Overview

overview

10

Static

static

1

classroom....2).msi

windows11-21h2-x64

10

Analysis

  • max time kernel
    330s
  • max time network
    331s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08-01-2025 21:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    classroom.cloud.1.1e32ad54-8afb-4c05-a1c5-6e3e40e93fe4.uksouth(2).msi

  • Size

    54.1MB

  • MD5

    7ac4d934b4d49e2fe9376a5d6071e95a

  • SHA1

    26f48f7235651115d4ae806b67867255fbff3498

  • SHA256

    d933149df4213449714cf63a0d63d04cb632caa97845579eae269bf16b5badcf

  • SHA512

    795429c6952e71ccd09259ce3bc4ccd6aa1a31ac193aff057ae160af8fa3000fcc7704ba3e5047c571797703fa4fbcfe7b3b40d89c2299c7bdb7c37138b64d11

  • SSDEEP

    1572864:FTBHdo6SPs7HpTeowced2oC6ho5fstdq:FNNSPIpTeoVed22

Score
10/10
netsupportdiscoverypersistenceprivilege_escalationrat

Malware Config

Signatures

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport
  • Netsupport family
    netsupport
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 2 IoCs
    persistence
  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 29 IoCs
  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 8 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 40 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\classroom.cloud.1.1e32ad54-8afb-4c05-a1c5-6e3e40e93fe4.uksouth(2).msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Loads dropped DLL
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1388
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1132
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C9B66D2420A877779D69D04B7750CE52 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1356
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:884
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 6860AC565BC508D9AAE98E79590D311B
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4860
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 168819B9C32BCC4142E54B55E4B10ACF E Global\MSI0000
        2⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:1720
      • C:\Program Files (x86)\NetSupport\classroom.cloud\WINSTALL.EXE
        "C:\Program Files (x86)\NetSupport\classroom.cloud\WINSTALL.EXE" /EV"classroom.cloud Student" /EC /Q /Q /I *
        2⤵
        • Sets service image path in registry
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2472
        • C:\Program Files (x86)\NetSupport\classroom.cloud\winst64.exe
          winst64.exe /q /q /i
          3⤵
          • Drops file in Drivers directory
          • Drops file in System32 directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:4864
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4716
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2388
      • C:\Program Files (x86)\NetSupport\classroom.cloud\cicStudent.exe
        "C:\Program Files (x86)\NetSupport\classroom.cloud\cicStudent.exe" /* *
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2804
        • C:\Program Files (x86)\NetSupport\classroom.cloud\GetUserLang.exe
          "C:\Program Files (x86)\NetSupport\classroom.cloud\GetUserLang.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2564
        • C:\Program Files (x86)\NetSupport\classroom.cloud\cicStudent.exe
          "C:\Program Files (x86)\NetSupport\classroom.cloud\cicStudent.exe" * /VistaUI
          2⤵
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:396
          • C:\Program Files (x86)\NetSupport\classroom.cloud\GetUserLang.exe
            "C:\Program Files (x86)\NetSupport\classroom.cloud\GetUserLang.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:4196
          • C:\Program Files (x86)\NetSupport\classroom.cloud\winst64.exe
            "C:\Program Files (x86)\NetSupport\classroom.cloud\winst64.exe" /Q /Q /EB60206,1
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:2760
          • C:\Program Files (x86)\NetSupport\classroom.cloud\GetUserLang.exe
            "C:\Program Files (x86)\NetSupport\classroom.cloud\GetUserLang.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:3880
          • C:\Program Files (x86)\NetSupport\classroom.cloud\CICPlugin.exe
            "C:\Program Files (x86)\NetSupport\classroom.cloud\CICPlugin.exe" /USER=SYSTEM
            3⤵
            • Enumerates connected drives
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            PID:4828
          • C:\Program Files (x86)\NetSupport\classroom.cloud\CICPlugin64.exe
            "C:\Program Files (x86)\NetSupport\classroom.cloud\CICPlugin64.exe" /USER=SYSTEM
            3⤵
            • Enumerates connected drives
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            PID:4524
          • C:\Program Files (x86)\NetSupport\classroom.cloud\CICPlugin.exe
            "C:\Program Files (x86)\NetSupport\classroom.cloud\CICPlugin.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:4328
          • C:\Program Files (x86)\NetSupport\classroom.cloud\CICPlugin64.exe
            "C:\Program Files (x86)\NetSupport\classroom.cloud\CICPlugin64.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3828
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://java.com/
        1⤵
        • Loads dropped DLL
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4824
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ff827933cb8,0x7ff827933cc8,0x7ff827933cd8
          2⤵
          • Loads dropped DLL
          PID:4204
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,18281320093702994561,2447071083961213830,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2044 /prefetch:2
          2⤵
            PID:2592
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,18281320093702994561,2447071083961213830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3348
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,18281320093702994561,2447071083961213830,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
            2⤵
              PID:2352
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,18281320093702994561,2447071083961213830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
              2⤵
                PID:5200
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,18281320093702994561,2447071083961213830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
                2⤵
                  PID:5208
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,18281320093702994561,2447071083961213830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1984 /prefetch:1
                  2⤵
                    PID:6104
                  • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,18281320093702994561,2447071083961213830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
                    2⤵
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5852
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2020,18281320093702994561,2447071083961213830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
                    2⤵
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    PID:6076
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:5396
                  • C:\Windows\System32\CompPkgSrv.exe
                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                    1⤵
                      PID:5452
                    • C:\Windows\system32\BackgroundTransferHost.exe
                      "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
                      1⤵
                      • Modifies registry class
                      PID:5904
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                      1⤵
                        PID:5248
                      • C:\Windows\system32\OpenWith.exe
                        C:\Windows\system32\OpenWith.exe -Embedding
                        1⤵
                          PID:1388
                        • C:\Windows\system32\OpenWith.exe
                          C:\Windows\system32\OpenWith.exe -Embedding
                          1⤵
                            PID:1424

                          Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Persistence

                          Boot or Logon Autostart Execution

                          2
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Winlogon Helper DLL

                          1
                          T1547.004

                          Event Triggered Execution

                          2
                          T1546

                          Component Object Model Hijacking

                          1
                          T1546.015

                          Installer Packages

                          1
                          T1546.016

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          2
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Winlogon Helper DLL

                          1
                          T1547.004

                          Event Triggered Execution

                          2
                          T1546

                          Component Object Model Hijacking

                          1
                          T1546.015

                          Installer Packages

                          1
                          T1546.016

                          Defense Evasion

                          Modify Registry

                          3
                          T1112

                          System Binary Proxy Execution

                          1
                          T1218

                          Msiexec

                          1
                          T1218.007

                          Credential Access

                          Discovery

                          Browser Information Discovery

                          1
                          T1217

                          Peripheral Device Discovery

                          2
                          T1120

                          Query Registry

                          3
                          T1012

                          System Information Discovery

                          3
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          Lateral Movement

                          Collection

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Config.Msi\e580b37.rbs
                            Filesize

                            93KB

                            MD5

                            3101039e4f92a1152867bff072170c64

                            SHA1

                            a49ea74a63dfeeeb6658e13a7c860d4dee74d681

                            SHA256

                            cfecf3a6c74eafc6ab8883b186a8c198e88843dae6b0f09911221cd8f441a863

                            SHA512

                            2350595bc88fc9eab0f475ad3a7327a01b398df5e1d46dbeac6ccc78c1c43ec960ca10a0c9403b8b8a76fc168c75b96e7278dc27a29983c8924bdfe49465225c

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\CloudConfig.dll
                            Filesize

                            303KB

                            MD5

                            3426d49120f48e536e7767175450a337

                            SHA1

                            86507fd056c7adaf3296a8941230a121967aeb24

                            SHA256

                            b55bf64e38ca2d2fe9af3a6d2f95f9b08ab8166f5f40f3099f6d7c74ba491435

                            SHA512

                            6f0c26a1d8b5ca77b48d88f687394edf970c079ed68a19df546e74d951c17e158574aff1fc88074b4f38b285ba05fe1a0fe92e0f09ec157530e2144e55372e03

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\GetUserLang.exe
                            Filesize

                            33KB

                            MD5

                            dcaf9bf3061481f1d980c81444d657d1

                            SHA1

                            5c23e64f597e586fa78e8cfdecbea0f4bf2071b8

                            SHA256

                            50dcabfcec447b99d118199d006ee3ac91b0fe3f590bc67e6b2b8893d9e87f86

                            SHA512

                            fbcb957766bb2422307dba68d7ce24c3515f6a39b7bb812ba5b9d6ca9584e1042900f2854fed1a4564782880b04ce029d24281738eee8447c1ffdf1e28d925c8

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\MSVCR100.dll
                            Filesize

                            755KB

                            MD5

                            0e37fbfa79d349d672456923ec5fbbe3

                            SHA1

                            4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

                            SHA256

                            8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

                            SHA512

                            2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\PCICHEK.DLL
                            Filesize

                            31KB

                            MD5

                            99217812500d0ee8494dbb977ae54dfa

                            SHA1

                            df0df5f249aab9c702fa48bd24338571c41bf06b

                            SHA256

                            3cb1f60988010c08934ad7c527ff2a0cebd37f0669eb05fc534bc67af7f3f356

                            SHA512

                            801bf960846f636b1263a219c859cbf4a9c143d0c076a0b593bd5ca61085fc36ad6443a67e408ca140acfe1a3db6112b3105c6c459f3c7be5e0428cf21cbe226

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\PCICL32.DLL
                            Filesize

                            7.3MB

                            MD5

                            0b6d88695106ba895eff00da393d5865

                            SHA1

                            e1ac54ac03a4d7e97ef3ada245dbc28e4cae9fd9

                            SHA256

                            d707d4da17a07c495a5ce282b766d01797d54602e20d76effa9003a6beb1acd1

                            SHA512

                            c56b384dc38d46f19d895a389391eb59e8b13aa542211cd0d063e9478e569003ea90b9685abdd4cad8fedf597d698bf1a022c22cd314fbf1b8b303e1469abe9f

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\PCIRES.DLL
                            Filesize

                            1.2MB

                            MD5

                            b7add7928db7c60b81b783766799aff8

                            SHA1

                            198ae0b23ccc035fdfaaef8bd7c8d84ea7920d1f

                            SHA256

                            4bc6aa2a95cf961b58e3edef2bcfc54bfb598426ded4d3cf6b58297e31c58e91

                            SHA512

                            5a7e8f910fcee1169557462ce774e06ff0419474eced6d2a23c13fa8f8955729d4ec7a0d6b510b0a22c9bdd851c9bf56407af95faaf9c0bd2644da71bb712f2d

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\Safeguarding\admod.dll
                            Filesize

                            227KB

                            MD5

                            72d513167a6f92a6dba7aff033269fb0

                            SHA1

                            f0022f343dab594eb3eda6be884bcc09df718feb

                            SHA256

                            5cec001d13e50f280d2a932586a349291886e70d727c63be1b0ed0e9989e303c

                            SHA512

                            a5e06840ec116c10afbfc809232b6b12cbd2881681cde9c823bf7e1ee8a9293f4200d172a8ae8523f3227ed46ac29ced8abe311c46fad9b29d91c43bfaaae5ca

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\WINSTALL.EXE
                            Filesize

                            743KB

                            MD5

                            4526ba183e49463e1352772606787180

                            SHA1

                            5803f9f8f8fd82cf4e2ad32db8313c1dbf8ece85

                            SHA256

                            a87cd4f66d54ec06d3bd75a6a54cbbb5838433376e38b1400200332a1192d49b

                            SHA512

                            4a0686ec6f79fc45405320b9d69c2cd4f4e8050b20921c1475a1f5ba6787c2f75aed54c0baf27b4161e17ca1a49731a533ee3e1e0a1df15b53ca8afc35db9fe3

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\WdfCoInstaller01005.dll
                            Filesize

                            1.4MB

                            MD5

                            f9cf2db8b99dc50eab538c4d860ac1a4

                            SHA1

                            b261c9e7f082eb8649afab9a677e022f84fd2823

                            SHA256

                            865864a32aee78e588764f37847522fdb0bd1940ecd73b3c49d8f68b4d5bad71

                            SHA512

                            59660740b58b1761a4658aeb02f669f1fd8a3fcb07c162a86b9565c5f9219cb993cc9d94b43b1d39edcd5032b478b8a9b3a388fb82449ca82a83e3c6dd94c02d

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\cicStudent.exe
                            Filesize

                            33KB

                            MD5

                            f046947fc0215fda61b173e6632f2522

                            SHA1

                            ea80f54f5ea5057138eac3be5cebc65a758730e6

                            SHA256

                            8d93e4a3952682cb6769d061f24ba3698907e8da13c3372e87550acd0e7753eb

                            SHA512

                            7134db57d13075436fd6135b1d9de8efcaaffe912fef56975209cdd218d7f8b8234b47ec0fef0a401fe137c7b490258e7c14a89b4f70416035d635cf940d59c5

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\cicclient32provider.dll
                            Filesize

                            102KB

                            MD5

                            a4d7dbec9f09eca4c73bddc111f759a2

                            SHA1

                            d72c24be3725f439f9c42e0b92ea57cbbe56773f

                            SHA256

                            8b0c10049712f99f976c1c7a2aeecaac05f485356d20ff52085d188bc857c64c

                            SHA512

                            e968985c27895b0a60cb5cde0cf91eff1533d605af337dbf097d4d4eaeca15ef2c622760ceb2740b6a8e29345156d099a2af412ea2d1f92804f7202cc2d91586

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\concrt140.dll
                            Filesize

                            238KB

                            MD5

                            092b95b9308e2827a3b1598add0e306d

                            SHA1

                            10321c34bbe5982c3005188afa94d1ce73964f2e

                            SHA256

                            a3cdd51d7a6260e352ad6de5451f4164228ef8150c77c02e5dab3b38f964307f

                            SHA512

                            20464945cdb7662e4d9f2226ad5e32ff5cff53f08e803bac1cd0a45063534e5b12aacd5661aedfe8ef5064ff56d6b147ecb9430d17e2d9ef4bb13fb7626c01cf

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\cpprest_2_10.dll
                            Filesize

                            842KB

                            MD5

                            98a75771d452d5d5fafb9bdc091c512d

                            SHA1

                            67a0e43a56a15082453a9d4940e832155a3057c4

                            SHA256

                            fa87e30988d3f55399042a2eae90eae0e1934cebd11c6e10168fb40a0395da72

                            SHA512

                            9dd3d0ed053976379b96064d14c1246df0fc6e09a2683d79d6c005622f5f64e208e45fa75df41e9854671ad093c9b4c8f2274aef623173e36f553733866e3c39

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\htctl32.dll
                            Filesize

                            609KB

                            MD5

                            39a26074fff53bb65ed23219b8c335c8

                            SHA1

                            a60b0476c1089b7395fbdbd18bc70cf897ab7181

                            SHA256

                            a4759b4c935ec37ea341cb41d3222faecb87c25ad3add3359d64261f51785f64

                            SHA512

                            61101f515fbda08849cbeb980098c1bc71ff45f4316a6a8547cc4a3382818176ea3d5b937d9499c7c04cd0941205ae2356855be42fb81fef209e1724599b338c

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\msvcp140.dll
                            Filesize

                            429KB

                            MD5

                            1d8c79f293ca86e8857149fb4efe4452

                            SHA1

                            7474e7a5cb9c79c4b99fdf9fb50ef3011bef7e8f

                            SHA256

                            c09b126e7d4c1e6efb3ffcda2358252ce37383572c78e56ca97497a7f7c793e4

                            SHA512

                            83c4d842d4b07ba5cec559b6cd1c22ab8201941a667e7b173c405d2fc8862f7e5d9703e14bd7a1babd75165c30e1a2c95f9d1648f318340ea5e2b145d54919b1

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\nskbfltr.inf
                            Filesize

                            328B

                            MD5

                            26e28c01461f7e65c402bdf09923d435

                            SHA1

                            1d9b5cfcc30436112a7e31d5e4624f52e845c573

                            SHA256

                            d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368

                            SHA512

                            c30ec66fecb0a41e91a31804be3a8b6047fc3789306adc106c723b3e5b166127766670c7da38d77d3694d99a8cddb26bc266ee21dba60a148cdf4d6ee10d27d7

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\nskbfltr.sys
                            Filesize

                            32KB

                            MD5

                            1c2143adeab91d77eb5a9624bd28b283

                            SHA1

                            5f8bb1a5a6ae56af8bbd60acd1c4c67cfd8e26b1

                            SHA256

                            f897746f7fc866b9fc100f36d6896b883e55b08c5ae9e7d8358fcdb937c6c097

                            SHA512

                            0d9a5c2130496f4ef4b06ad55be7ba84190a36e0d8412fa11e816ef53bbae413cb11742c053644d6f4df44d19746db0ea420d0426b83eb1a298d42e9e48d11a2

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\pcicapi.DLL
                            Filesize

                            48KB

                            MD5

                            93a96634b8d685f265eb7bd2b49f4d40

                            SHA1

                            d0ebf9a80161dd0a273f14ce331b5e8112dfc81a

                            SHA256

                            1173b0c5bfbf11bb6a928ae8dd9f6c909720043772ebbf589b11d07516742963

                            SHA512

                            17b4a4fa0f7844d735413cea553218d3dd763dae915509aac6ff82ab409ab6f2f3c8eab31b6c9308c51c0d4e91c155b65e25eddd1ed9d84ab1c6e2fe7c2e48de

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\pcimsg.dll
                            Filesize

                            54KB

                            MD5

                            c10a0306999ba7d7c598155c4d503019

                            SHA1

                            6f7674088d27cec8ba4deb84e603fdabce20da3c

                            SHA256

                            13590eab09c5d40d54a7ae1fa7beabb838187d782d02ede5a5bb21110117e452

                            SHA512

                            b5d1e13f3c4200ffed17053122efb989df55a417567466452243181991498b875ae3ac88120724376038cf5e59b79320387eee5104491054b036d10eaa4b2ddc

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\product.dat
                            Filesize

                            397B

                            MD5

                            1776504eea61cb14d645e4ecf7f66fed

                            SHA1

                            5902f0fa83a830bfc9d1befa3583330354389a26

                            SHA256

                            ebeabcbf16e7a50062ca7271a94359b5e1a648d84ab14e05974a293c56740bed

                            SHA512

                            e396290024f37579886f07e8924ba0ad5c95818fb3d7dc24263684a72d97ff0cf9eeaf85498d28bf22d8beb2c4c08eeea08839b26259b243cc3bae39eb851710

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\rootcert.pem
                            Filesize

                            1KB

                            MD5

                            3cdcf8f9b05de85c7e7008e7f4a70123

                            SHA1

                            4f2c894e8c86200efcb93ad0ebd85296d48f360c

                            SHA256

                            27f2bfa146d2d50ae0694bc4d0fbec7e47642396099fc078e4b567048e7a439e

                            SHA512

                            93f240508610c8cabdadeaf35049204d65985c10f6e3e44a6acef1ff0da62993460e35a6ed3e5b442e32ac751312efe4f03b6b1104b0adb5beb653d71750d3e6

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\shfolder.dll
                            Filesize

                            45KB

                            MD5

                            472665ab748444f211531025e1abb9d1

                            SHA1

                            a34c7579723f6cba9cb1c4b6494bcc659854710d

                            SHA256

                            c5426e49c295507fb5b72628a7bea1b4bbe673e07b27d8ecf8b3734a4bd0612d

                            SHA512

                            57487771f4b65abb9b4226d5243b57eebbbf04bc894aada7b341e592a1f32a7c417139bc29f4e4bd21e92ddfec472e9effa1b22ac9603d7199198de63b73653c

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\vcruntime140.dll
                            Filesize

                            81KB

                            MD5

                            8e65e033799eb9fd46bc5c184e7d1b85

                            SHA1

                            e1cc5313be1f7df4c43697f8f701305585fe4e71

                            SHA256

                            be38a38e22128af9a529af33d1f02dd24b2a344d29175939e229cf3a280673e4

                            SHA512

                            e0207fe2c327e7a66c42f23b3cbabc771d3819275dc970a9fa82d7af5f26606685644b8ea511f87ec511eb3a086a9506adec96c01c1b80b788c253bd0d459fbd

                            Download Submit

                          • C:\Program Files (x86)\NetSupport\classroom.cloud\winst64.exe
                            Filesize

                            335KB

                            MD5

                            65c4909e7184be52bbe4403587fe116c

                            SHA1

                            c624ba2f8b13a5eb68fd09590e4d92fc90a393f6

                            SHA256

                            969163068ac5a2587ac3afd7d849dfe431a3e1f48bfa4ad9c1b9a5d72a99a055

                            SHA512

                            f1008a52fdc37f252e678f7ed515feb0fdb48dcab1a5a0e142d77f0c4a5792ab3390e4e29aa5d2477308406373d1d2e4e6237ad5aed772c57d53c776ddb23e07

                            Download Submit

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_63B8E89846540A9A5AB10630E3861342
                            Filesize

                            1KB

                            MD5

                            91f72cd29793b2244cd11526ba718bde

                            SHA1

                            04165a2f569468fc7c273630c4bc63be781ab844

                            SHA256

                            208bb7fcc9ee35961be8d3e028f3b318a530cea5a9ba1aff329e1c579f25e4cc

                            SHA512

                            a95c815bdebb039e26cbea4d023c0aebcf74fba34afb5d958de26ee24eb7d17b610169bd8c1f000053296228dd14a792b2bcd3eec5c22656b197941e557a7598

                            Download Submit

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                            Filesize

                            1KB

                            MD5

                            7f96e346182b3bf61b256cdeb61ba4f0

                            SHA1

                            ce61ada47bc16ded28c7d0df6161a8a3c9e58152

                            SHA256

                            e47c2d5c97804825973404864450ee38869f435b6dbb1f5504ded6447e6c5200

                            SHA512

                            97e90c8b5da406504c621f6d4e8cc6c3980b935fcb20b536734167a9302f97b52bb48fa037ea2ed4cf6e6c4918210c0e9e517cec5d0dd501d4c9817d567cec3e

                            Download Submit

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
                            Filesize

                            1KB

                            MD5

                            324bc4cc7ed7dcf41283d6d2586bd43a

                            SHA1

                            37b8b7d0127f7bf137154990252d731066114db9

                            SHA256

                            589f0bae2dab92a8772d12e18a6ada129f7d6b6601b06884dea6a83368dddbae

                            SHA512

                            027aa2ccaf62f42559fa0044f51d7e0f4ba6b590d11460f801709874d8c3955be118089bcc436178d1c32a679ab7941269efd8836f31f741fdb05a6a45ddcafe

                            Download Submit

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_63B8E89846540A9A5AB10630E3861342
                            Filesize

                            536B

                            MD5

                            fe7726371e064cb8ba43c462426a8c1e

                            SHA1

                            0743ece609d97978c97b0870f1d27bdea5474308

                            SHA256

                            103200053e13568b003840249b8342ae22a4356a81403f2b128cf4aa1ce97184

                            SHA512

                            1a64329d1c585eac665b0d0d6252c29813bfdf4bc775c8f919b4152ad446e8957d2ae6bdd40120a8fad397ded6f47be42a315a291ce1a0cd35d2e799bb4bd8d4

                            Download Submit

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                            Filesize

                            536B

                            MD5

                            af3c659bee0cbc9c677bcac0f0608e44

                            SHA1

                            4aa382be14df0c278f88ef083c67677f50f381fe

                            SHA256

                            01082a3a4e8b6d29f5fcdb514b8befe81538c95686ac674477bb268135bb6463

                            SHA512

                            77486bd74cd19d9fbc1abc758b0b96f5ce06ab407cd0dfdb3336fb4d1234e7630651152995bd51acd4df303338251f9d2fd871c5ee9fd6061cbd2d842e007321

                            Download Submit

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
                            Filesize

                            508B

                            MD5

                            9a671a7e432ce18c544d53ccc8f20c02

                            SHA1

                            3624ac4511819b5fc6cd5994eb5af105b889048a

                            SHA256

                            ea5f2be546d73b708b9ab7a8e9bc4531dda5421ba208583df9da28e886158645

                            SHA512

                            fe24e83a5d1fc81beabd775325df120826e8c86f8b36752bb5cec10e0d3432c8654fd93335bc48269728c04adc665eef2b083f862cd762e83a1f8e3631a3ad04

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            Filesize

                            152B

                            MD5

                            e11c77d0fa99af6b1b282a22dcb1cf4a

                            SHA1

                            2593a41a6a63143d837700d01aa27b1817d17a4d

                            SHA256

                            d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

                            SHA512

                            c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            Filesize

                            152B

                            MD5

                            c0a1774f8079fe496e694f35dfdcf8bc

                            SHA1

                            da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

                            SHA256

                            c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

                            SHA512

                            60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\758a585b-4124-4386-8c15-53c4a552028c.tmp
                            Filesize

                            650B

                            MD5

                            260f3c402c2ffd3f9966fa2e895c16d5

                            SHA1

                            4d7b93cb4ac2ce38056b85807566c43f9183e863

                            SHA256

                            d661e2553066f91b62f38c66c48f34a9297793e6d33d8bd68acec55c39321659

                            SHA512

                            14769485597571eb3482a80ff180a22fc130a71371b3db33d8a5bc17dd63c5b1c8fc135607f071d81c4cc8838d1852eda00c82178be7bb7c49203044475e973f

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                            Filesize

                            696B

                            MD5

                            d1fb69c967ed4807cf9424abd3ed4fc6

                            SHA1

                            455f43b0e74ecacddf9c9eddc497a21e188880ac

                            SHA256

                            1d5c6ff4216384e67e4ec271cf8fcc322cf6929942c42180d1f42702c128c2a9

                            SHA512

                            0b1cc8f3c695678650ae567234955436649a7ae89cff3d708b357eacaddb3ca8e674c4d06895a513c2994848b1dce5215818f3562625a83c96b655b1828032e9

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                            Filesize

                            5KB

                            MD5

                            2eb7f6895e9cb76e00d2fef760ac78e5

                            SHA1

                            60d42edf30b7cda76a533b39417a0a001cb4c887

                            SHA256

                            c46d9ca0882d6fd9e9bd5be3ef1cd44faae75b0113e4f79677201f1b58a2fd69

                            SHA512

                            aa0528a3d7c5ed9d7574899bbf01e8b49b92e4e517a3b87a8d7e841c7a4eb8458e8c81fdfc190e518feccf22d0403dc36bf7dc8190aac585a0e423ba7636c45a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                            Filesize

                            6KB

                            MD5

                            258f15b61251999cfb4ad484e43d4a7c

                            SHA1

                            65adfd70ab90f32ad38fcb8c469fabefc4fb423e

                            SHA256

                            6a2addb4e39eeb52177d9027f829f046ab2640966433948a7b470cae8564e4b1

                            SHA512

                            b37d75e8643509fbc52a109537ce2be88e3f960c2b4815f7a1cd7884ffde0377c1d95c55c4d5f3c15bf776cb8361465aa683562b33e95667395e2451d7dc8867

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                            Filesize

                            6KB

                            MD5

                            78ee7b387aefb327e36e7da59072e848

                            SHA1

                            e61aac1e1aef2319e408a2d7b0dd3859aa4e25e0

                            SHA256

                            17fd7b2f89d95e095f32f5079059dac4105a9c255bfaa0f8432c5e72047a5ccd

                            SHA512

                            9a1112a4986b7f7095a9cd2303351eb125c58b0f2830830b4753443be497bc476694dc213f73dd7fd1e1b225d121422911d5e8bf2f9f15311e7ccdc93504b730

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                            Filesize

                            871B

                            MD5

                            bc2d7fe79a67ec016678a6e633d627d9

                            SHA1

                            2413ca846a1dbc31141c7f4d4645681b7233e8d0

                            SHA256

                            4033c96e5b88a0cb465a65b30aab2662702881c216f5a211eb36e89b9e70e3cd

                            SHA512

                            d034b5bb51fed23dd29259b94ade49e8864c8a399b30ab807ffc84ab25fbfd68e314f4ab03d1d4f4c3d305a7d490f979adf10746491e6a5c443e5288f035e4c1

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587867.TMP
                            Filesize

                            871B

                            MD5

                            a15a2c9954247564d706d025f29ca4e2

                            SHA1

                            6f7bdc878d5953480ffdd50163aac87770378695

                            SHA256

                            d3869e8967aa4fbe8a625723029353a718ff20a3f0d13f75e032bd2415d381d3

                            SHA512

                            ad198f1203652ea26e5925766ed00e0edce13daa2af8c30cf20a4b653e241b7327c0b259d6698a1c5f0cd2f4fae1e8045ebb2691691e3358222f3f483f13a337

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                            Filesize

                            16B

                            MD5

                            46295cac801e5d4857d09837238a6394

                            SHA1

                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                            SHA256

                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                            SHA512

                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                            Filesize

                            16B

                            MD5

                            206702161f94c5cd39fadd03f4014d98

                            SHA1

                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                            SHA256

                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                            SHA512

                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            Filesize

                            10KB

                            MD5

                            708880e7e66aad1533e02d604dd0f679

                            SHA1

                            cb8fa8e706456f2719d4a76916920a3ce3259d48

                            SHA256

                            0b6fc1a672c9479b035dd1ce452820d0f5c2bbc4c8701ad6116ebbb48ddc145c

                            SHA512

                            e0d20900d2f45aa4889b3ccc7ec5194e385c9e43e04abc8e8b45016547ae3bfce38588883fc2ff2214837df64272ac90d2c55a5ddfbcbf46585e32a8c3b14cf2

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            Filesize

                            10KB

                            MD5

                            43ff1a1a582479b467c0d3bf54185cac

                            SHA1

                            fec1a37d74f97c868400dceced5ef271490e160e

                            SHA256

                            389cd3e6097a529ccae1891998fc06b8588c94c7655b879c4c0f31a77693ae2c

                            SHA512

                            aec46c9b1467abcd160c9da386d2caaca71cf735238be8b4bf706782ecdd686d78d8fce7b9e8595efa3da5e5928986af245e3a1be19c84e4806c17ac514bdf3c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\2b4dba63-46a9-491c-b1ea-4618611a7f63.down_data
                            Filesize

                            555KB

                            MD5

                            5683c0028832cae4ef93ca39c8ac5029

                            SHA1

                            248755e4e1db552e0b6f8651b04ca6d1b31a86fb

                            SHA256

                            855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

                            SHA512

                            aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\MSID0FC.tmp
                            Filesize

                            169KB

                            MD5

                            0e6fda2b8425c9513c774cf29a1bc72d

                            SHA1

                            a79ffa24cb5956398ded44da24793a2067b85dd0

                            SHA256

                            e946b2fae0b36c43064463a8c16a2774adac30c4188c5af90e9338b903c501c9

                            SHA512

                            285bb7759a1214abed36162ac8be2d48df17a05278c4de97562448e20fd43b635563a6819f37e23d92a5f5ed0205a68bffe43dac0d3a67513bd0303b4e7f89aa

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\MSID206.tmp
                            Filesize

                            153KB

                            MD5

                            a1b7850763af9593b66ee459a081bddf

                            SHA1

                            6e45955fae2b2494902a1b55a3873e542f0f5ce4

                            SHA256

                            41b8e92deba5206c78817236ed7f44df95636ca748d95fab05f032f5aec186af

                            SHA512

                            a87a302a9a0d19d7ce293b42f5e7bc09664b21307a5321f226157fcc57eb2df2b59c6651878cb23969a182c82b55e8671ff00f8462194b81a907974a49cb25b1

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\MSID227.tmp
                            Filesize

                            504KB

                            MD5

                            caef4649c1b75f44c360a5574a4b9917

                            SHA1

                            a6070bd5c7258a12ae286456fbb7c5d2197d0871

                            SHA256

                            a84649e3f049f9209754cdbbdd0b09962b1a7c979271e263581dbe792e98d66e

                            SHA512

                            367872252bd58ab56400eedab653f7ccae852d20328d698b413ee31e5039660ea255f4e276680651767398a32ba90af2cb12a6a05a0f8eedd7900cd97cb1c2f1

                            Download Submit

                          • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                            Filesize

                            24.6MB

                            MD5

                            e32d7ff04abe620e10a1d4086095a166

                            SHA1

                            3994e79982fbb1294675796999d9f79810f9499f

                            SHA256

                            12f40496245c29161350e5479b9ecc22f18017737c6d566cbb29f4aeb7f31b29

                            SHA512

                            6149b2318f75cf6cf19cb5abe4f51d2866ec1e3444d27c089f9fd346f155152aa9a53421576c171ff57df2bae9294b3e9ff253b1713b052e9228b881753d599d

                            Download Submit

                          • \??\Volume{27bfae7d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1d7883b4-6a3f-4314-9cac-398483f08f45}_OnDiskSnapshotProp
                            Filesize

                            6KB

                            MD5

                            5f77dc193f3d43300b347601d4956fae

                            SHA1

                            a71c3370bb5c40b8d14eab566fa9d35fe014dfc3

                            SHA256

                            dec16962c973292486032f4bd14bc03719c13ff12607ccd7f7f6fcfcfbd96160

                            SHA512

                            0971bb5405671c00c0814636e34cf2fe921f2d467038b2cdf61b6ea57f8af43f434c2f5573cec438a7cff714aa99011ae18b7af0af7d1f998d7f5711a1f2c5e7

                            Download Submit

                          • memory/1388-479-0x00007FF837820000-0x00007FF837887000-memory.dmp

                            Filesize

                            412KB

                            Download

                          • memory/1388-452-0x00007FF83AB10000-0x00007FF83ABBE000-memory.dmp

                            Filesize

                            696KB

                            Download

                          • memory/1388-464-0x00007FF838F40000-0x00007FF8396EE000-memory.dmp

                            Filesize

                            7.7MB

                            Download

                          • memory/1388-482-0x00007FF836F90000-0x00007FF837077000-memory.dmp

                            Filesize

                            924KB

                            Download

                          • memory/1388-481-0x00007FF837610000-0x00007FF837652000-memory.dmp

                            Filesize

                            264KB

                            Download

                          • memory/1388-480-0x00007FF831890000-0x00007FF8318AE000-memory.dmp

                            Filesize

                            120KB

                            Download

                          • memory/1388-485-0x00007FF836460000-0x00007FF836CC7000-memory.dmp

                            Filesize

                            8.4MB

                            Download

                          • memory/1388-493-0x00007FF837FF0000-0x00007FF8380DA000-memory.dmp

                            Filesize

                            936KB

                            Download

                          • memory/1388-477-0x00007FF83AC20000-0x00007FF83AC8F000-memory.dmp

                            Filesize

                            444KB

                            Download

                          • memory/1388-486-0x00007FF837FF0000-0x00007FF8380DA000-memory.dmp

                            Filesize

                            936KB

                            Download

                          • memory/1388-463-0x00007FF838F40000-0x00007FF8396EE000-memory.dmp

                            Filesize

                            7.7MB

                            Download

                          • memory/1388-476-0x00007FF831640000-0x00007FF83174C000-memory.dmp

                            Filesize

                            1.0MB

                            Download

                          • memory/1388-474-0x00007FF836F60000-0x00007FF836F8D000-memory.dmp

                            Filesize

                            180KB

                            Download

                          • memory/1388-473-0x00007FF837350000-0x00007FF837385000-memory.dmp

                            Filesize

                            212KB

                            Download

                          • memory/1388-472-0x00007FF830970000-0x00007FF83098A000-memory.dmp

                            Filesize

                            104KB

                            Download

                          • memory/1388-471-0x00007FF82A840000-0x00007FF82A859000-memory.dmp

                            Filesize

                            100KB

                            Download

                          • memory/1388-470-0x00007FF83A990000-0x00007FF83AA7A000-memory.dmp

                            Filesize

                            936KB

                            Download

                          • memory/1388-469-0x00007FF83A4D0000-0x00007FF83A5EE000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/1388-467-0x00007FF838E90000-0x00007FF838F0B000-memory.dmp

                            Filesize

                            492KB

                            Download

                          • memory/1388-466-0x00007FF81BF80000-0x00007FF81BFAD000-memory.dmp

                            Filesize

                            180KB

                            Download

                          • memory/1388-465-0x00007FF837BE0000-0x00007FF837C07000-memory.dmp

                            Filesize

                            156KB

                            Download

                          • memory/1388-478-0x00007FF83AC20000-0x00007FF83AC8F000-memory.dmp

                            Filesize

                            444KB

                            Download

                          • memory/1388-475-0x00007FF836F60000-0x00007FF836F8D000-memory.dmp

                            Filesize

                            180KB

                            Download

                          • memory/1388-461-0x00007FF829EC0000-0x00007FF82A220000-memory.dmp

                            Filesize

                            3.4MB

                            Download

                          • memory/1388-460-0x00007FF829EC0000-0x00007FF82A220000-memory.dmp

                            Filesize

                            3.4MB

                            Download

                          • memory/1388-459-0x00007FF829EC0000-0x00007FF82A220000-memory.dmp

                            Filesize

                            3.4MB

                            Download

                          • memory/1388-458-0x00007FF829EC0000-0x00007FF82A220000-memory.dmp

                            Filesize

                            3.4MB

                            Download

                          • memory/1388-457-0x00007FF8382F0000-0x00007FF838402000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/1388-455-0x00007FF83AB10000-0x00007FF83ABBE000-memory.dmp

                            Filesize

                            696KB

                            Download

                          • memory/1388-454-0x00007FF83AB10000-0x00007FF83ABBE000-memory.dmp

                            Filesize

                            696KB

                            Download

                          • memory/1388-453-0x00007FF83AB10000-0x00007FF83ABBE000-memory.dmp

                            Filesize

                            696KB

                            Download

                          • memory/1388-484-0x00007FF836460000-0x00007FF836CC7000-memory.dmp

                            Filesize

                            8.4MB

                            Download

                          • memory/1388-451-0x00007FF83AB10000-0x00007FF83ABBE000-memory.dmp

                            Filesize

                            696KB

                            Download

                          • memory/1388-450-0x00007FF83AB10000-0x00007FF83ABBE000-memory.dmp

                            Filesize

                            696KB

                            Download

                          • memory/1388-447-0x00007FF82B4F0000-0x00007FF82B98C000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/1388-445-0x00007FF835890000-0x00007FF835921000-memory.dmp

                            Filesize

                            580KB

                            Download

                          • memory/1388-444-0x00007FF835890000-0x00007FF835921000-memory.dmp

                            Filesize

                            580KB

                            Download

                          • memory/1388-456-0x00007FF839CC0000-0x00007FF839DE0000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/1388-441-0x00007FF8386E0000-0x00007FF838A54000-memory.dmp

                            Filesize

                            3.5MB

                            Download

                          • memory/1388-449-0x00007FF83AB10000-0x00007FF83ABBE000-memory.dmp

                            Filesize

                            696KB

                            Download

                          • memory/1388-446-0x00007FF82B4F0000-0x00007FF82B98C000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/1388-443-0x00007FF8386E0000-0x00007FF838A54000-memory.dmp

                            Filesize

                            3.5MB

                            Download

                          • memory/1388-487-0x00007FF837FF0000-0x00007FF8380DA000-memory.dmp

                            Filesize

                            936KB

                            Download

                          • memory/1388-488-0x00007FF837FF0000-0x00007FF8380DA000-memory.dmp

                            Filesize

                            936KB

                            Download

                          • memory/1388-489-0x00007FF837FF0000-0x00007FF8380DA000-memory.dmp

                            Filesize

                            936KB

                            Download

                          • memory/1388-490-0x00007FF837FF0000-0x00007FF8380DA000-memory.dmp

                            Filesize

                            936KB

                            Download

                          • memory/1388-491-0x00007FF837FF0000-0x00007FF8380DA000-memory.dmp

                            Filesize

                            936KB

                            Download

                          • memory/1388-440-0x00007FF8396F0000-0x00007FF8397AD000-memory.dmp

                            Filesize

                            756KB

                            Download

                          • memory/1388-439-0x00007FF8396F0000-0x00007FF8397AD000-memory.dmp

                            Filesize

                            756KB

                            Download

                          • memory/1388-442-0x00007FF8386E0000-0x00007FF838A54000-memory.dmp

                            Filesize

                            3.5MB

                            Download

                          • memory/1388-462-0x00007FF829EC0000-0x00007FF82A220000-memory.dmp

                            Filesize

                            3.4MB

                            Download

                          • memory/1388-448-0x00007FF82B4F0000-0x00007FF82B98C000-memory.dmp

                            Filesize

                            4.6MB

                            Download

                          • memory/1388-468-0x00007FF838A60000-0x00007FF838ADF000-memory.dmp

                            Filesize

                            508KB

                            Download

                          • memory/1388-483-0x00007FF830840000-0x00007FF8308C1000-memory.dmp

                            Filesize

                            516KB

                            Download

                          • memory/1388-494-0x0000000011320000-0x0000000011373000-memory.dmp

                            Filesize

                            332KB

                            Download

                          • memory/1388-492-0x00007FF837FF0000-0x00007FF8380DA000-memory.dmp

                            Filesize

                            936KB

                            Download

                          • memory/5852-622-0x00007FF8396F0000-0x00007FF8397AD000-memory.dmp

                            Filesize

                            756KB

                            Download

                          • memory/5852-619-0x00007FF73FB80000-0x00007FF73FC86000-memory.dmp

                            Filesize

                            1.0MB

                            Download

                          • memory/5852-620-0x00007FF73FB80000-0x00007FF73FC86000-memory.dmp

                            Filesize

                            1.0MB

                            Download

                          • memory/5852-621-0x00007FF8396F0000-0x00007FF8397AD000-memory.dmp

                            Filesize

                            756KB

                            Download

                          • memory/5852-623-0x00007FF8386E0000-0x00007FF838A54000-memory.dmp

                            Filesize

                            3.5MB

                            Download

                          • memory/5852-624-0x00007FF8386E0000-0x00007FF838A54000-memory.dmp

                            Filesize

                            3.5MB

                            Download

                          • memory/5852-626-0x00007FF83AB10000-0x00007FF83ABBE000-memory.dmp

                            Filesize

                            696KB

                            Download

                          • memory/5852-618-0x00007FF73FB80000-0x00007FF73FC86000-memory.dmp

                            Filesize

                            1.0MB

                            Download