Resubmissions

26/10/2023, 15:25

231026-st48wacg9z 1

26/10/2023, 14:33

231026-rw1g2aeb34 3

26/10/2023, 14:30

231026-rt5zqsce5w 3

26/10/2023, 14:23

231026-rqg4haea93 3

26/10/2023, 14:22

231026-rp2frace4t 3

26/10/2023, 14:22

231026-rpks1ace31 3

26/10/2023, 14:10

231026-rg79bsea25 10

26/10/2023, 14:09

231026-rgk4ssea22 1

26/10/2023, 14:08

231026-rf2edscc9w 1

26/10/2023, 14:07

231026-rfcq2acc8v 1

Analysis

  • max time kernel
    568s
  • max time network
    579s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/10/2023, 14:10

General

  • Target

    Screenshot 2023-10-25 08.11.54.png

  • Size

    13KB

  • MD5

    51e504750e157c50fd5f07ae7643639a

  • SHA1

    aac2c4a1fd69fef7bff8c7447a6d13fa8a9a7452

  • SHA256

    9d1d5346149f31169406d2b23ec83fc292d561979a4f7819c26e74748d9efab0

  • SHA512

    b84134b916a1b91ced634997dbb810f77baa398e0e2c485db5a245e13609398d2c2e88dc6dec8080a769739125030aad33ca526480c67f46791537132020579b

  • SSDEEP

    384:MjreO3cNJHZf1wup3chMjNuMQBmiL4htpBKdBZ:83Kbfmup3A+tpC

Malware Config

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot 2023-10-25 08.11.54.png"
    1⤵
      PID:4936
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1104
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff89ebd9758,0x7ff89ebd9768,0x7ff89ebd9778
        2⤵
          PID:3212
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:2
          2⤵
            PID:4032
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:8
            2⤵
              PID:3468
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:8
              2⤵
                PID:4988
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                2⤵
                  PID:4832
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3164 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                  2⤵
                    PID:4980
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4744 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                    2⤵
                      PID:2308
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4760 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:8
                      2⤵
                        PID:3252
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4928 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:8
                        2⤵
                          PID:4628
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:8
                          2⤵
                            PID:1988
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:8
                            2⤵
                              PID:3848
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
                              2⤵
                                PID:1332
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x254,0x258,0x25c,0x238,0x260,0x7ff6eccc7688,0x7ff6eccc7698,0x7ff6eccc76a8
                                  3⤵
                                    PID:3952
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5196 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                  2⤵
                                    PID:4572
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5536 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                    2⤵
                                      PID:3784
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5580 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                      2⤵
                                        PID:1492
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4544 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                        2⤵
                                          PID:1068
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1676 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                          2⤵
                                            PID:364
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4636 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                            2⤵
                                              PID:4492
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2476 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                              2⤵
                                                PID:1836
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2596 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:2
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1276
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3948 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                                2⤵
                                                  PID:1032
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4784 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                                  2⤵
                                                    PID:5092
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:8
                                                    2⤵
                                                      PID:2752
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6108 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                                      2⤵
                                                        PID:1648
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5492 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                                        2⤵
                                                          PID:4316
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5656 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                                          2⤵
                                                            PID:2908
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5476 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                                            2⤵
                                                              PID:4592
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2948 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:8
                                                              2⤵
                                                                PID:4172
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3248 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:8
                                                                2⤵
                                                                  PID:1720
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6088 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:8
                                                                  2⤵
                                                                    PID:1200
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5576 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:8
                                                                    2⤵
                                                                      PID:876
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=2228 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                                                      2⤵
                                                                        PID:2580
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5796 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                                                        2⤵
                                                                          PID:2820
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=5828 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                                                          2⤵
                                                                            PID:4904
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=5256 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:1
                                                                            2⤵
                                                                              PID:3736
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:8
                                                                              2⤵
                                                                                PID:388
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:8
                                                                                2⤵
                                                                                  PID:4172
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 --field-trial-handle=1744,i,11840705321507424999,14365435732406607792,131072 /prefetch:8
                                                                                  2⤵
                                                                                    PID:4308
                                                                                  • C:\Windows\System32\msiexec.exe
                                                                                    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\EV3_Classroom_Windows_1.5.3_Global.msi"
                                                                                    2⤵
                                                                                    • Blocklisted process makes network request
                                                                                    • Enumerates connected drives
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    PID:5052
                                                                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                  1⤵
                                                                                    PID:1656
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                                                                                    1⤵
                                                                                      PID:2516
                                                                                      • C:\Windows\system32\dashost.exe
                                                                                        dashost.exe {312a2596-483a-4996-9863aeaade18973e}
                                                                                        2⤵
                                                                                          PID:2976
                                                                                      • C:\Windows\system32\msiexec.exe
                                                                                        C:\Windows\system32\msiexec.exe /V
                                                                                        1⤵
                                                                                        • Enumerates connected drives
                                                                                        • Drops file in Program Files directory
                                                                                        • Drops file in Windows directory
                                                                                        • Modifies data under HKEY_USERS
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:4576
                                                                                        • C:\Windows\system32\srtasks.exe
                                                                                          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                          2⤵
                                                                                            PID:4324
                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 1A08875947E5245C6E3143618CB567B1 C
                                                                                            2⤵
                                                                                            • Loads dropped DLL
                                                                                            PID:3088
                                                                                            • C:\Program Files\EV3 Classroom\EV3 Classroom-win-1.5.3.4056.exe
                                                                                              "C:\Program Files\EV3 Classroom\EV3 Classroom-win-1.5.3.4056.exe"
                                                                                              3⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              PID:3480
                                                                                              • C:\Program Files\EV3 Classroom\EV3 Classroom-win-1.5.3.4056.exe
                                                                                                "C:\Program Files\EV3 Classroom\EV3 Classroom-win-1.5.3.4056.exe" --type=gpu-process --field-trial-handle=2268,6344715535343926187,1848058785440386144,131072 --enable-features=CastMediaRouteProvider --disable-features=HardwareMediaKeyHandling --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\debug.log" --lang=en-US --cefsharpexitsub --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\debug.log" --mojo-platform-channel-handle=2304 /prefetch:2 --host-process-id=3480
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                • Modifies registry class
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:1036
                                                                                              • C:\Program Files\EV3 Classroom\EV3 Classroom-win-1.5.3.4056.exe
                                                                                                "C:\Program Files\EV3 Classroom\EV3 Classroom-win-1.5.3.4056.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2268,6344715535343926187,1848058785440386144,131072 --enable-features=CastMediaRouteProvider --disable-features=HardwareMediaKeyHandling --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\debug.log" --lang=en-US --cefsharpexitsub --log-file="C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\debug.log" --mojo-platform-channel-handle=2844 /prefetch:8 --host-process-id=3480
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:2296
                                                                                              • C:\Program Files\EV3 Classroom\EV3 Classroom-win-1.5.3.4056.exe
                                                                                                "C:\Program Files\EV3 Classroom\EV3 Classroom-win-1.5.3.4056.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\debug.log" --field-trial-handle=2268,6344715535343926187,1848058785440386144,131072 --enable-features=CastMediaRouteProvider --disable-features=HardwareMediaKeyHandling --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\debug.log" --cefsharpexitsub --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=4480 /prefetch:1 --host-process-id=3480
                                                                                                4⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:2096
                                                                                              • C:\Program Files\EV3 Classroom\EV3 Classroom-win-1.5.3.4056.exe
                                                                                                "C:\Program Files\EV3 Classroom\EV3 Classroom-win-1.5.3.4056.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2268,6344715535343926187,1848058785440386144,131072 --enable-features=CastMediaRouteProvider --disable-features=HardwareMediaKeyHandling --lang=en-US --service-sandbox-type=audio --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\debug.log" --lang=en-US --cefsharpexitsub --log-file="C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\debug.log" --mojo-platform-channel-handle=4828 /prefetch:8 --host-process-id=3480
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:4000
                                                                                              • C:\Program Files\EV3 Classroom\EV3 Classroom-win-1.5.3.4056.exe
                                                                                                "C:\Program Files\EV3 Classroom\EV3 Classroom-win-1.5.3.4056.exe" --type=gpu-process --field-trial-handle=2268,6344715535343926187,1848058785440386144,131072 --enable-features=CastMediaRouteProvider --disable-features=HardwareMediaKeyHandling --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\debug.log" --lang=en-US --cefsharpexitsub --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\debug.log" --mojo-platform-channel-handle=5036 /prefetch:2 --host-process-id=3480
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:2900
                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                          C:\Windows\system32\vssvc.exe
                                                                                          1⤵
                                                                                          • Checks SCSI registry key(s)
                                                                                          PID:1804
                                                                                        • C:\Program Files\EV3 Classroom\EV3 Classroom-win-1.5.3.4056.exe
                                                                                          "C:\Program Files\EV3 Classroom\EV3 Classroom-win-1.5.3.4056.exe"
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          PID:4176
                                                                                        • C:\Windows\system32\AUDIODG.EXE
                                                                                          C:\Windows\system32\AUDIODG.EXE 0x514 0x33c
                                                                                          1⤵
                                                                                            PID:3760
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                                                                                            1⤵
                                                                                              PID:1156
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                              1⤵
                                                                                              • Enumerates system info in registry
                                                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                              • Suspicious use of SendNotifyMessage
                                                                                              PID:1488
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff89ebd9758,0x7ff89ebd9768,0x7ff89ebd9778
                                                                                                2⤵
                                                                                                  PID:4400
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1908,i,3125154894678552616,17471199651120954414,131072 /prefetch:2
                                                                                                  2⤵
                                                                                                    PID:4664
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 --field-trial-handle=1908,i,3125154894678552616,17471199651120954414,131072 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:3120
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 --field-trial-handle=1908,i,3125154894678552616,17471199651120954414,131072 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:1208
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2924 --field-trial-handle=1908,i,3125154894678552616,17471199651120954414,131072 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:848
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2932 --field-trial-handle=1908,i,3125154894678552616,17471199651120954414,131072 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:4568
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=1632 --field-trial-handle=1908,i,3125154894678552616,17471199651120954414,131072 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:3912
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4028 --field-trial-handle=1908,i,3125154894678552616,17471199651120954414,131072 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:4696
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4988 --field-trial-handle=1908,i,3125154894678552616,17471199651120954414,131072 /prefetch:8
                                                                                                                2⤵
                                                                                                                  PID:876
                                                                                                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                1⤵
                                                                                                                  PID:3432

                                                                                                                Network

                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                Replay Monitor

                                                                                                                Loading Replay Monitor...

                                                                                                                Downloads

                                                                                                                • C:\Config.Msi\e5ce509.rbs

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                  MD5

                                                                                                                  5e7bcdad8b23303d31585c08d0a3d0b2

                                                                                                                  SHA1

                                                                                                                  8234a1f99f4b7c582ad38e445136e14facfe9532

                                                                                                                  SHA256

                                                                                                                  ac3b234b6eecdb9afbd57d42f3311c4783f60f03f0ee3d6cebfcebef63657594

                                                                                                                  SHA512

                                                                                                                  6ce1de076fccd62ba8fe0b44b8615239b80ebefc7eb4e57e74b29e93faba9681a4b215abe92b95257cccb509d785a7eadcd2594ab6a800b814a614a5e7d97d98

                                                                                                                • C:\Program Files\EV3 Classroom\EV3 Classroom-win-1.5.3.4056.exe

                                                                                                                  Filesize

                                                                                                                  491.3MB

                                                                                                                  MD5

                                                                                                                  c10f230d0d569bc5f33f9f3b6b709063

                                                                                                                  SHA1

                                                                                                                  46be5bda8b95878a71ee8dbb994072c14a4ef460

                                                                                                                  SHA256

                                                                                                                  d960568756546d24be2c0e0a106b140aa4b119c700de3a68710e16edc7cad839

                                                                                                                  SHA512

                                                                                                                  f49890aca15d6c62434aaa71d5c59fb03b8fa169daf014f5108080fae989af682bc0a54620e487e7450ebd02e89ea7a7699eee9d24da86448b6892b40f18dac2

                                                                                                                • C:\Users\Admin\AppData\Local\ASP.NET\DataProtection-Keys\bc85d531-97e6-44a6-ac92-d51c6c3bda8c.tmp

                                                                                                                  Filesize

                                                                                                                  1KB

                                                                                                                  MD5

                                                                                                                  15006b56aa9d1c490fcfe980591afee9

                                                                                                                  SHA1

                                                                                                                  89048dae20d387a75964aa1087ba3b1faaa713ab

                                                                                                                  SHA256

                                                                                                                  14570c496e4a227e6220fdea68ce4c3672d2bcc97ee93e80c2d3a81457f0f00c

                                                                                                                  SHA512

                                                                                                                  9b08f86be8f01773325a66213c1e2d7688be2e9d049b16e082f7da83997252c9b3681efb7e7696e7854e18bacf2c5da8db42b4a487a5f8239cea306907a31e31

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                                                                                  Filesize

                                                                                                                  40B

                                                                                                                  MD5

                                                                                                                  3095cf3ce9201a9fbed5a042e4de4f7d

                                                                                                                  SHA1

                                                                                                                  f3405054ce8285ea792e826cd86027b5a3ac5014

                                                                                                                  SHA256

                                                                                                                  329c5c7366c030f5fe85e73abbf5fb4d1b76950b7dc76720be5dd8c7dbb03773

                                                                                                                  SHA512

                                                                                                                  b377ea305be4623a8dfb2c22e9a75d2455bc7cd1ee4063bbf4bc722eab9fdb1ee43a89c89a18ba6d841f1f5e4daa96a3bb16fb2194261691bf40fa7c4b259f74

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022

                                                                                                                  Filesize

                                                                                                                  16KB

                                                                                                                  MD5

                                                                                                                  e501574042d1bd94fed0e2618476f55f

                                                                                                                  SHA1

                                                                                                                  3892175c9b92d7a8e8a050063ee83f1447525b54

                                                                                                                  SHA256

                                                                                                                  79aa859371db77f0b003ea9484505253fc8a60117fe8914608d7d71970b3f2a7

                                                                                                                  SHA512

                                                                                                                  e7fd01304321b4b89cda7e21472dcb93a2edc9e92c25aab3c666cc91312351cbf72b4c19b82ba7ee892fb3981039928da4406d4baef439e4ca1e3aa11ad2e490

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026

                                                                                                                  Filesize

                                                                                                                  52KB

                                                                                                                  MD5

                                                                                                                  570b69c23dc7193b15f04087186a1514

                                                                                                                  SHA1

                                                                                                                  6c650bd55d6a9cdfd0653a4f71a3816836f2a084

                                                                                                                  SHA256

                                                                                                                  2dc378433144352d6dcc5a840cebec805d83888303c08ac6ccfc61fc0360b7a2

                                                                                                                  SHA512

                                                                                                                  2cf049f7d99473047805ae6ad1a3c31e2eb22f2f7023164735d24a9703d92335e017daa736de122ee7858b3ccb9a70132b4050cedde6a2f87c360c58183678bb

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                  Filesize

                                                                                                                  2KB

                                                                                                                  MD5

                                                                                                                  5955a48430348a95f59a196d89a93764

                                                                                                                  SHA1

                                                                                                                  d7773efe8640bf9d3cb194762947048b061c41ba

                                                                                                                  SHA256

                                                                                                                  ec79495cb920f91249e640413bae25863c7ce54725d24272d19545cbd21b44cf

                                                                                                                  SHA512

                                                                                                                  4b191fab8eb0bffd4d0769d003783733a394a230b15c811307fd816892392162f1a14eb0e7ea064aa962a0cfc674bca15853c7a6f6aa67444dc21f8b3317699b

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                  Filesize

                                                                                                                  1KB

                                                                                                                  MD5

                                                                                                                  2ad5325c69b480f9ad7de99c1c14d9b4

                                                                                                                  SHA1

                                                                                                                  f1c272b1c727f477113f174de13453e40d586066

                                                                                                                  SHA256

                                                                                                                  4a735f9e27d6cf4d49b10954bd812c97c2e8ac2a098e705ab53fcefd1ca487e8

                                                                                                                  SHA512

                                                                                                                  76e236beeee058eb645705feed9249ce0299fb55c92a6fc9606679c4a3075bb40e9ac63228e2481d439345a71f4e563a2de3c48aba2422ad85f30028734fe8c4

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                  Filesize

                                                                                                                  3KB

                                                                                                                  MD5

                                                                                                                  88464ec2aecb1055191d2e2a9675b721

                                                                                                                  SHA1

                                                                                                                  9871745d41f4125539d2f21b5c9a5a348079e0dd

                                                                                                                  SHA256

                                                                                                                  ccf218e01dc4287c3814e6c71d4b9a8bc8d925afedd54cfcafae859c371eb644

                                                                                                                  SHA512

                                                                                                                  65dee45d65d3550f3413f774e133de9fa4d543bec414ee357e54d10ee9a8ab0111abc101040805188971794b7219fedf72691b3249988b97cbdb901bc427d3d6

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                  Filesize

                                                                                                                  3KB

                                                                                                                  MD5

                                                                                                                  abb87371c33bfac0caf428d7c65e2872

                                                                                                                  SHA1

                                                                                                                  94df90518c0fb7384423ac6559905dfcf39c60cc

                                                                                                                  SHA256

                                                                                                                  7c09640aebf4ee9454a055e39e5284f60633697b2da839723975ab6c4d091ee4

                                                                                                                  SHA512

                                                                                                                  18f949d815067e689320f0c7e3861134c6343aeff10c96d7f891a68d6e942322dae31f1b2c9a6c3acd1969a0b2138aa5faccf4e9735206ff3450d890e7fcbe97

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                                                                                                  Filesize

                                                                                                                  264KB

                                                                                                                  MD5

                                                                                                                  1a87e3f6aa8a8c25ad3c66de29fee674

                                                                                                                  SHA1

                                                                                                                  1d20d643eedb45569cbe15e58b791ad88e3baf04

                                                                                                                  SHA256

                                                                                                                  3907c2c48695a2ee484f59c780fbf9adfce575c2499c526902d58519b95b926b

                                                                                                                  SHA512

                                                                                                                  6541abf8e78ccbc70cbb3848c8d73ff05c9daa17ded618702ee4b83dc38e42bf610980abbcc9c54dc98f74ec9d12005013072317777dc63752bf0c920a041016

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                                  Filesize

                                                                                                                  6KB

                                                                                                                  MD5

                                                                                                                  04affa171ef27246c6d9fcf9f1ac7f8c

                                                                                                                  SHA1

                                                                                                                  f7f50440384e81bcfd448deb6b0f00bd43be4499

                                                                                                                  SHA256

                                                                                                                  ea2c3d2eaae564e3c0f05a27d10ad9f4426c205b94ccdb446f4006ccbad2a0d5

                                                                                                                  SHA512

                                                                                                                  9e50d6c8a407d9b03930813ec71652babbd52ef72c034af0b896f8ab11e4ad6ebd02fd7af35a9754c723b84d6c981f98f9e3b66e59fedd790c0481877e7b5516

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                                  Filesize

                                                                                                                  5KB

                                                                                                                  MD5

                                                                                                                  9d90474716b40ef4e3e38119d9fcbac5

                                                                                                                  SHA1

                                                                                                                  057f3518c939645ac61ccdd16865a9ccf61c1404

                                                                                                                  SHA256

                                                                                                                  9658901ed1e0b2db093775502e2f353d7b89913d63b743134d33be6c69863580

                                                                                                                  SHA512

                                                                                                                  61f354ba56878d92959f0abc309d214e850ba1b34f53f17941793baffba862d557d192ebf729093db9fe2396d75b70c9f6e293eb57002cbd5eb22bc0e63494f4

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                  MD5

                                                                                                                  2e9bfb2e6b3038791457a3069439a947

                                                                                                                  SHA1

                                                                                                                  bb8fc10f88c33cc1640f246318fd6f8971c4a39d

                                                                                                                  SHA256

                                                                                                                  8c6c9397df7dfa3de63a28a2357b6a64953acd399ef3bd209df958f1db726d60

                                                                                                                  SHA512

                                                                                                                  5487ce7f56024952f6b9cc6f4acb68fc95040b2f425907504dd1fe757066e44514e50208aaf3e91823941cf1d8b23564abd3171d1f828b5177617083796b2b0c

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  369B

                                                                                                                  MD5

                                                                                                                  fabd4f7b9cf28919a4466a85cd95a871

                                                                                                                  SHA1

                                                                                                                  a7bd0ad3905c906a3ceafcaf34c6baec68c9fd25

                                                                                                                  SHA256

                                                                                                                  a764fcb07d0709d89f6955f2280f438d40e48926b2a5e0ecf5b8a760832297f7

                                                                                                                  SHA512

                                                                                                                  828355648ba2f3aeb4467cee612988212ab119954a831ea556378b36963cb5f2873d3d08a387a1e494ebec70369083bb50cc39974d112260f979ca6f23ce118f

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  1KB

                                                                                                                  MD5

                                                                                                                  5ab369db38300920ffc3125dee36ee23

                                                                                                                  SHA1

                                                                                                                  6461767d1eb9eb8800ea270e617d9082ca339155

                                                                                                                  SHA256

                                                                                                                  b600c550ef4fe1fe79af9436aa7c699cf5b5106b5726a0863ea70b1908649fb7

                                                                                                                  SHA512

                                                                                                                  4d1c1ac370c997a8a65f1cec365b1a34dcb36e87b25886fd7da9b0f0592f664880eda9ad47be4b96f184ea5f714e8feb2def8a407cb87d653e0871efeb683792

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  3KB

                                                                                                                  MD5

                                                                                                                  a91bf271f78c74a02a48db31bb7c5dbb

                                                                                                                  SHA1

                                                                                                                  9ff458e88e004fee2d522bc03965d7e01034f530

                                                                                                                  SHA256

                                                                                                                  5cde4fa87faba9813268ccd0ee400f9ecbceffdea220d525b8de7dbb72a63db8

                                                                                                                  SHA512

                                                                                                                  2f51f289de62a3b4107ead5d49fa642bf0c5e8e9309058f01a929caa868fe8a3201368b6b6813abdb71c2e7a3599d93a68a057a45359b05a01b277c5dd8e8339

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  3KB

                                                                                                                  MD5

                                                                                                                  5e59738891a9c00adb3d95ef97cd9472

                                                                                                                  SHA1

                                                                                                                  146e8405eeba1ad4cc745c8563628c8ee9a84189

                                                                                                                  SHA256

                                                                                                                  07dc1ade9842e42985f8b5826b68df5c86258cb72602788ac2db5ff662a4a27c

                                                                                                                  SHA512

                                                                                                                  5c3667835f35cebb02a02c7ed9b9799e1e5e8cae01e3b85e89e07348ac9effdaf5395e63a55bb9a9e5f1faeba5cf7e445fffe8a58dc66d97e1578921f47bdf45

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  MD5

                                                                                                                  3865de724ac83459cabd61aaa5c4de0f

                                                                                                                  SHA1

                                                                                                                  698591490fd09a3f78b29425cbbb9b35a4853682

                                                                                                                  SHA256

                                                                                                                  1a5152043473c784f4344be1539f3f1bdb6ccf9216e5910341b24be97b2332e3

                                                                                                                  SHA512

                                                                                                                  dfd8931f2ed38983d51944c3467b4a95d9824485dfb9e009fbe45dd06ce4fc932e41fbb5f0eb863db9e32614f34eeed33aa80ffc0e278430fff474fe9b482215

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  3KB

                                                                                                                  MD5

                                                                                                                  f0bbe16b57acf8295cc938fec2472aa2

                                                                                                                  SHA1

                                                                                                                  80d4f1584a3edb990eb25ac48989234300c35d1c

                                                                                                                  SHA256

                                                                                                                  0b132dd8a0a0111690b9fa2c671aa147678e2f7d508626677ea7f03262bf4263

                                                                                                                  SHA512

                                                                                                                  281570d58a683b8bef4433f71ef9e873aae0e5d2652d5629ad6498f50b4b219b2e02f49eb83933da5dead4cb53bfa1bd0cb3eff750284a575e82f6975bc539d8

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  3KB

                                                                                                                  MD5

                                                                                                                  fbaec4418c21d3d687cddcc8433fede7

                                                                                                                  SHA1

                                                                                                                  3a22baf2abb34480a736b2dc73b18b516e7488ad

                                                                                                                  SHA256

                                                                                                                  39b2b33c7cbfac3df3e9f77fbc9f2b01d5860c54993c68738a04beebc22e83db

                                                                                                                  SHA512

                                                                                                                  d58dc9c40929f70c05e9dbc726cd06bfd3772f4b8acad8cbd14025d154a9be2007c136b713052aaf9c31ff356693f8e1c9869b82e47a5af92b6e35af7669fe2c

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  3KB

                                                                                                                  MD5

                                                                                                                  576a268c56f184857249472d2303d1f3

                                                                                                                  SHA1

                                                                                                                  fb99d9759a79999ea4f0ca9d6779be81fcdff9f7

                                                                                                                  SHA256

                                                                                                                  6f714e2831632206057a34eb39af7f633ea61ece469f91b209954e5d6634cc75

                                                                                                                  SHA512

                                                                                                                  dbd892794797f93f128f44be478d86b9a5dc57b2f224ca2b16a94b7ccc0be716c8c62d409088d40d88f3db5918346094eb4611d21702c3f5bac805d07bc0d9cc

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  3KB

                                                                                                                  MD5

                                                                                                                  9b429decbb9514905fb81aa889250cd8

                                                                                                                  SHA1

                                                                                                                  ba7e3edb95423dfca3c53bf0e7a4280ef9346fd5

                                                                                                                  SHA256

                                                                                                                  763cddf02960bfa16c713d8ce636da205bac06f1064fd7dd3c64e317531301fc

                                                                                                                  SHA512

                                                                                                                  d665f122a02fe6612e430c949f71028f06cba24c631cd2bc35a23b5258039f6e440c479fca7238f29624ad66d89283a2097221d8a0cc5636e91950344c6066e6

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  1KB

                                                                                                                  MD5

                                                                                                                  581768c6a620dcc231dedf35f9f50b59

                                                                                                                  SHA1

                                                                                                                  b4b2ee004bedbef59528267a90c1dbf4550f21c8

                                                                                                                  SHA256

                                                                                                                  8ed3659bc85575d0ce5b2e5abe6574ce7613bfde8fe181ab9d679c0ffca73e4c

                                                                                                                  SHA512

                                                                                                                  dff6a097c9c304f80942da5e629a4fc2e7739e7f151073ac56d5871975d94a4877e777725c1d4be85137f62a610c19b6a02341b7ab7110a0e4de07c3ead8055b

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  5KB

                                                                                                                  MD5

                                                                                                                  13d049f3592dcbcc054f38f2a6d1e92c

                                                                                                                  SHA1

                                                                                                                  0cc6490220888156c23625e10e80ca7bf89a4148

                                                                                                                  SHA256

                                                                                                                  c1fe51e8f4b97ad5ae8993d9a99cfdeb68072029effd75243dd119ad2044f300

                                                                                                                  SHA512

                                                                                                                  dfc84fcc459796cb32293fd492cc5391b2c0955e3b2f04ac459bda9fcc76e57c35723357da2297242bb85557507d235919dd08876ac65975eeb9d27678d3f161

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  6KB

                                                                                                                  MD5

                                                                                                                  fdefa79e16ac16fa966abb9b9f2e21a6

                                                                                                                  SHA1

                                                                                                                  24cf49c3fc1fc9b34bdbe23dd23d5665b08d348c

                                                                                                                  SHA256

                                                                                                                  97407501e26e3d4be9a07713b263415b2103fb192c85ba1fc01ae04a8c7e25e9

                                                                                                                  SHA512

                                                                                                                  b336a9c2cc5ed8060e302ac0430c522a757d232f839a6d49139af5fe05d4bec368c22a5b725287c379a57357ff6515bad57e1303fc2ae3e12103d47bebaa8138

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  6KB

                                                                                                                  MD5

                                                                                                                  be3d2a50ffb7a89f6bfc75e19d1a51f7

                                                                                                                  SHA1

                                                                                                                  dc00caae8194358ca2897f52423588af2ce7ceeb

                                                                                                                  SHA256

                                                                                                                  8e0cfdfb626cd8038318b2a7a8dfb41409cb907605c912597b7a393a374bbfa6

                                                                                                                  SHA512

                                                                                                                  9c72570717fd0ed341c692ac4fee9ec3e3cab908f07a5d1fedaeaa79c081b354b9742e09d75bc24d3d5b6bf388977d83a28a4b1c99b008a867fcfe0cc3b482b9

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  7KB

                                                                                                                  MD5

                                                                                                                  b06f02aabfd84157cc5029942188a268

                                                                                                                  SHA1

                                                                                                                  459f26b680bc9cf9de1a2261aa78b330e04878e4

                                                                                                                  SHA256

                                                                                                                  6e04feb23d7eb4ed807cd5bdd9fed0df6f14b745e209686f59bc5d3e4ef5799a

                                                                                                                  SHA512

                                                                                                                  a48a582ba793aa9257aa530c4658c12c2b10e2ddc10f0ce18c5d9da3433adb1752b6cb4410df3e9d1c714de4a1096be355d0ab1be0a83280ed65e3d4c0e94cef

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  7KB

                                                                                                                  MD5

                                                                                                                  ad169c8c77416f4c6fd36786f677b25d

                                                                                                                  SHA1

                                                                                                                  9ec72ef92e049eedd778ee1cffc45acec7c3bec5

                                                                                                                  SHA256

                                                                                                                  dcb150339082fbaf18242e7e8f94ba6dbb5b8d9183d18e30c4fc5dcf9ecff4a9

                                                                                                                  SHA512

                                                                                                                  8671816b6dc13fc223f9609f376b5ea103d2c147d505154a84a74332a678b085ea202deeb756198a80ad60fd41ef3baf11b8507c34db39bb8e828ff1cf184a7a

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  7KB

                                                                                                                  MD5

                                                                                                                  8e87d2979619dbd829b8cd5b24213a13

                                                                                                                  SHA1

                                                                                                                  2e4d92f31f339844625591dfc980bc3b9b329c5a

                                                                                                                  SHA256

                                                                                                                  933f8d5254fccf01948a62dffdcf1f73a1adb1f949920dde2670c0231f16e504

                                                                                                                  SHA512

                                                                                                                  42fd6be1cf36525a45f7e304f643c5b9c9471cc2af71059cdf44ba3f8dcbd23fbd47d69a7104882e3b805b337485dfb7437334027c0d133e29149acbe4b2adb7

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  7KB

                                                                                                                  MD5

                                                                                                                  ea36644ca59e644c397d97b08d96c315

                                                                                                                  SHA1

                                                                                                                  fdc261851ae5f2659850f450c6f725124d047acb

                                                                                                                  SHA256

                                                                                                                  1e7ed95f0161107bb80c17b6a79fb9de02322b7b73764f89b2b9b1a246b3a8eb

                                                                                                                  SHA512

                                                                                                                  e41fac216e30501facbeddd29af7b437dff3b1c6382c3363dcf878ea1b28d1b9773ff577a2eadae73d0a0b1203a50be165ec0424b51fd5b1e4bf38417e5d804c

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\04a6abb6-a11f-496f-a64f-4b0b92b3a9dc\index-dir\the-real-index

                                                                                                                  Filesize

                                                                                                                  72B

                                                                                                                  MD5

                                                                                                                  f9f73c1acd788d67fc2a9f2efd4a70ea

                                                                                                                  SHA1

                                                                                                                  ac65e6e3dd6299898f31fee424ef4a2ce1157840

                                                                                                                  SHA256

                                                                                                                  eef7bcab749bdea19aac877bfe7c2f862d3b3ac88bfb23d5dafb93e5a0fae381

                                                                                                                  SHA512

                                                                                                                  1580969e4be22842ced0dbaa6c4c383aa99dbba4c37a44dcb34ca0363367e0e25cbb4ad25e21aa0fc135e02f1a2f4a1d550cf3e5bb48fafcb5569d31ba19ddca

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\04a6abb6-a11f-496f-a64f-4b0b92b3a9dc\index-dir\the-real-index~RFe5a6b1f.TMP

                                                                                                                  Filesize

                                                                                                                  48B

                                                                                                                  MD5

                                                                                                                  89ba4acf94438c2603f2c3a4d86a12ac

                                                                                                                  SHA1

                                                                                                                  e478e72899ea6b51c4b1d933de52479c3f967ee0

                                                                                                                  SHA256

                                                                                                                  c6814b90bb18b8367c50a5b2fd254b9075ed40d45e283e93fa549e8715a883b2

                                                                                                                  SHA512

                                                                                                                  ad51c371e3dfd1c8376ae99b6ec404dac3db9ecfcf84777eff5b27af681234124bc657c3d8fe6c9e745357d22d7ef25c362fd93635134d0b0c15e51eedb2f3d5

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\7a60c8cc-7f96-44b1-b751-9a25588688c5\index-dir\the-real-index

                                                                                                                  Filesize

                                                                                                                  1KB

                                                                                                                  MD5

                                                                                                                  b3d6fa08ca15d1ba4ce85d4e8f55453d

                                                                                                                  SHA1

                                                                                                                  107da3b5f8a3de9a2605f02e3635fbe0815dbdd9

                                                                                                                  SHA256

                                                                                                                  d4e93e202c30fce2649a8f45720c0212ff58233351e321ebe0a9cdeb9c13150a

                                                                                                                  SHA512

                                                                                                                  fe8b47c73862184e2132d0b2ab9bfc6672dd7b7bcaf60b4cddb1d316fd855aabffdeb26ba4d6d57edfe24b6150b93285e55f0108c07bd74ed7cca32e762eb325

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\7a60c8cc-7f96-44b1-b751-9a25588688c5\index-dir\the-real-index~RFe5a79d5.TMP

                                                                                                                  Filesize

                                                                                                                  48B

                                                                                                                  MD5

                                                                                                                  fcad87db39c5dae8e57851f0111d133e

                                                                                                                  SHA1

                                                                                                                  fcfc3b4429e1af138f074a5d94962500a9bfe05d

                                                                                                                  SHA256

                                                                                                                  81ed4226c2dbb32a7d59b0d3ad24926447c588e8dd23389713f51579acfa0a77

                                                                                                                  SHA512

                                                                                                                  5626d3cecd00c44239f3484d1747d2b70310a468fc97b5be5350d61020c9d82a95e494fb29015bdfb319444bc328c6f1aa4cc51463ab282738de763b3a6a6b73

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

                                                                                                                  Filesize

                                                                                                                  237B

                                                                                                                  MD5

                                                                                                                  59b961c49c88885f4cec44899ad4fa25

                                                                                                                  SHA1

                                                                                                                  9edba9dfb6bdbafb1089e7f65d86c7cb1dbb66b7

                                                                                                                  SHA256

                                                                                                                  3a85a91cc5146f21784b750b22fa68fd398994f4b1df63f094c227c86314a207

                                                                                                                  SHA512

                                                                                                                  09f792dce436cb01eb5e4c5e21f782ced4e8c7ccd296bedfe9283bbeb53e397f3b456e89421467a9f96eda751a8978cb638e321de49b510b5f9623d0288d47fe

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

                                                                                                                  Filesize

                                                                                                                  234B

                                                                                                                  MD5

                                                                                                                  3041b90b8e9f471dfec6032f5d59f5ce

                                                                                                                  SHA1

                                                                                                                  6e86ff6a70ca29e0e30fe5ad343cfce47c145b20

                                                                                                                  SHA256

                                                                                                                  bab05029e01c2658c5ab5cc54fc24d565e0ebc8ec4cf467ee6f265f225187452

                                                                                                                  SHA512

                                                                                                                  719639f6e7333d07430abefe69de3065b4eb75145cb1d9074a258bba0b50234c6328b6a7b55d6f9bedf12784c037ec99f55f812c0ab055cc2c28bf1995f3dd41

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt~RFe5a1ce0.TMP

                                                                                                                  Filesize

                                                                                                                  142B

                                                                                                                  MD5

                                                                                                                  e061a470de216666462dcf244ab8e3f4

                                                                                                                  SHA1

                                                                                                                  2ba8d82e0e092004425634e7f1cceffc0594db91

                                                                                                                  SHA256

                                                                                                                  db696bedec2adb854b9fbcedaad3348e5cc27b182198c90d5559e8eef57e0a22

                                                                                                                  SHA512

                                                                                                                  dee3a12a26c6080f4f5826eb3f3d0b524cb213be9ee49e5348300a91c478017caaa1b5d6fcd996406b5d0381002c68ddcf3a749e69ca966a2d470fb5210ae7cc

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                                  Filesize

                                                                                                                  72B

                                                                                                                  MD5

                                                                                                                  7059813833e278fdf1bfc2bf62627383

                                                                                                                  SHA1

                                                                                                                  10525e9e81820aea29a43a0337a0e0a8c071e21e

                                                                                                                  SHA256

                                                                                                                  13f0384bd710a4d05af9e302d420060d294b080fd13b5d8a5c0deb8941e0f97b

                                                                                                                  SHA512

                                                                                                                  158aa49d79869f9204220a591090faec7194655b441afd3b5299e1363f05211933775bd6c23b1945678e5c4af7eb2a4cfd18a92effd84c25f8734adb3c7f93f0

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a6a06.TMP

                                                                                                                  Filesize

                                                                                                                  48B

                                                                                                                  MD5

                                                                                                                  cdb21938795d4a09b9a8105d66a46c36

                                                                                                                  SHA1

                                                                                                                  53fdd90d375ae293dea8d32d2b07a2d7ef019df6

                                                                                                                  SHA256

                                                                                                                  88fe52a361b4c19a68d100eba6a507d61b4d5772c614a585ac9a570bbefea4c9

                                                                                                                  SHA512

                                                                                                                  7513315f90a61fa3731fd02af14faeefbf053c2ca8f1966ba9ce67aa8f65a8f81de3974e0ee2f95378453b8221d47a3840d6208133fb7bf0b606b65fb255fc7f

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                  Filesize

                                                                                                                  215KB

                                                                                                                  MD5

                                                                                                                  f024eb556e6175ff5aab18eaa9c26e61

                                                                                                                  SHA1

                                                                                                                  ff0dcb759ffde1bb2708d364269f1cdadfa3e896

                                                                                                                  SHA256

                                                                                                                  11cd9fdb72c683ccc6cfd48872489d034849d3620599d20adf259f03d603ee76

                                                                                                                  SHA512

                                                                                                                  9ac97d61ec017bc2444e9241660cc2d96f1ede6bbbe03d58360f63548e5095f4f83a666abd15da2c5840506ff1a3fc94cba288631445772afad01bc63279c9e6

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                  Filesize

                                                                                                                  215KB

                                                                                                                  MD5

                                                                                                                  d33b144f3bc54254786c2b65d3b62a8d

                                                                                                                  SHA1

                                                                                                                  bdda3314e2e3c56cba9bcbf6d4b304f47e678a9e

                                                                                                                  SHA256

                                                                                                                  eff67aed0e29f56ecefd03f1982acec938e80da49d1570b86963022b08ff0342

                                                                                                                  SHA512

                                                                                                                  91f4daf34b4c8c1121f84d4156d812012501dfcd30990ffb5742227ff7caaa026e0fe2af131182a9206eac20111aefc34a4062c31f6b834a63a72044a40e7d41

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                  Filesize

                                                                                                                  215KB

                                                                                                                  MD5

                                                                                                                  1fcaca69693498c8ece2193ee4bfe975

                                                                                                                  SHA1

                                                                                                                  44ebd64f7e9f36bff51332fcf5f5c843431a5ab0

                                                                                                                  SHA256

                                                                                                                  9f2782757b85b4d9a9c836470e4db2599078a04c980d145818e310899d95eec4

                                                                                                                  SHA512

                                                                                                                  95deecd450d717da6bdb9a3337faf81f3c96e6148736c0594d777980170930d4aafa7eadfd863a7f12fdbf0a95e3a6bac0d60d7ec8fc3aee1f0f0788edb81c0b

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                                                                                  Filesize

                                                                                                                  103KB

                                                                                                                  MD5

                                                                                                                  fc0c7bfdeef8ab61d501491ae9d4065e

                                                                                                                  SHA1

                                                                                                                  9c483945a6839618612750e2d182d7c540a6e174

                                                                                                                  SHA256

                                                                                                                  26ef16ecf6c547a7e0253f3137d226c53e53e682516e3fc6eb04a84188ee1de9

                                                                                                                  SHA512

                                                                                                                  15ed3759c75667c67df4e14ad7b149ee2c4ac5abe3ab40a9f42d52aa7d62f63f2d817fc9f0bf7ef722eff232e6f6964778e475e8d38a527eb874e6a90d9a81ad

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                                                                                  Filesize

                                                                                                                  108KB

                                                                                                                  MD5

                                                                                                                  09dee916b4b76813adf2f482f7e22bf1

                                                                                                                  SHA1

                                                                                                                  1f1649e1a3479da519208ff7df1325d607be85aa

                                                                                                                  SHA256

                                                                                                                  e1acc302d85e3f5503aa2ad3325cb53e567bf49261de86a81077bbfcd82eac0c

                                                                                                                  SHA512

                                                                                                                  006e798921e4c356df087cbaa0961edf88ec6c1ab7f29375c9d0674dfce7e5f2632e617da6c8489834e806ffb655366904ed362969f1b5a86e04f4759eee20be

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5a9c41.TMP

                                                                                                                  Filesize

                                                                                                                  101KB

                                                                                                                  MD5

                                                                                                                  02c49d732f807dbb6cd6c7669f404644

                                                                                                                  SHA1

                                                                                                                  65638b5a1c8f8a7909f577bced88252144b2c664

                                                                                                                  SHA256

                                                                                                                  ead2eb2826291fa50145154249961ecf6a00669a3bcb77951639a932d77170da

                                                                                                                  SHA512

                                                                                                                  26b6d5ec0fb4eb1d34bb9f87082d47fb7a83758b1dd0ba0c7f3afec660fc8ea5e168a1702373a169090babb92f5bd673a14b8c48203fbed2a336ee2afb0d0154

                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                                                                                  Filesize

                                                                                                                  2B

                                                                                                                  MD5

                                                                                                                  99914b932bd37a50b983c5e7c90ae93b

                                                                                                                  SHA1

                                                                                                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                                                  SHA256

                                                                                                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                                                  SHA512

                                                                                                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\.net\EV3 Classroom-win-1.5.3.4056\a0dz4rcb.bek\CefSharp.Core.dll

                                                                                                                  Filesize

                                                                                                                  1.9MB

                                                                                                                  MD5

                                                                                                                  f8b1cf76364fa42d6c21a990eac8daf3

                                                                                                                  SHA1

                                                                                                                  d38d5687b46a669cb4cc4b1ef52f37c82d1529d0

                                                                                                                  SHA256

                                                                                                                  1ad29c3b8dc162c5493c9e45166ca8e3ed2e0a83a2577f7ffb1c4dca4f350e71

                                                                                                                  SHA512

                                                                                                                  de4edcc795404070263d840c7f65e74fec5197ab90e3001e805d3dbaaf3f1369d48627683461d00868656dfc1dbf20095bea54fd25c27a91cb0b72e22225920f

                                                                                                                • C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\Cache\Cache\f_00000d

                                                                                                                  Filesize

                                                                                                                  767KB

                                                                                                                  MD5

                                                                                                                  367360ca955c0c021c30fd6e8b1d14a6

                                                                                                                  SHA1

                                                                                                                  ec1c63bedcf00fe474757fa98006931a257d5000

                                                                                                                  SHA256

                                                                                                                  8ec42e5b7847cc1eea5e60f27172c10b9b361b86edfd8866676e156b0d449b67

                                                                                                                  SHA512

                                                                                                                  ec887f2ada6803409db640b6bc353b1eaed7504c509294f1be88ee1dcef8f9fd577e9fbeaffdf9297dc0f34bf66a487a084b844b88994091959ecea008450045

                                                                                                                • C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\Cache\Cache\f_000016

                                                                                                                  Filesize

                                                                                                                  1024KB

                                                                                                                  MD5

                                                                                                                  93efca9e28ef9d1632fac4f50599902d

                                                                                                                  SHA1

                                                                                                                  813a742c0b7e878cff24e00aa0f06701bd676efd

                                                                                                                  SHA256

                                                                                                                  8e6591bfba890d82b48846b5496b16c111180cf34d5db4e328331998a59f0034

                                                                                                                  SHA512

                                                                                                                  2029ae275cbca172b97837691a063fd07e196428aa11c17d62317affc4e3e4af48b99cc8ff60c3e55b107baf8a5276ee439e67dfb3a757d192623e0f4eb8ba29

                                                                                                                • C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\Cache\Code Cache\js\index-dir\the-real-index

                                                                                                                  Filesize

                                                                                                                  96B

                                                                                                                  MD5

                                                                                                                  6a68cb416dd9752f870283aa33197ccd

                                                                                                                  SHA1

                                                                                                                  2e00419746a1fcf22c95cb5d89588808ffec634a

                                                                                                                  SHA256

                                                                                                                  163610ebac6655d8e15ba8b83a86a6eb1c22a80cfc29b6e2283ce2f55b2c73ab

                                                                                                                  SHA512

                                                                                                                  f41dba4a834e3267ffc7c47281011112981909df5049948bd0c63759edd0189b54194c09f5e716b21a26eed28e880ca745b5ab7f8122224f99168d07c19d19ca

                                                                                                                • C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\Cache\Code Cache\js\index-dir\the-real-index~RFe5e4842.TMP

                                                                                                                  Filesize

                                                                                                                  48B

                                                                                                                  MD5

                                                                                                                  8df001e0f7c9d0e95f63f7a43c50dd78

                                                                                                                  SHA1

                                                                                                                  866794ea630d8134721b4b1e0c66cecd09739aa3

                                                                                                                  SHA256

                                                                                                                  85afb94e89a98e60d2f0983af8d799b707db3794eb7580cc877ad2ec69947e1f

                                                                                                                  SHA512

                                                                                                                  444598ef34f26a7ec21ffcb942c647e65fe40fd71c08f785cf4de9dc954f20ea4a050206ba84cf33288af894e248f0e578e36127b444a582a43b07bf08361618

                                                                                                                • C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\Cache\Code Cache\wasm\index

                                                                                                                  Filesize

                                                                                                                  24B

                                                                                                                  MD5

                                                                                                                  54cb446f628b2ea4a5bce5769910512e

                                                                                                                  SHA1

                                                                                                                  c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

                                                                                                                  SHA256

                                                                                                                  fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

                                                                                                                  SHA512

                                                                                                                  8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

                                                                                                                • C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\Cache\Local Storage\leveldb\CURRENT

                                                                                                                  Filesize

                                                                                                                  16B

                                                                                                                  MD5

                                                                                                                  46295cac801e5d4857d09837238a6394

                                                                                                                  SHA1

                                                                                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                  SHA256

                                                                                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                  SHA512

                                                                                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                • C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\Cache\Local Storage\leveldb\MANIFEST-000001

                                                                                                                  Filesize

                                                                                                                  41B

                                                                                                                  MD5

                                                                                                                  5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                                  SHA1

                                                                                                                  d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                                  SHA256

                                                                                                                  f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                                  SHA512

                                                                                                                  de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                                • C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\Cache\Network Persistent State

                                                                                                                  Filesize

                                                                                                                  186B

                                                                                                                  MD5

                                                                                                                  5e3a9694a4379f034047f3892c89d6eb

                                                                                                                  SHA1

                                                                                                                  df4dfb02b87dc54abdeff89841c0cd03ad1b1f44

                                                                                                                  SHA256

                                                                                                                  2d6a727c5f69c53bcdbe8c5c95591f2e554a94805a3963db2e3dd6736520774c

                                                                                                                  SHA512

                                                                                                                  5ffbf2da92e8216de9a33e0b6329c61ff9cab7fc11ddd75cddcf9c67d7e9056ff84eb2722b3e19093a5675276b2d709066c67f7a9d6eab6c42e869c7122f7d04

                                                                                                                • C:\Users\Admin\AppData\Roaming\MINDSTORMS_EDU\CefSharp\Cache\Network Persistent State~RFe5f11eb.TMP

                                                                                                                  Filesize

                                                                                                                  59B

                                                                                                                  MD5

                                                                                                                  2800881c775077e1c4b6e06bf4676de4

                                                                                                                  SHA1

                                                                                                                  2873631068c8b3b9495638c865915be822442c8b

                                                                                                                  SHA256

                                                                                                                  226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                                                                                                  SHA512

                                                                                                                  e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                                                                                                • C:\Users\Admin\Desktop\CheckpointTest.mov

                                                                                                                  Filesize

                                                                                                                  533KB

                                                                                                                  MD5

                                                                                                                  dedb9018c4e62bea471e3bf90fb3b07a

                                                                                                                  SHA1

                                                                                                                  543e5efc83024a4e3aba268ffebd299e3bc21da6

                                                                                                                  SHA256

                                                                                                                  48af33135549aedbceaeb41080e441be587b8c38ac99828eefc8581f88eaffde

                                                                                                                  SHA512

                                                                                                                  58b838ae1b975a87c7f1c3e1477887fa684fc1ca3fd80f0ed1951bb20c2718ed82425bf1dfff7765bef4bbed73f0f154dd5dc9824ae698a47195d303891598aa

                                                                                                                • C:\Users\Admin\Desktop\ClearInvoke.TS

                                                                                                                  Filesize

                                                                                                                  346KB

                                                                                                                  MD5

                                                                                                                  cad96bf73ecff603200e23bd76f41412

                                                                                                                  SHA1

                                                                                                                  730adfc4eeea99c604d662d3d2dd82c3a4d9aac4

                                                                                                                  SHA256

                                                                                                                  64009edbd4a739e57cef83a25e5837d7ca9ab26275c0b6b63d39b168f1e313f8

                                                                                                                  SHA512

                                                                                                                  6e66af6b5864eb149e1f43e4aeecba12ac3e75899fc2586071458d1c471dfd4f00c8495dce0d6ef3e88ee0f9c1d36a7085f88659416667725dee517795d62c7c

                                                                                                                • C:\Users\Admin\Desktop\CompareTest.ram

                                                                                                                  Filesize

                                                                                                                  800KB

                                                                                                                  MD5

                                                                                                                  645c7a0cafa991026bf18277e8cddfba

                                                                                                                  SHA1

                                                                                                                  2787447a8fa39a13709e6a75a1782a4a7fa34aa8

                                                                                                                  SHA256

                                                                                                                  0b01085957e3fad07bbbcb3d8664bf310fe54c6bcfa9d192352dbeb7108ccca7

                                                                                                                  SHA512

                                                                                                                  0eaa0864ac6aeb246cdb9bcdc469af8970e982cebaf848dc038caa200aabb27fd21bbcde24faccfa798ad7f0c20af324233e9a1877d2380364bfc592646f7c57

                                                                                                                • C:\Users\Admin\Desktop\ConvertToCompare.TTS

                                                                                                                  Filesize

                                                                                                                  426KB

                                                                                                                  MD5

                                                                                                                  cd687a14eb2cc17411f9b1d09f670946

                                                                                                                  SHA1

                                                                                                                  d8e0142992f16ec8dcd0dd25046fb43ec4145474

                                                                                                                  SHA256

                                                                                                                  73ab17e071db8713633f91e70eaf404c87be59ed11c310f97d6ad987a435a29b

                                                                                                                  SHA512

                                                                                                                  1eb7a9cf4e4c2268347cfc23c0ab4e0d7466b3bb0e3988fd4cf32fd837038d034e0bc9803be875b315403e51393641715d857b6f742fd08c062c859710e31f76

                                                                                                                • C:\Users\Admin\Desktop\CopyMeasure.mpv2

                                                                                                                  Filesize

                                                                                                                  746KB

                                                                                                                  MD5

                                                                                                                  cae6869a353344ef2e84f003a3234e16

                                                                                                                  SHA1

                                                                                                                  792cf92a148086de1a6e9e7f104488540d70f512

                                                                                                                  SHA256

                                                                                                                  b31732484e9318242ad1c01c36b2197d4ff34960ef81a836dcd5d8e67f800264

                                                                                                                  SHA512

                                                                                                                  a1b8ccb9a2d2d915e7f75556dc9f9b359cfb69f335324af1ab8090b0f985719ce6bd831f7beec35cdc108a47f03b0ae428405d7f00cdc185589e864ec9f87461

                                                                                                                • C:\Users\Admin\Desktop\DismountSave.mp3

                                                                                                                  Filesize

                                                                                                                  880KB

                                                                                                                  MD5

                                                                                                                  7219859b130e26074e3746bdff31369c

                                                                                                                  SHA1

                                                                                                                  73e97da900085fad0dd1f77d5031823ffbd7b300

                                                                                                                  SHA256

                                                                                                                  44d0500c627728f4aca77dfb4623be7def35ef885fa1fba7dc8ff0d5c6046972

                                                                                                                  SHA512

                                                                                                                  a20ecafec7982fb50153534810f86ac10e53efc95b57c587215035f734517ea33fc5d1de1b9769d6be51721ca2125618b467d9c1e8ee19de137fe1a987b209af

                                                                                                                • C:\Users\Admin\Desktop\EnterRead.m3u

                                                                                                                  Filesize

                                                                                                                  480KB

                                                                                                                  MD5

                                                                                                                  f53402fa36f92d9330d1d82238176afe

                                                                                                                  SHA1

                                                                                                                  aa5c437094c755087c8c6f085a86bc043fe6b8ab

                                                                                                                  SHA256

                                                                                                                  ecbc9e6d8d43904ed9b0db6fda83bcc8862981b89f8d557fdb016745fd32abf7

                                                                                                                  SHA512

                                                                                                                  1345c32efc8fcdfdef37f428fd1f6bed6ddb354f5dc18400b18b66343206c045219fe54c963d2cd83c528374390a147d97fb62373fa1e462f0325f34fbecbe10

                                                                                                                • C:\Users\Admin\Desktop\FindShow.avi

                                                                                                                  Filesize

                                                                                                                  453KB

                                                                                                                  MD5

                                                                                                                  89ab69de73c3d515dc899fe07d37e529

                                                                                                                  SHA1

                                                                                                                  9f5387c33965d99dcf60396bc364b45e5ec06363

                                                                                                                  SHA256

                                                                                                                  a02b812373a0eda68f3fb2334ea508e5c4837e39697e60b1c0af99162ebb3c62

                                                                                                                  SHA512

                                                                                                                  ba4319aef63b6d7aa4494b735ef6f555500fa2569fe9bb49fa30f2ab7bf20c1d1ae46eed7cd75c65859f5aa3ea05955ab814aac3108dafb6fb5d3b847c0dc123

                                                                                                                • C:\Users\Admin\Desktop\FormatPing.rm

                                                                                                                  Filesize

                                                                                                                  400KB

                                                                                                                  MD5

                                                                                                                  70f7d6391f0d298e26113f932c7349c3

                                                                                                                  SHA1

                                                                                                                  5b641a44728c19d5373a9c5584ad9078a18e9298

                                                                                                                  SHA256

                                                                                                                  1a4c022a00612cdb4da43332aa8b02670e0b74cacdb4d2828400d5ccc9d50b62

                                                                                                                  SHA512

                                                                                                                  b92dfe31004c7c038b0186655f2b26eda6cf2e8923c921a447fcc64fcf4d36273dfef190b6c2ae14a1d1bf9b3306efd6af275e06e5b22eac9201c5cac7244625

                                                                                                                • C:\Users\Admin\Desktop\HideEdit.otf

                                                                                                                  Filesize

                                                                                                                  906KB

                                                                                                                  MD5

                                                                                                                  3a5766a930927cbf3f596a902f64fdd6

                                                                                                                  SHA1

                                                                                                                  0e98ab74e00a254fc3090c7d96eabb4b409ae18c

                                                                                                                  SHA256

                                                                                                                  8d3bfb2af818d53e35908cf18aecccb62f921f77b1707aa921cd4177a1c67d3d

                                                                                                                  SHA512

                                                                                                                  8753d4bb918d152c1ccb6427742dbba7864f9a6c0fd06bf714b26989094d6b542fffa15a23dd6e95170cfba0072f8044f21234b0ad61118a8e2142ecc04d1033

                                                                                                                • C:\Users\Admin\Desktop\OptimizeReceive.doc

                                                                                                                  Filesize

                                                                                                                  826KB

                                                                                                                  MD5

                                                                                                                  ffce5282ce29762a9fad0f146db95dc6

                                                                                                                  SHA1

                                                                                                                  ded6064bcf3d3e9a4f7495db6589d673e63a004d

                                                                                                                  SHA256

                                                                                                                  6d90e68e5816fc940225b3b1646d5ed4d6e123d1d8bfcbe064990ea3ec10b51b

                                                                                                                  SHA512

                                                                                                                  2db1613b77f6e2ab72ae876c8e1026d8ce6b8c41bd28e5d504ee4d3eb6325ff621a72decd38c110591d65f7d958973d24efe91d39f2d6136335066142d7320e1

                                                                                                                • C:\Users\Admin\Desktop\ProtectReceive.ini

                                                                                                                  Filesize

                                                                                                                  560KB

                                                                                                                  MD5

                                                                                                                  58affdb43748afc75d754e051bad4fb7

                                                                                                                  SHA1

                                                                                                                  cb967b547da35d5175307e3c05e1ad76c9493614

                                                                                                                  SHA256

                                                                                                                  c7f9bad1c9a0f0efb382561afeed4f963f9c18cbdf2f93b14103d5e46eb71625

                                                                                                                  SHA512

                                                                                                                  d77fd7af73aa0dd1eef0347b9e008ca9229dadc9b17dca76ce4fa38f7ccc42a52948d3d2f24f814be92a7c623e9ebe5bf24dcf2d7705b030edfb68f8251e66cf

                                                                                                                • C:\Users\Admin\Desktop\RegisterWait.gif

                                                                                                                  Filesize

                                                                                                                  853KB

                                                                                                                  MD5

                                                                                                                  ed23b71e2b3804b1cae34af1ef9a8d96

                                                                                                                  SHA1

                                                                                                                  dffa723cfe2c9dbcde41a56dad1ec4e8dcccce10

                                                                                                                  SHA256

                                                                                                                  915e93d7093c4c91ec606b5829051203e4bd90391f014971eb070adf2afa6e8e

                                                                                                                  SHA512

                                                                                                                  a8d50fc036f8312bd07041c4dc5776b87abdd91b87387938ba5097dba15383b6e824ab32cf6dd72ae1e2bb4b9ea018b0e865b93251567d73bde82982ea7726bd

                                                                                                                • C:\Users\Admin\Desktop\RepairImport.csv

                                                                                                                  Filesize

                                                                                                                  506KB

                                                                                                                  MD5

                                                                                                                  95ddb1998c299a0918b7d91beb8c6ccf

                                                                                                                  SHA1

                                                                                                                  42392c8be50fc980318c0f21286550fab74f87fd

                                                                                                                  SHA256

                                                                                                                  6af1102bbf457eb5218ab2b2146d9e46db62b901f58e72d466f7848043281b92

                                                                                                                  SHA512

                                                                                                                  1ba4b68ab00261e6c2e5b3874291c243f4f69cdee54b59679c3edb1a1e2e0bb19b84ab3a2446e0caf7666eb9b4b4c12ddde244c378a2f110a463e706a2364831

                                                                                                                • C:\Users\Admin\Desktop\ResetRepair.wmx

                                                                                                                  Filesize

                                                                                                                  720KB

                                                                                                                  MD5

                                                                                                                  289c3fcc7602258b8629ba5ecff53cb9

                                                                                                                  SHA1

                                                                                                                  0e5e7cc307d182c64741fef6f8b8b1c8fa1f62c5

                                                                                                                  SHA256

                                                                                                                  5038408367fb78965520f4b5d435175c9a09f69d3f1137d103781101b5d6875a

                                                                                                                  SHA512

                                                                                                                  508ac9755ce0c711a2d323e83d367bc6402245c7e990099bdea85cf9a1774f71558107423223e8b4771237a496aedb0ec462169d629296140ec7f51ae61d3e23

                                                                                                                • C:\Users\Admin\Desktop\RevokeSend.mpe

                                                                                                                  Filesize

                                                                                                                  586KB

                                                                                                                  MD5

                                                                                                                  a1482a63420f504c926139c6f02f9933

                                                                                                                  SHA1

                                                                                                                  8b8a9e8a8d8e5e723e4d1b7ea2eb0f121eb9daf6

                                                                                                                  SHA256

                                                                                                                  a9edfe7c422b77d259b7709e99051dee75bd37fcbf2432d873a97d3676311691

                                                                                                                  SHA512

                                                                                                                  215726279d1f4df72dbeb9bca03b13a2d4c9678bf68561db8a017cb0d0832e97dc05ab56dcd7997929bfb88c76114cf1d52abe5b9d584cf3bc88a91726376277

                                                                                                                • C:\Users\Admin\Desktop\StepUnprotect.001

                                                                                                                  Filesize

                                                                                                                  613KB

                                                                                                                  MD5

                                                                                                                  a6780a69e87e9ab62b83cd4946ad4737

                                                                                                                  SHA1

                                                                                                                  0922a5fd5d90f5a0da5bb7689694351b148b111b

                                                                                                                  SHA256

                                                                                                                  d09728171b9ed7fa40906e74c4e93a997e9378326002e0c59218b875fa67eaa1

                                                                                                                  SHA512

                                                                                                                  01d63b725c9ecde551739c53afa905fcce7efe5ca8bfd201639e89ce95a03ce4826378b10101ba2995e66d41684324fea10bbdb2e2b828d0be6e42440a9354c2

                                                                                                                • C:\Users\Admin\Desktop\StopPop.vsdm

                                                                                                                  Filesize

                                                                                                                  666KB

                                                                                                                  MD5

                                                                                                                  914cd64b0d737b5bfa13d12791db2194

                                                                                                                  SHA1

                                                                                                                  2321043bd4f70a826e96ba5963a0084111214f00

                                                                                                                  SHA256

                                                                                                                  473c5331eea1cb8430ac5520a0f4bfc4377bb5631115f4f2e26309858a98da24

                                                                                                                  SHA512

                                                                                                                  0cd8c1af5933bcb6737bfd1afee17ef9ee50575a43e9955178e7857ad35cc9494d59519432a1c8045f9e6c12e78618247c44973de4b2a04cb6c117aa3111082d

                                                                                                                • C:\Users\Admin\Desktop\SuspendSelect.clr

                                                                                                                  Filesize

                                                                                                                  773KB

                                                                                                                  MD5

                                                                                                                  adb3e1587d4152991a7c5ec91f8fcf56

                                                                                                                  SHA1

                                                                                                                  e9ff99cc90ed65792ee02648e36c6a213031613a

                                                                                                                  SHA256

                                                                                                                  9a2a84f89b8579377ed8d9390a46cf6a16add180b9e66ee07654a6ad82596dab

                                                                                                                  SHA512

                                                                                                                  b5ca70dd05899e8b7d85f7aa7ee2dbc9479309d3c4ef0f817404b50ee15f3a59a6d73779af06eadbcbf4ab0872543384e07ab863110e5f47780f7e9bae3c5570

                                                                                                                • C:\Users\Admin\Desktop\SwitchRevoke.7z

                                                                                                                  Filesize

                                                                                                                  640KB

                                                                                                                  MD5

                                                                                                                  4011bd07127f563d1c8de4b8f250dd00

                                                                                                                  SHA1

                                                                                                                  53162d77a9db1f4d8a84fa9efe15a403255c999f

                                                                                                                  SHA256

                                                                                                                  2cb19bf4e65dedbcccacedce10165002112fbe2f5d5f799a69ef3c138b4f63d8

                                                                                                                  SHA512

                                                                                                                  e79215558e6ffb3367210e231341ebb995eff9725f2910e2b0e8127aa1debb2be4bcac8a5678ed6a053b6354dc83ea47eb1dd7b1288529282c87ee66a67e78c0

                                                                                                                • C:\Users\Admin\Desktop\TraceMerge.htm

                                                                                                                  Filesize

                                                                                                                  320KB

                                                                                                                  MD5

                                                                                                                  1e8e58e8c66025734a2b2bb3eef3451e

                                                                                                                  SHA1

                                                                                                                  001f3dc54162d5987c2c74fd2c2c4d3445df800f

                                                                                                                  SHA256

                                                                                                                  6855bcebfecfcf944c33122cdfffe173063f80de00d1103a55f3805fb10ec71c

                                                                                                                  SHA512

                                                                                                                  453260ff94d93eb0279ad1bdcaf8f73599f1f6e08057f83e2b6a94f71c764102f9fa982b7ee8f5603978aaf9c8131994c8bd0542f7a3c445df1a576516a40411

                                                                                                                • C:\Users\Admin\Desktop\UnblockClear.ppt

                                                                                                                  Filesize

                                                                                                                  1.2MB

                                                                                                                  MD5

                                                                                                                  20dfc322fff54ed29fddc2095b6ba8df

                                                                                                                  SHA1

                                                                                                                  0a1bd2212abb47c16028a927e14ff7b6db10c355

                                                                                                                  SHA256

                                                                                                                  1446e39322d3d97b074cf2c9208350222b79f0b0e35a1bf44baa3a9afa96173a

                                                                                                                  SHA512

                                                                                                                  87ed6f8869f7edb24b2ce1b483b64b4e0df798968cf711e2d1b3a7cd48b47518584eab92698aa895dc759258c0581a8b58dbd434f6025a799faac528ba7b7cf8

                                                                                                                • C:\Users\Admin\Desktop\WatchOpen.eps

                                                                                                                  Filesize

                                                                                                                  373KB

                                                                                                                  MD5

                                                                                                                  c654ec07fc83a874d0790ee549eacc4f

                                                                                                                  SHA1

                                                                                                                  85d515ac2da0d401656dae3eec518f2b10259be0

                                                                                                                  SHA256

                                                                                                                  2ff6fb3683a33d10e3b8c7563acc67747cfb85dfed2772aa70b8ae5040c89cd9

                                                                                                                  SHA512

                                                                                                                  5ced8026da5a069215a31b6cd90b8fa9cd3fb2c29c9921a82fb24160b747cd865d464422e148f865395f7ec45ecfe232fa6bf76bfdf9ab170293ed73958dec39

                                                                                                                • C:\Users\Admin\Desktop\WriteConvert.vbs

                                                                                                                  Filesize

                                                                                                                  693KB

                                                                                                                  MD5

                                                                                                                  7fad361f02d5d9f714b29432fc828f2a

                                                                                                                  SHA1

                                                                                                                  f68b3f7dfcdb023c495711d4f43141083b6a6fef

                                                                                                                  SHA256

                                                                                                                  e4aed6ebf50ef6b1e9247deeae074a946855aa15e9788db72fe79903dad63f7c

                                                                                                                  SHA512

                                                                                                                  510a8481684156d4df1f8cead7ec7f4ce51f671cfe9e1ddde7ec12cf408b65ae08b0afa2f494f3160c7a079709dd5353652755f5302b7bdca1bcedfc3f261b43

                                                                                                                • C:\Users\Admin\Documents\LEGO Education EV3 Content\en-US\buildinginstructions\manifest.json

                                                                                                                  Filesize

                                                                                                                  3B

                                                                                                                  MD5

                                                                                                                  58e0494c51d30eb3494f7c9198986bb9

                                                                                                                  SHA1

                                                                                                                  cd0d4cc32346750408f7d4f5e78ec9a6e5b79a0d

                                                                                                                  SHA256

                                                                                                                  37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570

                                                                                                                  SHA512

                                                                                                                  b7a9336ed3a424b5d4d59d9b20d0bbc33217207b584db6b758fddb9a70b99e7c8c9f8387ef318a6b2039e62f09a3a2592bf5c76d6947a6ea1d107b924d7461f4

                                                                                                                • C:\Users\Admin\Downloads\EV3_Classroom_Windows_1.5.3_Global.msi

                                                                                                                  Filesize

                                                                                                                  249.9MB

                                                                                                                  MD5

                                                                                                                  d7bb4958b30df56c72041ff26d875f43

                                                                                                                  SHA1

                                                                                                                  70ed2ab3f18f157db6556f88e99f8575a2498379

                                                                                                                  SHA256

                                                                                                                  e9639181b5cf21ebbfa217cf9cd56cb87af6cf24a22898321b44dfe9f563e5ad

                                                                                                                  SHA512

                                                                                                                  96b61d9344472b375ee9f281d25ae02a7060e6ccec19e894e3e8d21d8fda09820ac3af3b7ac8b344684b3f23dc090449f08e6bd6a321335c95046b3c4d7a74ca

                                                                                                                • C:\Users\Admin\Downloads\EV3_Classroom_Windows_1.5.3_Global.msi

                                                                                                                  Filesize

                                                                                                                  249.9MB

                                                                                                                  MD5

                                                                                                                  d7bb4958b30df56c72041ff26d875f43

                                                                                                                  SHA1

                                                                                                                  70ed2ab3f18f157db6556f88e99f8575a2498379

                                                                                                                  SHA256

                                                                                                                  e9639181b5cf21ebbfa217cf9cd56cb87af6cf24a22898321b44dfe9f563e5ad

                                                                                                                  SHA512

                                                                                                                  96b61d9344472b375ee9f281d25ae02a7060e6ccec19e894e3e8d21d8fda09820ac3af3b7ac8b344684b3f23dc090449f08e6bd6a321335c95046b3c4d7a74ca

                                                                                                                • C:\Users\Public\Desktop\Acrobat Reader DC.lnk

                                                                                                                  Filesize

                                                                                                                  2KB

                                                                                                                  MD5

                                                                                                                  5fda61c18b4898bb6876c22e0e161615

                                                                                                                  SHA1

                                                                                                                  a02873731ccc27d5e17d941fe61b3017f8c86df0

                                                                                                                  SHA256

                                                                                                                  f1db7dd18c946dce3f6c3be4ed3d27251f5d2b5cfdf578994c572e3603ebc191

                                                                                                                  SHA512

                                                                                                                  fb44b3868394a0c8427b15cb2252ccc098617c3a3807a72a1b7bbf5143468716a308811c3935a678c77754859222a4b4cf919f39b54b82e50636b705eadfec8c

                                                                                                                • C:\Users\Public\Desktop\VLC media player.lnk

                                                                                                                  Filesize

                                                                                                                  923B

                                                                                                                  MD5

                                                                                                                  25214199d15ec9b2b69fbff67f42042f

                                                                                                                  SHA1

                                                                                                                  7b7caa9588eb25d5636b32c5560866e88c9bc7ac

                                                                                                                  SHA256

                                                                                                                  1c9fa87a54117a1cf1b49ca87ba1fa7d9ad4df64b18693c15a49c0b85a14cb28

                                                                                                                  SHA512

                                                                                                                  8512bf7649a798dc7341f559b4cc73bb89dbf8388ed9c8e587c5dce6ba2228ff9be24c157b60e31ee662b3c158354ee33601ccdfe1acb14a05a339319c3d8c16

                                                                                                                • memory/1036-2632-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/1036-2058-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/1036-2455-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/1036-2467-0x0000013620B00000-0x0000013620B10000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/1036-2076-0x0000013620B00000-0x0000013620B10000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/2096-2495-0x000002D1F3410000-0x000002D1F3420000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/2096-2633-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/2096-2491-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/2096-2456-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/2296-2482-0x000002457BDE0000-0x000002457BDF0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/2296-2631-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/2296-2476-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/2296-2099-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/2296-2134-0x000002457BDE0000-0x000002457BDF0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/2900-2617-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/2900-2616-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/3480-2413-0x000001F3EB530000-0x000001F3EB540000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/3480-2093-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/3480-2490-0x000001F3EB530000-0x000001F3EB540000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/3480-2627-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/3480-2488-0x000001F3EB530000-0x000001F3EB540000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/3480-1997-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/4000-2556-0x000002089D050000-0x000002089D060000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/4000-2543-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/4000-2492-0x000002089D050000-0x000002089D060000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/4000-2489-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/4000-2634-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/4176-2033-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB

                                                                                                                • memory/4176-2003-0x00007FF89CFF0000-0x00007FF89D55F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.4MB