hxxps://ctan[.]mirrors[.]hoobly[.]com/systems/texlive/tlnet/archive/hausarbeit-jura[.]source[.]tar[.]xz

Analysis

max time kernel
281s
max time network
306s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2023, 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ctan.mirrors.hoobly.com/systems/texlive/tlnet/archive/hausarbeit-jura.source.tar.xz

Score

1^/10

Malware Config

Signatures

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
1392	msedge.exe
1392	msedge.exe
984	identity_helper.exe
984	identity_helper.exe
3684	msedge.exe
3684	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2664	OpenWith.exe
572	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
2664	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe
572	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 3396	2308	msedge.exe	82
PID 2308 wrote to memory of 3396	2308	msedge.exe	82
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 640	2308	msedge.exe	83
PID 2308 wrote to memory of 1392	2308	msedge.exe	84
PID 2308 wrote to memory of 1392	2308	msedge.exe	84
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85
PID 2308 wrote to memory of 3360	2308	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ctan.mirrors.hoobly.com/systems/texlive/tlnet/archive/hausarbeit-jura.source.tar.xz
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd32f646f8,0x7ffd32f64708,0x7ffd32f64718
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,9275188585094093371,5479653600503300801,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,9275188585094093371,5479653600503300801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,9275188585094093371,5479653600503300801,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9275188585094093371,5479653600503300801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9275188585094093371,5479653600503300801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,9275188585094093371,5479653600503300801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,9275188585094093371,5479653600503300801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9275188585094093371,5479653600503300801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9275188585094093371,5479653600503300801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2180,9275188585094093371,5479653600503300801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9275188585094093371,5479653600503300801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2180,9275188585094093371,5479653600503300801,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9275188585094093371,5479653600503300801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9275188585094093371,5479653600503300801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,9275188585094093371,5479653600503300801,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5380 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1976

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2664
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\hausarbeit-jura.source.tar.xz
  2⤵
  PID:3896

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70e2e6954b953053c0c4f3b6e6ad9330

SHA1
cb61ba67b3bffa1d833bb85cc9547669ec46f62f

SHA256
f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4

SHA512
eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6954ddc98e0d6ca64db6792fd3463b19

SHA1
fb0b5009edaf115ef2546805080a2bd966971b6e

SHA256
2803007cb759d734bc1c577d74d8389d0da7158435698f49202a5c2fa55f0693

SHA512
01e9e248e0dd6c19a921dec71f57601988d1f36efa8131790a10680bcb082a2f5e2441aeb23fc3be313ad6fc3f1c58e961a8519e96cb651ae391ae9d5d3d1288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68412fdf291900e0e30af2910cdccfa0

SHA1
08d5144e7d4e8ae181aaa297cbbe0209bbc5dad4

SHA256
17f4896cf1e7a2d9c871a6473dbe956fb9c50bddee5a66187db96b84aa4efe3a

SHA512
d88e81081126aee3626bad645ac90ec4b969194d2a6fb8d0e6b8f950ba9967ca57b51584c93250470130ef8575ed81cd92df19839376a6129c0ee7910157583b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6d7612e9a2f813e566294fdcb1122281

SHA1
d34919704f43ba71a874d696012a7258c397d7a4

SHA256
5d013c15279e51d39afafa950b31ba77484c534c8108e76c310ff5e8c4da6ae7

SHA512
70d39ed5cd0c8575a4286a53957d13fbd8c0cc5225e2c650ca2b40c2857370bd1cc31b3c82c2da0abd74361714337b77ba5999c06d7b395eabfdb4cf38980902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
436b2fe2aad2fe4a0c56d29d3f4e4f72

SHA1
64c4438dc0e66b87d4a8b70fe7f480666421c89a

SHA256
1736f3cec59a3da6c0df978829f1987e7f8ddaea2c9c7599d1c4172e8dcf51c0

SHA512
9bbb1972e9630d08a045d19aab4ff946f193f9eb1f9175ef673c558d51a313f8d7c705375a0ca3e9ad10667beee8b79df190ec1b32d5c3ff83fa6de05b9bf1b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5a478f1e08816969e8214f982850b754

SHA1
1cf5e7192f3c6e31c7e27b6cb34ebf89036eec0c

SHA256
665cf5612c61412c9acc928b1e155c8f11ae83905ce614d9a1a7ad72cc0fd489

SHA512
7e7ff60c157841f6f5bb206ebbce29f6df3a6c0c671805415ad7226654e13da49ad76e39a6d0afe28992348f3b5685ecacbfb44178fd61998c54caebbfd97832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
75a4f8ba494cd7ab48e587ebf759779b

SHA1
fc55bbc1f773e154b626cc4be2038f92c460361b

SHA256
89628b5d751c892da362ed9f46ef01730566d809abe0931f0e814065c7d54d51

SHA512
4bc3c0edd0c7649713be7f81634cb88246b00f7ab9938cea9b66f3c59f3be89a9db6123671b2ea23675ef6db600be01ea93139f6d9f6b3d8ed7861fae782ddc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d61a7e3019eb4e67903c8482b1209056

SHA1
399d33ce15b11209ecb23de1bf498eec6d062541

SHA256
3b554108513077fb097769b6384a1dd6a77a357af33bbd2624ef4d5a4f43d727

SHA512
331fe27b86681de9f3636aa51850f248471558182e0f9dd83b40b87744e52513e9036aaf69439c6ce47c18befc9f9a34e92efa7b9e170f5a8ba15f3f15d8b659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b27fd8364c0aa64cf973a2188ff3e093

SHA1
0c1e2bf29d8d3d43778fd09db8f4ca41cc71187e

SHA256
641f28d48f489236bb159d8ba4863b87eb769d7c4cb81af2d834b029862657c3

SHA512
c35a9f65a2eba11981609589dd63b54838720f64311c28f52b503a859f4c09c5867246ea3c708e32b483c3d167d1fce307cd3045fe6fd960b4fea6ab1b79ce00

Download Submit
C:\Users\Admin\Downloads\hausarbeit-jura.source.tar.xz

Filesize
12KB

MD5
fba9a23a503a30080fcfcab5b74528d9

SHA1
d642004db32d0032f20a8ec864064fab974fbc63

SHA256
e85d83835aa9c661d103cbdbb8e94e557255c1335e6cd9c3e9886c073c4a9b24

SHA512
3346edf31e0f7545c1c53fbe88fd12a902ef673cf5dff0858caec415e1b30e3c26a2bad613a947f5897b6867ac5730deff8c7cf24f51d9078ed0494104bf5a1f

Download Submit
C:\Users\Admin\Downloads\hausarbeit-jura.source.tar.xz

Filesize
12KB

MD5
fba9a23a503a30080fcfcab5b74528d9

SHA1
d642004db32d0032f20a8ec864064fab974fbc63

SHA256
e85d83835aa9c661d103cbdbb8e94e557255c1335e6cd9c3e9886c073c4a9b24

SHA512
3346edf31e0f7545c1c53fbe88fd12a902ef673cf5dff0858caec415e1b30e3c26a2bad613a947f5897b6867ac5730deff8c7cf24f51d9078ed0494104bf5a1f

Download Submit