Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/06/2024, 17:48

General

  • Target

    afa228d5ed641943a654c70d6478d350_JaffaCakes118.html

  • Size

    85KB

  • MD5

    afa228d5ed641943a654c70d6478d350

  • SHA1

    ea7ed7a7d35c46a015d887d8ee10ba1322799f70

  • SHA256

    ccf9ce642a896bafc2a2a8afe1f388c9d69b6f4b1e344150accb53532c36467d

  • SHA512

    1d8d35b267d27362210aedb1226984e2484d1575389e11d3e411f4ccd6d8ef5253722ed06b0c2d8302f4a528e186628b3ba12f7395db4fbd7a05b751f7422a7c

  • SSDEEP

    1536:rLTal1jus6Z/5fQE6GBhw0JrCeDxlqjQF9fBeVUDDkz7inM/TL/O:rfal1juDZ/5fQE6GB60JrCeDEQFi7SMG

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\afa228d5ed641943a654c70d6478d350_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd08de46f8,0x7ffd08de4708,0x7ffd08de4718
      2⤵
        PID:4868
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
        2⤵
          PID:3148
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4052
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
          2⤵
            PID:3456
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
            2⤵
              PID:1476
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
              2⤵
                PID:228
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
                2⤵
                  PID:4024
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
                  2⤵
                    PID:1232
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
                    2⤵
                      PID:4288
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
                      2⤵
                        PID:4092
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
                        2⤵
                          PID:3964
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
                          2⤵
                            PID:2416
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6912 /prefetch:8
                            2⤵
                              PID:1664
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6912 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4804
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
                              2⤵
                                PID:4492
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
                                2⤵
                                  PID:1756
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
                                  2⤵
                                    PID:1796
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
                                    2⤵
                                      PID:2428
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,5796920732638822658,2188166674618272306,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5036 /prefetch:2
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2192
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:1652
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:4216

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        81e892ca5c5683efdf9135fe0f2adb15

                                        SHA1

                                        39159b30226d98a465ece1da28dc87088b20ecad

                                        SHA256

                                        830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

                                        SHA512

                                        c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        56067634f68231081c4bd5bdbfcc202f

                                        SHA1

                                        5582776da6ffc75bb0973840fc3d15598bc09eb1

                                        SHA256

                                        8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

                                        SHA512

                                        c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

                                        Filesize

                                        44KB

                                        MD5

                                        23536ccfe05b737ae639fe63ee4cc435

                                        SHA1

                                        6d2e9822835dc3e6117a4d2addfc8f241fbdbc82

                                        SHA256

                                        6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce

                                        SHA512

                                        f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        240B

                                        MD5

                                        f7e812e232ee07afa4852538704c2973

                                        SHA1

                                        8899fff9ec6c9809420a78be17bde97c753c6bc2

                                        SHA256

                                        ec376eba4095d8eee1443e1ff2be9ef094c7469d2e8db82485c48426883d1941

                                        SHA512

                                        4e68cd7a7a12b903a5a60def5f7a26b7f5c382c97563f90807f245f3403e6bedb599e871dfc22849fbe97d84fa8289b245945bfd9d2ae69958e05d8874ce886f

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        96B

                                        MD5

                                        7c9fa7923fb5d471bb602f0d7838cddd

                                        SHA1

                                        5e5a2536f74c64dc3cfbb4c01b20e2afd63be84d

                                        SHA256

                                        d6392178ec0afd2de385ab7e7986599ec450b67657f7e143e296f4a6fa41d7a9

                                        SHA512

                                        7c98a46ec1f4d42f6b0379032e54eb8c6db0d2a74ebf2f7b70a64f1556eaa80d44162551d857a3bc86f2bc2e7f3ecbac7f74b0ac788deb1e4e9992f03e18aa73

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        216B

                                        MD5

                                        34612056eaccb403f30c5a9a86a49786

                                        SHA1

                                        dc4b76f668a73bdc71167b1ca276d0606926ee26

                                        SHA256

                                        7ffd4a91128528c72a4d793947bf16cdb30feebb72e26170b6536c3760210edc

                                        SHA512

                                        952dfbf0ef719c4b30e964ba8b8c55d4da82623e824df495a80b2af681e03d9591b8dfa0bc834d081442df66973d3f9fc7287e4a66f5d8aa5a35b27ff6653ec5

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                        Filesize

                                        2KB

                                        MD5

                                        d81969d5687162ba5bf47efb23962b7b

                                        SHA1

                                        955110d6ac0aadd26032e1644a4a73fac451b5e3

                                        SHA256

                                        185550b6c453b0a1bb2b4b919ccd4a89ade526dd7e6e0b70e53528d4b279650a

                                        SHA512

                                        6c6ae4310fd2f3bdf4af02e419692a5a0ac4f7237311f3f40ca5754caf1b689c7a88d260688e4fdadb5b4a64603a7751d5f48b17a3f13423c65601864056d5d9

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        8KB

                                        MD5

                                        2fa0feb9d48a0bb5f9d36b5e937611c2

                                        SHA1

                                        450d18bb9a2b6390b1add8888193be5b4b00636c

                                        SHA256

                                        632003a471092c3170f39c1d8b653fd6883a61021a3c6863e9d47c5a43d1502d

                                        SHA512

                                        66e7b4a18498b13444bff74384b8b83f9ab9f6a33cccaec8e531d9cc67746a96dad7cfe2e7f8a1c2c366320d8bc85ed1de59c5730e62df6099b57fa13b4c1251

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        7KB

                                        MD5

                                        83cd93654005900659ea653412a43be7

                                        SHA1

                                        d9f7fa0c8e869bb93121b1754a66e072aa64f292

                                        SHA256

                                        a1043908daa56cadd5df881d972f23a9d05e60a788c6bacbe2c71900423e614d

                                        SHA512

                                        a29874e4f7741028e1c66ca2b7958efad4f420941737ea0d798b728e29e039aac8ed70c9b76492178e3334033d711ea894c59ec38ce46478d807d790c41c275c

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        8KB

                                        MD5

                                        e0bafaad5b7559e09fb5afd116e25074

                                        SHA1

                                        4fe643539c55c6a3846a055d760df90fa5a51001

                                        SHA256

                                        94abc3a711f186397134c3068ac3f72da46e5876bddb019337ea270bb30971ec

                                        SHA512

                                        52fb73e35b08ae17e19b1609ca207cbd7056af39793ade96931359ce058ee2b114c4be01ef46047877b01a6a57f58f837ccf370fd52cbe5cd629ca864f39afef

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        874B

                                        MD5

                                        20040cf3ccc4ebc9b143bb08c4cf9c7f

                                        SHA1

                                        c187de9c17b869bd313e9fa4a2220800220f100e

                                        SHA256

                                        7ce992b4c0ae2e427dd7069f7dd318623209e41e9adccf1adb3bb76978c40f9d

                                        SHA512

                                        8e7717e39770fef72b6ac511c5e04b93b44015b86dd1019f91ae27ed08a8862dbd9ee9f6a89dfcc23ffe6ddd074cf8941739c52b70f36fccf5b498d2ca663f02

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b5b3.TMP

                                        Filesize

                                        539B

                                        MD5

                                        cc27b0ea9e882c0e401c38685355f846

                                        SHA1

                                        ad470c2fb618282588b977f71bed4515d35871d3

                                        SHA256

                                        354216bd2ab85f22b8199fdd61a92645bc8153a845f3dcf575e78664fea7046d

                                        SHA512

                                        11cc8d1c49501641af0c0cfbfc0c0b2a7ccda63336a3ec40a8d59303d533e742fb75864cf901803445111aadce09c6cdb20d7bea46817c5650758be8dcabafdf

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                        Filesize

                                        16B

                                        MD5

                                        6752a1d65b201c13b62ea44016eb221f

                                        SHA1

                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                        SHA256

                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                        SHA512

                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f58b24d7-df5a-4d82-bd06-6763f4384868.tmp

                                        Filesize

                                        6KB

                                        MD5

                                        95c5f3b4d67b0b4eaaf1b09a305f2ef7

                                        SHA1

                                        37dadbc51dfcbeed87062298bf5b9df250ff7901

                                        SHA256

                                        01cc8061510bf09ddb332c52f505b0ac4dcc9326bf45c7d1a53538f34e2058f3

                                        SHA512

                                        a3dc52b0d459259f0e96666717cf2594b31af19a693fab5fa76e65f5dcd0dc1e075442e101ff7b8d5d1583a7e41e5d304080087a6e2cc8ff44481386f58b0868

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                        Filesize

                                        11KB

                                        MD5

                                        21853b0e5f9826f76988a5c1951d3750

                                        SHA1

                                        943fe26e387a2461f8ca8320c3902e505eb04d86

                                        SHA256

                                        1df50c86def7ca352fe3dac0c5dbd741493309be4f3d1cb3b70d42149be8fd67

                                        SHA512

                                        d57303286e3a7e4916532ddc1bdbf4178da48c5aced06582e86e54a39bef6b1a901af77a6c31a79c5f569717cb08ee46be63c088b886e8bb2b052531bfb57a19