18cab026398200aa19a9540486ce6325146ed84194ec3523d383e2c71afe9900

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 06:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
karat.jnlp
Size 1KB
Sample260722-hdkt7axta1
SHA256 18cab026398200aa19a9540486ce6325146ed84194ec3523d383e2c71afe9900
MD5 d7127953fa010fa4470212ca7ab2db3a
SHA1 b8899b3c3d64e0ddfc20332087c604ed15552b41
SHA512 b900abe12bed040dfeea81f8972450fa4a3759964d3969796b4d1858b923290b8815cbbef0c253e45df12fc758f7e788b2be1b894a71468c950a04074ed036b8
TLSH
T1434113C72842D3F9438A0215FD31B288E3A9439CE98CCDBD5ED519823A26E42C2543E5
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5628	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291758614869169"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{E460473A-159D-4575-84F6-A6927FEA99DD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5052	javaws.exe
5052	javaws.exe
5052	javaws.exe
5052	javaws.exe
5840	msedge.exe
5840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
252	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5180 wrote to memory of 5052	5180	jp2launcher.exe	88
PID 5052 wrote to memory of 2260	5052	javaws.exe	90
PID 5052 wrote to memory of 2536	5052	javaws.exe	91
PID 5052 wrote to memory of 6088	5052	javaws.exe	92
PID 5052 wrote to memory of 252	5052	javaws.exe	93
PID 252 wrote to memory of 1180	252	msedge.exe	94
PID 252 wrote to memory of 5628	252	msedge.exe	95
PID 252 wrote to memory of 4364	252	msedge.exe	96
PID 252 wrote to memory of 4364	252	msedge.exe	96
PID 252 wrote to memory of 4364	252	msedge.exe	96
PID 252 wrote to memory of 4936	252	msedge.exe	97
PID 252 wrote to memory of 4936	252	msedge.exe	97
PID 252 wrote to memory of 3344	252	msedge.exe	99
PID 252 wrote to memory of 5080	252	msedge.exe	100
PID 252 wrote to memory of 3344	252	msedge.exe	99
PID 252 wrote to memory of 3344	252	msedge.exe	99
PID 252 wrote to memory of 5080	252	msedge.exe	100
PID 252 wrote to memory of 5080	252	msedge.exe	100
PID 252 wrote to memory of 4284	252	msedge.exe	101
PID 252 wrote to memory of 1116	252	msedge.exe	102
PID 252 wrote to memory of 4284	252	msedge.exe	101
PID 252 wrote to memory of 4284	252	msedge.exe	101
PID 252 wrote to memory of 1116	252	msedge.exe	102
PID 252 wrote to memory of 1116	252	msedge.exe	102
PID 252 wrote to memory of 3552	252	msedge.exe	104
PID 252 wrote to memory of 3552	252	msedge.exe	104
PID 252 wrote to memory of 2772	252	msedge.exe	105
PID 252 wrote to memory of 2772	252	msedge.exe	105
PID 252 wrote to memory of 2308	252	msedge.exe	106
PID 252 wrote to memory of 2308	252	msedge.exe	106
PID 252 wrote to memory of 1632	252	msedge.exe	108
PID 252 wrote to memory of 3160	252	msedge.exe	109
PID 252 wrote to memory of 3160	252	msedge.exe	109
PID 252 wrote to memory of 1104	252	msedge.exe	112
PID 252 wrote to memory of 1104	252	msedge.exe	112
PID 252 wrote to memory of 1764	252	msedge.exe	114
PID 252 wrote to memory of 1764	252	msedge.exe	114
PID 252 wrote to memory of 1764	252	msedge.exe	114
PID 252 wrote to memory of 3088	252	msedge.exe	115
PID 252 wrote to memory of 4928	252	msedge.exe	116
PID 252 wrote to memory of 4748	252	msedge.exe	117
PID 252 wrote to memory of 5448	252	msedge.exe	118
PID 252 wrote to memory of 5448	252	msedge.exe	118
PID 252 wrote to memory of 5840	252	msedge.exe	120

C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -securejws "C:\Users\Admin\AppData\Local\Temp\karat.jnlp"
1⤵
- Suspicious use of WriteProcessMemory
PID:5180
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" "C:\Users\Admin\AppData\Local\Temp\karat.jnlp"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre-1.8\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.11.381.2" "update"
    3⤵
    PID:2260
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre-1.8\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.timestamp.11.381.2" "1784702252"
    3⤵
    PID:2536
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre-1.8\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.suppression.11.381.2" "false"
    3⤵
    PID:6088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://java.com/inst-dl-redirect
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x258,0x314,0x7ffc7f6cc188,0x7ffc7f6cc194,0x7ffc7f6cc1a0
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,17704197125102123016,9889558248374250395,524288 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:11
      4⤵
      System Time Discovery
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,5754338032933008961,17604453643804394441,262144 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,14380496815996934884,4183100072031671852,524288 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:13
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,6612277688055470469,9461431848012449916,2097152 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,3495794993078411835,6013804402518232277,2097152 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,10515508762478896398,15440709466749776343,2097152 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
      4⤵
      PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,11999821257285812689,13443334536449035551,2097152 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,5369052826118938660,4446301756907225807,524288 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,4246428669799913660,7929083782612621409,524288 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,10961144541147213701,566352802381537100,524288 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:2308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,1779640587474422012,9183129809399866379,524288 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
      4⤵
      PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,1779640587474422012,9183129809399866379,524288 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
      4⤵
      PID:1632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,4292612229396427590,16846987135533887235,524288 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,11553411421164861127,10538068422892359753,524288 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
      4⤵
      PID:1104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6080,i,1589003069456787264,9540289680023272138,2097152 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
      4⤵
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,2285358886200719013,4528330057646050940,524288 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
      4⤵
      PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,18091622363499530602,1030296937275056196,524288 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,8712174901528035977,8967705371521005749,524288 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,1616481934593852552,8515234814225191218,524288 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6296,i,16726506775050185436,18087934435943425628,262144 --field-trial-handle=2248,i,1673097130309183176,16270863019172583598,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 5982268e8cb4f491128b3dfab8684bbe0f079b4c04060755415a05deb9b512cb
MD5 2c65f3ff9f8cc6810472af5d0ac47b63
SHA1 5f7f6dd8d402d4ce9f490a8b65287525ff6b2f91
SHA512 b78876d615801472aab0fcb56e11a9b44502ed058265731db5cea2eda72940e760ff498914291ad1fe2feef07b09e361d28df4e20b044fccf40d7d9ce5756c0e
MD5 SHA1 SHA512

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 897B
SHA256 9cac90709f69cdb63f5f487a5f515fa636877215d9f848c656003482b06db1a1
MD5 e2c14fcf4c6dbd8f672f6a2f251cd556
SHA1 c3d90058a675f564fe933025118f6db5a46df346
SHA512 2b04632d8625b50d0000dc35740d2fecc15102856ab5371b83cbb5467c6f7ed37f21271bfff4277fc5c3bc74e063b1eb48a1b4573a163fc605e7821ac6f7be33
TLSH
T103110486B82BA4707D513032E9CF42F63BF1A77D09A52275B1C059CEB871F3606A3C25
MD5 SHA1 SHA512 TLSH

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 897B
SHA256 0fa7f8442a6de81fb1177f41e67bae87911ef2b02013c8c77242de0991fa600d
MD5 83626e3b84e3b76d857f5e54024b3722
SHA1 aca07d9716688dd683cf2abceea2f4c2855b0ae5
SHA512 c4c23c4ad1bcbc749cc179a84698f5ea77183fccb69de91bfb944f959a674d4746fb19a0ebc2facfc05ef40cde5cbccbb4e6c5774a88d8bf14f7002387877db3
TLSH
T1BB110486B82BA0706D513072EACF42F67BF1A77D08A56275B1C059CEB871F3606A3C24
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c5d46bcb264324424b40cae351f1fa73eb3846ed035f43aafba3e0a2744d4a06
MD5 6e3e8c68a76bd6477f29029a801b4083
SHA1 557e793d5b174c162efe1c0ca66c6782e0ec4941
SHA512 b550c3c6a20e24f6de0f28eb8f318e2abdd14f9d2889d8397645e15473d97e6a10c11af28e0f2a26c5a7c353a57486536d35e59adb75ce924ca442349fd34571
TLSH
T1EB514D10B32E2AD1E3A19AF280F8C6CDB3F5946DC6C72ED11A5C2D744C26F9970E1523
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dc4be48a763b43fe20d43fee17afdcf9561d9a5d1165669d086de0dc92b385d4
MD5 5bb5523c342fe262affa6c193194f760
SHA1 dc22919cb0cee4d0004a591c7d8f216ead81f1f4
SHA512 bcfbd99ea1d5a45064599a637f22aae63ac7518b31aa43e288e52ed169d95b3e07a17c56af8a6793dd0923280ce41ae6d8a59434652f9c8c1f563fbaedc570ff
TLSH
T1D6616010F36E6AE1E3A189F594F8C6CD73F1846DC6C72EE10A5C2D704C22F9960E2563
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ae57.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ae57.TMP
Size 2KB
SHA256 2abf8a31ce8a961fc0365b71d04c7da5ddb3a9dcea5cb400279bb1269da74e9e
MD5 7b3247621f5376c12fef9ad279583756
SHA1 03568e355ef8fa4ab38d0c47b074af6bfa899b8b
SHA512 3af30ddc3bfca56b33506ee499a8632769d2be4a55bfc162220845a890f28f8b89d4114743e75a79e6aa8f32e5c92282297836b34d96f56bc0f07234250f99f8
TLSH
T1EC514D10B32E2AD1E3A189F280F8C6CDB3F5946DC6CB2ED50A9C1D704C22F99B0E1523
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 955c3546847a5487f83862c23080f94e11b66954734497eede6de3b036c96a1e
MD5 10de0679e8dac655635ed137351b4370
SHA1 d8315a0585f2fe57de7cbd89bff00f3eba677df1
SHA512 9c82455a503c6e1960b061669e31c8b9201a3088291221b5b3d5a45868062fae737e3dd863ac9aa03ba645816798bce62bc9c1524ecc3112d8fda475d973c175
TLSH
T17E61AEF787F4866ED91192F0AA186F2BCE1C0925432C7D5AC5E0AF2793F2470E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 10040bc1c7d3e77305ce81fb6b8bb13e03fb6217422a448c4e0deaf2fccc0d5e
MD5 644c0f073ee448fc018d099bece039b2
SHA1 6ad58b560af850c203a6051928d534aa52855077
SHA512 81dfa0d9c3ec696ede4ea01cc65539d1c08fe7f5742915b8b17ef1c9ce7aa8ddd30d08ab781cd979d725063dfac8908a02f86c2de75a64e7fb27f7027556560b
SSDEEP 192:sxRoRtC+/f4sHGd6BZuczoA8pi/Fg6+WNIYD9R6SHGhvIgVLJ:sxRoi+/f4sHGd6PuNi/jInS8z
TLSH
T12B32951A6E28A93B9DC7D21EBB65BF53D6F95022A1D11E48E6FC860C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 287fa7e23d38616c45abdc6754e104db9cb8bc007b5da7dca40254a65ea95c86
MD5 6854007e6ce663fcc38ef125100cf838
SHA1 713f8ed6b07fbba1ca6dcf14a6b3f56966f2e38c
SHA512 5ca762284628993a665f21725cdd56424248b713d62dd68f71d7b9a9456891099c6110d380d6a80502d2c70ff0c8e9b3097c9272df17c8c28cbccb5959499a97
SSDEEP 192:sxRrRtC+/f4sOGd6BZuczoA8pi/Fg6+WNIYD9R6SHGhvIgDSLJ:sxRri+/f4sOGd6PuNi/jInS8m
TLSH
T18E42A51A6E28993B9CC7D21EBB65BF53D6F95022A1D51E48A7FC8A0C04E77DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 39007380b96c3f6c33660ed7284b891b6e25b7eba4b6e6bbc794b1ef7f92d3f7
MD5 96d7cff6da5bb9f46bd00d29eb13f970
SHA1 bae88ca94ca9db4448d8324360b31610b8ee2589
SHA512 a784621013e55b2affdff7a49547f66ed1f200af9eeb356a688e17143843e78c5d1b555d0122ec8b9dbdf2948f209f0fd7a1b0040d3bbfbe6343be2cd64df1c5
SSDEEP 192:sxRrRtC+/f4sOGn6BZuezoA8pfF/Fg6+WN6Mj/UEiD996SHGhvIgDoLJ:sxRri+/f4sOGn6PuDN/j5/FS88
TLSH
T1BA42B81AAE28597B9DC7D21ABB55BF53E6FD102291D11E48A7FC8A0C04EB7DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 a1fea14e0f5b1fe1e54c739454a36535d88533d9c6bb275fd92eb70adb8a93ea
MD5 b979ba96050f43d5938a4e96716ba785
SHA1 c85ed6b050f685002f32183f663df6ca903f90d9
SHA512 801026e2310b571237cf779cdb4f44bb2a36d631e117595dd34200fcc13d302125f151c257053516555af5c6c183cd0c4d6f7e7a6dd045991f344220099463c8
SSDEEP 768:azfW2L7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4wYc16aropI/HY:azfW2dE7J0Wg/XfHfu1ja3wYy6RpIQ
TLSH
T15ED2DA7B640CCF7F4F800ADDAD1A7E9B6DA802CB9698CD5047FD941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e385db7fe1b6a6a2b8fd0ff21bd03d783fb92cf4398c804065e8981c86d858d4
MD5 e5876b06ce9e61347f99eb626c125c19
SHA1 f58877b0874791f40191dc72842e0233e9b73031
SHA512 200388bdd1c2844f3637a73d5705680674ade25e123cf299f7a83c904ec2326f822e9f8262ddb99c4ff9e91d19346cfc8ddd6723039c0a7ed3e30e46964e5744
SSDEEP 96:KRVCbvlfjHWLQeg3HK4GgJHcNVIbTMHwBUAyeSIWWLbgIIK4Ng6Icoob6ji4KTaD:CVCbvlfj2LQ/3dGgJ8NVIbTMHwBUAyef
TLSH
T19191BB543077529038BE671D81A5D89AD6C3B862722CF42B7BA901910F27E239DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a499d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a499d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 19278e081f0212ea6fd3371a539571e6057494e3b230dc14d567f6898abc273d
MD5 4f6b59ddb712e246858e9ccca42cdde0
SHA1 5b8be23b9f0314d8c2cbe7c81e656a4f6b7406c2
SHA512 5a289d1e6d9b6483d7cd8d093b51f280c9209ee96ff2931fcea773a6d5b7deeebb80cf682dd9ee33deb09dfb058500d87d313a11f27dd0ef17924552b2097dfd
SSDEEP 768:KFjj+933fwg5o9TsdTXQFrEnjN3Gac1FcYMjXE:r933bX6QnjMaVYj
TLSH
T1E21339F659D78973D89E9787673E2E419EBCC1A3B4840954B7C8590CCD832BFD30A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d5e3bb12734b89b67e4d3d2da15eae9033605eee12b586a6d9e0fc21acb897ce
MD5 27ea37fa0fe07cd4b2bd6f0922cf2ea7
SHA1 940cb5af4ab2e015c32c78a1443b665c8395546c
SHA512 4755ed9892ba567c38d9b403c2a951965ac148d57b2e982c6ea16d9f3ce59d0a2a85e295eec4e21d04f332d2d1bb7372c9e480f8b6ecd1f0fc6d3f6f04cf5eec
SSDEEP 768:rrv+4UNbdS3Dmi0+rEnjN3Gac1Ze6eVH1SCz:rbsbg3o+QnjMa76EH1V
TLSH
T15003C03669A89EB38CEBD385714776037FF4125386840BE4C6CD6B0D069B5EC130B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 26a6211c351f6b19c35b8bbf4b7bc8420c7b6a54b39ef6eaa41696cef3d5deaf
MD5 401e4ce5fb28ba8f180c2f44194f23de
SHA1 03e3316be34e033b98ff613195eee220fa219e01
SHA512 71cf8868929914abb1d016aee9213b09fbd428f1c26cb5935464db0532199511d84ce5499e2cf0c37436cff4182eb685dd2a8b5ebeedf39e556f84ec9f0e7262
SSDEEP 384:nl5tNn/s3n9S438N8EXxwwOOcuSWZlf8hyEGHoU7Gtloby2rEoajo4cdR8eHhVOA:vj+9H3MbLi0XQMrEnjN3Gac1FcYMjXE
TLSH
T143F2AF366DA5DDB38DEAD28676477782EFE015A389C40E94CADD6A0C05C37EC130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7a87dbce1115c25368d3ee17ecea2ed1829a4a31edd987460ae84a80687f1422
MD5 648196a9116cef3c91f69285cf530f50
SHA1 fd7a2c559968ef6858e4ff5e1a37d2afc80cb60d
SHA512 9138c065e8db56dd71f93b0825cc35c1a6e11fe8f1ec91565af7928b571fe8a0b70d45e3b8969e37e85d8071de226f862d111e2801d1a1a1dfed438e4d60d19a
SSDEEP 384:nX5tNn/s3n9S438N8hxwwOOcMSWZlf8hyEGHoU7GtlMby2rEoajo4cdR8eHhVOD0:pj+9H35XLi0XQ4rEnjN3Gac1FcYMjXE
TLSH
T1CDF2AF366DA59DB38DEAD28676477782EFE015A389C40E94CADD6A0C05C37EC130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c9f1a95-0f68-4ba8-b1c9-a188f0a989c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1c9f1a95-0f68-4ba8-b1c9-a188f0a989c0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir252_244979882\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2260-2-0x000002A097F60000-0x000002A0981D0000-memory.dmp

Download

memory/2260-21-0x000002A097F60000-0x000002A0981D0000-memory.dmp

Download

memory/2260-20-0x000002A097EC0000-0x000002A097EC1000-memory.dmp

Download

memory/2260-12-0x000002A097EC0000-0x000002A097EC1000-memory.dmp

Download

memory/2536-42-0x00000232F4120000-0x00000232F4121000-memory.dmp

Download

memory/6088-62-0x000001FE7F020000-0x000001FE7F021000-memory.dmp

Download