hxxps://campanha[.]corpacademy[.]com[.]br/track/click/QnZJNHpheVA3RERXRGVYK2ppV2JkOCtIQStCNW1MMThPKys2L2tqRGdDOWFucjRBWGc4R0VtcjEySmcvaGdBMitUOEtDaGR1M1ZmMkFMZk5mMlFtdVY5bjMwMVgzSlN6czJKS3U3VkE3SlNKRkRFRWxBWHd2L3FsYkN1Zk5YNGVnSUM5N3FBZjRUcG9rbkRBMGlUU1FiUGNwOXRHQ2wzK0JuckNOY1g2SEVPeTBOSGozWWlIY0NDVW1HWHVjUlJrcXZ4TUpPM3JXSTBRRHQ1VXhjMFRuSVB0aEVPeEJqMGJDQmpDNU45aFI4WXJvdWV4cTZwRitxQUNMQ052SjRlaVE3WnpZbWtPaWxGLzkrSmhTaG1ubVppK0hJemVEaVNwZHFpRkVlR1hLdVVwV0pCTW5ROVg0NnlMVksxbkVUYnhxZFlHZzFLdnB1N0JtUXU3RnB2elhRPT0=

Analysis

user interaction
yes
max time kernel
91s
max time network
88s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://campanha.corpacademy.com.br/track/click/QnZJNHpheVA3RERXRGVYK2ppV2JkOCtIQStCNW1MMThPKys2L2tqRGdDOWFucjRBWGc4R0VtcjEySmcvaGdBMitUOEtDaGR1M1ZmMkFMZk5mMlFtdVY5bjMwMVgzSlN6czJKS3U3VkE3SlNKRkRFRWxBWHd2L3FsYkN1Zk5YNGVnSUM5N3FBZjRUcG9rbkRBMGlUU1FiUGNwOXRHQ2wzK0JuckNOY1g2SEVPeTBOSGozWWlIY0NDVW1HWHVjUlJrcXZ4TUpPM3JXSTBRRHQ1VXhjMFRuSVB0aEVPeEJqMGJDQmpDNU45aFI4WXJvdWV4cTZwRitxQUNMQ052SjRlaVE3WnpZbWtPaWxGLzkrSmhTaG1ubVppK0hJemVEaVNwZHFpRkVlR1hLdVVwV0pCTW5ROVg0NnlMVksxbkVUYnhxZFlHZzFLdnB1N0JtUXU3RnB2elhRPT0=
Sample260925-wp954sshpf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4996	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{BD233964-F327-408F-9AAD-AC44F9795B5A}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2420	2992	msedge.exe	89
PID 2992 wrote to memory of 3196	2992	msedge.exe	91
PID 2992 wrote to memory of 4996	2992	msedge.exe	92
PID 2992 wrote to memory of 3196	2992	msedge.exe	91
PID 2992 wrote to memory of 3196	2992	msedge.exe	91
PID 2992 wrote to memory of 3264	2992	msedge.exe	93
PID 2992 wrote to memory of 3264	2992	msedge.exe	93
PID 2992 wrote to memory of 2160	2992	msedge.exe	94
PID 2992 wrote to memory of 1292	2992	msedge.exe	95
PID 2992 wrote to memory of 2160	2992	msedge.exe	94
PID 2992 wrote to memory of 2160	2992	msedge.exe	94
PID 2992 wrote to memory of 1292	2992	msedge.exe	95
PID 2992 wrote to memory of 1292	2992	msedge.exe	95
PID 2992 wrote to memory of 5768	2992	msedge.exe	96
PID 2992 wrote to memory of 5768	2992	msedge.exe	96
PID 2992 wrote to memory of 5768	2992	msedge.exe	96
PID 2992 wrote to memory of 1288	2992	msedge.exe	97
PID 2992 wrote to memory of 1288	2992	msedge.exe	97
PID 2992 wrote to memory of 1288	2992	msedge.exe	97
PID 2992 wrote to memory of 4640	2992	msedge.exe	99
PID 2992 wrote to memory of 4640	2992	msedge.exe	99
PID 2992 wrote to memory of 4640	2992	msedge.exe	99
PID 2992 wrote to memory of 2472	2992	msedge.exe	100
PID 2992 wrote to memory of 3168	2992	msedge.exe	101
PID 2992 wrote to memory of 2472	2992	msedge.exe	100
PID 2992 wrote to memory of 3168	2992	msedge.exe	101
PID 2992 wrote to memory of 2728	2992	msedge.exe	102
PID 2992 wrote to memory of 2728	2992	msedge.exe	102
PID 2992 wrote to memory of 2728	2992	msedge.exe	102
PID 2992 wrote to memory of 1988	2992	msedge.exe	104
PID 2992 wrote to memory of 2584	2992	msedge.exe	108
PID 2992 wrote to memory of 4676	2992	msedge.exe	109
PID 2992 wrote to memory of 4484	2992	msedge.exe	110
PID 2992 wrote to memory of 1268	2992	msedge.exe	111
PID 2992 wrote to memory of 1268	2992	msedge.exe	111
PID 2992 wrote to memory of 5332	2992	msedge.exe	112
PID 2992 wrote to memory of 5332	2992	msedge.exe	112
PID 2992 wrote to memory of 1308	2992	msedge.exe	114
PID 2992 wrote to memory of 1308	2992	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://campanha.corpacademy.com.br/track/click/QnZJNHpheVA3RERXRGVYK2ppV2JkOCtIQStCNW1MMThPKys2L2tqRGdDOWFucjRBWGc4R0VtcjEySmcvaGdBMitUOEtDaGR1M1ZmMkFMZk5mMlFtdVY5bjMwMVgzSlN6czJKS3U3VkE3SlNKRkRFRWxBWHd2L3FsYkN1Zk5YNGVnSUM5N3FBZjRUcG9rbkRBMGlUU1FiUGNwOXRHQ2wzK0JuckNOY1g2SEVPeTBOSGozWWlIY0NDVW1HWHVjUlJrcXZ4TUpPM3JXSTBRRHQ1VXhjMFRuSVB0aEVPeEJqMGJDQmpDNU45aFI4WXJvdWV4cTZwRitxQUNMQ052SjRlaVE3WnpZbWtPaWxGLzkrSmhTaG1ubVppK0hJemVEaVNwZHFpRkVlR1hLdVVwV0pCTW5ROVg0NnlMVksxbkVUYnhxZFlHZzFLdnB1N0JtUXU3RnB2elhRPT0=
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffe15a9c188,0x7ffe15a9c194,0x7ffe15a9c1a0
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,9208274109329221320,7714881028906922778,262144 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,6522490862849949643,5198018516347585700,524288 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,11204957587170149209,4119053413140376424,524288 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:13
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,271487044164062565,9741575901648930617,2097152 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,5467106563662399506,3010620792515817157,2097152 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,11259665187879705474,3463396230209316689,2097152 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,3413388752468733163,4702083921696070546,2097152 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:9
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3904,i,16765074816521237752,4193052602825409320,2097152 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,14212140347185814134,5149680920589832962,524288 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,4289820064053656028,12825029379739016621,524288 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5456,i,9639410498992231904,13833472755171924371,2097152 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,10938367854441873215,15500453620648082267,524288 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,10938367854441873215,15500453620648082267,524288 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,4384474682438899229,4789321103747314449,524288 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,2691771574319137553,14577555617922753677,524288 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,11664050776850654665,2090784438798602973,524288 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,4188126719088766764,3389606442704765929,524288 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=1444 /prefetch:14
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,6936159761808814812,11543273925828362977,524288 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,7261334457672613031,16359009507567954807,524288 --field-trial-handle=2448,i,928834252184466907,4345503492991412826,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7bdb36b6546986ef1d80d1fbf0d2393ddc34ee5ab5e16d49b9767bdaa065a0b4
MD5 fe24339954269f1ecc884c3f2b5967a1
SHA1 d287132f9d0c847fa4532a696711cd9fa2596709
SHA512 734b7be469eba6d5a8bebd91c0331160e8ef0f5151d189c43c33d1e26b104bd5e7eafa597afb1f47fe29fe3330b400ed308332f7aa2d062e5dffc82f8e2a1113
TLSH
T1DFE086D809DAC26EE305648B867CA74D8390770A96CCEE4E170C868CF142945E6A2792
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ec85fc5b21a28429e660adb6f6abb42f8718e66239ad7920c491d92ab5a45167
MD5 2464dcb79b2075e8de0cd5d845142478
SHA1 6033045df8eb2d7a1f6de89d449252674ba82379
SHA512 4c127ab31aabd1808f4ee8e526e2f7b09d9fc15385111a1c910eb6ec580c9197f4815f8a7630bcfd540d4dc6b5f8ed1098c2e7182fbca6d33fe97e7dd63c6c49
TLSH
T1F471C4C361F0E36FFBB8A830C7D76CDB3A34778A124B4F116A91C8751842717A2048E8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59acb1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59acb1.TMP
Size 3KB
SHA256 5dbcb786f10bcf875594095ef86e9fea9a98981e108c17cc5efd17b273b0d160
MD5 e75cb0275dcd4e83a0c9c3071c0cb9fa
SHA1 d4b8d293b35196fd42777dde63779753c3a9f97a
SHA512 ed55983f7dca9cd32c0a3e087737a5f058df3b33d83a5548361f5743b82a67ea3fd7764110ad0f943c1b305d833e78e9e3e2731018602cb4bf1fdb3f99779f32
TLSH
T1436118C360F0D36FFB78A930C7D3ACCB3A307B99104B4F11A991C4B55886B1BA1048E8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 260e779867475c118e265afbda5de553383002c554782bf5f3e90973683c7ecc
MD5 637a97acafa7c23181b765891106bdfb
SHA1 8a87a3034f668d153c7cdbe6723b407ae267398c
SHA512 6a4fa93a951555814f66324f47406b40b0445a7b9ceefad193284753ecaf8370f6b5cf1b35411892f5e18b4b7c4e75f9918f8bbb81a5f4fe3b526bf7dc90d43c
TLSH
T11471CFF3C3F8862DCC2156F4AB156E1ACE5D0D5883283D5AC8D4EF5BA3E2871E24095E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a0450486574d0800f4d6a41a657dab9ffe55fc2ddc4fa2b3b4a83d5765f3b02d
MD5 5f3b14c7f25ac35ff7196f2add652bc8
SHA1 ba2203b41d61ad87845ed25c50949b87c3a50d3a
SHA512 169f5bc13689b5c938d4ef235744609fa9b27a008559de5f226188c43d37f5875e99976f2fa4bbc261e4302d067d390700aa53f46b08e21a5beda47cdc90811c
SSDEEP 192:sxRWRDba/feCseJqrVivzoA8ppz/g6+WN59l/YxbqUb+GOIgIJ:sxRWda/f3seJeiGF/5B/TUbks
TLSH
T1763286196E28A93B8CCBD21DFA55BF53D6FD1033A1955F48E6FC861C04E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 951d0d726811556dfd68ac30103c0003564f833d58632ebc473f9bac48dec7a5
MD5 bb1b120beb7173129a5f5519729e0095
SHA1 c6cc076c05c79338558c0f68b04241608fbd3ba3
SHA512 2b72db5fa6230d61565708109732c96e5200de4cc0fb6b781ef7e385587069b0f28ac66eb815158696f8d2259a77c31bb83fd16f014b1e16a3fc04eac3a8bfbb
SSDEEP 192:sxRlRDba/feCs97qrVivzoA8ppz/g6+WN59l/YxuqUb+GOIgDjJ:sxRlda/f3s97eiGF/5B/EUbkJ
TLSH
T159429519AA28A93B9CCBE219BA55BF53D2FD1033A1955F48A6FCC61C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9f9b7932bad0426c9a5e2a7922af7f58208de774f8500073b090d9cf02b6664b
MD5 32255176c613092cbe19faa50ebae76d
SHA1 d2ce9ab25dc3a57a4696715f61ceea512e08da7d
SHA512 a93a4e843a7fad551d37b235829ef976e5a855b77fba5add09bb4e118a1f81b72e09407199526be0d9b186581daa1ae048963a0c04ce0c2f0a24222fde149969
SSDEEP 192:sxRlRDba/feCs9JqrVivzoA8ppz/g6+WN59l/YxbqUb+GOIgDNJ:sxRlda/f3s9JeiGF/5B/TUbkb
TLSH
T182329519AE28A93B8CCBD21DFB55BF53D6FD1032A1955F48A6FC861C04E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 6421bebca983b9d0628836f2c72bddd3d97ea6842425cbefc3d343083af46cac
MD5 d0823fed9befd3c82c47959f71e490bf
SHA1 a3855f204df56588dac59d071120873fe3e39f6b
SHA512 24759d56e6574bdc201c3fcfe356b679bab81193ca1ca4a02a310bc5a3a9ab5c209662a7a0b3b1dfb4feab3cc397c10156f2f9a9ef1bd562847f86f530007ecd
SSDEEP 384:z/ZDnwZfCtgbRFfkWKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVnL9K6RMZrow2Q:zBDnwFWgbjfkW8F1+UoAYDCx9Tuqh0VV
TLSH
T1D9B2C92F644DC77E8FC00AAD9C196F9B7D9802C79A548D4047FE994C02C77EE922A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c7edb77208fe040b6c5569cf81234f712b2e719b829ce6d405f3231f99c0d296
MD5 b7029ca3d065b06d66334b7278540863
SHA1 3db0483b93bf01b7d947c0661ed96fe126d33c02
SHA512 946ae029c2d09a9dee691849fe8a6d3e55049c6ebd529be91ee30c8c7eb8e72685bd9dc5d869832ea1c027d3afc849b4dd8f77bd1c08f925d352e0d08b2d7cf2
SSDEEP 24:KSAXAYmIpK0hk1KS5+C5yXRKNCg4IZK2h41CSXwWO5WAEIZKShw1qSD09yX7MXi:KYxIpKikUc5yVzIZKg4843IZKkwUTyP
TLSH
T18F91FE12327B1601393D390C95E0A76FA34231737068EA2B7FE915A58EA6E250CFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

565a3a3e-2b98-4a26-9c69-21de0196b826.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\565a3a3e-2b98-4a26-9c69-21de0196b826.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 32be1570ef8c6dbc2c6f3f6b70c9a3adf65605013c59171c2a43909e562d741e
MD5 2f78f5c99f8a5c4b667f78c55575c643
SHA1 688c3ec565096ef597a382c44131b02a70f2c7b5
SHA512 7ced257864a34fc9fc31d88ca7297cb7b8b13139d921338484760c28b77dcf131add2c6a10ce39f8bcfc0374b7b8b69be49df3cd34f3e16a1b6b65f6289c56d9
SSDEEP 768:dJ3yW9TOfZf4t5fMyJYe1ELsAvC8/YEqK2sMx:dJ3YfZfofNYe1EQujYi2sMx
TLSH
T1BFF2AE72DC74CA772DF69695B6462B03BFB88113A5C89B44D1DE270D04C7AAD234F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c82e93802d11871997a04c492a2744b4f2d0492bb625a82e1c5b1b5b349c43ce
MD5 9a2a87c70c4a311e93378a9b7cb66563
SHA1 4fab590393cc506ee4e273f07d1f0a87debf4c41
SHA512 f395ff46066da0284dff27a27c913bdd6759efbf3391ba19ab8cf255cc44dd4c8d9d73b55b76681f9889238fed41602f256904610ae72755bef9e47894c4d015
SSDEEP 768:qJ38W9TOfZf4t5fMyJYe1ELsAvC8/YEqK2sMx:qJ3mfZfofNYe1EQujYi2sMx
TLSH
T1FBF2BE72DCB4CE772DF69695B6462B03BFB88113A5C89B44D1DE270D04C76AD234F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 8a737b7623bd4ff3b70fd64e6d908ce5c82d7ed0c9df438c10702774acd7b6c7
MD5 99098f2eedf55d4ff7b7f738ae0a25ab
SHA1 3bafb4a8375d92c49726c5ece00f542ab4aadeaa
SHA512 e34fe58fe0dabaf1b4d3c55caa4e7dd5339c54fd0d693ff978f00e3d0735fa37722393055fe0ce79530dceca8c1900c207a4b97f5056f54a76c89cd41e224c14
SSDEEP 768:vFQe3mwg+W9TOfZf4t5fLGJYe1ELsAvC8/YEqK2sMx:ye3nfZfofIYe1EQujYi2sMx
TLSH
T10F134AF288D78936DDAD9787B77D2E02AEBCC113B4849650B3C9160DCC866BFD30A855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 f1be23a555cf6daad32d65592a0f17ac664c15607fd1bcad04fb6932a432252f
MD5 4652d3976fad28ccb423181917022e60
SHA1 f31e4aa95c9e86581c1cb5dfe9098e8021494610
SHA512 b85007ba49158a1acb886fe577388e75c0dda0f3ba6ac51a94e52df9dd3c8eecfb36b90fa08d677d73a0b48f45c04494032c0a26229c6bca3023366c2f3562fc
SSDEEP 768:h/UxvxjgC+i3Nj9TOfZf4tSKJYe1ELsAvC8/YMgxSHrkw:0Zj3+i3SfZfIYe1EQujYPS4w
TLSH
T16F03C036ECA48C375DF2A788774A5757FEF4812394C46AA886DD2B0D05C73AC630F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads