ed6f6f2144998175c846a99d2a0faab5bf7b6ace318f0fe2dc4bfeaf4700c1d8

Analysis

user interaction
yes
max time kernel
4s
max time network
6s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/05/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3vil.user.html
Size 564B
Sample260506-vbf5faay4l
SHA256 ed6f6f2144998175c846a99d2a0faab5bf7b6ace318f0fe2dc4bfeaf4700c1d8
MD5 54d14e2aba479693f9fd361a56d5f525
SHA1 2e52709ffe46120e45b90fb907bb2d09e083b448
SHA512 460c379c9b4c4b5b89f302cec4edaa5707578fc336ec70c8ad992d8341a9f3e27b1764b8b9f170715723afc7f3e7114faa4c09ed4e3db2a77c90ba5ccaa05498
TLSH
T110F0CD9F1F12387F2E238170F0C35068CF680A56FB9921E28748001F3ACA04549F6FAD
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4976	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 5040	5012	msedge.exe	85
PID 5012 wrote to memory of 4976	5012	msedge.exe	86
PID 5012 wrote to memory of 4972	5012	msedge.exe	87
PID 5012 wrote to memory of 4972	5012	msedge.exe	87
PID 5012 wrote to memory of 4972	5012	msedge.exe	87
PID 5012 wrote to memory of 4840	5012	msedge.exe	89
PID 5012 wrote to memory of 4840	5012	msedge.exe	89
PID 5012 wrote to memory of 3168	5012	msedge.exe	90
PID 5012 wrote to memory of 3168	5012	msedge.exe	90
PID 5012 wrote to memory of 3168	5012	msedge.exe	90
PID 5012 wrote to memory of 3396	5012	msedge.exe	91
PID 5012 wrote to memory of 3396	5012	msedge.exe	91
PID 5012 wrote to memory of 3396	5012	msedge.exe	91
PID 5012 wrote to memory of 5228	5012	msedge.exe	94
PID 5012 wrote to memory of 5608	5012	msedge.exe	95
PID 5012 wrote to memory of 5228	5012	msedge.exe	94
PID 5012 wrote to memory of 5608	5012	msedge.exe	95

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\3vil.user.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9f535c188,0x7ff9f535c194,0x7ff9f535c1a0
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,13603441482116559289,868538398756966263,524288 --field-trial-handle=2288,i,8966747519484012214,13181926948357929386,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,17538177310727600833,8395163298169478563,262144 --field-trial-handle=2288,i,8966747519484012214,13181926948357929386,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,7215309664485739669,13650839161223549826,524288 --field-trial-handle=2288,i,8966747519484012214,13181926948357929386,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,15651176587571587465,17529842189056453804,2097152 --field-trial-handle=2288,i,8966747519484012214,13181926948357929386,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,17603196505694039630,585485028698033432,2097152 --field-trial-handle=2288,i,8966747519484012214,13181926948357929386,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,2742738933803294494,13419895147317874428,524288 --field-trial-handle=2288,i,8966747519484012214,13181926948357929386,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,6842037002561915996,8516232266415277441,524288 --field-trial-handle=2288,i,8966747519484012214,13181926948357929386,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,9391200286505452108,1934214420574963744,524288 --field-trial-handle=2288,i,8966747519484012214,13181926948357929386,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,9391200286505452108,1934214420574963744,524288 --field-trial-handle=2288,i,8966747519484012214,13181926948357929386,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 924e96ec20750cb6a5239ec6615014ae8ebb3de4d3c60595d6c95e7ccd197fe9
MD5 9b2430d85ce0b6612f557c45f7f3cbcc
SHA1 0a1e10f745cd18a847854cf92a1d4154f1e53a18
SHA512 187d6a5fac24a44192cd7964a293cf55a01134f6bd0ced9759bf4dee1fbc0273c5e118208cf3606ca4853d0f0f145448fc8342dac94a0745638e99f4acafd46e
TLSH
T1FED0801C1275BC31D4BA8575544537092D1DED675543533B5433557C0D87E1085971C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ce180cf0fce9a4a96685bbb0c58efb5750080d37ce961b69a74ae38b49eb68c9
MD5 2abcf056d353616a5983a10f17185a31
SHA1 40d71f06b42cf03d05e8dba44f76231dd24d9fd9
SHA512 5bff16b6683201694139145fd708bf7d834e97a5792e68cfb43b011e13c0e993e1cfb6a8c6f450aa2437fe486fb6f3ff1af62a05b918ee73bc195ec5cb0b3e02
TLSH
T1D7D080181275AC31D4A68575548537093E2DED675543533B5473557C0DC7E1085971C3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1b8bd8e7b67e4a33165754d3f7d5f5a33d27be07384d9d4b81dec3437f2af7fb
MD5 08999353e9d48e905289776d30bcdd97
SHA1 fd4a7e8c5e6ff6a5b74480f0d50286b59a192d83
SHA512 5a5a5708b8b63ff3ecd33c5539fd5e5df6779670de7fb2ecaa0866f49fb1a7e657e22a3e198ca539936ae85a2e34193deb9e1403c3ae6eb8b2c56a7e31f208af
SSDEEP 96:K4n+K0cCmHyKcI3IgKdG62fGKssvAAKdKi+1OKew/Em/mK4omaQwKBySr6KYY7OO:ANtDrpn3F2E9FHwgRBL3WDfSZX4RnU
TLSH
T16EB24B11713B02C53E7E299E8195B46F62C230633198B92B3BF814664F6BE20DDFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6e69e7a-4956-4cb2-8c54-0d4b2f007a3b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6e69e7a-4956-4cb2-8c54-0d4b2f007a3b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 45d95b564dd7384aeb9844e86879e91080844cfc342ad7402a80b4344a433724
MD5 d87ba947bb9619742179fe1597e23eee
SHA1 1b5a6c4f75f65d95a3e62f3f13394ab8a9028b99
SHA512 dd5e87dcbc6bab01fd9a37c4760a80d46378d42634c7a41dcef5d546d200a84fa845d55abdd40ffdd304010f70847830055fa69d792668200baa7378c7b21296
SSDEEP 384:nviFavqMg3sNH8TUNTUlIm2TJvuxOi7kNLqvfqTrckkgRYV/Vw1mRerN1k+5vI+T:6Fayv3ewgzmxMd3ckkgRYk1mYf
TLSH
T137C25C75ECA8DEB7EDE64FC9E7493A06EEE40167C98C4AD4DAD40E0D009719E134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 75b27e36405a75ca9739e8492d48ffdbcc7bbc74fa4051363c0aad5c4abf9509
MD5 259cd395121c65c06976bb2091f72760
SHA1 1d8c4519c840da7b18dd25ed58f341f01c7b8d70
SHA512 ed2d3ed0e30fd5003a765fbec1fc539c9d3a90afe38c893432ca0c9c12a0d29050433a6eb572682e0b7ce6c484e3a41906e145162d5100f6a71738d40c9b3b77
SSDEEP 384:ndiFavqMg3sNf8TUNTUlIm2TJvuxOTTnVqvfqTrckBjthRYV/Vw1mRerN1k+5vIm:UFayv3ewgzmxcV3ckB5hRYk1mYf
TLSH
T1A5C25C76E8A4DEA7EDE64FD9E7497A07EEE401A7C58C4AD4DAD40D0D00871DE134BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 657e60816831b5fabaeb70596a6c706ecf93ea06d10c7058e09ea9e7c3ac3eab
MD5 35d0f3a879b2bfc9ee90e223160b0e26
SHA1 27bce50bf9df30d4f11bb93c50077d529214c2ce
SHA512 7ea2b3a28e8f79b80ae5ab7ee1395a7bb9003de167c7e055ff005341195e7d9b3ab6df67354c8f7e381cfc3bc391560e2d838bcdcb38581fecb6693459b10a79
TLSH
T1B041F85CB6EA1158B3777E5AAFF6A86D487FB8772E0AD45D10110D4E0A72E00C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads