Analysis
- user interaction
yes - max time kernel
525s - max time network
447s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 02:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://transfaze.com/hwzcujfz5iee/Third_Crisis_Neon_Nights_0.4.10-sr.zip.html
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
900 seconds
General
- Target https://transfaze.com/hwzcujfz5iee/Third_Crisis_Neon_Nights_0.4.10-sr.zip.html
- Sample260804-ch78dsbc55
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\d3d11.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\dll\wbemprox.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\symbols\dll\dcomp.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\DLL\dhcpcsvc6.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\dll\FirewallAPI.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\dll\shlwapi.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\Kernel.Appcore.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\symbols\DLL\hid.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\dll\UMPDC.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\dll\ResourcePolicyClient.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\symbols\dll\wbemprox.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\dll\shcore.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\gpapi.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\symbols\dll\Windows.Networking.Connectivity.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\dll\kernelbase.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\symbols\dll\oleaut32.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\DLL\audioses.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\ntdll.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\dll\rpcrt4.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\devobj.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\symbols\dll\rpcrt4.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\symbols\dll\Amsi.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\audioses.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\dll\propsys.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\dll\msasn1.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\symbols\dll\dnsapi.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\dll\ws2_32.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\dll\CoreMessaging.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\ucrtbase.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\winmm.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\symbols\dll\steam_api64.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\symbols\dll\ws2_32.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\dll\winhttp.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\CLBCatQ.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\symbols\dll\Windows.Networking.HostName.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\dll\shell32.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\dll\devobj.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\symbols\dll\sspicli.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\steam_api64.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\dwmapi.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\symbols\dll\Windows.Devices.Bluetooth.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\shell32.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\symbols\dll\twinapi.appcore.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\symbols\dll\gdi32full.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\cfgmgr32.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\dll\Windows.Networking.Connectivity.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\symbols\dll\win32u.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\gdi32full.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\cfgmgr32.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\version.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\MMDevAPI.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\symbols\dll\oleaut32.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\crypt32.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\dll\InputHost.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\Windows.Gaming.Input.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\ntmarta.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\symbols\dll\wintrust.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\symbols\dll\cryptbase.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\msvcp_win.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\symbols\dll\ucrtbase.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\symbols\dll\d3d11.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\system32\dll\winmm.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\symbols\dll\shcore.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\system32\ResourcePolicyClient.pdb UnityCrashHandler64.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winmm.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\dll\cryptsp.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\symbols\dll\cryptbase.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\dwmapi.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\dll\opengl32.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\symbols\dll\d3d10warp.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\wbemprox.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\DLL\hid.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\symbols\dll\profapi.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\mono-2.0-bdwgc.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\dll\msctf.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\dcomp.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\dll\rsaenh.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\symbols\dll\shcore.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\dll\sechost.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\ws2_32.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\Amsi.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\dll\msasn1.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\setupapi.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\dll\d3d11.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\Windows.Gaming.Input.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\symbols\dll\ResourcePolicyClient.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\symbols\dll\UnityPlayer_Win64_player_mono_x64.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\symbols\dll\glu32.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\dll\powrprof.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\symbols\dll\UnityPlayer_Win64_player_mono_x64.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\ResourcePolicyClient.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\gpapi.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\symbols\dll\Kernel.Appcore.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\symbols\dll\cryptbase.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\dll\version.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\dll\MMDevAPI.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\bcrypt.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\dll\biwinrt.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\symbols\dll\CoreMessaging.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\kernelbase.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\dll\bcrypt.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\hid.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\dll\Windows.Gaming.Input.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\symbols\dll\fwpuclnt.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\dll\shlwapi.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\dll\crypt32.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\dll\Kernel.Appcore.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\msvcrt.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\symbols\dll\shlwapi.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\imm32.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\WLDP.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\d3d11.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\dll\steam_api64.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\dnsapi.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\shlwapi.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\symbols\dll\ole32.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\dll\ResourcePolicyClient.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\symbols\DLL\kernel32.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\symbols\dll\oleaut32.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\symbols\dll\ntmarta.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\Windows.Networking.Connectivity.pdb UnityCrashHandler64.exe File opened for modification C:\Windows\dll\DXCore.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\dll\MMDevAPI.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\dll\lib_burst_generated.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\dll\wintrust.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\win32u.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\symbols\dll\dbghelp.pdb Third Crisis Neon Nights.exe File opened for modification C:\Windows\rasadhlp.pdb Third Crisis Neon Nights.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1976 msedge.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 Third Crisis Neon Nights.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags Third Crisis Neon Nights.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 Third Crisis Neon Nights.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags Third Crisis Neon Nights.exe - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Third Crisis Neon Nights.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Third Crisis Neon Nights.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe Key opened \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Third Crisis Neon Nights.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Third Crisis Neon Nights.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302827738101279" msedge.exe - Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{269E8D18-1E2D-4998-8070-50D93009E681} msedge.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902 msedge.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children msedge.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage msedge.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox" msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe" msedge.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children msedge.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe - Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 856 msedge.exe 856 msedge.exe 2748 Third Crisis Neon Nights.exe 2748 Third Crisis Neon Nights.exe 2384 UnityCrashHandler64.exe 2384 UnityCrashHandler64.exe 2384 UnityCrashHandler64.exe 1576 msedge.exe 1576 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe - Suspicious use of SendNotifyMessage 56 IoCs
pid Process 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2748 Third Crisis Neon Nights.exe 4136 StartMenuExperienceHost.exe - Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 4380 wrote to memory of 1576 4380 msedge.exe 85 PID 4380 wrote to memory of 1976 4380 msedge.exe 86 PID 4380 wrote to memory of 1652 4380 msedge.exe 88 PID 4380 wrote to memory of 1652 4380 msedge.exe 88 PID 4380 wrote to memory of 2752 4380 msedge.exe 87 PID 4380 wrote to memory of 2752 4380 msedge.exe 87 PID 4380 wrote to memory of 2752 4380 msedge.exe 87 PID 4380 wrote to memory of 2164 4380 msedge.exe 90 PID 4380 wrote to memory of 2164 4380 msedge.exe 90 PID 4380 wrote to memory of 2164 4380 msedge.exe 90 PID 4380 wrote to memory of 2952 4380 msedge.exe 91 PID 4380 wrote to memory of 2952 4380 msedge.exe 91 PID 4380 wrote to memory of 2952 4380 msedge.exe 91 PID 4380 wrote to memory of 3716 4380 msedge.exe 93 PID 4380 wrote to memory of 3036 4380 msedge.exe 92 PID 4380 wrote to memory of 3036 4380 msedge.exe 92 PID 4380 wrote to memory of 3036 4380 msedge.exe 92 PID 4380 wrote to memory of 3716 4380 msedge.exe 93 PID 4380 wrote to memory of 3716 4380 msedge.exe 93 PID 4380 wrote to memory of 3324 4380 msedge.exe 96 PID 4380 wrote to memory of 4052 4380 msedge.exe 97 PID 4380 wrote to memory of 3324 4380 msedge.exe 96 PID 4380 wrote to memory of 4052 4380 msedge.exe 97 PID 4380 wrote to memory of 3636 4380 msedge.exe 101 PID 4380 wrote to memory of 4796 4380 msedge.exe 112 PID 4380 wrote to memory of 4760 4380 msedge.exe 113 PID 4380 wrote to memory of 4416 4380 msedge.exe 114 PID 4380 wrote to memory of 2576 4380 msedge.exe 115 PID 4380 wrote to memory of 2576 4380 msedge.exe 115 PID 4380 wrote to memory of 808 4380 msedge.exe 117 PID 4380 wrote to memory of 808 4380 msedge.exe 117 PID 4380 wrote to memory of 856 4380 msedge.exe 118 PID 4380 wrote to memory of 4212 4380 msedge.exe 120 PID 4380 wrote to memory of 4212 4380 msedge.exe 120 PID 4380 wrote to memory of 448 4380 msedge.exe 121 PID 4380 wrote to memory of 448 4380 msedge.exe 121 PID 4380 wrote to memory of 448 4380 msedge.exe 121 PID 4380 wrote to memory of 3004 4380 msedge.exe 122 PID 4380 wrote to memory of 3004 4380 msedge.exe 122 PID 4380 wrote to memory of 5048 4380 msedge.exe 123 PID 4380 wrote to memory of 5048 4380 msedge.exe 123 PID 4380 wrote to memory of 980 4380 msedge.exe 124 PID 4380 wrote to memory of 980 4380 msedge.exe 124 PID 4380 wrote to memory of 5108 4380 msedge.exe 125 PID 4380 wrote to memory of 5108 4380 msedge.exe 125 PID 4380 wrote to memory of 3596 4380 msedge.exe 126 PID 4380 wrote to memory of 3596 4380 msedge.exe 126 PID 4380 wrote to memory of 2160 4380 msedge.exe 127 PID 2748 wrote to memory of 2384 2748 Third Crisis Neon Nights.exe 135
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://transfaze.com/hwzcujfz5iee/Third_Crisis_Neon_Nights_0.4.10-sr.zip.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc3ec1c188,0x7ffc3ec1c194,0x7ffc3ec1c1a02⤵
- Suspicious behavior: EnumeratesProcesses
PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,9283234099425661248,17512535070029191271,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:32⤵
- System Time Discovery
PID:1976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,13720059065123099758,15861981268637925026,262144 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:22⤵PID:2752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,16351732897909633621,4048555523339054722,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:82⤵PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,7325180907374966610,16105198016214555122,2097152 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:12⤵PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,6506007593870709905,11192032769330359313,2097152 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:12⤵PID:2952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,3012263704854631114,11768828620418632859,2097152 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:12⤵PID:3036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,9698580505530595257,4797842730709422849,2097152 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:22⤵PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,1279606258771234782,7766601000717800450,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:82⤵PID:3324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,3166634272560467704,12901000573106375639,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:82⤵PID:4052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,13938942086968342871,14455153884753570887,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:82⤵PID:1424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,13938942086968342871,14455153884753570887,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:82⤵PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,7899081346517646005,12305856277520468232,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:82⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,18406299473267153821,5272958517777868922,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:82⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,4636442390906701605,12073682444793265787,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:82⤵PID:4416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,3730597781340766520,15884517952533038959,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:82⤵PID:2576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,6712341257446793469,5430482438740564715,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:82⤵PID:808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6496,i,16113479423259496062,11071377193307386980,262144 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,8745496713443810224,18029056736595754350,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:82⤵PID:4212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5444,i,6189031269365789033,4016702690606951853,2097152 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:12⤵PID:448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,8907336195115786239,14513765839927510405,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:82⤵PID:3004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,12746381593792510198,9696042784680061705,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:82⤵PID:5048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,17885642439968532732,9456897452051241959,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:82⤵PID:980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,2218026504614628029,17372950186539972986,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:82⤵PID:5108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,197623684119047910,12569429080454263389,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:82⤵PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,13782001769835840965,7886025890782742918,524288 --field-trial-handle=2512,i,13370695958896183084,7839696768479631698,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:82⤵PID:2160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3640
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4816
-
C:\Users\Admin\Downloads\Third_Crisis_Neon_Nights_0.4.10-sr\Third Crisis Neon Nights.exe"C:\Users\Admin\Downloads\Third_Crisis_Neon_Nights_0.4.10-sr\Third Crisis Neon Nights.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\Downloads\Third_Crisis_Neon_Nights_0.4.10-sr\UnityCrashHandler64.exe"C:\Users\Admin\Downloads\Third_Crisis_Neon_Nights_0.4.10-sr\UnityCrashHandler64.exe" --attach 2748 20114403532802⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2384
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2c8 0x1581⤵PID:4172
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4136
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
- MD5 9ea20a12d0c030ae7f84014f382662b7
- SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
- SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
- TLSH T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
- MD5 89bc5edb6bd922f1cf8ec5536b066fa6
- SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
- SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
- TLSH T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 331B
- SHA256 fd64d2b062d4584d8366b670ed6e4fce72a4656bf94279640fe9e81872b88709
- MD5 764b9ca2778dc4cc95a01c44b0f5f7f9
- SHA1 8094da8159445042bcb9150c962a0a730754b8fa
- SHA512 a0985a850a45d2118190b28d23de422951532a5f6151a6cc1a2c687d5bf5831e7c4c7a8c6888992d5e08b1a9c309eeb3c9292452c0cd86373ec0c9fbe24307dc
- TLSH T1D2E0789404D5C21D55146987B1F4534E81C0361EDFC4E9491740C4C871419407BC1BB4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 331B
- SHA256 9bb86d977316c8a8e831376f2999f413734061bccddb3510bb6cc274ba2f453a
- MD5 ca552e5dd1770e4d15b76901da90be89
- SHA1 53c8f3be28f78a3b1e63977c7e9785c4f88d39ef
- SHA512 5bad438b1be50a9934243c844079beaef7c2be5116499173aa955180b671ac2c632e21a9f3bd24489a823eb147daa84309a67fd0aeb1a68041fe0568bc8c1333
- TLSH T1D3E026E50BCCC22EE6506847627C83CC92C13B1FDEC8E98A170C858870C1240A382FE4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 686cee82466a0d570d2907e2f8bc25ca1fbfad1f6a9eaa049d7176339b147504
- MD5 c567c9b39c1ff3f88d12893579eb50b0
- SHA1 86e99c3aa45776b90be07788caec130d4489b9ed
- SHA512 11ac79b37a426f70ce7ec145d690c4c4097a3ffb697f4a5d082f3a65fb41b7deec6b70c2c502ea4feb7a71ecf4695b4963b90a7697f1f1f33d7af148da531ac2
- TLSH T1BE81543837418054D76708718FC912DA367689EAFCAF3E8411F2B974A421F324267F1A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589e10.TMP
- Size 3KB
- SHA256 b985e14163ddfae578093ff6e0a0c579f2f787c8d2b2f4e99e0e9a910ca76d41
- MD5 c2d38b039a0f7ea536a96f033d0c3d84
- SHA1 25ae94822f211022cd42c29b063e0eb0fd82570d
- SHA512 f4e554808a5635a0ca6b3aee432b4c1485e7f43a710fd4eb2c9f17549ef7ecadf5517c0dec54854e78496bcf3ef7af3af2c8714adff0ae561b55e3343082b96a
- TLSH T18371537427018054D7670832CFC912DB76368AEAFCAB3E8511F2BD74A121F324667B1D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 d89f2a05de3d52c5e43bf55f69c7ffe6cda635f7190e615df241dcf629bffb15
- MD5 e6079592ff41ce4ecc9f9bd6e89cef04
- SHA1 ccb3cbc937a7fbfea62882344f1071569e41e5ab
- SHA512 aeafdd66969afdbb0758607e228538b40095d51e9e0cab584d7a44c3b79488b94bae5a9f870830cdfe3de5b2e836cc98351d13a142aa67c55a697b2fe0b58bc8
- TLSH T16D51DBF783A08AAED80156F49A14AD1BDF2C0519831C3C65CEE4BF5BD7E3062E11574B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 631be0692abb8ca7003a50b96597325779f649bd18d1521edc2313e360d649ea
- MD5 de69441a47ae39d9ee7b1ad6422385f2
- SHA1 464d2616de567e0736ab21e583a9b9182a6a971a
- SHA512 8ee71df233b2f64c8954a419e5a1afd939ff4e8b6fe4624537722e6d012b8ca9b8447be07c6fe027e9c15fcbb54e0f22245a2a41f5a1e2cbff88bcfd42de55d7
- TLSH T1C1517BF3C3E48A6DC84116F45A14AD1BDE2D0619821D3C25CDE9BF5B97D30A1E21564F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 096d5cf3cb5bc8388bf6f16f9e3d268fd066edc1945d25e3b78087e386c68e10
- MD5 7c44a3723ca4da0c70423e532b40d000
- SHA1 03c26df43f725bf7edc83f19cf7e7cd9981893aa
- SHA512 f9643a7239fd77c2f2d32454e4d1446c06167e04ef9ec9266e179a951c171e6e052f2537435c2572bcb9009ef931e1f8013e434ebceeae5703e611acbe2e91fc
- SSDEEP 192:sxZxRTyM/jK1Ml8UQbkY/fqskOtUVOIdpwwHW6+WNh6R/Yv3XjFxIg53J:sxZxVqwY/fqskUQBHba/oLj
- TLSH T1465208166A34697BCCDBD20DFA45BF53D6F5447292900E44AAFCDA1C01E6BED220782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 5cbb10f72d3a5e03af3db1ff07894ce55d74016f9a1066dd19837de73a11666b
- MD5 4c37e32bdb0665334eb156cb7091a11c
- SHA1 5ac85580496550acbef4d9efcec9231c42dd283e
- SHA512 747dec97b1d20e5f222167165538107793fc34bcf7b6c9add3e7c036803777d189d83a72defd73357c841391a361cf9e217911f245ecea8852b814eee0e79b39
- SSDEEP 192:sxZxRTyM/jK1Ml8UQb9Y/fqskOtUVOIdpwwHW6+WNhQpXYvxXjFxIg53J:sxZxVqpY/fqskUQBHbaXeLj
- TLSH T17A52F7166A346A77CCDBD20DFA41BF53D6F5447292900E54AAFCDA1C01E6AEC221782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 6824d5c760a61ba0e2164240de26b57b91f21430771301281fcd5ce9af7744ee
- MD5 3109756aa730bc286faa7f67ccb74b3e
- SHA1 21f3ee7ea9e3edf09cedb297bf7470a5093b416d
- SHA512 420f491c15ba1247202526f2a5ea4dc6328d127fdc3ebf6675f32a6df55abd50fa19618c4fcc9bc4870b1772307bda4463ef706c5608c6dc8ddb744a9988670f
- SSDEEP 192:sxZxRTyM/jK1Ml8MkY/fqsYOJUVOIdpywHW6+WNh6R/YvTAjFxIgrJ:sxZxVMY/fqsYUQXHba/bL9
- TLSH T18642F8156A34A97BCCDBD20DFA55BF53D6F50472A2900E44ADFCDA1C05E6AEC220781F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 30KB
- SHA256 a5e07220f09db1c90422fadb3a6c6600f9f01c84d947665c844dfe286e2eea02
- MD5 b3c4370eebf922be99ca84a87b335ed6
- SHA1 71dbba71bccec4c41094ec711460e51eb9627e52
- SHA512 a5877848e2523851515273f5d655cde7f71c7605a2b17d5a46715549570a436d3eafdbe38fe7971807239ae70b174f1b11c308b8b789d05c6c9685e2067bd098
- SSDEEP 768:KMseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp5roj0:KMseJ3xWvhfynu1jaVcL88pyY
- TLSH T10ED20B2B280CCB7E4F844E6DEC266F966EE801CB57944D5487EA884C03C77EB512B5DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
- Size 371B
- SHA256 af2849cdd69564b82ea618771ce8fa8e1f392671dd8bb813fee832071e8d90b8
- MD5 cc52946e13dc75f97e1f498a2668f41b
- SHA1 689cc0c6c3ba64dbcfcb4cf38dbb768913f7a652
- SHA512 7f1ec2573133e6ae3a1e2a91bc578a31dcfea02d4522db14a4210b7ce88ed68a7e787a2284cb0fcc286a89f2e9a76da9aad033ee1d8fd652d47b7d90fca03209
- TLSH T1A8E0C0762DD72454BEAFC3D120308090060A749DE945FC0E541BF6C310B235530D7C75
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 15KB
- SHA256 ff18f821734d109910afe37a49a10a8f10cfd06910d2cfa41f14f0ee15e460ae
- MD5 b3892c55944f99ef8fda00d0879489e7
- SHA1 fdbfa5b16f9043bf764bb5f0ebe27cd72d757aee
- SHA512 524d2e060b9e91ca0eb569e156bd1b1ee84d39b12412b36f09ca331234c16a5ec0fdfc11a65ff1badcfb01b59137020f54b8c89cdbb1cb9b9cc2837e976f7552
- SSDEEP 192:u3m+xasuheOwQxMGsNlkQbvAM71rNQmiU15yU54MTQj+FdLKKSnGNlC8z12/q5S4:VZcIhsNlkk57dLbmkdeKS0l72eS4
- TLSH T132626C72AC785C3769F7F142F48A36075FF89027D6C45B94F6EDAB1D01E92A8030791A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 9KB
- SHA256 2648acba7f93f9deae62e75762e2581fc1ec4048579302b42876e1e4fd7a2274
- MD5 5c6c6e5650daa696f67f6d268b5a6ee0
- SHA1 a64f88a071387a303ec637553b54332010ff8561
- SHA512 e73149f8e2cf2e8bc7c58500305c1a8dc1aaad6146f5e3410c4c8f5859d9f6ab41006db090a1c47583988dbae631640483376e3a567302f83238821a93cea8c9
- SSDEEP 192:IONw6vMBPQmiUyOKyhTQj+FdLKKSnGNlV80I2/q5U/u:IONw6UBROybdeKS0l62eU/u
- TLSH T143123C72AC786C276E93B582F08B36075EF4916BEAC56B50FADD2F1C01EE65C1307816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 ddb1de6c87352108d0262048448f5ec159c8041cd4b7cc5df015669a24435258
- MD5 eb23574799c4d0d25e49041b30e866c2
- SHA1 d0ba0d807af170f1b181df61c7f4d838f91a631c
- SHA512 dc951b77cc746170444957b9bc7b3a60438f3ef7de21d32378660d85e4ad8a24b26c24498df1a51087ac8b9288b361b866099af8795f7968a5050eb9650c3c2f
- SSDEEP 192:lONQ6vMtPQmiUyJKThTQj+FdLKKSh8472mWU/u:lONQ6UtRHTbdeKSJ2NU/u
- TLSH T104020835AC786C7BAAB3BE46F48A27171FE4216BE5D11B54EAE92F1C00D765C1303826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 5919f31c086b934e8813dfed5acff33f3d9c813ac7d3ad07035845871c6a83d2
- MD5 5e888d1f9942e9fd247ccad84ba73898
- SHA1 b8227a1340460d70315bd4fa595f93a2553800bd
- SHA512 4ca72b995421fe7206351818f661523854eb5f8ed6647c2df0dec3c74b6c562c432d94959611b8df77f5d66ac0a6f14a120045651e7d1c648d4b60e9fa430350
- SSDEEP 192:u/m+xasuheOwQxMlEzsNlFQbvAM71rNQmiU1gyU54MTQj+FdLKKSnGNle8v12/qx:PZcIxzsNlFk57dLcmkdeKS0lj2eS4
- TLSH T124A218F258E75836D9AEA343A37D2E024EBCD027B6845A44B7DC6B1CCC9527FC306916
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 15KB
- SHA256 4de2db8a0fe89fbc9dd127c2a0a3aa743be0dd598f1727808bfdd23833edb070
- MD5 c15e30b8bc04ced59cc4f2a1100948a6
- SHA1 de2d4919a4b924604a5fac6eb1505763b989d365
- SHA512 32131e1662d209d10d404fc0083c6b67bb761735a05b2bffc4a4f31037ec518dba74409b1a4c5b9902d4f9b335fc2db93ef61cbdcdc728caa21b4cbe96f6c0e8
- SSDEEP 192:uCm+xasuheOwQxMGsNlFQbvAM71rNQmiU15yU54MTQj+FdLKKSnGNlC8z12/q5S4:AZcIhsNlFk57dLbmkdeKS0l72eS4
- TLSH T1E1626C726C785C3769F3F142F48A36035FF8902B96C45B54FAEDAB1D00E92AC030791A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 21KB
- SHA256 eff08ec6b54456095157c6c6d79a81da2c0fcfe93b5a4d0289dddad3883803cb
- MD5 3232dbeab4023cea903716db7f6e63f3
- SHA1 5fe7e04a288cc179153e38404cb52601f1c6580a
- SHA512 0e5fe357b526d549f5688df06e2373c49b95012c5649a5a863f7e05122cd6da0d996f0267e80b294c4886bfebf3e2c5fdb9c59437f060dee7b6c51a6b4153820
- SSDEEP 192:u/j+xasuheOwQxMlEEsNnYE/bvAM71rzQmiU1gyU54MTQj+FdLKKSnGNlq8U12/K:UZcIxEsNnpD57dlcmkdeKS0lG2eS4
- TLSH T1DEA218F158E75836D9AEA343A37D2E024EBCD027B6845A50B7DC6B1CCC9527FC306916
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 4d86afbea4a1cda797a4146eac4d56e4eb96c1101ae65af68168ba9b158ad497
- MD5 c47fd82f973457e0d63c5af5cb5fac94
- SHA1 b9d22484e4bc082499437abc6252cd0b8aa0dd7a
- SHA512 07e9799d991f1cfc02c0f465e536b9434d4ef3d0e65d27d398319fc3c004e347fae4fdaa9cdcb524442501496b9454159cbaf0020082b7304e96a985855edd06
- TLSH T163410798B6F91114B3B76F0A9BF6A86E447F7D372F46D49E10110E4F0A62A40C8B1737
- MD5 SHA1 SHA512 TLSH