2b85db3c2223acc244301598a01351a24b86adbe
MD5 d4406486fe6d3c8fde7ddf09b0f70deb
SHA1 ee5aa2876d1e7e6d35e42d86d526c81338c4889e
SHA512 564a7eba6946d013d03a2a907b2136ed97fea96a60a5e25adbec2dee3d40fc04e851de3702d33bb1992a885382e090c97f63f944b0d2e7ecdc0279207c3d552b
TLSH
T15051C67224BCDC775FB3D542B5811A038FB96857B4906F84CAFC1A2C51AB9D42383427
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe586184.TMP

Path C:\Users\Admin\AppData\Local\Crocotile 3D\User Data\Local State~RFe586184.TMP
Size 867B
SHA256 4b58d43d85ab5a90b4a2a81655cb71d09e3937d7e2f4ba27e04c6cd66e36a708
MD5 287b93194211e910f0f2eecc4c165333
SHA1 f5694f2eca653e6e346b6ea35560cb94c753f280
SHA512 a26d45eb4b2fb346e71f0791e82013cd88543e966c5e244b8fb0aa596216316a9ab515d1dcfb934e55fabdb97506ba00c9a83e68bfbdf0c3b9a74acf0edd5ed5
TLSH
T1F0115273A8FCD763FF91540AB6C56D634E65A07762C14D49D2DD4A3810F308C2107837
MD5 SHA1 SHA512 TLSH

Submit Download

box.bin

Path C:\Windows\SystemTemp\nw4144_1741245535\box.bin
Size 264KB
SHA256 8b6cf6ffacf7a3d69322189a38ac3698c010b4a736f130ed8d3c04a340875ea6
MD5 bb587d01f604d4af895e5369a99983b9
SHA1 6eed5c80be6b516e670bd767c290f7ca10087302
SHA512 8878733ab91f9de045939b7ecbdd9cca89a114a81df9edd66c789c7ded9de2938e6f9b5e155a4a648bf4867d12c6ed1ade4b441dbd5c52b27d5c3112a43e78ec
SSDEEP 3072:6BAjwhiVBVnCQbdFFCukTLQio6BczfoExpgJPusYXPvxB2Krnn9RZ+:SG2ixCwsuk3otfoEUssYfveKjn9R8
TLSH
T11B44BF82A3677F7FDC5AC07769A6C0B32B21DD4A4893E7875A14937233C32D59D4EA80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

three.module.js

Path C:\Windows\SystemTemp\nw4144_1741245535\build\three.module.js
Size 1.1MB
SHA256 69b859e1e556b803fb2a77eb59a763bf430dfd01dbfa5a89cb66d6804021eaf7
MD5 64c116b8be48d1b5c13ab9c93b717c45
SHA1 4c7a0aa7a4b4d81e6558eb2585ab16a110a0bc8b
SHA512 8c88624ca22721d9807a1f7a1d0d0f85159aa3bd039b0dc84785dd89ab7f3c32b00398592beca049b7cbe306b3f87c31d5b8310d043552830b1f53e708cbd882
SSDEEP 24576:1TjWY8dy6kdazW/XzFv1kBL/6LAg+IDQj2FUUhNo6p6QdGovl0Dv:Wdy6kdazW/XzFv1kBL/6LAg+IDQoUUkv
TLSH
T15145D7852BBD122E8B667199886C05C5663C9473B502C4FFBC0C59EA68D143CC7BEF7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3dicon.png

Path C:\Windows\SystemTemp\nw4144_1741245535\c3dicon.png
Size 12KB
SHA256 180337998a2c6a7d141aee116e17d908d8a9c8595fbc8ad9f4e887f9a7edd479
MD5 2bf570d04b39995c2b16e9fd10c4f1b3
SHA1 967c2997f97a04299df469c975716d761889b1d0
SHA512 c4e7e3cda9455646492eed1f7dd2d989076e958d630f038e618834694a69e1d083ba371e23e563229f24abb525a7ce32c3aca31bec4f2ac0c2bdf1f11d0ecccd
SSDEEP 192:NSDS0tKg9E05TiqLbFHlbNDUYduJxd8xAn+yJlo8aAKWHIWltzQodWQjoT0Bx8QD:MJXE05+4pHng3a5yQLAZH9UoJET035/f
TLSH
T1CB42BFC1B5B8FC8C29BEBD13C6EC418F7732643864953970A49469BB1D92B9BDC94431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

greenworks.js

Path C:\Windows\SystemTemp\nw4144_1741245535\greenworks.js
Size 7KB
SHA256 0e614f1526c4c3f2effb6dd6d8927d5c46c983072962316655ae874e51bc2888
MD5 30b906831a14a37b6566dc95311e5117
SHA1 e45a4c613880b748316fa87cf427b81d8072071a
SHA512 061a2a01589eaa7ea646e9d4bed7a89844fa7c6aa58abb195ca6886173d7ca9469fae1c28fdf72f18adc242f649c34a8dbb5e2439b9174de3008c77f709996c3
SSDEEP 192:70jXU22YSYUMewiaVwdr/AEt860/a+9UcGTf8jYtOpjXxl:7uXU22YSYUMewiaVwdr4k86Ya+9ZWntK
TLSH
T192F122324EA3A0D648F2BAABCA4B170575BBC093071D596A348DD38C5F44434E7EFA4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

greenworks-win64.node

Path C:\Windows\SystemTemp\nw4144_1741245535\lib\greenworks-win64.node
Size 1.3MB
SHA256 2e9e1385f88c77f2bb596951e3f548019f012027a381716b092c98cf83440458
MD5 f3dbfc232ff83089b99a268a1c7cebf1
SHA1 94cada9ffc70ec9a2a672c5b5e55aa99a5e3686e
SHA512 e969503186909ec1a0040242282cffb061f34c110688f189c40c09b8fc27d719ec588f3bd5c9b545e23775606b2c430c99b37378ec6cd555a355333fbd27f27c
SSDEEP 24576:atRIzeXIPDpw+7RUWnTOvSgwtHTCzkqrTC:atROeXIbRWvS1HTLWC
TLSH
T108558D03B39501A9D4B7D239CA479A16EA7278454731BBCB03E49BA63F237F8563E341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sdkencryptedappticket64.dll

Path C:\Windows\SystemTemp\nw4144_1741245535\lib\sdkencryptedappticket64.dll
Size 778KB
SHA256 8ca8efbbd8d51acfede84d7c97462c76f555233a33138ddf95537cfb3019c27b
MD5 b5d48fc98be086eda0defefc9259bb78
SHA1 bd3f5a18d46a8a43c4eac9fa8a760c1067dba045
SHA512 1cfec1bd1c234e6addb1924ffe4818b5e2f3de10d0371be20c2c03ab9c93082636607b7aa32532894e3e6127779eb0dec6132d0aa16854181477f043956f57dc
SSDEEP 24576:TcbnnHLRDKPsf2k5Q+exLKUxPCrhFUMJY:YbrROSjPmWUxPCrhFBJY
TLSH
T150055B19BEA481B5C077C17E965B8287FBF274051B359ADF52A1432F6F37BE01A3A210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_api64.dll

Path C:\Windows\SystemTemp\nw4144_1741245535\lib\steam_api64.dll
Size 258KB
SHA256 67b094d16ab0f1216ed94fc95db1281b75c2ebf1e71e583bb0545a0fb73d7765
MD5 3e86835c23c2865ce4bae0890816aa42
SHA1 079f0750b2feb90eb447858fa51dbabd56240404
SHA512 86d446e2617f146698274326a93e78c201e8ddc4e998faa5b6f42a992fd1082fdc4d526b2a287cd61b6d1782727a6e3d26a80990ee935b48b638034840cb6015
SSDEEP 6144:T3Z4rQ8sCJ935KFs2z4iUqy7BCcM3tJRwG:bYhPpKFsFYy7BCVtp
TLSH
T11C44383A72750CF5D1B6C139C9961E0BF671304B23219DEF276053368E636E22A3BA95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Windows\SystemTemp\nw4144_1741245535\package.json
Size 467B
SHA256 5a5a595c33eef8f0f62ab4af9be35c45ab52cc85fbc9d35e63877168d6aa92bd
MD5 744634bacde76470f778a541c646b0d7
SHA1 73b92a5054c131c4386b2c02ca551bdaa3d406a5
SHA512 5fc65d0154d1b539bc4f2f3df739230cf59cc2ecfa4bf0439c418abf00f01d6f2b2d3bb0d3629ab9d3fdc0e647ce89be7511babb040d3cc9e7d2090eb5e277b9
TLSH
T115F05C12C1A1BD3B467C9D83B9714BC6F34A1A2F11299C1E7170352C57FB97A8181764
MD5 SHA1 SHA512 TLSH

Submit Download

workerThread.js

Path C:\Windows\SystemTemp\nw4144_1741245535\workerThread.js
Size 16KB
SHA256 4171b36c8f939fe4d09a510ef85cdbf8fbea5b034d3c2c9eff46c115efab4389
MD5 d00bd459d4686569d53f453d19766fa6
SHA1 95e571226bfd2edd98a9fcb2ab455f2eb2f5de2e
SHA512 0ac4be6aa0c7bc85e5c8ace06183e8d6670135599cd8d3571074db5aa736aff4b186d9f0172991ccd3cb991c16db6b1d7993586ca3e26d686849d8a7931f486b
SSDEEP 96:xZRqAgEA2SYKriJnew56PJ1SPza8RuNe5sFeCwkk3eNoo5WLa7HyCzQ0U+duGZuK:xZh8OG4R8ksKVaWItc0nCd5bLHYRX
TLSH
T1827200C8734ECC8A86DB1299143C9595EF7CE0338121079FB62F6C527599CB483EBB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/656-865-0x0000000003760000-0x00000000037BD000-memory.dmp

Download

memory/2024-864-0x0000000003750000-0x00000000037AD000-memory.dmp

Download

memory/2816-917-0x000000000AC30000-0x000000000AC31000-memory.dmp

Download

memory/2816-919-0x000000000AC30000-0x000000000AC31000-memory.dmp

Download

memory/2816-918-0x000000000AC30000-0x000000000AC31000-memory.dmp

Download

memory/2816-928-0x000000000AC30000-0x000000000AC31000-memory.dmp

Download

memory/2816-929-0x000000000AC30000-0x000000000AC31000-memory.dmp

Download

memory/2816-927-0x000000000AC30000-0x000000000AC31000-memory.dmp

Download

memory/2816-925-0x000000000AC30000-0x000000000AC31000-memory.dmp

Download

memory/2816-924-0x000000000AC30000-0x000000000AC31000-memory.dmp

Download

memory/2816-926-0x000000000AC30000-0x000000000AC31000-memory.dmp

Download

memory/2816-923-0x000000000AC30000-0x000000000AC31000-memory.dmp

Download

memory/2816-930-0x0000000005320000-0x000000000537D000-memory.dmp

Download

memory/4144-835-0x0000000001DC0000-0x0000000001E1D000-memory.dmp

Download

memory/4616-848-0x00000000031D0000-0x00000000031DC000-memory.dmp

Download