hxxp://bestel[.]com[.]mx

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 11:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://bestel.com.mx
Sample260813-nhermaxhra

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1504	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310938269358553"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{9288E6EA-47A8-49C5-96B4-7067510C1185}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
880	msedge.exe
880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2816	2032	msedge.exe	83
PID 2032 wrote to memory of 2664	2032	msedge.exe	84
PID 2032 wrote to memory of 1504	2032	msedge.exe	85
PID 2032 wrote to memory of 2664	2032	msedge.exe	84
PID 2032 wrote to memory of 2664	2032	msedge.exe	84
PID 2032 wrote to memory of 4912	2032	msedge.exe	86
PID 2032 wrote to memory of 4912	2032	msedge.exe	86
PID 2032 wrote to memory of 3188	2032	msedge.exe	87
PID 2032 wrote to memory of 3664	2032	msedge.exe	88
PID 2032 wrote to memory of 3188	2032	msedge.exe	87
PID 2032 wrote to memory of 3188	2032	msedge.exe	87
PID 2032 wrote to memory of 3664	2032	msedge.exe	88
PID 2032 wrote to memory of 3664	2032	msedge.exe	88
PID 2032 wrote to memory of 5020	2032	msedge.exe	89
PID 2032 wrote to memory of 1264	2032	msedge.exe	90
PID 2032 wrote to memory of 5020	2032	msedge.exe	89
PID 2032 wrote to memory of 5020	2032	msedge.exe	89
PID 2032 wrote to memory of 1264	2032	msedge.exe	90
PID 2032 wrote to memory of 1264	2032	msedge.exe	90
PID 2032 wrote to memory of 2300	2032	msedge.exe	95
PID 2032 wrote to memory of 3548	2032	msedge.exe	96
PID 2032 wrote to memory of 2300	2032	msedge.exe	95
PID 2032 wrote to memory of 3548	2032	msedge.exe	96
PID 2032 wrote to memory of 4892	2032	msedge.exe	98
PID 2032 wrote to memory of 4704	2032	msedge.exe	104
PID 2032 wrote to memory of 4704	2032	msedge.exe	104
PID 2032 wrote to memory of 4704	2032	msedge.exe	104
PID 2032 wrote to memory of 4256	2032	msedge.exe	105
PID 2032 wrote to memory of 4256	2032	msedge.exe	105
PID 2032 wrote to memory of 4256	2032	msedge.exe	105
PID 2032 wrote to memory of 4128	2032	msedge.exe	106
PID 2032 wrote to memory of 4128	2032	msedge.exe	106
PID 2032 wrote to memory of 4128	2032	msedge.exe	106
PID 2032 wrote to memory of 604	2032	msedge.exe	109
PID 2032 wrote to memory of 3244	2032	msedge.exe	110
PID 2032 wrote to memory of 3752	2032	msedge.exe	111
PID 2032 wrote to memory of 2424	2032	msedge.exe	112
PID 2032 wrote to memory of 2424	2032	msedge.exe	112
PID 2032 wrote to memory of 2424	2032	msedge.exe	112
PID 2032 wrote to memory of 4944	2032	msedge.exe	115
PID 2032 wrote to memory of 4944	2032	msedge.exe	115
PID 2032 wrote to memory of 4236	2032	msedge.exe	117
PID 2032 wrote to memory of 4236	2032	msedge.exe	117
PID 2032 wrote to memory of 4236	2032	msedge.exe	117
PID 2032 wrote to memory of 716	2032	msedge.exe	125
PID 2032 wrote to memory of 716	2032	msedge.exe	125
PID 2032 wrote to memory of 880	2032	msedge.exe	127
PID 2032 wrote to memory of 3588	2032	msedge.exe	128
PID 2032 wrote to memory of 3588	2032	msedge.exe	128
PID 2032 wrote to memory of 3588	2032	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bestel.com.mx
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x25c,0x7ff90f1fc188,0x7ff90f1fc194,0x7ff90f1fc1a0
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,13969268527740378684,2718438512500849121,262144 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,4841485178111679783,10990896601556300347,524288 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,12258059133012659536,10666217421379645402,524288 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,6378909303738405085,12158976715427293818,2097152 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,14705592551164629896,5988275623550294457,2097152 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,883363046153225777,9858278056090793617,2097152 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,3934394251601520479,10513732003877918642,2097152 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,17980949385748396820,1577346621515632748,524288 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,15161028220460209918,4345515284735413912,524288 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,2508484338152672460,15896556178696414407,524288 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,2508484338152672460,15896556178696414407,524288 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4164,i,1142781992100652981,10893178002786591498,2097152 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3560,i,14054251374528940890,10795172327619715493,2097152 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5052,i,72462063028767656,8142261083734197852,2097152 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,4372066847490861481,10208676155509771866,524288 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4172,i,18279532057953515206,10532477700822235197,524288 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,2134495911478956413,7977990177429430604,524288 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6208,i,10986692942158566221,18030752371141342126,2097152 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,4965881854441837605,13361789386709915778,524288 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6260,i,3610588337228767474,8490525124326032586,2097152 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,10159884504006219835,2597594732069965218,524288 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1232,i,5458505539074311029,17837556303285194876,262144 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6012,i,4676546082535202590,8917701675337506579,2097152 --field-trial-handle=2356,i,10547973104392295733,4103335009817330647,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 0c666b32b999a15012cf0bab91723ef2a4a362578f46dcdb7d87d1f77e957246
MD5 d95f8992e9034bed39eaf45f6e32dd51
SHA1 0245d17013a269c62e526ca35133ff55d67a96ab
SHA512 014c62dd0504a2c1f9eb7be7e70faa649c5ae113489e24dd97bf2736e0534710858a98dcbaaf23d17c983b56bbe6cabd5ea58e9d0c29140ba381e80eb7866b85
TLSH
T1B171523D192649A1D3A1893278CD12847DB1C9EEFE336DAE0179FA74E50D71B812F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589853.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589853.TMP
Size 3KB
SHA256 e863141cfbe2fc91cd63b925cf60f188e19d4a0d79a41f80bfeb382b5d2cb33e
MD5 8fb2e0180c84b2151f72e39a29b0582c
SHA1 3dc386e544bcd6e4cad06067c1b3ed0f0c89277d
SHA512 fb2e38f64fe492c99e9932588d41fff3a2edf31f9d1057f37a245c28aca66e43c4ea4ef76401dd731101df4b66267a9eff0adb71fc75fb38e904e0adf394c23d
TLSH
T1C771523D192609A1D3A1893278CD12847DB1C9EEFE336DAE0179FA74E51D71B812F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 b587a8daba634b95a7760d1003639877be9b2fe74d08253da914d1e274187caa
MD5 79c9b12a2e9dc062f261dc3645aa2578
SHA1 36bd9bb7daee233486ba9c546ca0490085047d4d
SHA512 1b012aae9358f5a519a6f0714fce2027a6d81867ebd0c415fa5b5695f497ebc7de3799fcb0aae0f371af80d8d2e3347306b6ec97bd2e1daa43b78d880aee3f09
TLSH
T1CE117AB3C3E585AE8A1156F05A28AE2BDE2D0606421C7C19CAD4EF6BD3E3475E10255B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5a5a65760fb955ff52527e0d00620b8fafd46ab5085f8cba8b73b8baaa434ffd
MD5 4213920d721778c4d91a8f32de76b61c
SHA1 096b07c224e5fcf74473c96233c934eab56789ec
SHA512 165623bd5a3df8dfec22455dd0561a6000ce4f3779985b3f1118a18cf4ebd143c30873eed23adb7276ca2dbb872aa069af1590577f50f1314586c285036db7d5
SSDEEP 192:sxZRbRAkom/fmsa8c5+MIdpJHrsi8L6+WNGYIwP/XIgrJ:sxZRbtom/fmsa8I+VJHYi8wG+9
TLSH
T17722B8126E28A57B8CC7E21DBA257F53D7F95032A1D01E58EAFC855C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b7a90e5e90ef90f5674e5129fc573fdba1d1498bf52d289351ce5b42e75f8a07
MD5 660506f5f09a8c8741e3816a93c6732e
SHA1 34d56a8f2a82669eb7744cb2c9ac8c362bf40e83
SHA512 9fcb4f6f9c88c5966321fec9e2d2ebdda0daac92361b5871a6c6d2f2d8b242bce837cd759475ad254feb1776b1435406668e79842bed243b681c9edd78100ca2
SSDEEP 192:sxZRbRAkom/fms/8c5+MIdpJHrsi8L6+WNGYIwP/XIg58J:sxZRbtom/fms/8I+VJHYi8wG+2
TLSH
T1DB22A8126E28A57B4CC7E219BA657F53D7F95032A1D01E58EAFC955C04E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b4908a01f9d163ebcf2fe50fb573adadffc395ecaad90d52aa34e827e45f2572
MD5 018f412b8561e11165b94e8f5affad18
SHA1 0e689ae5933a07ab463f6391029143f552fec713
SHA512 ead28f416bc9cdbe3f0570323098b5d41f8a76b987dc8dc511a8236b823fc348b464082501b44c557f5cfc2ac67057b4d17575da9f8ce23876102ce087a8c5da
SSDEEP 192:sxZRbRAkom/fms/8cvpMIdpnBHr7c6+WNGYIIp/XIg5uJ:sxZRbtom/fms/8apVBHf9G60
TLSH
T1FB22B9516E28A57B8CC7E219BA657F53E7F9503291D01E48EAFCC65C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a2fd07e446af3f7f070db33889cc53694460db8121fb25666cc6c3a831d6a317
MD5 7db551e9cfa2202414e8e27c57c4dbca
SHA1 f387618965f0fa970304b61dc41bab192ad8dd89
SHA512 d288833220932dbeb3eb591607650998a865ba535c575ef2bfae44a26b390a0c84ff365d5f7cad5b8fb48a0e8be1b6d384ff34b1ad30787d2d4069978edc5d30
SSDEEP 768:k7yqbblWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR7jro/3F:k7yqbblWvJDjTu1jah4LAs7Q/V
TLSH
T1A7C20A3B654CCB7E4FC00AADDD5A6FD73E9802C7A6588D4047FA994C02C77EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4187b715c7edd6546a62059d8236539bd6e50f6db2f7002a73b15cc45128e7d1
MD5 9ece2ce55bed70deaf7cc59df14361ac
SHA1 2fd579d3c7c19dac3bfd8b03622aee6f3742b56b
SHA512 8b40c9b081fb4a03720db9289e26c40de3ba7e02650f7ba3966876cb913db0de4a0a9d98d6123453d86f35c03e8487771786aee64300b66ff6f4b3dc032c1c15
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyuEVQUK+agembzIfcgKU1cCgAswpLiki:KYbaKYIKOfuKQY+S2gKnKo7yKW
TLSH
T180A14A15767E02417C7D2898B3AA9A374F4531A33018A4EF3FB854624EA6E120DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

167e06b7-d674-4ad7-851e-89e7555dd9ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\167e06b7-d674-4ad7-851e-89e7555dd9ab.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 620e3437425091f365d56fede970c0627a3f64fff12e50c1d56b73575d5b141a
MD5 8666d167c0f5100ac989dea7bcaa293a
SHA1 f8381acd7baeed4d352ab102fedff84e5b2b1040
SHA512 71a383d184f4b52afe02c0887200bd631a9dc36f894ceb5f789beba15b96031207f4af607590154f624b98d6068177f6ef8d97bfab1247e5adb62d34a041ef2f
SSDEEP 384:RZcIhsNHpCWa+btbv2UduVRNT6bfWOOPrXLpe8C/EB:5hpvUuHTKWOi9PdB
TLSH
T1BB929D72A8385C6B9EF6E911F59622135FF88177F6C92F44A5EC9B0D01CB49C130B936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 c473ab2a96ab0e791a55f50cd6727a95741a4fae3ee8574efc49ed66ee933541
MD5 62eeb20b75c32310c057e7028a49f260
SHA1 0a1de5c0e01186ef625c97d0311ca79ad0c87ec8
SHA512 260491beacca48ce64d49eb4b8d08bb35c062c39b4b0ca329eeaaf2ba86dedc724486f61483b2bb544090b7a730839d04a318cde63143436667523b665bf28ca
SSDEEP 384:+iFiZcIysNZ8TUNTUlIlpCWa+btbv2UduVRNT6b+WOOPrXLpe8C/EB:VFQywwgsvUuHTFWOi9PdB
TLSH
T179A28D735C688C7FAEF6AE55F99A22138FF88177E5C56A40A6DC8A0C00DB0DC0307D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2c0a57f0bbc85021e7258a94e2f16c67916136e67e8aa0e3b83453ab7425e459
MD5 8697d95f80ade0b0a79f46da04814166
SHA1 5b8e9490b9130b04ff56966826ba9e59755d76f1
SHA512 01cc28cb1bdfab3f7c9f2b36d5c4239f404afead48029761d2d3b5cf3e3dc57b0d6fb07a5e5b4fc0d4d588b66d092fe372cefd811622855e34f8ff4ae61154c3
SSDEEP 384:RZcIhsNHUCWa+btbv2UduVRNT6bfWOOPrXLpe8C/EB:5hcvUuHTKWOi9PdB
TLSH
T17E929C72AC385C7BAEF6A911F49622135FF88177F6C92F44A5EC9B0D01CB498130B936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5436a6b6f32a97cb656ea930ca462717fffa32d1ff47f68d6209a975133fa293
MD5 e2eb91d3f5748da8c2be6f823b6568de
SHA1 ff936f166a71b01c2dfca219a3c8c3222f20a892
SHA512 274e722331d7e065ae3884c0fc692bf0ebeb714f81fbaccefad253a62f13a4c44525bbe5b211e5f6957a605b5cd9123ebf695ba3642becfafa43fd9da000e9da
SSDEEP 192:tONb6JkRtQmiUy3qGW+RNKFCk5dZDh3oREU6:tONb6UrIW+RNT6bVfU6
TLSH
T1A202FB35AC386C7B9EF3AD06B48737275FA4117BAA952F40DAE81E1C00D769C2346937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bf33e403c474b8d49f466bde2a82ecda56ce3efee3ca234fc6f5f75240f92910
MD5 c3125f3e33cb5c93263fad54ce690156
SHA1 311a0c1c91822731a503cc44cec5069a3acc53af
SHA512 2f84ca44cef7f2b10f7b09c5a9f169515efc0b59a3eb2cbb9519d99c46e314be030cda387b6f3d1b7d826ad3f7f13289ec2a728683296a9610985fd2cb9853fd
SSDEEP 192:IONK6JkRkQmiUy3WGP+RNKFCk5dZc0vpVcbqomU6:IONK6U0KP+RNT6bwWU6
TLSH
T151121B36A8385C7F9DE2A815F4C732135FB4926BEA897F40D5DC1A1C01EF99C130A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

105c618a-cb18-4058-939b-c058faa9ae45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\105c618a-cb18-4058-939b-c058faa9ae45.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 880bd44fb79ca287854f78bbdc14d76266e245c482406251cc7a61548943321a
MD5 def4996aea6262673ad51199863035d2
SHA1 f921850b0261c5449455301d8d0685576bd79940
SHA512 ee0730f924bdc44be989e6cbf5c58f3116a1ea399559467edb0a648690b607f5e20257ce847c8f0b699bf92be82b7441ccc0000588572b42a99ef78bc9e84206
TLSH
T1C2412859A6E90148B7B76F5AABF6686E587FBC372E0BD45D00010E4F4623A40CC71777
MD5 SHA1 SHA512 TLSH

Submit Download