hxxps://www[.]bing[.]com/search?q=the%20heller%20agency%20llc%20po%20box%20280%20damariscotta%20ma%2004543&qs=n&form=QBRE&sp=-1&ghc=1&lq=0&pq=the%20heller%20agency%20llc%20po%20box%20280%20damariscotta%20ma%2004543&sc=0-54&sk=&cvid=C8F22AD1BDEE4519B2C68B6F4F2599E6

Analysis

user interaction
yes
max time kernel
50s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.bing.com/search?q=the%20heller%20agency%20llc%20po%20box%20280%20damariscotta%20ma%2004543&qs=n&form=QBRE&sp=-1&ghc=1&lq=0&pq=the%20heller%20agency%20llc%20po%20box%20280%20damariscotta%20ma%2004543&sc=0-54&sk=&cvid=C8F22AD1BDEE4519B2C68B6F4F2599E6
Sample261026-ynnltsws2j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4172	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{E4E10F6E-1000-4823-A5AA-73890717B76F}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2044	1276	msedge.exe	84
PID 1276 wrote to memory of 4172	1276	msedge.exe	85
PID 1276 wrote to memory of 4856	1276	msedge.exe	86
PID 1276 wrote to memory of 4856	1276	msedge.exe	86
PID 1276 wrote to memory of 4856	1276	msedge.exe	86
PID 1276 wrote to memory of 4796	1276	msedge.exe	87
PID 1276 wrote to memory of 4796	1276	msedge.exe	87
PID 1276 wrote to memory of 452	1276	msedge.exe	89
PID 1276 wrote to memory of 452	1276	msedge.exe	89
PID 1276 wrote to memory of 452	1276	msedge.exe	89
PID 1276 wrote to memory of 4328	1276	msedge.exe	90
PID 1276 wrote to memory of 4328	1276	msedge.exe	90
PID 1276 wrote to memory of 4328	1276	msedge.exe	90
PID 1276 wrote to memory of 4624	1276	msedge.exe	91
PID 1276 wrote to memory of 4624	1276	msedge.exe	91
PID 1276 wrote to memory of 4624	1276	msedge.exe	91
PID 1276 wrote to memory of 4980	1276	msedge.exe	92
PID 1276 wrote to memory of 4980	1276	msedge.exe	92
PID 1276 wrote to memory of 4980	1276	msedge.exe	92
PID 1276 wrote to memory of 2108	1276	msedge.exe	96
PID 1276 wrote to memory of 2108	1276	msedge.exe	96
PID 1276 wrote to memory of 3640	1276	msedge.exe	97
PID 1276 wrote to memory of 3640	1276	msedge.exe	97
PID 1276 wrote to memory of 1156	1276	msedge.exe	99
PID 1276 wrote to memory of 2040	1276	msedge.exe	100
PID 1276 wrote to memory of 2040	1276	msedge.exe	100
PID 1276 wrote to memory of 2040	1276	msedge.exe	100
PID 1276 wrote to memory of 1404	1276	msedge.exe	109
PID 1276 wrote to memory of 4788	1276	msedge.exe	110
PID 1276 wrote to memory of 964	1276	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.bing.com/search?q=the%20heller%20agency%20llc%20po%20box%20280%20damariscotta%20ma%2004543&qs=n&form=QBRE&sp=-1&ghc=1&lq=0&pq=the%20heller%20agency%20llc%20po%20box%20280%20damariscotta%20ma%2004543&sc=0-54&sk=&cvid=C8F22AD1BDEE4519B2C68B6F4F2599E6
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffa7730c188,0x7ffa7730c194,0x7ffa7730c1a0
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,3322446564318420993,17269759642228272179,524288 --field-trial-handle=2272,i,4801599312477507097,5130106474494098124,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,11345481617183680916,14504142880615973112,262144 --field-trial-handle=2272,i,4801599312477507097,5130106474494098124,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,5252298445874366781,3217413154644934642,524288 --field-trial-handle=2272,i,4801599312477507097,5130106474494098124,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,4662671214811817501,6173602308861205314,2097152 --field-trial-handle=2272,i,4801599312477507097,5130106474494098124,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,10720415836101501104,3166541377888791396,2097152 --field-trial-handle=2272,i,4801599312477507097,5130106474494098124,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,2884033761028417122,5538400409201530414,2097152 --field-trial-handle=2272,i,4801599312477507097,5130106474494098124,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,3121515620672341451,4461636248461909386,2097152 --field-trial-handle=2272,i,4801599312477507097,5130106474494098124,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,3975564589192215366,16601923981504117146,524288 --field-trial-handle=2272,i,4801599312477507097,5130106474494098124,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,16725909297612823667,11335807458999538728,524288 --field-trial-handle=2272,i,4801599312477507097,5130106474494098124,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,4535599059497257568,17986244675628724109,524288 --field-trial-handle=2272,i,4801599312477507097,5130106474494098124,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,4535599059497257568,17986244675628724109,524288 --field-trial-handle=2272,i,4801599312477507097,5130106474494098124,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6172,i,16342862925121928648,5392472835085874985,2097152 --field-trial-handle=2272,i,4801599312477507097,5130106474494098124,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,17000561688926623483,7934764038344859383,524288 --field-trial-handle=2272,i,4801599312477507097,5130106474494098124,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,3255374089191769640,4528955134296239016,524288 --field-trial-handle=2272,i,4801599312477507097,5130106474494098124,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,18232755555102259524,16035307656653430194,524288 --field-trial-handle=2272,i,4801599312477507097,5130106474494098124,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4f3cf836-5315-4d6e-b4e0-fa453bf24e48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4f3cf836-5315-4d6e-b4e0-fa453bf24e48.tmp
Size 18KB
SHA256 bceecd8376b0f7b43a18904046505eab62c39962ac6d59db279b42e0b1ef3421
MD5 019a96322c5f8f1a46db7a33c29e594e
SHA1 e10de6f0ed2a80df772504811ba999103a65c47b
SHA512 eef3fe6a3e47b6f8a880298f4fb31af2c29c11beb390caa2a266b46187e511848d16fe2851e01ba0e0138b69a2005b1d3b8a20ca4bff8942ae2e8172a561d4b7
SSDEEP 384:QQkUSv0sNTyW5Uoap5u8i0+aADvf2IaIIlG:40SZYkCADH5aL4
TLSH
T12A827D36ACB96C379DF3E960F54A35139EB48157D7C86F98DACE6B2C02DA1D81307902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68ac90b9-5609-4d0a-a11b-83ba42446985.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\68ac90b9-5609-4d0a-a11b-83ba42446985.tmp
Size 8KB
SHA256 8ac22c3e59d0bf4ab8587fe7dfba203049f9610ae5b43c17f18b8d9c18197184
MD5 a9f2011b5b786e0b6f2d2ae9fb389a42
SHA1 365eabc0c4f928b9b49ffb0c312cc44a0a5cd9f2
SHA512 c26d86692fe9790a494fa5d7b765374572600a27a72ae503a293539e732c3e40b9b6913e1ee6d9e9722e79f100284322284279ad091c56d74fcddf255f59a90a
SSDEEP 96:PqONkgQsjpfwDISp5ih/cIPURHl8h4otop5AmDeBfPGxvw45RxmJm78lFIxCYbq/:SONo6iDCQmiUyTeHq5u88PAgSqvraqU6
TLSH
T1E302FA39AC787C7B9EF3AD15B5473B239FA4116BE6945B84DAE81A2C01D768C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdc1f255-4746-45f2-b77a-69997e9eb389.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\bdc1f255-4746-45f2-b77a-69997e9eb389.tmp
Size 105KB
SHA256 c232ec974e0782cd13a8942d319d172253ded086c99dd896db4bd09ec5006e8d
MD5 0a841124514bc95bddf295e0991715e2
SHA1 0c7f8d71116903710115f6bcd7457435319e2456
SHA512 f0411e7fb7b1b65af2901ce74beb7aae12751e5f298888551f71344040955011ddcfaae5bc0a1a0e03678f7366a807beeaeeecc467babcc548116b11f29e166f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T17EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

02b9abc8-197d-439c-9050-48e9433a0d82.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\02b9abc8-197d-439c-9050-48e9433a0d82.tmp
Size 27KB
SHA256 8412b933e10697d05c9527bb2ac193ad6901848febe5d6a1cfae4a0d9e1c6871
MD5 c96aa4a86fbc931a1df02d5e321a37f4
SHA1 845e27bd0cfb80a11902584fd05258df61616954
SHA512 0d7548e36c671681e1a5b76d279ed4c90531e1805aad471f3bb8eb713f677d878e8c3a5543a1b37e9082d590caabe9f602bf735c0d9724743ab1ca84c3a56f67
SSDEEP 768:sRyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3DrooZI0:sRyQRbrWvvlpZu1jaXKLf33woZI0
TLSH
T10DC2E93B640CCB7E4FD01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0341d9ad-a49c-41f0-b4ca-c02a8b7b7325.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0341d9ad-a49c-41f0-b4ca-c02a8b7b7325.tmp
Size 12KB
SHA256 1f4771611ec511bb703dc8a3fbb6f6156693bfa768befd312f7d328a43038cc0
MD5 0841b0fa797579a8bdf2d77812148015
SHA1 fdaceeb07609fe9c816c32e6ff4830fb91c33216
SHA512 0d0e3d49d4f87314479a7be1d378c107109747d14822c91924cfabd7308dfe6ee841ed64c4989701ed494b2219df86dedc8de39ec66b2e0a1254793a03de835a
SSDEEP 192:sxZVRaucBzH/f1scV7FdpTsBHW6+WNiUq/YaFSjIIgrxHQSEH5G9x:sxZVvmzH/f1scV7p0HbU/VfHx
TLSH
T12042D8636E28D9778CCBD609BE35BF12D6F50432DD911E8CAAFCC51C04AA5EE220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1376c755-c2e4-4af4-af94-595775bde13d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1376c755-c2e4-4af4-af94-595775bde13d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7d18d280-c51b-4046-8960-8b191df26d27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7d18d280-c51b-4046-8960-8b191df26d27.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 68KB
SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
MD5 0e776a9829f2513dc6b150e6e74178aa
SHA1 60fcee40a3ce00c80e125cad5c0a55fa02d15f2e
SHA512 39f0ccd6a44b69d59611679d725ad12187393d9628d977f9848796d5855fb145f3bfe2a3998bd2bbf8b5240c33cd6ecd9d49ed09f4d0270d5ae40558cf7acb54
SSDEEP 1536:H51miTVgrQ7JaUf76Z+AGYguWv0KxwhGPkMxOIdzz/SIWT27zQMPvp+elQDQ:ZYMR78X9GjuW8KxwhGPkKB5JWTMzz5+e
TLSH
T1026302329668F371BDE5B98DFECAD32F58485C204207CA11167E3DF3852549954D8C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 45KB
SHA256 940e937d624dff1d92f851eb934d25d8f553b21ece4ea0cd28ce09a9c26d42a3
MD5 44e017eb03ad119606b480cec663fa30
SHA1 9241911887c38c5465f7c2e52241aa36cef8fe71
SHA512 fa9327022c36d67b6a43370f035d1e7817e65e0a8260a14084dff52665372fafa909c2b1e41e7590aca67086c84f975093ceeb0c2169afad18f7dd066ea3bbe8
SSDEEP 768:n5tNF8slLi+NBxYf86HMA0PF8/3SDtPoHMzqQqZKq1r/sFD5f0tjlLILDkF1OYh0:5tNHxNBx286HaGfSDtPo0q5rwDetRwDH
TLSH
T17523F10BD1C595933AE03B3E3ECE143C80846699A757B2E2F12A350AC6E4F59C50F5E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 69bb9e01b9df23d9a54fa9bb10413c66414ebeaddb4cd2f872054213835e54eb
MD5 7efada04d7c2e7f2c62ffdef27654b9b
SHA1 515564f8d8ff6c6048ca4e5596410feab0986234
SHA512 eef09316ef70bdd950266799d75bd7397733c799ed87333d48bf5e1892dbf733bceb7fb8bef5039c6fb86f2fd42eac86e94bb8b42dd06c34f816bfb195851ede
SSDEEP 96:m7jtf110O8mCsl26YOZYK59ZPvSvPvvaw:Gf1ahslPYO3TPwPvvaw
TLSH
T1C1A19474B4E8C0ECFBD87078EAD1198EF5B9D95D7C974EA201A0CB7899CBF10115C026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a455a08012e0917fb7ebbd7d24f2e4bb3dcdf3a8dc0c104b88f43e004b588c6c
MD5 a93054703e8ad7041447b7f5f5cb847e
SHA1 e920f393d9c816126ef93139fa23ebf9fc8e7d7a
SHA512 4ab7739950afe99dc146df033ccd506d8537e31eac0d4e592acf5a7ae72e91157c7ddac630cb6f622b96ce9984430077cf67703ed8967c4bc8f2369a469f6620
TLSH
T14A617178B8FCC4D0F7D8443CCBD52A8736BCEA818C979EF201A0DB785D8AF101054046
MD5 SHA1 SHA512 TLSH

Submit Download

25d14ab3-3631-4660-b51c-757a4eda4b6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\25d14ab3-3631-4660-b51c-757a4eda4b6b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0963b7ed-f07d-4669-b514-ebdd78548600.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0963b7ed-f07d-4669-b514-ebdd78548600.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

83fa443a-abb3-4c45-a351-00d137660859.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\83fa443a-abb3-4c45-a351-00d137660859.tmp
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 00745c18c5a0d701303019ddcbabbde0f78cf815ef642cc89390eb10cc3a7d14
MD5 b422bff351c4c2e16d32a9a80fe0a53a
SHA1 df6a586e94d1d7def6e1876bb6675388772402f7
SHA512 d6512d44dbc738216b57bdaa8692fb49f5c224603e365d9f95f2067e63f4a2a9e46983a1058e8e8aa03c824bc80039f48fad35399c2daeab4866480b01f90492
SSDEEP 48:K0hwdR7/DcbvaHISpcK9J1jcxBMY6LBByLtMBdvbfAbzGTISVAK9V13AxFQYWXDn:K8S4K7S6aaoKnKcKEKLyK6
TLSH
T156912D01757B060038BD294894B9866B528271F23058EA3FBBBD60B65E6FF054EFD7C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba142a78-4cd7-43bf-9417-b0d36024ace9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ba142a78-4cd7-43bf-9417-b0d36024ace9.tmp
Size 12KB
SHA256 74f0f857b174a516c15238e5275af13c109f28f23e4359e74b04a11948f7f211
MD5 d024bfb1632cf3e9a72720007870b238
SHA1 d03c163ec92af3670da128b166ba0526bd0a0e8d
SHA512 f7c12b97bfa990fe8f3f220500970f9574abf0658d665c9431144752c976f5015d73babf1df9c15e175d7a256dbc81299e8233c73eac109e8fb20f9de6d726bc
SSDEEP 192:sxZVRaucBzH/f1sDV7FdpTsBHW6+WNizYZYaAGjIIg57xHQSEH5G9x:sxZVvmzH/f1sDV7p0HbFZKZHx
TLSH
T12642D953AD28D9778CCBE508BE357F52D6F540329D911E4CAAFCC51C05EA5EE220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edd52fe3-6006-4dbd-925a-a6c1432a49e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\edd52fe3-6006-4dbd-925a-a6c1432a49e5.tmp
Size 12KB
SHA256 1da7f58f8e9e9204b7d6432997f0990a19b84c2728fe4d781b44981e1b6be92d
MD5 049b0b055981a75c8cd404007873292f
SHA1 d9103cf794b9321137c7a757320fed6133d34caf
SHA512 4a9a7d750a31cbe526b68799d80b3306ef9bef4b258ef145976b307e953250919aa1156ada5348a18f8823753e1ad8c77f94112f5a014679f7ff2281091b799b
SSDEEP 192:sxZVRaucBzH/f1sPV7FdpTsBHW6+WNiZuXYaMSjIIg5BxHQSEH5G9x:sxZVvmzH/f1sPV7p0HbRXczHx
TLSH
T15F42C753AE28D9778CCBD609BE357F52D6F5043299911E8CAAFCC51C04EA6EE220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3e295ff-348d-42f2-816e-6fea012a77e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a3e295ff-348d-42f2-816e-6fea012a77e2.tmp
Size 8KB
SHA256 09313dadf5fb66a0edfe7e66e77cd1ee7af2a3c5d1d259afe6ee9242935e640d
MD5 2833654b1d0ad14c36b4af112600259d
SHA1 01cbde50e2ab3a9df68b2a9bfa552991dcc6f357
SHA512 cda56dbb53981570fc29ddf098d29005d8ea52613842b5bef66088a625e7b483861fadb9ba8c1455ec93828bcb9c13cc88d7701fc013f8a9598049a1eaae3b32
SSDEEP 192:0ONm6iDcQmiUyFeGq5u88PA9+a8uZvqqXU6:0ONm6BDGq5u8i0+aDvfU6
TLSH
T1AF122B36B8786C6B6DE3A964F44736239EA4426BE7887F84D9DC271C01EF59C1307912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5bf76b2-61df-4dbf-908c-90552a5372fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f5bf76b2-61df-4dbf-908c-90552a5372fc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f714a36c-cd60-471b-b30c-6f8917292d1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f714a36c-cd60-471b-b30c-6f8917292d1b.tmp
Size 18KB
SHA256 44a89648a4fe68329eb0b9b533379617d93fd6cdeb87dcbccbc802293fb595c3
MD5 1a0195601344c80dd1a37666eefe289c
SHA1 116b3c0b6160eb6a0dd02be0dcdc6e0dc6ac984a
SHA512 53547664d59b955c2ffa334ecddabcdfdf019c5754bfeac7050e390c36aae709bd1fd5ccf08b64492d1f53d8b3f881df6379acba282e153bb20f9a94eb2ae2a9
SSDEEP 384:yQkUSv0sNTzW5Uoap5u8i0+aADvf2IaIIlG:q0lZYkCADH5aL4
TLSH
T188827D36AC796C379DB3E960F54B35139EB48157D7C86F94DACE6B2C02DA1D81307902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d29548ecfc7c5098ad379772ba00a2e3ab9ea11c5fc2a48fec044dafd6bbc147
MD5 13f6299e35f314b0108700de15169489
SHA1 2af73ef79537f837fedeacb15d884397c538b601
SHA512 5f9b014736edbc92ba3750947437cdf769f4902980d03ee2fb3dd8c54902bb321d4e00c2322243272b86aafc830ed5b1e73471ae92687fff36c431f7a4c49159
TLSH
T1CD412858A6FD1108B3B7AE1AABF6B86E487F79732E06D55E00110D4F4A62B40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads