0496e69e98edfb3b70de8a69986e8dc75e1f6240eb513c6fd03069a902365920

Analysis

user interaction
yes
max time kernel
97s
max time network
100s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/10/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Locally.Uncensored_3.0.8_x64-setup.exe
Size 20.2MB
Sample261029-vc94xaev7m
SHA256 0496e69e98edfb3b70de8a69986e8dc75e1f6240eb513c6fd03069a902365920
MD5 bf8d8d645d82d88df5a6b911a38ff788
SHA1 b6d8e7546afce961c76a52638400e9986499bd65
SHA512 bcc0eb20ee38ff61f39ec4162b8b2dab13eaea39ae14acf331bb0847ffcbcbcd164096e5a3c2ab4abb4dbb923f50fc2644c23d90b07795c31e919e51d384c2aa
SSDEEP 393216:9YRR9fWrcdoDfr6NTJjQhb8S0P7MpsUcli4OKsHzNLIbSAgAaf4xX0:9YRfyc62lJctnSMyU8sHzNLsSAgDf4N0
TLSH
T14527332427B6C886D1759E335D88BC5953958982BF3F5F2FFC449838BE01ED8EE4A604
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
892	locally-uncensored.exe

Loads dropped DLL 8 IoCs

pid	Process
4668	Locally.Uncensored_3.0.8_x64-setup.exe
4668	Locally.Uncensored_3.0.8_x64-setup.exe
4668	Locally.Uncensored_3.0.8_x64-setup.exe
4668	Locally.Uncensored_3.0.8_x64-setup.exe
4668	Locally.Uncensored_3.0.8_x64-setup.exe
4668	Locally.Uncensored_3.0.8_x64-setup.exe
4668	Locally.Uncensored_3.0.8_x64-setup.exe
4668	Locally.Uncensored_3.0.8_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	locally-uncensored.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Locally Uncensored\mtmd.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\__main__.py	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\auth.py	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\models.py	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\voice_loop\requirements.txt	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\abliterate\constraints.txt	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\ggml-vulkan.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\llama-server-impl.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\engines.py	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\errors.py	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\lu-llama-server.exe	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\ggml-cpu-alderlake.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\ggml-cpu-alderlake.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\ggml-cpu-skylakex.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\__init__.py	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\ollama_native.py	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\requirements.txt	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\ggml-cpu-icelake.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\speech.py	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\llama-server-impl.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\latency.py	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\speech.py	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\thinking.py	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\models.json	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\ggml-cpu-sandybridge.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\mtmd.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\commands.py	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\pipeline.py	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\whisper_server.py	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\locally-uncensored.exe	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\abliterate\requirements.txt	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\ggml-cpu-sse42.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\commands.py	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\latency.py	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\tools.py	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\ggml-cpu-x64.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\config.py	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\models.py	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\pipeline.py	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\voice_loop\python.json	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\abliterate\constraints.txt	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\ggml-base.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\ggml-cpu-haswell.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\ggml-cpu-sandybridge.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\llama-common.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\log.py	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\lu-llama-server.exe	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\llama.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\__init__.py	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\config.py	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\log.py	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\whisper_server.py	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\abliterate\lu_abliterate.py	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\ggml-cpu-skylakex.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\server.py	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\ggml-base.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\ggml-cpu-cascadelake.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\ggml-cpu-icelake.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\ggml-cpu-x64.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\llama.dll	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\auth.py	Locally.Uncensored_3.0.8_x64-setup.exe
File created	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\thinking.py	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\voice_loop\lu_voice_loop\tools.py	Locally.Uncensored_3.0.8_x64-setup.exe
File opened for modification	C:\Program Files\Locally Uncensored\resources\abliterate\lu_abliterate.py	Locally.Uncensored_3.0.8_x64-setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	locally-uncensored.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	locally-uncensored.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Locally.Uncensored_3.0.8_x64-setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4380	reg.exe
5080	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4668	Locally.Uncensored_3.0.8_x64-setup.exe
4668	Locally.Uncensored_3.0.8_x64-setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3612	msedgewebview2.exe
3612	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	4668	Locally.Uncensored_3.0.8_x64-setup.exe
Token: SeImpersonatePrivilege	4668	Locally.Uncensored_3.0.8_x64-setup.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
892	locally-uncensored.exe
892	locally-uncensored.exe
892	locally-uncensored.exe
892	locally-uncensored.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
892	locally-uncensored.exe
892	locally-uncensored.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 936	892	locally-uncensored.exe	85
PID 892 wrote to memory of 3612	892	locally-uncensored.exe	87
PID 3612 wrote to memory of 1124	3612	msedgewebview2.exe	88
PID 3612 wrote to memory of 3864	3612	msedgewebview2.exe	90
PID 3612 wrote to memory of 3864	3612	msedgewebview2.exe	90
PID 3612 wrote to memory of 3864	3612	msedgewebview2.exe	90
PID 3612 wrote to memory of 2576	3612	msedgewebview2.exe	91
PID 3612 wrote to memory of 2028	3612	msedgewebview2.exe	92
PID 3612 wrote to memory of 2028	3612	msedgewebview2.exe	92
PID 3612 wrote to memory of 2476	3612	msedgewebview2.exe	93
PID 3612 wrote to memory of 2476	3612	msedgewebview2.exe	93
PID 3612 wrote to memory of 2476	3612	msedgewebview2.exe	93
PID 3612 wrote to memory of 484	3612	msedgewebview2.exe	94
PID 3612 wrote to memory of 484	3612	msedgewebview2.exe	94
PID 3612 wrote to memory of 484	3612	msedgewebview2.exe	94
PID 892 wrote to memory of 1472	892	locally-uncensored.exe	95
PID 892 wrote to memory of 4380	892	locally-uncensored.exe	97
PID 892 wrote to memory of 5080	892	locally-uncensored.exe	99

C:\Users\Admin\AppData\Local\Temp\Locally.Uncensored_3.0.8_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\Locally.Uncensored_3.0.8_x64-setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4668
- C:\Program Files\Locally Uncensored\locally-uncensored.exe
  "C:\Program Files\Locally Uncensored\locally-uncensored.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\system32\where.exe
    "where" python
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=locally-uncensored.exe --webview-exe-version=3.0.8 --user-data-dir="C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=892.3140.14357974027059726753
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3612
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffa3a69b078,0x7ffa3a69b084,0x7ffa3a69b090
      4⤵
      PID:1124
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView" --webview-exe-name=locally-uncensored.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1800,i,2156306386287840173,11852404648880781016,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView" --webview-exe-name=locally-uncensored.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2136,i,2156306386287840173,11852404648880781016,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
      4⤵
      PID:2576
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView" --webview-exe-name=locally-uncensored.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2360,i,2156306386287840173,11852404648880781016,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:13
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView" --webview-exe-name=locally-uncensored.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3564,i,2156306386287840173,11852404648880781016,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:2476
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView" --webview-exe-name=locally-uncensored.exe --webview-exe-version=3.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3852,i,2156306386287840173,11852404648880781016,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
      4⤵
      PID:484
- - C:\Windows\system32\where.exe
    "where" lms
    3⤵
    PID:1472
- - C:\Windows\system32\reg.exe
    "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318} /s /v DriverDesc
    3⤵
    - Modifies registry key
    PID:4380
- - C:\Windows\system32\reg.exe
    "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318} /s /v HardwareInformation.qwMemorySize
    3⤵
    - Modifies registry key
    PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

locally-uncensored.exe

Path C:\Program Files\Locally Uncensored\locally-uncensored.exe
Size 22.2MB
SHA256 27970f5789257fe0f229c51634c9f2d40ceb84b8dd8795a470e33665d9506c12
MD5 ef70deb7e0008bb2e7addfa835e554d2
SHA1 e6611ffd7224e70f2493c1468a0205875c63fcbf
SHA512 c8c77990f4248aef239840eb216691788efc373f807f2ffd248cea54cfae63971ae009b82b0a953ee16e3499fbcf95b19e9035d79efda3152b97fc2713db5e2d
SSDEEP 393216:iGto42gOKoUpm2QGK3EocKStOOYX95sa:iGG42h4BG7l92
TLSH
T14837AF03F66184E8D05EC1B8835BA233EB72B89D493472AF1BD45B213F6AF506B1D758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDE.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDE.tmp\UserInfo.dll
Size 4KB
SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
MD5 e6f30908abfc6f53b7c3c36daec4586d
SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
TLSH
T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
MD5 SHA1 SHA512 TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDE.tmp\modern-wizard.bmp
Size 150KB
SHA256 108902cfc8f908bf5f9d61fd62c64e89ba303bbc17bc38356716ee5fcca58901
MD5 912ee0d2b97cbdbfcf611b0de29c58c3
SHA1 bd27bf708070d1e45a67ccd8b791086dfd8035a1
SHA512 af1226d01bda0b54e451d0210386060bb2f60b2df247debb61164d67ab67e494c36614814e8f37117b009368a9d468dfa5919898d71538a9ffb05b2545535470
SSDEEP 48:+R1lWULv3+2BlU9K13D/44444444444Bf+my17+dVL:+R1H+2BqU1D/44444444444DE7+P
TLSH
T187E35762CC428B795B9513B98E038808A731FC7CF3BC1179B55773BA91F9BDA804646B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDE.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7CDE.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f8ba299-57b0-49ef-8792-e399564c7410.tmp

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\5f8ba299-57b0-49ef-8792-e399564c7410.tmp
Size 16KB
SHA256 52ea7d863f58576c468ce9d9a71fcea5391f3fccefdaa2f482a488abbce07c90
MD5 05c14509e5b1c74db7515ed038d61bf3
SHA1 9f1794eee0317872c78911c06fcdb8bb3af218a2
SHA512 0ce92996a0ceda5f29ddab89e94af4bd2d399c1d37c0d89b71874142cb01f955927fff5841c8e232d5b20dde943b812813bffc77ffdcc60c9bc482849f2a012b
SSDEEP 384:zF+OBqImmJvGBLx3NaFMJF9NbBcrpoPSacg6rf:8cvGtlNiNoPFSD
TLSH
T1E572ADA928756A332CF7C449BACE6B47DA6562A7C0D47FE4DCEC5F0E023B1881352C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8cc2cad6-9bc2-4a9c-b809-6f46a4059f33.tmp

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\8cc2cad6-9bc2-4a9c-b809-6f46a4059f33.tmp
Size 16KB
SHA256 289e8389df50e9c68478af5146b07b58ae25386c7efc8c7219163d804b19d3dd
MD5 7861c67586a28a5a1b6f9932ff236226
SHA1 a091db61673aa29687d5f67d989573d381bd8c10
SHA512 bcc6da50774eb47ccf1465b5a18d6d97835dd22b32dae6b360b3289fe2847292ac6178b12fc163d411ed915a8731386ab88d1749c5272129e0285ef8b36ff5ed
SSDEEP 384:zG+OBqImmJvGBLx3NaFMJF83NbBcrpo9Sacg6rf:fcvGtlN8MNo9FSD
TLSH
T150729DAA2C656E332CF7C545BACE6B4BCA656297C1D47FE4DCEC4F0E022B1891352C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f328c5beac1047ab22fdd706c3c961271518964f5479b2261e9ee83e44aaade5
MD5 ff13ff7f6252c26754f19c422f68ef95
SHA1 6bbc23cc3a9526bdddc715fa6018d074731cc469
SHA512 488da65fe3dc34219048940c0a799f8e5a21e2e45a3fa16cb39af62a8d4dc6c2369f7afdee72080e7ae1295044f01916c53f018e5efc1f2e326f7d5042cb0a71
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4fd354a6e6c230334b6e20f5ae41ebb87756dab06ec2536e0ad6ae0afb38db62
MD5 321274bc2616b8f0b30014f5783eaeba
SHA1 bb83892d8dfb568582f391119e797487facd7f77
SHA512 9693a6812592f2b6b3f11f48d6149e7e8f8d74df7e1431aa9c1cd8c0fc92d01c2cf0776a77afd9735bf3f6a76f1c82c888c09568e9c1b0f3e3f644dabc3d8a7d
TLSH
T135D0121637018134C01021330A03AA0C2400C50B800E4100F828871E5A444606943453
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7b94130b945c84c4d7b1591f3189237134b45fcd616be55ca360412527c9ccc1
MD5 1dc915a608a321794e48849c81152c2e
SHA1 f15a4049ec13a530979cbd24027f7ef75fc4932f
SHA512 ddbfcba2e9963577c86cdc4ed5eb55ada8ec88e080e3f8fc7ff79e0fb82124a6002db3ad4bdc2663f660755c4986bcef59660f93f6c1a1bef27164d7b211f41a
TLSH
T1C3D02B1123008A74D12119330743DA093990F10BC00EC128F818C72D1D044E01E824D3
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 696B
SHA256 3b4f55e3bcdeacd3741d9e8bdaca3984a5c0817eaa625e387abcc18143aef3a0
MD5 4184719dd4778cc66e4fae7e639f5420
SHA1 ce76d7530b4b7330547a8d5293d3044333c98a73
SHA512 fd858755880ad901db51ce86312b2b9e43e654fca8620d9c56bd5fa40ce7422cfcc349c2dabac3653b90cf3704b0ca9efe37949568dde737e1edcfc4d4ca7e1b
TLSH
T1420168102D346A93C77546B960CA4D4EB0BD1E8618BF2C21D2C6843E88F97C5D21E94A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 854501d5d79639f07a954687789cedaf06717443934a598e5594ff3c657551ff
MD5 7dff37c28b53f1ade6c6061e2d644e62
SHA1 0a107f533d39f9849c3d91d4cce5a3fa71b72567
SHA512 f233f15e5779a3dedd8d6189d84789095a0bccf6af99dd10658758ea52e5c00238aa599f46675cce52365d690be73008db664f361355231c39865a2767bb9989
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 797f6c4dbd538c3857b2c684b468fb6c170a5ace57317568d5aaa3561ad820cd
MD5 3fa39c6d27b1c0829ed1eb4f79e68bbe
SHA1 a9d808d787926fd32c137e6d35a9e20f39cc0ec2
SHA512 fcff6d8682330286ec5488b4224f3acd39249f6ef4fd36d4eb21254af740b2392c3cade13a0d1d7a1937b1297050fa5af2f58e791cee10c4da6d678743f2361d
SSDEEP 3:LstlNllkll/lc5l:LsX3lEtcn
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 86c404f8bf58682156caa587bf9913bccd31f8e02806419f06140b1ba07fcbec
MD5 1d940f6eb0263d3483cc932156a7cb1f
SHA1 2167638bae705fd00ef8449331ece9f9c06080a4
SHA512 383091e455cfa42e0a6017a30c8e8abe4252ce071313186946c986f58ec2dad5b874dd638aeb64b903670eb25c52cb7b32a2fbfde984eb5f4c4cfca3fd3bac1d
SSDEEP 3:LsOllllkll/lc5l:LsUlEtcn
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

61b7487b-e2fd-4d69-a62f-c045166e85a2.tmp

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Default\Network\61b7487b-e2fd-4d69-a62f-c045166e85a2.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Default\Preferences
Size 6KB
SHA256 b26c91ac664813392aaa0c896b5a94b2aeafe5858f89d8ed7091a69ec784c366
MD5 98193e9e86590a721d2518a2ac9bfdb0
SHA1 b9d0cdabb198290025e652f1eef88598916b7ca3
SHA512 7c5022d6416a08a51a66b5cb93e944f2cf8ac20bcf698887b03011e2fc330ca6d0a8a0f4cd19522c4558430d3b35a5d03f4d65857937cb79b86fabe5c70bb15c
SSDEEP 96:st7F05kYnL/Cb9TffVtZ8i0vhEDkt1m/7qx+WVHMSm+uecJWfSMk8dQjO+g6MjM8:stR0edfvZ8pa+4/S+WiTWKQdPkMjM8
TLSH
T1B5D1B8026F6879774CC7F2197A75BB13D2FA206165D40E98EBFC891C0DEA6CD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

e3e5d055-15f0-466e-bcd2-df138939605c.tmp

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Default\e3e5d055-15f0-466e-bcd2-df138939605c.tmp
Size 6KB
SHA256 9f106df9d5cd0c3691c301192199bc19a7ee8452b72bc00774057d4ca968a64a
MD5 c8fa6793a19e334853bc53317ea33515
SHA1 db2f58b9e86de3255d4463319da29fcdafda8e76
SHA512 de4d4ee0d870aad4d36df18d347b65fa9519b62b13a5ed293a4af39f0bafbe5e0dd7b4e636dcaff77a180b77cb2fc9a1e9bafffe86d2f1cebbf4b816fa0c643a
SSDEEP 96:st7F05VBYnL/Cb9TffqqtZ8i0vhEDkt1m/7qx+WVHMSm+uecJ+HSEZdQjO+g6x2r:stR0rBdfxZ8pa+4/S+WiT+yWdPkAnK8
TLSH
T1F8E1CB02AE28693B4CC7F2597975BB13D2F5206165C40E88EBFC891C0DE76DD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\GrShaderCache\index
Size 256KB
SHA256 e1242fd3db0d1ef357e192e7b84b81b0c92f2d15b2d6f67df0a2fa4874ea72ac
MD5 998555558a6dd0403382ef0cbe586c61
SHA1 c048c13de7fd98d90e57381a669360f145806b5d
SHA512 0251e6c58ed5dc2facc8bb5559c45c32718bcfaeb0174afd8f35cb59344d1a4afce6ce613ff88624056e2d62439e1ae8cddc10f9a21b0ea33d6bcb7a0f7dec50
SSDEEP 3:LstlNllkll/lYC:LsX3lEtYC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\Local State
Size 1KB
SHA256 4dda4c02182bfe262ec5b6109ee3dcec2ee5553c3b74a3059e9718249a78f325
MD5 3b6cb973e676327b436fe9af2deb3677
SHA1 6443827f38889e2ddc116c11e85f6d88d9eb877e
SHA512 768dbd6aa3c975482047353a8d7f7c1b042b15d38d12361583fd77f8b0a7cb654bd32471a4daa09194fa86f64dff89cbd46ae4a0551b1c1625838df9e221eb4c
TLSH
T163219572E4946A71A4A2D9C0B186FF4B6D50A13A4264CF18D1ED070816DB5ED8227C33
MD5 SHA1 SHA512 TLSH

Submit Download

adca19f6-4312-44b6-8705-a673454cdd66.tmp

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\adca19f6-4312-44b6-8705-a673454cdd66.tmp
Size 1KB
SHA256 08af70627c06a2e73559c3ffe7e4c533710082fdaf900f6fbb36b38adc69de34
MD5 e181a1d5377ac51bdf39d6c2efb08e37
SHA1 6c5fe779801d489bb4e40f2bd88f16e5c67ef26b
SHA512 32cbc8f9de76d99a148a83179b917f54447384f527231394f454976f77d9c2dd0aba87d4f3f568157e7ec21c960b7731c9cc552726d481e926228a50b01da3db
TLSH
T1CC31CC71B4901B71A8A3F5C1B1C6BF4BAD1461398254CF5491ED0B0C07EB6DD4226C33
MD5 SHA1 SHA512 TLSH

Submit Download

d9476426-d840-466d-88d0-d2ffda254a47.tmp

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\d9476426-d840-466d-88d0-d2ffda254a47.tmp
Size 2KB
SHA256 f09aca395a1df47af26045ede69f68608bd27f67708539a384356582080e0478
MD5 afa207a6bb46a232a122848ca4f2c5a8
SHA1 7529db7483da3ef1085930a50b461af2f70def47
SHA512 b9f548865092d51db96754524571b7adb7784f8d72944aac9030feff137a7b1921aa38908b8836ff42269df7da30fe29f8ab91a2c6cd44db2c59125764f6004f
TLSH
T1B551C8327814AA7285F3E9C0B98A7F13DD39A1658A955F6095ED0F0C06EB69D2302C37
MD5 SHA1 SHA512 TLSH

Submit Download

f917df53-78a9-465e-a60c-1635c276af7e.tmp

Path C:\Users\Admin\AppData\Local\com.purpledoubled.locally-uncensored\EBWebView\f917df53-78a9-465e-a60c-1635c276af7e.tmp
Size 3KB
SHA256 949629900ff9b0ec38b38f7ce006719983f655509ff149ba18be8198747641c8
MD5 2ccfe4c12b7d09438c87e3e06de06436
SHA1 9cdf71113f170883ee9f6674a0ad8d9357e5b71f
SHA512 ab34248490ceb0f271ccee2b53ecdacde68ab7744aee6fbb4072605878ba9e7918a4a8b70d24428c441b908249fae94b2398e2d5801be3cf80b99c7a1913ec3d
TLSH
T1E97155226864A9775DF3E980B8C63B07FAA55136D9D46FA4D5ED0F0C06DB2DC1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2476-291-0x00007FFA58790000-0x00007FFA58791000-memory.dmp

Download

memory/3864-166-0x00007FFA58790000-0x00007FFA58791000-memory.dmp

Download