hxxps://freemasonry[.]dev/dl/0d5397429794f2389bf0a8d87f8eb3a6/raw

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/08/2026, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://freemasonry.dev/dl/0d5397429794f2389bf0a8d87f8eb3a6/raw
Sample260807-x2d4wasbre

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
16	3544	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3544	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306040479337543"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{6C2F97A0-2D55-476A-AF75-66F4DEAD25E4}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ssidviewer.bat:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 3216	4396	msedge.exe	81
PID 4396 wrote to memory of 3544	4396	msedge.exe	82
PID 4396 wrote to memory of 5312	4396	msedge.exe	83
PID 4396 wrote to memory of 5312	4396	msedge.exe	83
PID 4396 wrote to memory of 5312	4396	msedge.exe	83
PID 4396 wrote to memory of 2904	4396	msedge.exe	84
PID 4396 wrote to memory of 2904	4396	msedge.exe	84
PID 4396 wrote to memory of 3020	4396	msedge.exe	87
PID 4396 wrote to memory of 3020	4396	msedge.exe	87
PID 4396 wrote to memory of 3020	4396	msedge.exe	87
PID 4396 wrote to memory of 4988	4396	msedge.exe	88
PID 4396 wrote to memory of 4988	4396	msedge.exe	88
PID 4396 wrote to memory of 4988	4396	msedge.exe	88
PID 4396 wrote to memory of 4952	4396	msedge.exe	89
PID 4396 wrote to memory of 4952	4396	msedge.exe	89
PID 4396 wrote to memory of 4952	4396	msedge.exe	89
PID 4396 wrote to memory of 1104	4396	msedge.exe	90
PID 4396 wrote to memory of 4804	4396	msedge.exe	91
PID 4396 wrote to memory of 4772	4396	msedge.exe	92
PID 4396 wrote to memory of 1104	4396	msedge.exe	90
PID 4396 wrote to memory of 1104	4396	msedge.exe	90
PID 4396 wrote to memory of 4804	4396	msedge.exe	91
PID 4396 wrote to memory of 4804	4396	msedge.exe	91
PID 4396 wrote to memory of 4772	4396	msedge.exe	92
PID 4396 wrote to memory of 4772	4396	msedge.exe	92
PID 4396 wrote to memory of 732	4396	msedge.exe	93
PID 4396 wrote to memory of 4776	4396	msedge.exe	94
PID 4396 wrote to memory of 732	4396	msedge.exe	93
PID 4396 wrote to memory of 4776	4396	msedge.exe	94
PID 4396 wrote to memory of 4844	4396	msedge.exe	95
PID 4396 wrote to memory of 4844	4396	msedge.exe	95
PID 4396 wrote to memory of 5664	4396	msedge.exe	96
PID 4396 wrote to memory of 5664	4396	msedge.exe	96
PID 4396 wrote to memory of 5664	4396	msedge.exe	96
PID 4396 wrote to memory of 5688	4396	msedge.exe	97
PID 4396 wrote to memory of 5136	4396	msedge.exe	98
PID 4396 wrote to memory of 3804	4396	msedge.exe	100
PID 5136 wrote to memory of 1940	5136	msedge.exe	101
PID 4396 wrote to memory of 5464	4396	msedge.exe	103
PID 4396 wrote to memory of 5408	4396	msedge.exe	104
PID 4396 wrote to memory of 5436	4396	msedge.exe	105
PID 4396 wrote to memory of 5956	4396	msedge.exe	106
PID 4396 wrote to memory of 5956	4396	msedge.exe	106
PID 4396 wrote to memory of 4400	4396	msedge.exe	108
PID 4396 wrote to memory of 4400	4396	msedge.exe	108
PID 4396 wrote to memory of 4752	4396	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://freemasonry.dev/dl/0d5397429794f2389bf0a8d87f8eb3a6/raw
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2bc,0x7ffcbfbfc188,0x7ffcbfbfc194,0x7ffcbfbfc1a0
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,3581347799178583285,16374126672463972508,524288 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,8195440250627924346,3567613463725664069,262144 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,1746688033251723456,14922898374923819677,524288 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:13
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,7774156840629747555,15101147345672050032,2097152 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,8232513757527196940,6296918297039923700,2097152 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,3444154339636747886,6417492618247656975,2097152 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,11513896222456274469,4093994944335123294,2097152 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:9
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4248,i,5927392035127783070,16696853024316175418,2097152 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4312,i,17580708900710554658,7618469879064201081,2097152 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:9
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,6081167714457310085,12359756662153523136,524288 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,5108891880012590120,11738793734241045911,524288 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,8047134934502348320,3434769379201798378,524288 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5932,i,13001159281121983652,3185393345584835750,2097152 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,10589135063976286704,8166243308670012711,524288 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,18269399976239511160,16016367857961726057,524288 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1136
    3⤵
    PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,5235684371891126702,3706170278380508707,524288 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,5235684371891126702,3706170278380508707,524288 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,13255495369714111640,14511668260597254939,524288 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,7832250765114605193,1643855118372120017,524288 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,10301647725878905379,13149066067522579922,524288 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,10246114367645955459,3142234849378029306,524288 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,3505171944608478375,12511466927797557495,524288 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7024,i,399068710737738754,4903488582991387415,262144 --field-trial-handle=2140,i,8782512987094159109,830425197574203497,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 987a8409b500944c2e91e6f0b356beba7853fbf9bc34127cdcac87e36a5d159b
MD5 711b7276ab4cac5c7d0662623628b4f1
SHA1 c0b08a2ce958cd6b3cf43b1b606bddac6f416c76
SHA512 53334798f71067d33c5ea1fc8c14893238cf2be2d4562c934fc37a0753148ec6d84178d601e10f62955b9a3059a4dc075f4e1a5620c5a7ef13184470d069a6e8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P76:fwUQC5VwBIiElEd2K57P76
TLSH
T188B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6f94f839ea1445fe2d2975b76e7405f2c4d0c81c074f8b6b93e058f289202529
MD5 791c4ad3c3314568904f2acc113d09f3
SHA1 2dfa5569c4daeefb3c55d8b918f0b4bce353c0fc
SHA512 d1f9dc546154913502134dba8cd9c52da04dadb24bbca2bdebedf2cd1ccec11ad83fc7354974a44d87d5bcf06aa162d50f4ee08521c91e3e4d2dbd9f229097a0
TLSH
T1B5715D25896157B1F31F0233ADD3171539F17A9A190B2E763153AF367503B37D805780
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a7a5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a7a5.TMP
Size 3KB
SHA256 7f458e27ff683e61e36c9311178d3335266dae087b58da5609637681d25ea7be
MD5 0cfd3f8b14299dfa90aa92a3e3453960
SHA1 6a63999401d5a377bb70153f7eace34f1c00c5be
SHA512 eab66cb8c8aa7ad66d2c0f53f9535853561011ff73991b57b5b9fd11b686004ae714b0b91949c708fc6ebf7c583be5417f8f0089320cfddb7143a79b668a40a6
TLSH
T194715D25856153B1F31F0233ADD3171539F27A9A190B2E7631529F367503B37D905780
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 89b7f858543968a854041ad53e3c040188a3dc19f91592d23d629bc966c621b1
MD5 26d889fc779be34d207e9c2ca532accb
SHA1 2e2a9ab37666c7a1f465692103ff6bb64f7c3648
SHA512 62e84b35a81e9a9b02faeb67a7027db62d1ccc9564d53cae7659ab75b6556dc2e3f1a6fe9a8326f9e902cd3d75851d242b1d626bab08ed0a3e58810a67421f99
TLSH
T172214DF3C3D5C6AEC90516F09A146E1BCE1D051943283D29CAE4FF5BA7E3075E10559B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bc860e6a3c1ab804dc689adab169b286abd8146e4cfc3f6f6cf48d631b914951
MD5 cfe4c02c96effe2ff93b84160b6b9e59
SHA1 0e113b1752581f425d7d9c4753d6b21fac3c6b1f
SHA512 db5686c128b633beab3c3b5b94d2b6389b16785f12efb1654b39cd7a49b12b9a65ead9ff9ee992052a3ec4625ac3ac951254ad540767ce43cb0ca36fc22112b8
SSDEEP 192:sxZFRHyM/jK1Ml8UQjoF/fCsfefPOaIdpW/W6+WNGY05qmyjsIg5mJ:sxZFfq8F/fCsfCOzW/bG56Mo
TLSH
T18A52F746AE346977CCDBD309BA51BF93D6F8057392900E54A9FCDA1C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9b2a65fa7015c4ad27171f1f3356671a802cfb531d38015e53ca279ed0c5d132
MD5 ca803c71dfe738045eb1a5182c713371
SHA1 7d70c175e5e1045cb32f110448e9c515436a5638
SHA512 dd553fa95b6055c9068d058ca690240edcae36893c65e1136afae0fdca30246d40230bfb3e31c701e48ffbdf76c40b5525b6d1440eeae450b997fdc4e89eb47a
SSDEEP 192:sxZFRHyM/jK1Ml8MoF/fCsuefPQaIdpM/W6+WNGY05kVqjsIgrJ:sxZFfQF/fCsuCQzM/bG5NM9
TLSH
T1D542E6026B346977CCDBD309BA55BF93D6F80532D2900E58A9FCDA1C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 f1b2c81a6593437e12632e2b9e7b76bc63c45748833b290f0852ddfd8a14244c
MD5 6cb599dfd0c90ef30424bbada3a8dcbe
SHA1 e3517870a519ffa8bbb218e2d302e79dab5afb54
SHA512 a5373d75004dad9f620b1be3b442199aada8ea0d0b4c32a9f14825cac46f8502cb36e2b3ef004e17cc709fb5160bb8db07f0ec8fca3d1b4d26179b091ee88eb0
SSDEEP 768:GxzXl8pZ221WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u/Ll/df0hh9ro00:GxzXl8pZ221WRmsYQL0u1jaKu/Lpd8hi
TLSH
T121E20B3F284CCB7E4F844E9CEC266F966ED801CBA6584D5447FA494C03C67DB522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b09ebd5fa0f936cb6bfb5eb4b29181e3ab58b9f07dc0224d142ee77a992b8dc9
MD5 c52a9dfa0336d810a4e8f1f8346561e5
SHA1 94f29195c6b1832c066b0ea0a11190802ac5fc92
SHA512 23958f508b97522785a52792d25efc49eab8c67e58cf196ce5b25c656bd636a6697d5cb9155bedd88e4696b0bb39a4cfc392d3fb5d199a095bb4d2b84d67e829
SSDEEP 48:KgtIFKGww3y56IvKjqo/hIVKCw4fyNLsP71xNkdxY:KgtWKGwSq6UKjqYh6KCwCKk
TLSH
T16B91A95331BF06A13C7E250C81618616265270EB3118A97F7BE900B21E67E6B6EFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7a51ea9-cd40-479d-ba97-fd623dba0027.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b7a51ea9-cd40-479d-ba97-fd623dba0027.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 c751347333899df9678a19fe77fb2fce678114f79b2df05f5e685ef7e3a01404
MD5 39f00f73bb8725887a2f5ed41867c959
SHA1 7a5860310aa49e79719f7f4b7af9c98ed799ffcb
SHA512 8616e9dbacffaa8e5949461c20f8c65ab7ddba746ac6f6640488af9698c6ba09924ac083ee37ca2f772834f144cd3d0f2d98057b6a30bc8cfeaa8d2a749e9038
SSDEEP 192:uK88NIHQBfscfNEuNQmiU1T4fx74K/GPTHXRLrgPLVsAjqJf5CFh9L+3grj+pWt:Y8NIHY1EMF4pkK/Aratmf5Urz0Wt
TLSH
T155726B716CB8AC3B4DE3A645B90732139FB451A7C7C52E98DAED3B2C05DE19C630781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 d6144a5980a70f7932609272d81f968d39215120ae5905be4de649d24499d7e9
MD5 b2524663e950d5b79286502f4c5e4b37
SHA1 5c1e922c6fb7bf11001db4e02ce7d9378a34bede
SHA512 3571510ba72b3b2e8bca736769febe27e5753607bbc2adf959f118c32618a40b2ef768db1e1d76468fdb11971e660f0b05cbe76e46ea0eda334ecda30845dbff
SSDEEP 384:niFvZcIzv8N48TUNTUlIlaY1EMF4pkK/ArMZmf5Urz0WG:iFnLVwg8H/A4ZmS0WG
TLSH
T1A0B27CB25CE8E83FADE69A45F94A32178FB451A7C6C56A94E7EC7A1C009A0DC1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 87ac3a1cb6bfbb47bc5ae785ffa6cdf7a59a8e8d46fb41086c3fa452a4b5fd60
MD5 09310cc7866cf654d82cf29d8ca91da4
SHA1 8c6f651b241f7e861e824f81811e13b8546389df
SHA512 ae5425a7f9eafcb0fcfc2ee590b2ab1d1534a4812cc18e7ec6d9aa3693b6e4bc94b0954c63b6a72f927163875001e04578e62c41d9674b67f6b7388043e90088
SSDEEP 192:udj+xasuheOwQxM98NIYJQBfscfNEuNQmiU1T4fx74K/GPTHXRLrgPLVsAjqJf5n:AZcIq8NIaY1EMF4pkK/Aratmf5Urz0WG
TLSH
T1C192AEB05CB8AC3B59E7E644F94632178FB45167D3C42F98D6FC7B2C059A198270382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 86c071fbccc9604871c3eedb53a4207687232263ae0b4967761e866a134e07b7
MD5 8545566c4cce128afd86f3d7f5c1eaeb
SHA1 d57b17262bb4413dab641d5a66e9c82086588aa8
SHA512 a238d692395573b3c0f13cc2ef9413044ad6cee40b54efad441b6ca6bc2c4ef2b231e40975ef33c33dabbad69e2a66d9a3341ba250f4fc1f023bc99dfc42bb6b
SSDEEP 192:7GNv6fNNQmiUy2zHGPL/GPTHXRL1V7qG6U6:7GNv61LBzmPL/A1UJU6
TLSH
T13C020934ACA8687B8EE2AE59F58377175FA4217BDAD51F54C6E42F0C00D769C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 5b008fefcb61a3f6a21fc6316779afcae1a784e04ee9d09984250bf89187fbc4
MD5 7171334ab3d7b57d986a96badc991586
SHA1 e0d351e8e62e18292f91f2eb1f24f679e5652dc8
SHA512 031e52fcbbf65f99496216598b962f6151e6c76b56456f132be3ffb43a795ef47bd1f6d6ad3f1e898cfdcc0f735d605408c00316fbd275e906c939f251675466
SSDEEP 192:uKb8NIYuQBfscfNEuNQmiU1T4fx74K/GPTHXRLrgPLVsAjqJf5CFh9L+3grj+pWt:v8NILY1EMF4pkK/Aratmf5Urz0Wt
TLSH
T156726A716CB8AC3B49E39644B90732179FB451A7C7C52E98DAEC3B2C05CE19C630781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 810ebd52145dfbd269888778722f6b892b392bcb91bfd7f0792967abf519538f
MD5 7737de4381a6d00885ac5a19742cbe12
SHA1 d9f9ad22b6ec2b5a202ae8fea90ddfa47fe0a359
SHA512 60cbfafc67fdb6e2586fc567ec8cc5ecba33d2052b69da18fa8b6831eaf270a0b06b23bce99eb70de27560b1d9b48ef0439ea07b72275d1c484fd23d14e3ab82
SSDEEP 192:sGN56fN3QmiUyE4SGkL/GPTHXRLrgP3V3ZjqJU6:sGN561ZB4XkL/Ar4LmU6
TLSH
T17E120831ACE8A83F4DE2A955F58336135EA4516BDBC96F54C6EC3B1C01DF5A8230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c0012d4-6cba-4c77-af4c-c99ef31583bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2c0012d4-6cba-4c77-af4c-c99ef31583bb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ssidviewer.bat:Zone.Identifier

Path C:\Users\Admin\Downloads\ssidviewer.bat:Zone.Identifier
Size 99B
SHA256 1302e485141b11b3c554ec48c81dcf3efb7c5a15a085b2114936f18b926a27f9
MD5 f23bc110e360aa98b7d5ea31f4a279e6
SHA1 bdec72422d93d62c32eb4e93992b1ac13f32ead4
SHA512 00220367ca2d7d2a84c8c48e110e324d7200847e248d814bc4a298957bdd3bb6260a126f6e88039ffca188e359db0c5a540ea68311bb91da9823841bb4f8118b
TLSH
T1A1B012FB00015AA84D4734880CEC8514604F763D8ED55906E980A6D6C54A099135D51F
MD5 SHA1 SHA512 TLSH

Submit Download