Malware Analysis Report

2024-09-11 00:56

Sample ID 240622-sxqvnaxarp
Target 2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos
SHA256 c90cfb29c3a12d7e51649f59308c1d59ad948d2ddbf001d0a12d98d7a09f7b46
Tags
neshta phobos defense_evasion evasion execution impact persistence privilege_escalation ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c90cfb29c3a12d7e51649f59308c1d59ad948d2ddbf001d0a12d98d7a09f7b46

Threat Level: Known bad

The file 2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos was found to be: Known bad.

Malicious Activity Summary

neshta phobos defense_evasion evasion execution impact persistence privilege_escalation ransomware spyware stealer

Detect Neshta payload

Neshta

Phobos

Neshta family

Renames multiple (212) files with added filename extension

Renames multiple (128) files with added filename extension

Modifies boot configuration data using bcdedit

Deletes shadow copies

Modifies Windows Firewall

Deletes backup catalog

Executes dropped EXE

Modifies system executable filetype association

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Unsigned PE

Modifies Internet Explorer settings

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Uses Task Scheduler COM API

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Interacts with shadow copies

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-22 15:30

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A

Neshta family

neshta

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-22 15:30

Reported

2024-06-22 15:33

Platform

win7-20240419-en

Max time kernel

150s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Phobos

ransomware phobos

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (212) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIYQP923\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\QE6QYUAB\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\L54IQZD2\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6KIMP0IT\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ASWW3GU0\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\334W6EWO\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XHX8DMHP\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0238983.WMF.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT_COL.HXT C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Hardware Tracker.fdt.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00078_.WMF C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PG_INDEX.XML.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked-loading.png C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DISTLSTS.ICO.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Thatch.xml.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLADDR.FAE C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OnLineBusy.ico.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\logsession.dll C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00170_.WMF C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.IE.XML C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0304875.WMF.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectStatusIconsMask.bmp.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\PROCDB.XLAM C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_09.MID.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL044.XML.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN110.XML C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FORM98.POC.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPLACE.DLL C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182902.WMF C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099195.GIF C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107192.WMF.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152894.WMF.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSOUC_K_COL.HXK C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART12.BDR.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01140_.WMF.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\INDST_01.MID.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GKPowerPoint.dll.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Country.css C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\MINUS.GIF.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090149.WMF.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT_F_COL.HXK.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBrowserUpgrade.html C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB1A.BDR C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NAVBAR11.POC C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsBase.resources.dll C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02444_.WMF.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18193_.WMF C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01473_.WMF.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02262_.WMF.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART7.BDR.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00236_.WMF C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00236_.WMF.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382966.JPG.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\wmpnssui.dll.mui C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01166_.WMF.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\MsMpLics.dll C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG.id[1B9674A1-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00633_.WMF C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\SUBMIT.JS C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2936 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe
PID 2936 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe
PID 2936 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe
PID 2936 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe
PID 2540 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2540 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2540 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2540 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2540 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2540 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2540 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2540 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2540 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2540 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2540 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2540 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 1784 wrote to memory of 376 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1784 wrote to memory of 376 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1784 wrote to memory of 376 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2344 wrote to memory of 792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2344 wrote to memory of 792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2344 wrote to memory of 792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1784 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1784 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1784 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2344 wrote to memory of 1680 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2344 wrote to memory of 1680 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2344 wrote to memory of 1680 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2344 wrote to memory of 352 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2344 wrote to memory of 352 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2344 wrote to memory of 352 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2344 wrote to memory of 928 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2344 wrote to memory of 928 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2344 wrote to memory of 928 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2344 wrote to memory of 1448 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2344 wrote to memory of 1448 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2344 wrote to memory of 1448 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2540 wrote to memory of 236 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2540 wrote to memory of 236 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2540 wrote to memory of 236 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2540 wrote to memory of 236 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2540 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2540 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2540 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2540 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2540 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2540 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2540 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2540 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2540 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2540 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2540 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2540 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2540 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2540 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2540 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2540 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 1944 wrote to memory of 3016 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1944 wrote to memory of 3016 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1944 wrote to memory of 3016 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1944 wrote to memory of 868 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1944 wrote to memory of 868 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1944 wrote to memory of 868 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1944 wrote to memory of 2056 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe

MD5 9b949b041cfe8391d65657156c2cf4d4
SHA1 1a421a968ce61d0d5ab4c968602298979193c006
SHA256 eaf933e9cadc5a4f777a463ee9f73769aad85bef8d72359895a0c773526a6b04
SHA512 2317ff650d9ac22823e68ea6085e7b0c251eb09b30e1c6341765fdccf42e697bf1d6e1eeacae8ba117fce350cbcc581c96033df08eae163db7e5abdc2d78f7f3

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5 cf6c595d3e5e9667667af096762fd9c4
SHA1 9bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256 593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512 ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

MD5 dd88cd2e2873a04f1b44b81e2a40ba87
SHA1 ee29ca31f99fa067cde7d35cec7e64cbb9111650
SHA256 83cd4395b42a80615a1267bb2a2e71dd8953f253f3d50b1d2020c3bc975d0678
SHA512 580c8d2ef4a58ef64885455b4d92dea544e7e56181629cd0146433990f7d8e94008c1b7ab8c4f0dae5ed9b6f14208b5c70f48d0c2168b3258a50ade2ec094fe6

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.id[1B9674A1-2686].[[email protected]].Devos

MD5 56076c500c4818c8817548ff2015aa3e
SHA1 92ba632b3b941bab44854fe29d788c104ade7eb2
SHA256 f0b5b5e8af5f796ce7374b2cdf22e1ed1dfd9e7578d900503e4ff5cd7bc27125
SHA512 0321027a6b121c93c95d8fd7a78f632c90d03021291991c600e00028634ba787a7053da479ec830eb93bf683cfbe956533188a1b750a737a508125c047be9c9a

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

MD5 d059b46b8bb34111db0040eec1d29a04
SHA1 ed1d6d999e0c514b93c67171b47c41483ed18166
SHA256 c7b86c8d4e21008b8f24cd003ae7725cda9fbe15d83c9b5d60f01d529adf2588
SHA512 5d599d0c00e80cf92c4fcb9360d889cf4d46e4214ca533e5b4f73e51a23d1ed62467e3e21a04f357a299650d0a56803e3df079f862397430b639f71d95e7a5b2

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

MD5 e13383b5b1f1eeadbc837a8c07ca8911
SHA1 3c3dce72323c4262962921dce61d8106f1578570
SHA256 51e4db873d14549cfc617f0a48ecfd06c6ec885917493e1e62476db55f6faed1
SHA512 dca8d18b24c267fdd8a66309ebfcdba0bb54885e7135508c9460bcb61b8dfb24a29cc2b9ad635a76a4d3ec34759869d93060fbda0ed04318106841c9b1c2ec7a

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe

MD5 40c8e8c5758557477573172e1a41080f
SHA1 25f67b9dd8cb5c73de0e028ac8d8b7b526adb27d
SHA256 a90f989f5f6b4f932feb14477d2a042460a944a0ddc5e2dd5d5d733f20020935
SHA512 1c99a7837cb6fdbede180a7e4646dc1880de85927acf1afd127322faa19a53633888c070eb1d2d7f423d0784fae5ef1e6f447a847518fdb738302d0cc2a04133

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe

MD5 f4988d7ec7286976af1ebd5c7443be9b
SHA1 5c9d293127395d240112aca3191f6763e377ea69
SHA256 365151e60b6d5d3faa3b6bda819524b98e96b66913d74cd1911010389583a237
SHA512 9cb87e2c8d83a7f52700626d1b774264a164ce44d920c4a083754cb0105884e51345e422176fafca3f36262d978ddbedd01c9e7d934b66b42235287bddb7586a

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe

MD5 8c4f4eb73490ca2445d8577cf4bb3c81
SHA1 0f7d1914b7aeabdb1f1e4caedd344878f48be075
SHA256 85f7249bfac06b5ee9b20c7f520e3fdc905be7d64cfbefb7dcd82cd8d44686d5
SHA512 65453075c71016b06430246c1ee2876b7762a03112caf13cff4699b7b40487616c88a1160d31e86697083e2992e0dd88ebf1721679981077799187efaa0a1769

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

MD5 c1c197ea35f355dd77226d0c9f97bb4c
SHA1 701421a95883d9ddcd2f57de5e65fde3d3c4a289
SHA256 1696f25ea7574d62ceb2e0d786a7edf9c98e74c1322927c3f32d3e25ef5814f2
SHA512 b414f7efd5d68a5a2640771566572576b7498d0a7c819cbcd4c8b4c982a416de2fae8ef881f88a2a9ede5f2475452c330266dd778f8d0441293f584b27712cb8

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe

MD5 eef2f834c8d65585af63916d23b07c36
SHA1 8cb85449d2cdb21bd6def735e1833c8408b8a9c6
SHA256 3cd34a88e3ae7bd3681a7e3c55832af026834055020add33e6bd6f552fc0aabd
SHA512 2ee8766e56e5b1e71c86f7d1a1aa1882706d0bca8f84b2b2c54dd4c255e04f037a6eb265302449950e5f5937b0e57f17a6aa45e88a407ace4b3945e65043d9b7

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe

MD5 fb54e7953d62fa86aea496cffd7e6498
SHA1 b34a52b311a4c9420e244754e5d47d2bbdade2bd
SHA256 e390461689549b8570fb395e5f68c343c09e22619e402481ca5ff3069b884284
SHA512 44616503ef0c1b4359eed861ba87d912c75f006d50a27652e0bb0f4f69c0c44386b2eb419513fe29f0e11f0b223c31850acca348bc359a7daa7f5b901d3dc0b0

C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe

MD5 9574e987abe9f8a2a545e60e2c4fd458
SHA1 321b59df4983b2be0ef9eb231146d3c03a155460
SHA256 0a22bb73c3f2e43d03b9d453e549b83483d0003561b8dbd2345e8be4610926f1
SHA512 1f17d19a312593829eb70ce1dacd5911b5c9b02b4f7eb38f1d23e1995c680017f6bda6e9401c3c6838219740ab602f4f95a8010c04fc04ce33c9c503d733232f

C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe

MD5 7c207706cac247b1f9342af52edf8b28
SHA1 50f70cb6b7728b000ef242cae910543aa8aeb6ce
SHA256 1c727ae9f3c0460324151d7119748e01e25a753e8d5106edd1a39e9d53d8c35b
SHA512 cdf4ca0976720aa8582ef30611f179fb23175d78376acac70df610fa7092ec9588893c06c8bb96b70a29c718e89a974a215a1319cd9528ca855c92210a0c8e08

C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe

MD5 b639c57bbe4c959037646f075ccc8734
SHA1 5495bd2d5edc42590a24768e2086a0763501df65
SHA256 3dacb82dd5e01cf0d80fa98f8370c33d4b08b427ec5f0bbd678e6484d6ed7003
SHA512 3b099a6ef57e8c053a405e2ef28d91c7cc684001640547aaa12a0fd97443f69f16019045ed5348b08b2c9160c34592e2760e2af19f855ecdaea5318bc4af4946

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe

MD5 35863ef4d1f320b6b9e74371f27615a5
SHA1 236f55f4462859528225f6198ddb22b5a1e14cdb
SHA256 bb74b30efa0fcae915d0e09da93c53620e1ff68b07db81d1c6c4ff8ea1581ee8
SHA512 ce2d7c131b9c0fdeae007134139a4159b4bbf0788bab0acaae3d0ee91afbbabce1d5ad5a115ab0c7f376b131eaeff88096ab6e43bbe18fc609f71a43b60a562d

C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE

MD5 8110c78af76836805c0ec7121d4c2ad0
SHA1 5099967cb35145bbd0bca3c9f723a3675f0e052a
SHA256 04192ff04ccd2943294b50d7e33d9feab11da88748ca073191fc4666fd4ec8c9
SHA512 e4c2d9e002ae6860c06e1d42de395655d7d3eebb6826f7a436ef3824759f8a5fc16d54c07b942aa098fd9b6ac6e9dbd18970be8572f6cb40e2c3d128e81d95e9

C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE

MD5 b70e12a99078046b5137685709b549ab
SHA1 05a8ca2e6bb4769b81f99d197a26d33201c1f726
SHA256 472490b5d497151edb0ce65fec9f236a262a39a17f5340d2f94de49e2d2c4a24
SHA512 76059ab7a263a13d2fb44d1eaaf42c6b5d6cbc6f3617f9d8aa1f304e43a9e8e8e287f7d5c32284165e32ff3c22bae06e7ac25174161490063120ea27628d67c2

C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE

MD5 aabda1120d4cb6cf7df6c74c3ebc7803
SHA1 cc00c59b8d770334eef07bbe4984532a0794483c
SHA256 7abb5ed592746e8bca6b3a0d69fea5560075376d57434648c62c469f2c16d8a0
SHA512 cc46ca780411d8eab2a795d6a4b27c11fbd2f1c7db312bfe34a34d89b9cacc7167e4f9c429a2ad05b3340b37ca199f5d1927a76a221bcd5ed723bb2265f84d8d

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE

MD5 a24fbb149eddf7a0fe981bd06a4c5051
SHA1 fce5bb381a0c449efad3d01bbd02c78743c45093
SHA256 5d13230eae7cd9b4869145c3280f7208788a8e68c9930a5c9aa3e822684a963d
SHA512 1c73b762c340a8d7ea580985ba034a404c859d814690390a6e0b6786575c219db9ca20880ea20313bb244560e36cf24e4dda90229b3084d770495f4ceedfd5de

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE

MD5 74566c21f0efe213d438964b3289c89f
SHA1 d604912b106418e03397966a3511f47a4acf36f7
SHA256 7ac4029ec946af909ec5c8b3981ef1e7c77e9e93a095eeb41f755f7962375d96
SHA512 50d73caea309d87ac16e9b7b9053e32f11349952cde483b5cfec76b93d2241742b03dcae9c0bdfce05eb6d27b69653dfb2f27573ed6595aa63d76e10d82d87db

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE

MD5 6a9923c8c67b4465b580b943f8b4bda4
SHA1 6e0aea882778d0951d13d7142ee74af5bf399828
SHA256 e81e33c42c06a473d56fb42d47b615fe26cd51df523ae0b4323f0018d6b8a0a9
SHA512 c2af649221b1905f54a0d1cd2abb2190a0fa1a61c3bdf0ef26a81e20e3890def8cf36121e1b361c86d7149243088d0afcf0b34a4f25fbdd90a3850777b475d3f

memory/2936-1517-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE

MD5 31f86806bc6b3a572acd3026177423c9
SHA1 04120856da3311bba44f74d8b2ab5d3af61af700
SHA256 17636bb3ad6745beb6fcec16e8f30870a17493a04b0f32fa8be5fd6e4ca55d4e
SHA512 8229dc8c6bab17f7e195ef45f7838c13dd289648ece1ac01dfc09e08dd081af8a0117291d7c4405601ce4948896574ac4233d88e21b5c5a2c81f71161277f07c

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe

MD5 b546740b0db37565ae9d7a40975a759c
SHA1 8de20279c0f84703c203f85b09ada3729c638de7
SHA256 ec497740ded5f7f7a251fb183eca5253b98c63a0a318ad5d827db3b2b609c244
SHA512 f82f472527c45f786df840c5175ef3753409c98cff8ce04a1d2029c4a5364163f05442ccc25c5593e193e28f97566dcb9c6a8bc559f0cbb2bbdece9ddd1252a1

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe

MD5 60f6a975a53a542fd1f6e617f3906d86
SHA1 2be1ae6fffb3045fd67ed028fe6b22e235a3d089
SHA256 be23688697af7b859d62519807414565308e79a6ecac221350cd502d6bf54733
SHA512 360872d256ef91ea3debfb9b3efa22ee80859af9df29e0687c8e1b3c386d88ff1dc5635b86e714fbf1a7d4d6bc3d791efa31a9d9d13e0f79547b631bddb5108d

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe

MD5 938f9e69d0acb3caa3400e75f4965541
SHA1 47dd55e000f73de19ecfbfb77ca79c7a8c9f2599
SHA256 7a29fc2dafd0456a5fd5fe8a90c3d7054d954868e4f89facdc31ef6d63f38f1d
SHA512 4f63bc1c507500b48f94c1f2b2487301c12bafd4fb62516cfd508a11c6e6d63bff7dea5c4f653395e807378547d76d6c1b94adcf93cfead3405f55a22ce138dd

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 58b58875a50a0d8b5e7be7d6ac685164
SHA1 1e0b89c1b2585c76e758e9141b846ed4477b0662
SHA256 2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae
SHA512 d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe

MD5 2ca22feab6b7cb9348f890e54c7ab082
SHA1 d8471bcac34ebbf3293aae2084e37660017c7cd1
SHA256 6b3aa3a3e0b0138aeb50ccd3f1061800f5171bf58f174bfdf7a206ab98d6839f
SHA512 3787edff0196fb62e91bc19470dfe8070b2f7ebfbadfc13da719117e13510d922bf9cf3147093f7356b614d49c2cb9bc23d85248e90671370eef957d524dc43b

C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 726e7d645e2657dd9fe0ccaac4177a0c
SHA1 2405e0d02856b6d133d3c2389d16790d372c73c6
SHA256 d9df21997b3223df407e322cce1044bd705d776da0f38eae6de18c9ff0748a57
SHA512 e5fdbb7d201862bb9f03c6d3bb3bc0bbab06a05de86e4ba1870ffb04485145452ea6c59c2c89254d994ee45b138fb090c20e005fa3607b7916178607ec8c33a9

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe

MD5 11b808a636ca2514df18d3b8a4e0e6f9
SHA1 77e101fa15da2fc0032a9fb7c4f3e8aa8d426295
SHA256 eadb833ae0dc8e459473e17769228508d0cd2099c9468ddbd7ea18fb2bbf8360
SHA512 664748827ba087b851861f65e7013910fd56347e3b5018891d633d43e4ccbce954267304ad6c952350ffbfcb3f6bce1aff2f38d7dd95d500efc34fc41d566fb1

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe

MD5 d7ec8fa051fd1a84482d8c75fd4874b9
SHA1 5feeb949ea637dc6119075a99395dd1264195140
SHA256 119289acb5bb1aaac9b7de849cb67b8019d36a4b863e34043eae264eb578c558
SHA512 a914cdc117f60d3f663a17338f1701caf76481e46d1ded5752d096aea9534bb2a22086976adadd54773dbd6deaacaaca52ade243a15472c317ad25352d7f4a1a

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe

MD5 6c5966ced4c238ddc9d9df81c8c006b3
SHA1 473184992814479ab0729b85837ce7984fb15b71
SHA256 7a6844baaa17ab9f80ee9a6a5a615e4d3e8987ae91c4b4877fddda6bfdee9eff
SHA512 99053cf1fa86743b8dc2298008eaba8495d4b7a7eb85a773f1f5923d2cf85f488f31a62545413679d95c8124e30309353242ab8655897ac76f3274e540a6e029

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe

MD5 96a14f39834c93363eebf40ae941242c
SHA1 5a3a676403d4e6ad0a51d0f0e2bbdd636ae5d6fc
SHA256 8ee4aa23eb92c4aba9a46b18ac249a5fa11c5abb7e2c1ca82cd5196401db790a
SHA512 fbf307a8053e9478a52cfdf8e8bad3d7c6664c893458786ae6ee4fffc6fe93006e99a2a60c97fb62dad1addd5247621517f4edee5d9545717c4587a272cef9a2

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe

MD5 ea605a6af7d7304d83b21619cb33ee6e
SHA1 5eebc2494214a8a22229630c77469bd9bf8c9157
SHA256 fa1ae4ef51e2ed75f7ad56cc553ece61a84ec415242200d66b1200ef8d40bac2
SHA512 4868ed87dd1cafa808469233bf01d5faf29c3dc94b31f6a46959b5b9eab1158af0137a8a649eaf1c3b855fc7a9b2ae860838209eee4e53a937e01cbb0e8066f1

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

MD5 25e165d6a9c6c0c77ee1f94c9e58754b
SHA1 9b614c1280c75d058508bba2a468f376444b10c1
SHA256 8bbe59987228dd9ab297f9ea34143ea1e926bfb19f3d81c2904ab877f31e1217
SHA512 7d55c7d86ccabb6e9769ebca44764f4d89e221d5756e5c5d211e52c271e3ce222df90bc9938248e2e210d6695f30f6280d929d19ef41c09d3ea31688ae24d4bf

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe

MD5 1b9cc7e46765f3a07113568a76fa2f1f
SHA1 6c7b7494d4cd17c8f2fa99313a0ddadd45bdd471
SHA256 ae5b8d19cc48f20ba8c466e0122ed37279e9ba335d751e9f7bf6e3f5aab608b8
SHA512 fcb61565b91f3d58a207a7893be8ce808bf6d6f582ee353e74de2d284ce81248904b7f7eabc179666764704c386219786599fae61651c071f063a6bd9b5c9746

C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe

MD5 6393e803f97c7fca713d899cb9886d18
SHA1 9172e7ae4f35a478cd416ece868cf308d303c3ab
SHA256 e7fe1ff96b2dcb1512bc530e2ac86ded63c495618d18aaf3c3db52e6ea3e2b0b
SHA512 de53203ad785d523124aeea4f5ede064dfa635d13b99db991728976bef4af2fa9afdc17f27a31c2b854a38cd2f37edd2343a2bc14581141217d09495dcac9970

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Hardcover.xml

MD5 0fb569bd35d44c9ffa7d4728af4e734f
SHA1 b41945703b8efdabbb18c60ccd93d2115ceb78fa
SHA256 788ddb3f7716950d0d204e6cad9fe3cc1dddb6140f615cb1c76bea0541722c20
SHA512 b94c1fd2dd103b19b5fbac6c76d3166be91b01d659e1c912a26ccc48664a153c62cbbbf15ab3869aef08fdc8bb3918e4ce83bb97a1a428f55ce12793d50ee646

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Module.xml

MD5 5360b12f6a07af7be93437d215f72fca
SHA1 fe12fecaca49a131167d88817c4941514ea408e1
SHA256 a0cffb66ffbe1d4701a3aa75ae66af7ca178b45f5c722de3d9021a543129f80a
SHA512 a0b23b148cd30b1d4a41e81aca63179eda341bac1d1c3bf83924d0bef90a47e11f2de08b4cbb879331d507184ec1df9b59c18951e740b94247ef726b15fcc410

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Pushpin.xml

MD5 c3c9945cae188df73afd04c6251ba98d
SHA1 4327d33b49b3c7046cdff83bdd31c724bdbf4118
SHA256 a2a40bb99c6a44d49eeb216549045620e8cb9fb90fb165eff71f846f30264096
SHA512 a674c78678624d59cff6386381c0e4e459836484aca4e617fec26729878743d2ffa5dd4a3bab0a0f0f27d60095739cf4ee0a6b0f4a5d79d31b43a7ecdbba02a2

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Urban.xml

MD5 e2b1e53f26985bc0bc2a99c7d107a1d1
SHA1 b0b9bccd847f973baaed9790a33f3f77d2d1db1c
SHA256 3dc463a76fc170607c07b104c3cb531362ce7d6e10c1a34e0c0f370aeae08ce8
SHA512 0c53d4208a6b0cc0e6959d7eafc24012efd854316ac3830267861fd02f1da0246a268e75a7549b8b5ede05d08798f22f87c7bc305b62dbf76632cdff107ff718

memory/2936-8800-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14691_.GIF

MD5 6f6b5e30af6a9e64b7b6a19c39de7e0c
SHA1 f4e37133cd52efd2967e90d645332c44a56b6832
SHA256 babd6f664158d665504571b169a1e81ef75470cdca4fdd7d95be6cdb7826136d
SHA512 4521a9829f60e2f4af33d4f72dbeedac048fcec352554b449ca36bcc32b64b65151bb7fcec78b389c37ed5819acd4c7f61e9ec08591408dd2400cf78ab5d67ed

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21434_.GIF

MD5 81e4bf29a6552cb0df60980b937ed4a3
SHA1 ca18e846361c6f84ae934ac108d5df987e977925
SHA256 8d84ef2aa665b1d6e1a15112d9c53eab04b68a09a088de5392ee63d51060db81
SHA512 ff58938f4d4c80baba6b15d20744b9762757cfc6834d8a5023b209f07914793881361ab457eed2fb0d17e28a8c99c541a142809f19715d0350c4487e78846ed2

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21505_.GIF

MD5 6790430bcb39e961b83668cbaa1573dc
SHA1 9f01e584f766dfbb5e49d6e32f7dc51fea2d0d91
SHA256 5514e3463923ca8257bc073bf34413d0426a6b45bf569b5a5b74c7c5298c57a7
SHA512 6fe6a31054dc68ee8c59da7de683ce56963f27b6a3e8ed634184c5ac99b6cb4dfdc2ab7980b4acb1f9b2a44ed61cd363ebb388b44cf466c736789d9bda98573e

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115836.GIF

MD5 4df019b7bb2ba1e54ed725a85be04261
SHA1 f40905a7a7dd1623fa8f075715c862f6b944e961
SHA256 33c35642a71ce7d31f92ebe614045d206968f058cb345c7df4ab397a2655f16d
SHA512 654f35be8431fb1e9995a75ea93b9fb04fa12e7ed94923df34ec99bf8052c46effb28ea46417357e1a6ce6f9a8663525d5ad48cd74942968df2a178396024ac1

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115842.GIF

MD5 5dc32f41bef844b95b3a8d79e9633c42
SHA1 50cf558caa78030567cf4e265f7c9cba3a2d904b
SHA256 86d2cf5b090f43ee54d8f7c1dcf746a853951191457ff6dac96269a9d24860b9
SHA512 99e7e8bbb58a6727ddbfa71f9dbb7d02658a11d7e735367ead3cea004ed3edba9cca8997117745fb40733672879b5f466a7e39cd5684729eb413bce49c2019ec

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\TAB_OFF.GIF

MD5 c2dc578691371996eab94eb37f6896e4
SHA1 9c09715d6b50b203e161cfb59bbbfaa7837532c4
SHA256 9f3a97071dc41574af5b54e44945fabef8d5da339d179476a78dbd624a60033e
SHA512 a3778926bde4b74eb0dbda8c7857f2f05c6abfc39222f80332bfdcf7fcfd4db9b81ddca44c45a1155244e667f98f07c7211c25a29c68a62d89b8637e8ae05e70

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\TAB_ON.GIF

MD5 3e586cd8128ba5d03ccbc121909e7421
SHA1 140dc52658e2eeee3fdc4d471cce84fec7253fe3
SHA256 1207fbf437a6d60bad608c9c4a7397194c4f3768142a32c7e5f3a1415452a992
SHA512 f1759159e90975a7baf3c666e402f9063909bb11f47371c9472ae40315ba13454f0ff4aa418c7d0079eebc09909268b5d2d39ef871f0e5850544b1442f9d6f1d

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Main.gif

MD5 79b9e09ca5f8f8ebd840da4c96afeccc
SHA1 efd9e4cb4eb7a896db0cd0de5138eb5be50864db
SHA256 318e9e1df845c4135ab519baf8e2c9e617df90e2b3020741ab5d926bb0d4cc93
SHA512 2df29a7c367151d76b4adab7002e0e90337c1ee07f935545cf30cb729ae91171bceeec0e2611e50d91d097797bc221ff63f949e225629f23a0dc5de3dae851da

C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK

MD5 301657e2669b4c76979a15f801cc2adf
SHA1 f7430efc590e79b847ab97b6e429cd07ef886726
SHA256 802bbf1167e97e336bc7e1d1574466db744c7021efe0f0ff01ff7e352c44f56b
SHA512 e94480d20b6665599c4ed1bc3fc6949c9be332fd91a14cef14b3e263ab1000666e706b51869bc93b4f479bb6389351674e707e79562020510c1b6dfe4b90cc51

C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK

MD5 b9205d5c0a413e022f6c36d4bdfa0750
SHA1 f16acd929b52b77b7dad02dbceff25992f4ba95e
SHA256 951b1c95584b91fd8776e1d26b25d745ad5d508f6337686b9f7131d7c2f7096a
SHA512 0e67910bcf0f9ccde5464c63b9c850a12a759227d16b040d98986d54253f9f34322318e56b8feb86c5fb2270ed87f31252f7f68493ee759743909bd75e4bb544

C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE

MD5 685db5d235444f435b5b47a5551e0204
SHA1 99689188f71829cc9c4542761a62ee4946c031ff
SHA256 fde30bfdd34c7187d02eabe49f2386b4661321534b50032a838b179a21737411
SHA512 a06d711574fbe32f07d20e1d82b7664addd664bf4a7ee07a8f98889172afe3653f324b5915968950b18e76bbfc5217a29704057fd0676611629aa9eb888af54a

C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE

MD5 5609f1f48a601631146002fc642c5338
SHA1 0a2111f648b62c4673e6a876c492cabb8025c19b
SHA256 151dd4949daf9d7b81d59bbaf2dcc2b8918ac6d9262db88f348fdacc3abec05f
SHA512 55793b21574dd01529f495eba67aad57d6c6ed6aa1012799607bff530a0ac905d84d032d15f5aabf5821029827092c47119e73c16aa95157d32b0b5ade0d6089

C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\MSOSEC.XML

MD5 bec4473fc43b77e28e60f89da4e29c00
SHA1 d5dbc7c6642a8a23da14f952a0f64fe874e8191b
SHA256 5e06bfa9ebccfa3d8759270620b6860f0b92be9d69ef7d7802b78ee5b5f07f96
SHA512 ff2c101c1172e64481be5e98b2216d5eba93b81210a1a67adecfe05bcf37c3d965c06b368ddc1ffb7e4187cda0373720f6a27476f036a41517762d5cb3729aea

C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

MD5 b1e0da67a985533914394e6b8ac58205
SHA1 5a65e6076f592f9ea03af582d19d2407351ba6b6
SHA256 67629b025fed676bd607094fa7f21550e18c861495ba664ee0d2b215a4717d7f
SHA512 188ebb9a58565ca7ed81a46967a66d583f7dea43a2fc1fe8076a79ef4a83119ccaa22f948a944abae8f64b3a4b219f5184260eff7201eb660c321f6c0d1eba22

C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE

MD5 6180bfc8a67fd42e977375c0cb644a6e
SHA1 1ca669f62d9f6637783be37bb6b3dfb41d2810aa
SHA256 d29d3d783b82422a1fd426cf891ed386bec1ce6fc8e094c33530d8299bac9029
SHA512 6c3af53faf366d41bc3a7917eb13b6e5767e1bc7581dd3779930bf919b5f5d25db53b9a8c1129a20fd768c50da36ebccdad4cefb717ed05569daa267c63d63f6

C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE

MD5 a7aa0336e62c816116e998046085935d
SHA1 d71d0ad204b1a8165d260ff9ed978bcb8eba75f2
SHA256 ee0d2c64243e6ab4c23271dd79c5ebd62de4ba00a3590e1cdb9f5647c9903e9b
SHA512 63c4a2ad43cd16df38eab65a66732d16ea885fa486c91751c3b3f5e216fdf06fe4d6306d79e82eedbaebb88b5bbed376c61025a3d67efa0340436831ef842f87

C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DISTLSTL.ICO

MD5 8722af8683c6dedfa35cf708f04e507a
SHA1 e411318d7904624a56946cec0059e380b0a4bd0f
SHA256 a338f849bbccace695e284ab83c0cecc84876fdb292078f1186b31e9b6a07127
SHA512 1341ce0453aeae411696a7343f2f6a6fa991fbd483433841cfd4b202ad476d77ba62b66ff547baf4e29a5bd38e7c1f2f78ead201ed1bb8ec50b98eb763bb11da

C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DISTLSTS.ICO

MD5 d4a7e4b0851785143ecd98f019ace3c9
SHA1 99d3d7b7167a9ce2fe67a0d296bfdf60ba7a8a8e
SHA256 ea3a2d1ae34d98f545d82a53ff2d1c6e5334ab4a0a4cd902e3fcd0fb697bf32d
SHA512 cfaa3e8c5f61f0b662c6e04296ae67b83d81fe96eed7872bc503c131cdf47576777d1857d0575ca309652f63f5de2a8ad6fe072bd3c3127eda3d353e61260c2a

C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE

MD5 0331c5bbb62748785b64fdc324be2aeb
SHA1 0d3f7fc0de180279ca5e3a41e0b2419b6df023b5
SHA256 b98e4998f26ddd63dc31d11d3722ad2ab66c2d83752683fc09d32aa3eaf42366
SHA512 70f8acec7517aab035b70adc8f2c78d65c323d6ae0f56891854023b5bc1c69763f56c6d6e33163f327328fb6f02cf30de18379515c5181168cf9f5adb5e78714

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\StopIconMask.bmp

MD5 cc084392f2514a4337b42f4865e2cc83
SHA1 79ff391fe2ea7244cdb5a1e1e5bc68ee0cc1c17a
SHA256 3bff857daf1c246b3ba79bff08805f403b65b0e2a5cffb40b078a383eb861514
SHA512 9c19d048cc3c0b34e8191368b9d243a4a9a25bdf4c55b3d51da4e97a679ca8507dd7368fe3ba22cb32451d433533d215549a276271462f8d1d1c2a9ff37ab68e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\TAB_OFF.GIF

MD5 9cb5fb90f42219febcadbc6eb57257f6
SHA1 c948b86625804155f9ac9478a07cae11d8021563
SHA256 1093af6901915021573eb2e3bcb49af7f1eb79df351806d325b80f1baedaa185
SHA512 9c9031770c5c67f40b93dc7dac91822f3b5eabe1deb83eceb2a878afc810a810ce0521f966e68fa49aa1973cec342cd3ef6096ebaaa191b885a542e4a178ca5a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SAVE.GIF

MD5 59bcafcabdd1f16e7b9889ee10dec858
SHA1 116cf3bc4321fa20352d009e1d0cea588a9b61e0
SHA256 006f8885e892963b3d4a0b53141f888ef5d0b36770d43b82296bcbf800a89d13
SHA512 2d0fe70022c2bd7397b94c78b27d6c3d2426a644a1601b6381084941e9b1dca913d0e0787d8e463d69d7730031233f5b85ec76b480b736ced324fbd45727dfad

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\VIEW.ICO

MD5 385592b8ece89d5bb6c8ff79b132c562
SHA1 bc14ffc7e1686ee066f445f1ab95714ad631b9e3
SHA256 b57536fb8401facf2e6aed14ed0f15e42a4f38b1e05eebc1a8be1613909c5165
SHA512 62ad043d2e28c8e5eddfb9d46edbacd40ac092b3fcc0e5bca70ac0d07d9d4b80cbf194f99803bbac70f3b963f9a3e7ae2ba29ecf3d71535ea3ab257115862bc1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_right.gif

MD5 697538917066fbdc54bb7922e0f2eef8
SHA1 21cf57e715733ecaadd17747a6956fea5dfcc3e9
SHA256 1270be94b76ac32534581f51fecec7ce90ed9e0f3693f310058fba0c6ca8aaa7
SHA512 26806e433c67cbcf7bff91a47e214a312929f279739bdf2ca0b5d26f04e40f76f6350161c7aaa44de48fe70aa6bb67293d9736aaac526f1f794e94f135538be1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_right_over.gif

MD5 bd38f281632881248ac7f09eef8a6319
SHA1 5a40ad5f3ec39d2ad991e0b94683a0ce987d5066
SHA256 b92428daaf38be6775a2b1ce78f5c8ce213b90c6e6fbd95bae56458ab90f7437
SHA512 1e102e101b9c679ff5bbb874806650bc12a69dbab6fd446617e392c99620c81e35c2233a745934692b2e4f20b46a7cf5e90cf38a97b87ea588d525ce356b6099

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF

MD5 ab58d658c2dfe0393df78f57740dcdb8
SHA1 096427e4fce6a16c49a01f645139172fbf077ba5
SHA256 882993b55cc0c527f0a6059b69b3faf4ef3ccb9cecd3d8847ca0e49a1444debe
SHA512 bfbad9a939371aa29f4ed8c5bcad0d0299766bbe6dc1d9d6233ae0c060a394c0b8bf665b11a28c3713d434340dda690cabb578ecf3e2a4a462d797f0b3f30df2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF

MD5 0ad4cf7b35f62b8ff9c73f481594fbdd
SHA1 08b895c85051d99477cdf56d80c4006c262048ef
SHA256 c55b90509b8cb9bac53fbdddfc93d4e572685c509f1218423c43a5d6013bbd48
SHA512 697f1c0117c89ea0486b5b8e9dded787eafcfd710251cef4cf5cc275b1572a5cf9d499e44fa672aca8a77521a33b2e5040cf69c7cc3947fec2cd75d2296edecf

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

MD5 9d1101f2c45ce53f2ead40247bc2629f
SHA1 c7c2770645e7611ae33bd7a0b3ed948d39f17c06
SHA256 47f0149b43961165c5fa224dbd2d1e956cf0a26b86d15ee3e12652c2a6e013ca
SHA512 91ae75b332bb98b6116352147701514db0426f710600bcbd1bdfe31f20ab83c2c21c794244055372e5d11ee177f8dedfd31a1d9a744b84be0f57b580a8464ec1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

MD5 64321e9c7da09049fe84bd0613726226
SHA1 c2bed2099ce617f1cc035701de5186f0d43e3064
SHA256 e43fe96a7f7ec0a38984f78c064638b2daa75e261ab409bbbe2d3e590265ec7b
SHA512 4f56b895d0ab27f71ad4f5e54309538ab3052955c319ca5f718e6b8f8fbed1bd5f51f036eff7cd82d4403ad4b93395ddf75dc8621041ef5c5ca916c1113104c7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIconsMask.bmp

MD5 79f7ca0fba179cb0bc93eb2f178e4ace
SHA1 a529d3822d5bbe18f6c3acfe44b19f0449e76f9f
SHA256 86a618c687c518ca93f7151a26391ef0e19101986d30f7eeefa420b0574fc5ec
SHA512 3924f19e1a9e1b9b9eac515c1d5dffff2aafde9745ad8d20b0d71dfede631875c611b58b2624fef0273830341b497fe7b554710d18bdfedd57c36ac0a764947f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\SAVE.GIF

MD5 9c1b2a47c87f33de47ccfcdc098e1806
SHA1 4ea8f90ce4f6569e41788252674776594ca668f8
SHA256 8d77e83b50a81c442acd64cf5a57ee30906256da88e661e87cba51320f2cdda9
SHA512 b317fc3bea365325bc928e347d081bf019c0dd35e764172ed105212e86ab4ab303b92bd1bb0752cc27c0a7d46548e199df353fb84873e812a744878d9d34bd30

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

MD5 ccd9d8aa4c9fbad1069e4dd2c4982652
SHA1 58cc653eba0694d39e7615ee7e049c8441fe6600
SHA256 35e1150f8a8236fd8c2be2c6da618b5f5366caabb763b7453201f5c430441aae
SHA512 7530335f5f01da26479349321531093d3da8a1cefd4e916496dd254273076df9ef5eb91ecde1221e37a2525e76a8578a6859ec79a15ddb0a69e2e39578afb8f0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\messageboxinfo.ico

MD5 46b109680d8e37a25b4ca79ff35e270f
SHA1 e1d4ca57aa3114a7931c7a5bbc8be1ecd8bd7882
SHA256 54a918ed71329a2e6af831153825cb69b8cd45938a352d3b0882c92969a353dd
SHA512 7533cfb7af8b272d23734efddd2eba7524a746ac0664621ba3c05f139417f6e68bdf6e38c57ea16e8552d0b491a37f320f8f95d7b9e39e3c171a28f81643197c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OnLineIdle.ico

MD5 175b6d3035eaaf10bcc78b54ab021ecf
SHA1 480f5c00b285f824d6eec209d6937e05c34d1805
SHA256 868d0516a42b8340eba07ffaa00f5928e1d6a7daf2a3c4d96c1b86b80e2e3e81
SHA512 eb0b26da872e4e957415ca60d0114903a3b62dfc6f4b02db745004a32ce55d791baf8d550284be03157a59a433fdc9e39a3129155cc0a73cef87febc51fb2f6b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\PersonalContact.ico

MD5 d33c6324366941b3c100293e79426478
SHA1 afd047c1461a2ce36b775cc94392672eb43f1463
SHA256 d2a2840f1282913c2678160f13f3204616a9c302ae3b8f47bf17783ef3323aa7
SHA512 7cffef992a6008d2d5b1cd768ae722d533a7e2a637b421ab67f16175328ffc9f3a4cd72ed5db695796d335371aad94c4bf9003fe685c3833b7687b59bbb6b940

C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE

MD5 a8d6186f02c35cab83ebedaae12b4843
SHA1 76c2504bddf77de324a0f7ce53a1727a7f9c786a
SHA256 2ef43165fe34716221e217319534ce922802e5773202c0e84a34c21be0de23fd
SHA512 f76b1ee2e939269b919d7149b0c2189cc4f4fcc9b6ef73e805a332abbb4d5264bb6e1fce7e0324e849aaaffc8fd23d949bf3a8097001702c06f79595e0eef71a

C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe

MD5 7edab6d619b457241241ef62ddf90f73
SHA1 6c1ddbe90cdd79759c11a471e2373085440ffbca
SHA256 715f27fadb7a11200fcfc52ddc90197b4ad3e5b3dce31ba63775902894af52ef
SHA512 c0ac06b8052db4811c34edc28b0fda61edeb686d05f1788a4fe212cee32181aa81ad151d7a9829bd5a47f06c29e326a558fd798cfa434036c976cc8953ae3591

memory/2936-13891-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE

MD5 088158b1d858ec57898f3e2b51e24b83
SHA1 fd2071c218305bfecc8b06f2ee32f72024fa0770
SHA256 c976b6c78b53b0fe8429648ab13b76336d4ebf43de3dab7b2243415c90a71d89
SHA512 6721dfbbe145104a2776dd4fd21334bd895e987b5be70b431081088ef64636700726df52a19ddfde3c5338a03605017cc1e79a67df68ac46fc872dc9dcc7c0a2

C:\Program Files (x86)\Microsoft Office\Office14\misc.exe

MD5 02e02577a83a1856dc838f9e2f24e8d2
SHA1 2ab44e2072a3598fc7092b2ccb9aff3a2c5d4ced
SHA256 3b6ca9d9fcbb0c1677fe4caeef03e4db326f70166f030b5f9fa9f2856031d4fc
SHA512 a95d454a4f9e5271bc52e6c245c7840a92b8331b84260b2556432ac66dd07bec1b2c3dcf41282d6d8ae581a152f3147e75dc673ce0c7ecbb653dcc61bc1d1bd8

C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE

MD5 cae066fa2cef1dddf17a314dc4339357
SHA1 6548207f4e6430a7953b3a49fbf43d717bd2e459
SHA256 c0a60957b1c3ff4c0482eb05a16a37325c0ba1454d59474af269f23f2184db5a
SHA512 c5f242a288ee6176e4d2be587d895fe43cc55d880cdecbdec7e97a316e4f7474d45743e44bdb39ddcf7ceb5dff4c6efeddede0c9b6880722e0565dd236471351

C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE

MD5 5d2fd8de43da81187b030d6357ab75ce
SHA1 327122ef6afaffc61a86193fbe3d1cbabb75407e
SHA256 4d117648525a468532da011f0fc051e49bf472bbcb3e9c4696955bd398b9205f
SHA512 9f7470978346746b4e3366f9a6b277aa747cc45f13d36886fc16303221565d23348195b72ac25f7b1711789cd7cb925d7ceea91e384ef4f904a4e49b4e06d9b2

C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE

MD5 6b53560b0d6081aafa69ee8687f3f169
SHA1 e7e7a0fe35e4524c1e97f7c4648e87e7bb0381b4
SHA256 820e94d494329c2b5c4c8abebbf0c413af0c18f2b02693cbc2dba587fffb2cc3
SHA512 11369b380a51575148826d945f14a087e2062a52978b2739140bc2d584aea7a98e683303d59eefc8e8181bb5122023b1d21cf2f45e73e2cd3e3257ae848a381c

C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE

MD5 7a4edc8fb7114d0ea3fdce1ea05b0d81
SHA1 02ecc30dbfab67b623530ec04220f87b312b9f6b
SHA256 ff16fdc703e55ddfe5ee867f343f3b20b496e7199c6c4b646335a01026f74550
SHA512 39519685b1dd872008abfa967f79fd3b7a5e6f6ee1b9c3de891aae64490b2d0feb56bcd3f5dab4527d2c6d07646db5966028df153f38a1c09ee88a1ba9a1ef44

C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE

MD5 7727ddbded4ba205b69965dd7771efeb
SHA1 b8d2d6cfb58c89e34745d6da921663f6db381d4b
SHA256 5ebcc7be4a23b0017b99136770837e404d0b9bc988b44910d6a24519fe8ba3e9
SHA512 f9e9c1449abbe513a9256c295381a0126804a13cb3afa57a5b788593a9ba69cbf64bcc916f1b9e193802d70348d39bf0b70a269c89b0e0f802693eedf167fd9b

C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE

MD5 d69c90688436599c02adcae443d5066e
SHA1 db630b4b8ea4b1f398f489bf63a24ef718013c00
SHA256 ff2476e26f6fe1ba615d7c3b4f9dd96a1d944c45569be1a22529ee48cfd6a891
SHA512 53e55fcfc0946a172d9d30a8f953c978735e39eb6ded62d4df073d49c958e389054560678a6db0629bc53e41c7aa65646a8c9d8ce146b73b7918033460a662c4

C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE

MD5 871d63b651881da72ba1d81b4f1c23bb
SHA1 0792e23e8831aad7bf2524ec3b825fd12beef262
SHA256 e944575e070184af5e9870c1f4984e10b3de361f75683377c74c5022153e7521
SHA512 c40e14c2af28aa9aa3d6db6aa3f45233f53abef6d00d4437c59d29e36955d3237f32ec22e06ee18db04fbc27cb3f79d75df1f646ccb55500fec429509d1f4809

C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE

MD5 a42dad802d28bb23964c726b6df4a7e3
SHA1 e781e9120dad101caab3c21aa3e236feaf898b2b
SHA256 e48cdc6c411889025c285a3b2d2bb70a6a4e9c9a67c47618970db964ebf058a3
SHA512 d28512cbbb97eacd754f3c30755a008ccb88a47704b2f6d7f7fe69184250bd754af4fbc5839970576a6f8d37724a910ea25111152fe445bd2950fd53b6194d92

C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE

MD5 101bfb38c27bbe9b50fa01ecf0ad5673
SHA1 440b04b7b40934b45d2acc09e81c8861f611195f
SHA256 2e8640a9e59801e7d230af76367cd41d0d3ce730b1a58c48fa6154df74674944
SHA512 10cb5d2284ce20666e655c8688b75770d20d29d44c2c635d48204c2d0ac2b27e3c9b86e65d44d989a1ad77b80962911cbc80c18ec86cf959b6a2660ffb765d87

C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE

MD5 0c567b63dbd294c74b2af44ac55bae60
SHA1 3bb524c6c6c5981a36ea7018c2319e1441462006
SHA256 9749bef3ff4ef9f4c9aa4a4991c3c6e943b2443c0e24efab2f33315c7bbd7b8c
SHA512 1c504d5383a0f50dfaa2852c549b4e4b6196daccd9c625d9cfb098a247d35b33ca5f5536fe3bc34ff6e77e6685b49f5c0abc2c19b579b60e9196333c5a85d87d

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\BTOPENWORLD.COM.XML

MD5 b024a04198ed894b334178e411856122
SHA1 ca7552399eca0ceec6a3dbf393396fade2f5f550
SHA256 cadbea407cb411d2ed1c47c77536b622eb7d53d4fd3ee3b9897d554298683fe3
SHA512 466ef38a6bd49fc816e208b408e5bcc7d366dc7eb9072600ab21510b6e1417894bffeee5ec96f5a0a535d8e541fd505ae3450f2233e5a128bb073394c530e879

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\WANS.NET.XML

MD5 b4052c951a5d5df0482bec08dcd1a1d9
SHA1 99f3e0929eabf972e94c276c6423499860202f65
SHA256 f860ea6cfbfe8ddb3862a09c1b443f3273dac1a4757ce9e7a3b34d46f971ff10
SHA512 c26450d504e58cdbba0ded009158837855dadd8040b0c05845ee25b540567758c650df3d6b28c3571adff47e39d8ef99b30144250477524a19ab172d0870ef82

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.UK.XML

MD5 938fcac2676e99d92efee069eacacc37
SHA1 575b35480aab9ada77d22f922bc57cb49a7580a6
SHA256 9b8747ddedfdcb06f34ca5161281e28aafe3bec2e4b21aa731e17bb46dabc6c1
SHA512 515074b8b8c14986ab86913a659ffa007cab07db5c6798ef6a4e12279ad3bf68262ac42ce991ed20a06825a8e5b8d0efc48aca38dad5503178d1dce0ef68c33c

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.AR.XML

MD5 dc5794fd7e35debdd2e25f3e22761cce
SHA1 348034e08eaa9434bcf5713e9880f60bfd33ba78
SHA256 15dfcf446deb114d465215cf49907aa5efc5fb8531f97607d50148cb4b680288
SHA512 6a9b27a6702e40ef03367ce611716816cc4debac9086983148ff75c4e8656f10ff5edf73e95e18efe9e0ef7b721350e86a20919061d0ce1266258384ef98b1d2

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.IT.XML

MD5 0b0d4b77b1494ca873f4311cc88a9fde
SHA1 e88f8c3100290bbcdc224f4db05a77811726fe90
SHA256 60107be66c9efe4d6aa0a3864f71d60b3800c8d6400daa36c05609d099b5f891
SHA512 0a2410540f096ebd0464f16681b7375152fe8844ad2fed5fe86b352a61d6c65695051c82a36b77156a79ac633943463739752163d48b26abedf2db2c49ba794d

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE

MD5 086b46156a85ba0815e579b50f928b90
SHA1 b92833f4ab149ba63a9c1d46b7de709ac9a73295
SHA256 b697eab4fd05cc29aae628c524521c1872fc5fce3d6ea51886c5710c5db03e0d
SHA512 ad8e989c1fe5de536155799fc8888ecf12e21fdba6deda119e2f34ba961fa199bae85c9176d14fa60e584c1d470a9aed46de6aeaddd7e194576873aa4763a388

C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE

MD5 432b905f73c0ea980f48843ed0661a5e
SHA1 0c7de0aa00de32d267847076559dbd145944a8e5
SHA256 3b18534f5a5ee9bc20dc6819e89bae7589f932e33dfb9a403ee0b9126c0a551c
SHA512 2184190218e0b6ba12c2b85e9c54016eee66c37452c306dfbfdef83e6f3ddd9b669311211c71e00a50b3033054b19680c70b9653dc1f4e90e3599e4a782160cb

C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\MSN MoneyCentral Investor Currency Rates.iqy

MD5 0ec3bbc188caf04134280e5a95f00446
SHA1 bd398b51e76ebec0b43d756e04548a1907e8d2ba
SHA256 97779f7cae716a4243ac78cdd8c051cfbefdd111d26740978dd0f4c962c2aa7d
SHA512 e67b8b8f0a30a663360fbac820bfe536abb5534db6e0475424ad3dfd526793663ba5e7d866ebea85f67c9154d6bbda2d38789255f83567be05848cc0d7c1934c

C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE

MD5 ca97b2675ee3f211d85d8ea1ab401e34
SHA1 b7eda9164d6a9962f4d649f6f2920f3bc62b5536
SHA256 faf84a290ff03a2f598baecaa63de2bf0d369747c04a83d033c28be2c45a630d
SHA512 4822b020cddb445c61aaf4d1ed35f33eec15283810110b47b598abbbc7961f93f105f1c4fc6503366b6a68f2cbefc87d461f33defa19f773227b4c2d7e15fc39

C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE

MD5 9b1c9f74ac985eab6f8e5b27441a757b
SHA1 9a2cf7d2518c5f5db405e5bd8d37bf62dcaf34f5
SHA256 2a189b995a7283b503bb5864dd9ca57976b3812a6a34aaf89a7551336c43bc24
SHA512 d72e83aeaf1d34627a6c6aa469821af8a8d464a72c764fbb064484adea509a8c1d3628e2166859286e84daae8ebdf4f800693ce203984a8c313b1f2263e101c4

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MValidator.Lck

MD5 f1d3ff8443297732862df21dc4e57262
SHA1 9069ca78e7450a285173431b3e52c5c25299e473
SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
SHA512 ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0001.000

MD5 cea67ffae620e6410ed0590dc6ec9b92
SHA1 de0e7c9e496fdd650fd8ab826e84b256eeb85812
SHA256 2dfba633817046c7f559ed4b93076048435f7e1a90f14eb8035c04b9ebae2537
SHA512 ba21e55aa88dc8b12e13ebff9e67570177db6aacfb606658650397e6423937d882b1e1c93ed62d12de0dfd59791d78c6a73d68e55f343cfa1f85235daf3b89ec

C:\ProgramData\Microsoft Help\MS.MSOUC.14.1033.hxn

MD5 80bda6f948a1289beefa36d2ba38194d
SHA1 948905d56e776f1efa1e026b309c6669b089a2fa
SHA256 9cb5d05f0db60b9e0d1b76af229fd2a705903d6a1278d4b815faa536a60c118d
SHA512 ebbc2ac06f50c65430f2d3df2dd94434a6bb0e431a48e5929d57b944882f66e488f6abb668535f0bdd5007b92d18d2c4b726ccbc547c60c6adb3c8f5b7f4e586

C:\ProgramData\Microsoft Help\MS.WINWORD.14.1033.hxn

MD5 565aba2aa486212bffe024fefb3a8ba0
SHA1 13f8e2befaf22d391595db2f5bb2efd761cb41ac
SHA256 891c1644d5e29e33e5bb88666853f9531b93a3d6fbbd4a8b01e4e8701f836bea
SHA512 a7a9610937383b8b9feeacacbda08f5d05692cd1550b238caac7a94d17399d689bc95e5afbd7a378e4cb2524d59c3bc3591e975a6aad65bcb6f6cd2e65cbe8ea

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index

MD5 1681ffc6e046c7af98c9e6c232a3fe0a
SHA1 d3399b7262fb56cb9ed053d68db9291c410839c4
SHA256 9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
SHA512 11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT

MD5 4ae71336e44bf9bf79d2752e234818a5
SHA1 e129f27c5103bc5cc44bcdf0a15e160d445066ff
SHA256 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
SHA512 0b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\MANIFEST-000004

MD5 871bdd96b159c14d15c8d97d9111e9c8
SHA1 8cd537a621659c289f0707bad94719b5782ddb1f
SHA256 cc2786e1f9910a9d811400edcddaf7075195f7a16b216dcbefba3bc7c4f2ae51
SHA512 e116d2d486bc802e99d5ffe83a666d5e324887a65965c7e0d90b238a4ee1db97e28f59aed23e6f968868902d762df06146833be62064c4a74d7c9384dfb0c7f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png

MD5 251a7e1401487e69a415fde9d5128b27
SHA1 9bb2d9b5d93e8f9dfe5337014008bce57b3cdb18
SHA256 d1db33e3ae5c6779e11ecc0ddf3962bf0559582980b5e5a92fd5caf91cb1bff2
SHA512 b572720338c60d4c27870e563145269d62470bd32cfb6ba4dbecc881632273189946d813fb6c6f4ea0539f9f0a6975c89b1bcf7fe7c297a005a4b15d8a4eccd2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser

MD5 f536fbf78e26387affb82ee89943b870
SHA1 3ac8e44a9491c16bcd86dab6781acc4f7e1f76a7
SHA256 34dbd6bf55d0d075d666181d9278b8387482a8b5804e44e1ddaafe6876dadc15
SHA512 d9ad640884f40495b4255bd221f0902ff64f84e3136053d03abee7ca417d32a1d72f24a75cb67bc50629e102bdb2f81c0bb087e0eb5cb82fa3d67c4fa5d92450

C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\QE6QYUAB\desktop.ini

MD5 53553242d57214aaa5726a09b05fe7bc
SHA1 931613845dd0e72f1b1a5ba0c89f1c34e5cc089d
SHA256 1be2b3990b410ca4fb38d1f79019c4018cd8820b69618646c81d22dfcbddc802
SHA512 dd0a0b9213182c99444bb7fb2eba5b28f521a768880be2539706730693ed9ea462feb4fd46b1deb5e7d4f31a284f2803b476209b451c9dc4d6ed056d71736d64

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3D507084-FE51-11EE-BDA8-6EB0E89E4FD1}.dat

MD5 b4202f7fe985b9648b4676e6f70832bd
SHA1 d37c2b3927946ed617455b3c5913fcab0bc1af52
SHA256 6cf1b57d59e7111bc218dfb01dda93ac0f776715599a1c69f89035bd20c16a10
SHA512 447ea3de41bc400836a5a3df01efe61c2b3d5d646e9310f399c4842c5268d96042d8432d85fde19dcc8f43a2243626e9de850c9ce37d46fe0d0dd0fe5b2b6a88

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htm

MD5 6df9012b2b7cb3c55963499a26309bba
SHA1 6d7aaa7d2bcca4a8758b398ab7617839203c828a
SHA256 80bd5cb5a9ca35dcdea1d59b5f1778f4114f6215af38004a02a99a1d37383648
SHA512 32aa05aca47a17b6afdbadabe83e929e5a55777c5f5ddb0c854ae78ef403a2baeda46e7f1f1fd7de5237749f43d5f8ce0c95e260ef25e27e20cbdffde41bcaf6

C:\Users\Admin\AppData\Local\Temp\ASPNETSetup_00001.log

MD5 c3eef41f29629d2c7796d9c3ee638df3
SHA1 65c07cdd1c2108cb27649aad8690f2643d018e41
SHA256 04893027370077030b48fd90535706dedb3b2d31e4f6ce5bfbcd1c8578017383
SHA512 96898187fe2e319b120c3026a300b06109bc1c9720660a30d8a3705d7cf58f37162d61e904f64b798c4368e4716c3adbbbdb8d047dae4822c131f4526d5b331b

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 d2a70550489de356a2cd6bfc40711204
SHA1 02ec1f60b2e76741dd9848ac432057ff9d58d750
SHA256 e80232b4d18d0bb7e794be263ba937626f383f9917d4b8a737ba893a8f752293
SHA512 2a2d76973c1c539839def62ba4f09319efa246ddc6cad4deb48b506a23f0b5ddbc083913d462836a6eff2db752609655f0d444d4478497ab4e66c69d1ef54b5c

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini

MD5 897208d5df122e307ab837d982b2c085
SHA1 cf4ca14a7adcbc197cd84c1997efdd076911d608
SHA256 eaae98aa73fe0b561c8b02607a524fb4853bbe81c6de8c3d8a9b7449366809d4
SHA512 b0aa03063c42515de12fbf6d89924a3ae7d8bdd64d7c9bae94c75d571c939655253f3e87368fcd96f5784b2aee8fedac8f66200b8672ab47cc8b37c57a9ad334

C:\Users\Admin\Downloads\desktop.ini

MD5 65fe580cf845ed035c4e57ad02a987cf
SHA1 6a7fc08e53675bd325b0e6426eec4ce52db7f2a6
SHA256 4afd6e7f6ef862c727cf5780abfde2094eb56e93383b6e9d4cb7fae81dd17cd1
SHA512 bbc34c4f8892aaae0831e02cdc146ffca22efff5e70601bafa084bb0824e88c87fd20988e602fdcf649ba0322ea1d74cdd5bc7805525987c4115096173e33b76

C:\Users\Admin\Favorites\Links for United States\desktop.ini

MD5 59763dea4943fa0a7ec51296d5f2c7b3
SHA1 c3b3795c396c3f64ac68d9304f97b34adfdbf206
SHA256 6eb69e26de2a26eda48af77d4cec893aa0cf4748a64cbefcfe11a22c1e680ad9
SHA512 92c41f07d1aad07acbe943f36731f4739b5bd84822f660459e464262d45f4970203210180655683feb51868735d9deaaf37fb8308d415376bc631ce887b94fdd

C:\Users\Admin\Favorites\Microsoft Websites\Microsoft At Work.url

MD5 b85026155b964b6f3a883c9a8b62dfe3
SHA1 5c38290813cd155c68773c19b0dd5371b7b1c337
SHA256 57ffc9ca3beb6ee6226c28248ab9c77b2076ef6acffba839cec21fac28a8fd1f
SHA512 c6953aea1f31da67d3ac33171617e01252672932a6e6eae0382e68fa9048b0e78871b68467945c6b940f1ea6e815231e0c95fbe97090b53bf2181681ecf6c2dd

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk

MD5 1477fccb6f5105178b8a4959217a35a0
SHA1 c66fa5d6d133a7cb7247edd1b32fc6b82dec3dd9
SHA256 118980fc1bef9a9da8a06e2a864d3f5f5573b37786bac8709746a8ca26a12523
SHA512 1715a141037d97e12c98f91a62bd44e76364af02e8ad5024699e9dc3951d005eb3471de1bde3569a61af8e5127883cc1133b6274928bde3c5ad5840e36ee764a

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Run.lnk

MD5 25a495be8250cc90b02a483e82df99c6
SHA1 0f8ca0d9fa83bb38a8a400a893185e589a968742
SHA256 ba1d859d62b101dc263d6834aaa81378941736dfab33b15243a4bf3b45691735
SHA512 6926347d0da33ecdf2af9d5ef5966f2108da941447c4e33ca90eeebf82a4171a1439bb3b285c31387e08b5fbd964851fd98d4c352975802de74ce02b03b7bd0d

C:\Users\Public\Desktop\info.hta

MD5 3a742589205cfee4a1d4196f4090f017
SHA1 6e20926f4edb7b2f05920bd4d2bfb78bec1e8d99
SHA256 9e500fd27f2d4c286badf411f4bdb609d22e18d90e1cbf888388c1eef8eeb2d4
SHA512 00ecd63f3dda3d8aec08ed9beddea55ee465f5965e0c0a583139a69c79346d468356f4317cdac585b7b7699fb6274dfb399d35a1d95c69530d814a84edf8f049

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-22 15:30

Reported

2024-06-22 15:33

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Phobos

ransomware phobos

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (128) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeXMP.dll C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\en_get.svg C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\ui-strings.js.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\msadc\it-IT\msadcer.dll.mui C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons.png.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\javascript_poster.jpg.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_en_135x40.svg C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_signed_out.svg.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\bg_get.svg.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\cs-cz\ui-strings.js.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\msdaorar.dll.mui C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\Microsoft.PowerShell.PackageManagement.resources.dll C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\da-dk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ja-jp\ui-strings.js C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ui-strings.js.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nb-no\ui-strings.js.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected] C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\am_get.svg C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.pdf.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.MsuProvider.resources.dll C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover.png C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\en_get.svg.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_th_en_CA_v2.txt C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\msadc\es-ES\msaddsr.dll.mui C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\ui-strings.js C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-hk_get.svg.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\es-es\ui-strings.js.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ro.pak.DATA C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-gb\ui-strings.js.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\MSFT_PackageManagementSource.schema.mfl.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\main.css.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\ReachFramework.resources.dll C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\rename.svg C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_anonymoususer_18.svg.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\WMPMediaSharing.dll.mui C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\MSFT_PackageManagementSource.schema.mfl.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_ko_135x40.svg C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\tr-tr\ui-strings.js.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\ui-strings.js.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected][32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_nl.dll.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\TabTip32.exe.mui C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_download_audit_report_18.svg C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations.png C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-disabled_32.svg.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-right.png.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\ui-strings.js.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\AppStore_icon.svg.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ro-ro\ui-strings.js C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ja.pak C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\pages-app-selector.js.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_vi.dll C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_gridview.svg C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-114x114-precomposed.png C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ui-strings.js C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\caution.svg C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\ado\adovbs.inc C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe.sig.id[32C5F8DA-2686].[[email protected]].Devos C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_history_18.svg C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4152 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe
PID 4152 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe
PID 4152 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe
PID 2944 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2944 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2944 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2944 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2944 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2944 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2096 wrote to memory of 2452 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2096 wrote to memory of 2452 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2536 wrote to memory of 1536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2536 wrote to memory of 1536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2096 wrote to memory of 4756 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2096 wrote to memory of 4756 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2096 wrote to memory of 2656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2096 wrote to memory of 2656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2096 wrote to memory of 4116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2096 wrote to memory of 4116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 2096 wrote to memory of 2396 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2096 wrote to memory of 2396 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 2536 wrote to memory of 116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2536 wrote to memory of 116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2944 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2944 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2944 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2944 wrote to memory of 6020 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2944 wrote to memory of 6020 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2944 wrote to memory of 6020 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2944 wrote to memory of 6084 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2944 wrote to memory of 6084 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2944 wrote to memory of 6084 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2944 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2944 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2944 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\SysWOW64\mshta.exe
PID 2944 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 2944 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 4824 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4372 wrote to memory of 4824 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 4372 wrote to memory of 2972 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4372 wrote to memory of 2972 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4372 wrote to memory of 2788 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4372 wrote to memory of 2788 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4372 wrote to memory of 4312 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4372 wrote to memory of 4312 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 4372 wrote to memory of 4440 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 4372 wrote to memory of 4440 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\3582-490\2024-06-22_8d4fc2fab29b53848f56f876cc33b6ed_neshta_phobos.exe

MD5 9b949b041cfe8391d65657156c2cf4d4
SHA1 1a421a968ce61d0d5ab4c968602298979193c006
SHA256 eaf933e9cadc5a4f777a463ee9f73769aad85bef8d72359895a0c773526a6b04
SHA512 2317ff650d9ac22823e68ea6085e7b0c251eb09b30e1c6341765fdccf42e697bf1d6e1eeacae8ba117fce350cbcc581c96033df08eae163db7e5abdc2d78f7f3

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ACE.dll

MD5 07b38e42c13d0dfe62c43a58cf4eaaec
SHA1 d3c8b64dfba279d7aee4c7e4c1b2aaa7dbec7863
SHA256 37c3a2d82c37125bb5384e5a92d46acedb9aa34f120e9f5e46ccda52aea7985c
SHA512 8c613ee25662819bd8d31f27e4d5ba6fb97fe7bdbfe3f7b2f97dfd3adbd65dc274a684767b74a18e452b401e7671dbf4580c7c2b5e499a99fe4a554958b2618e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe

MD5 fe7eee091e63afae3eb7cb350187cdd6
SHA1 4be4d0d784bf71ad02cfd4d994eef2a92557aab8
SHA256 0e278165565aad3eb6143470c6120ffa8d16bd0a6cba3a2df4d0199fac7f65e7
SHA512 6fbe5f65f05876c9ae6d855a0f6ccc1b5748360bd07e8b533779775e926d5f7b8e7c60fe0074ab29249e4f5dfb3febff99b405c2c2b62a9cb230c78f65b6b180

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

MD5 9fa62451456cd73edc602242de14adcb
SHA1 90dfb3e0d3278db374fb3e5cc494c4c16fe49928
SHA256 c6210a1fa83857d48bf1dd4835625ab5e28ac01b57a282d839c2f0e14442ee3b
SHA512 10f4ab61a0e1e0132982124f7c0c1744db949f7bcf15d286da35588e1b74abf84e74e00ca34211bf8b2c1f2779f7d9c490ac6babe10df6e1db41964537c3771e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

MD5 1681ffc6e046c7af98c9e6c232a3fe0a
SHA1 d3399b7262fb56cb9ed053d68db9291c410839c4
SHA256 9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
SHA512 11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

MD5 f0797685ce45a8c4dcce566369562700
SHA1 1124c34e57821714388c40e35ac6056abd912af0
SHA256 e3f3be9192c2184d0d0f0ab5c9f6fdac049937777d87ab6bfb7c411d36d72df7
SHA512 f5677604fcd2b7b0c9d33ff7716ba23ac8a35f999b7a9d22ed8256323d30e93d7e90f0f24ac610f308c454d23401987f151ed16946f6b0e8f6cf61d7f11958cb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe

MD5 1f2faf4cfe37cd2c874c9646121c214a
SHA1 acd0b74b2a39f2b58c2a45c1c4d29e0573f7d638
SHA256 666a4b362d5a895ce7e20c15a8743ef6d838bcea568619f8d4a607338617c1c2
SHA512 2ca20ca809338d248b76ee0fa30789ab173d8176f7c0d957f3ffedd8780643e7ee89653aebc7d2c1059ef725494f402b51e36d87f625bef3665488ba1c04cf13

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe

MD5 b43a07a463c9ad9d8419d986dc6211de
SHA1 8c8db898325d2d3bddae171773ec374d85fef90e
SHA256 e0d6fce3bb1d440b19a18a3deef77ab4b9e24dc342ed0139492328d638178e54
SHA512 6036525f03bcd817b80283dd18ce3f30fd09f2403429c056c1f62d59f44179a9e0061bc72fb3921f56393cad82c8c6597b7929d87c8abe57991e595956ff7f73

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe

MD5 4f2d5297ad86a80825307c4a16dc72c6
SHA1 0eab56252b09d9b61d420c0037c4811fdc9cc486
SHA256 1c66fb848ff70bae4bdf57ef2bb728e8803591f3331ef1e8300a43aa315f9381
SHA512 cb6786431770f70745466aab71c98e500e9b58549133bbdb6e8148e8dafcebfdb1ec8d30ef4caa293fde7ff1ec680ea7a753d5d5a3f50852335b142aa071748b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe

MD5 cce8964848413b49f18a44da9cb0a79b
SHA1 0b7452100d400acebb1c1887542f322a92cbd7ae
SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
SHA512 bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe

MD5 cf9ffb7ea7001f26fcb3d5f6da2aed64
SHA1 479e5310378d1e773e4b38cedaa5266eb82cf79b
SHA256 a4a5394541eb8a08d54a354f9cb445e577e54d22ee3679391f9c0ca07672fcc2
SHA512 1af42e32c203aec582a0f561297c1338cdf92be5b46a02984515a6c4ca5cf45429c79972f8e1ab5f1a2cc0162ea5e61995f01c3179f303a5c95419e360139736

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe

MD5 69e4ba1f83980700b6676a20dbf7b3d0
SHA1 030edea5f616be1bddd9af64a23aed89f5e14d5f
SHA256 b5ed2baef8e4752fa2f84d711597c0b9db1d501daa501067c5345d8cc2c73a6a
SHA512 abcad716ffc648bfb6380125e9e1f2f728e39b380ed6757961fb8f4c3b87506e70db0f7a0dbc69636b6c7c75cedc978cb4e917b63db1e22f97b29de9e3a72267

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe

MD5 33ff04415f2d8f2a29ff3908429a3c23
SHA1 294ea591d235a728e5023397e1aa32e7f9cce2d8
SHA256 e3fbb185f7debf1ab7dbb0bea1c19b69473806855bb8efb267606baa3b01964f
SHA512 99b14b21d06ba857b43d9b6db6a11c6feb95e6f279e8f7aa182d92a2688bb2f946c75cdd7b4849d937944b1f164e22f1ce4cf1c6352367b47b22cfc800c33d52

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe

MD5 ddd0389389450f55ce1a1154fc6caca2
SHA1 7dde57eb3afe8d0f1d413c278e342604e1df2427
SHA256 aea9fd9958934efe57f14b2e375af4bea0acb728a61a8ee3664efa938cb840bc
SHA512 e6e3efec88f74a862371e3a20404ea043f12b1a86f84db25dfc3eabc185b32713b8c168b7ba285fe2d7ac8bb1900ba421a4b1e49b78b6eb36a09478afd7bba38

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe

MD5 30d7d53969ea68a8d4b36ebb2cbba7bc
SHA1 2456c3af5412ede0f510db4f65569433da119f27
SHA256 bbebb679023fd1768537ac4436a0a4ad0bf86a162eb04b3e02e66059f097f905
SHA512 8152071217f67a8f816822f2b6941036d4256dcb24e6b7cad9cee99c7cc7cc0deff61340f43f4e4a925100b771a43b1fc72fab3a521601adbce693b4578449bf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe

MD5 653aeebc98df7ee6e7867b25e835e3c1
SHA1 bca711524516bfe85d7aee7a83516a41dbaf165a
SHA256 aee0bc18d855eada25b25016845447b51b9a885755ff85c7db9954419ab9f848
SHA512 a9cd010e20ebbe3120515ffbb161a8326aace09b9a07c729e1a7723be99423102d47e6c9e94db7f3161ee13583e7c205cd8108e0e4c2c9a42a362746dd454fb4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe

MD5 95610f9dcded01432d179f76a715400f
SHA1 435b7845b5dc5c1d3348640277a231be146ff646
SHA256 4f97cdcbaf61c668233cb0ffe7a4868e287bfa2ba969760ef70c20a703354dd3
SHA512 de4b305b541a1511780e6bc3a759fc1c64addb96290decc9fba6d4ea42a320aa422c8ed55a7b7fc91d308491f711243b42cdecad47c39c47cbd418106a8ee0f8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\s_shared_multi_filetype.svg

MD5 eedd2d13e3671d589714446755b78b38
SHA1 2fdd23507187a259f5a7edb01611a37b6b09f4da
SHA256 467082e15a8ddefd51088e12a6189f9923dadfdf363ac1b0448ec43dc483cb3d
SHA512 ef47a62ce6ffb0c5b34b2c6d72f5874dbad4109b98aaa21f56b8b2d83471f5ebf983f6dfd889399abe4fead6296cf2ca3f409a4aa4badad8cc3c48f688323837

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-hover_32.svg

MD5 55215e8f92d35f26cca06fa9d5d221e9
SHA1 994838c8df5921e3828749a7703ebfa8383e43b6
SHA256 e94ac27227c8a25c3f8ede219fd80ace01e7176a12111125b31ae1dcddd487ae
SHA512 7972d3fb8c305a1b41f3ec4a618c9904c1e655fc757f1dc83f9d9041433f3c30e6708ed3d4fb3166cc41d9773df3f159aa44333f76fdde28f317676046bc9c67

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_newfolder-default.svg

MD5 2807924fc18c958c38a7004a5dbd4091
SHA1 85534040543c3306284e6a475999c46249a35e4b
SHA256 0345bffb28f80f4d0ded1a2af09a337b18ab3a80c68205bc8321a6ad4d409500
SHA512 264d29c6b920b3005ebda1fdb0e0ee6e17059c69d63969c61ea4b5c5464022166ccc04b2c1f69b91052c3e3dd551a087e8e5379d2a62c452184a12b278a8ac3a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg

MD5 cd5d2472a2bf9ac7eb4e15146b30bd2f
SHA1 bca600423f99b87df44fde9d96ff874017037afe
SHA256 038589c0f8f0b9fbed7fe7835de0237de4a28ea404078955a78c0b8145fa323c
SHA512 dde83047b85cf0afd4ac77c9f4e850ebba48a1e1d581ed78c30733f58a9d5e2e22d34a2b2e57e4527f3c314f84922c3aecd6366052d46e0d6157990ed888a27e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_hover_18.svg

MD5 0498cfb8aae1383c049e8ccdd85f3abf
SHA1 c5fbfcc70b441e91a5ecd23295c745aaf076aa4d
SHA256 ad125b854735c81b5782a65b5b006c7c991e28688b6dd8e5998f432976b9223c
SHA512 113f19bf726f79473ae2b4406a76676ec0bc4709a26f374aaa3bbd9d0b5790ee4fdd8ebe1a3ab68995973923ae33df7c1c6798e93bf060643c14acfabd4e9302

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_up_hover_18.svg

MD5 30c9bd1aee3794fd46bc99fc2a359212
SHA1 9817640da0b98babc461d277a39b323dc9a76cd3
SHA256 4b10fc416763ad7b65a6d6fb3c0016505ec5aaa7a117021a26e4dd6d11fe7d1d
SHA512 bae367b7555f5f7f677abbad1dd548225c2580ffe21bcae5022f8eecf8c97cfe8f7813fd86c31a7f9052c174610ae9d2ae21ac22b381701975492e2386f67f94

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js

MD5 68b6f0644d50595a97c9fd60b8d8e697
SHA1 a4d0edf9264ce1922dc419c7f3b3cedb2814bea7
SHA256 bf9b3f1f9a3a163d41b1b20a2c410355e6ee72ae97725a7bad97ad23993b0b5f
SHA512 d1a26cc27c302f06419abf97507c0a4d06729aeadab615acaaac0c3fcec6d7715e10642121a4d773ad3d5f613030728e49fb3d07303fad05f7a342352ebad003

memory/4152-2618-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon.png

MD5 65c9f3fb24b80d8c470d518f901b9c60
SHA1 b9521c39944357d4b55b91f9f3739575d1f3bef1
SHA256 8de76ee7eb6b32c307d4a46a43ac55bc15b917e2a24d36c3d001878a97fd39d6
SHA512 6572d65abd587055a69980558b2568266ff76555faadf3ddc93fa65bdd7a009a2fbca10f37f44c27ae889d3de99a3673c2b9ba6e6456242e951703fa32d9c636

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\ui-strings.js

MD5 b651e9101be833e87337050028831efd
SHA1 ee594ba38a6324369ffc7b4dc89407d3436e34d9
SHA256 4717e5fb82c0ee85a7c97d022f410990a62efa2492070e42385cfeab67afd619
SHA512 3552858c2a688c95a76c0bb8a6a76b119b744b2e8ae7e7f30135ccd8a145318762faa52c1783a639fb179056317caeaed20c15f211db1d45bc957bc3ce591aef

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\ui-strings.js

MD5 dd24e91615f1963a5c64bc9878a0a8d5
SHA1 407ece3322d57d16a448b5522d4f29229f80b8b1
SHA256 4cf9816ed1062189ff0c8d427fba5e912cc68fc9af76cf7f08fd255977de3b33
SHA512 a88d5e6fcfd998b0abe79b5b314f3f83f424be9447dca01e1a64a3e7313eb247baa894c10c5758c6788cad27582c09207d00d2e7bc41515e7f1751e05aa812ba

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons.png

MD5 3f7323acc829bc8b3799148d439b3d47
SHA1 3d3c540c4080462a8013d6db9383ad69606779e8
SHA256 d9de646d51650572b66a6cf8a52ad1efd46b7a47830fa7972da0bc05baa2fad0
SHA512 09e2a175dd874ac369331fbfd863be20c9ecc005bfd6c7eeadac071804653265e4f7195d70058f2f73951a6a6e202fc96930f2ce71c2d815b228edf01729b559

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\ui-strings.js

MD5 fb4aa89fb89bf94d0590a3174d1193ff
SHA1 c3812f2105099071c24141a994a9d5087199dbf7
SHA256 655a3ef0465a9f30fddf25f4dde0c19a05c6f9069b83961800c1944165955273
SHA512 a494c0d9faf3defa9ff320421d0c00e4e39845f7e998c6a06c50b5e7edbb1ed7a948dda23ace06a3433843615553d2357f1cb04acb4ad1155ec43f1d07511524

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png

MD5 7ab2ac51d33778dac850c5dd8b4ba45d
SHA1 b3f47f20c438aa488fe835e0145c014853ee48aa
SHA256 ca17d6cc1f7ab317c34a7cb767ad017163e71726ac648518679c6b1c59fa86dc
SHA512 c14ac0ad209625e0acb2ca9e0afc5f6c98901b01f92b675d073b72929455f47ccf29cbfdaa248c602b02fc2bce484c56753b1a54e66f6ce9df2ea57bed88962b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\ui-strings.js

MD5 07bcf4e882ae521ec6ddfd0bb2a608db
SHA1 88e2ab25dec6ba9fedced9bbd21da03639da9409
SHA256 bc9df2774317cdca8e5a702f249a6994fa3b63852e7749124e82ef1f37b89aa6
SHA512 ceafee63fb03e94b418bd87c6af91a53c9bef53b86eddb51a7aee77d8ad5e6654045da12c3c28f3ab4486d2f6f135f7f834790991037708b0301085f62e22fa7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\ui-strings.js

MD5 0ec670fd70f5e89c3d2727df9f2a5398
SHA1 d19c88c8e11361d4f29719518b8543e0ecf5ff09
SHA256 8267479623714339b61159b2f8235b15a38ccc1199eff859e5dc13359f8711c3
SHA512 a429234afdc29df1276238d3e329299a6fb5b1ef6044429c1acd8abb95c0b76a14836b47805c5d464cfc95978f5e3b10eceae6c26a2964e2c352fafe1d7dd6f8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png

MD5 2a78f84427d1d591409740722e60d793
SHA1 304f17d9c56e79b95f6c337dab88709d4f9b61f0
SHA256 4eae979bb805992739f77e351706e745076ed932d3ef54dd47ba119c4c2fb5c6
SHA512 d687c646bba8b801511a17b756f61a1209ea94938940fbe46d9e4893f14606f9e1e5ff468ba4a77474603f5cdbe0cb9df3d24767e5c9ac81a0b373dcf4a4f3ac

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png

MD5 c7fc95def1d53bd3e747248ecbd3cd5e
SHA1 1b251f02465f9c7dce91aac5aa0679a3c34318e8
SHA256 4049b739e6322c7d7caa241ac41c8e0b1f2893957204a910c9708c7731a7a8b5
SHA512 f4b90435a3b250c1d3dc8df9bb4d331dfe9b1c0212eeb1768073afb81b3915fe61a7c4af151c8090565f778dbdf1f4fad7b5f545c9a21b7782cd7671be2ac96e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\ui-strings.js

MD5 1ea3b76135bb4a589027d6243075a936
SHA1 2951fdafcb862ef53fcf213572368bd5e08094ad
SHA256 c960c819e997c1c9d080235a5e24e65059b63cf66b95ff3da9a44773ebf81c1b
SHA512 3c10075e71d2e44535e19c8660bee7071a110d07dbef67ccc4cc94c45f93afd72f8ce6b24be31e6193549823b7db204e20950e5c1a075ae159c39682db295d27

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line_2x.png

MD5 b513ae819f7d8d10fa4f6cbfdf055b22
SHA1 b4228971cceadd4a698f3c206d8f4bc24a37f991
SHA256 25778f162c4243167f8eaa876f1b0619e67afc158de7805600471a563ec5e8b7
SHA512 c11266406d79494f7d74f8f8a5f955e2bad14b8924877e882fb3e7cc7442998cf6e7a9be3aa7f1a945af8bb2add9dfcdec0ef54239f6ee80748d77444dafe6fe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ui-strings.js

MD5 b17a6a8826832fc2e1098d0286242861
SHA1 8ce2bb5944d61be2b628fc80ebabc769768e0b48
SHA256 82a1cc52037ccd1ee4a73cc41b86ef4c9b45db28025d56105566bbc9f06bc41f
SHA512 688757cebb6aaf1a9948ce1dd30318ac2b7afb7a47938e6eecf1bbbc1be058ba78744c208d71a9747ae514242b09322489ad314119cf612a7e4a717907521962

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main-selector.css

MD5 651bcf535ed50ffa7724c8751bec1a66
SHA1 5758c4862740517ba28026c298d1b3a61f43716d
SHA256 359f38eef400e2fa3924a3258652e74ee19cd46cb92e47bce91f1194fce25e9e
SHA512 492b73f1622e8a1a064141a2edbac9fb29e5f604b629b063fc7251289d237e50721e1295b4f3450322fe72f01b57561a79f0ad4b3a20290cf3214ccf0204d372

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\ui-strings.js

MD5 d3e4c2fefeea6e6c467df305f7a8f3af
SHA1 a4468bf4d5abcb4d720b0fefb396dce5864e4717
SHA256 e9288289beec2fe3b6ac24c1311451c8d079786a09515b95cbf2eda7f87f0b22
SHA512 b81a9d38a4a6cd54c2081289192ce7aee3e34d71f834c9b94eac8cd79a5cb90a0dbd3ee0da89be68e4fb69a82903c658addc272a9d70d8f8f8f8cff5c2c18f10

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\ui-strings.js

MD5 a3f07671642038caece41ff2a52d8673
SHA1 53442624b01b79a3729a23d4f12efc8dae4b1002
SHA256 088d391d696ec15140e7b4dbe6fe17e95296af9d09c7eeff17a0a9c241925b89
SHA512 5d1ab4b072eec924d13d760da6aa958cc81fa58cfec3de8ff239d131d37b31cdd547eac0fa5ab34c060f0f28a2295e071a1a9573815541c5b92cf0c63f11bdb7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\ui-strings.js

MD5 74ca2c01b07af0dda4bb39ac330fc49c
SHA1 7cc7781cca7798ce0940fe9be999e85f8b5064e1
SHA256 ab9ac8d62fd064748c921e6bd4c123f5cc8910a384d1804bec33ffe27da27c4c
SHA512 cd71201d364c7cfc9d317f091a9dc318d77bdc7340ec4abceee2fa23e3f58cfb1a8f45b5216f5ebb40b3738fef28eeb37717b2508aa1369316da6b7c82c510fa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js

MD5 df3b4d35decc08d05ef8ee0644ab7274
SHA1 6b0381b9ee40dc8470a63218e5cc5feb579f7334
SHA256 e27e5eb93a24a2d866e30bf027e4f0c3da9fae8968cf5eb69446e7f668356164
SHA512 257c770416a94f5b79ed837fa0f5e7926cede3ce06c1a9b819c1ca77c645f37bd366564cb028b0ba6afc5444aa5ac774c3af36cd7c108164d1000254cf85c94a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png

MD5 39e7048d412b94bb2dad145a2daa5875
SHA1 08778bbd84d9411f2e531867dffe45fee5d60d24
SHA256 4985216f1f370fff03c45d4a711c18b3f49165f8278e6cfc231bb38b920095a7
SHA512 65803d69def3517f0021a291748b55cb5bb2e8437732e6cb9b99b1f778f766fbff2c484b664d16ccbedcd51c14f89e99cd5f977cf97d680eca78a9d4f8b87fb0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png

MD5 bec4473fc43b77e28e60f89da4e29c00
SHA1 d5dbc7c6642a8a23da14f952a0f64fe874e8191b
SHA256 5e06bfa9ebccfa3d8759270620b6860f0b92be9d69ef7d7802b78ee5b5f07f96
SHA512 ff2c101c1172e64481be5e98b2216d5eba93b81210a1a67adecfe05bcf37c3d965c06b368ddc1ffb7e4187cda0373720f6a27476f036a41517762d5cb3729aea

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\ui-strings.js

MD5 92f1f77de0ce17e9486d53787f69618e
SHA1 41198fdd6a18321c15c3d4647962e687fc036af6
SHA256 4ecb5e390829b5b11dd02db2f22ac1349e32a24e5bd3a8489f6fb5fb0f07eeb6
SHA512 b389c8364936fbb96a407fb1a848254fd8b7bcbde05637ac1acfb48ba0b30e887dd44b2447e1e3eb75a902241d67571584a819927cc8d0a91d325f5df79f12ce

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ui-strings.js

MD5 72542b122d453927f3d6c59552165606
SHA1 6e2b7f049b60f10edcdec06f357114448c0896f8
SHA256 3b17f8b83bec3e72acd0d014f58e7de206106a7644bf3293f93c7456ced47419
SHA512 25eade5c88cc35325978ba2e103050608fed4330a1677280eb2e0445946a3367d26796ca1233aa6d7ec4c87f04faf7706d82c72b3f3485d80c18e088813f7a1f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js

MD5 421cd12b43e660f10da31bee36e85f4b
SHA1 b568bb931d5bf4b5805d20fc339b06f9b3763c9d
SHA256 ce7c16adff608d624a412164fdc692305fb461f4b14f9167e6efa78dbbad12ba
SHA512 f56bf5a7a713cbf018203c24a7f9dd426a2cf018cb3ddf9e27f3a7765be3571339421fa5a2cc68f677eb4929a2a2835238a723db4de07bb0634e3f151878ac86

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\ui-strings.js

MD5 7d8302df4582de342a31d0335e979ae7
SHA1 7a3e918e23dc8002dfbe1695f8e8fd52db995d1f
SHA256 899ad5e0b3501d7e00d2f3bd3c7729b4223839e8629c61328db0f818ba0870c9
SHA512 cbc23b3285f6d8d72221d0fc05ff59336402005e7d3f50d66249ef6076648ec2e22d33ed64f5436767c123f59d37dae45270a259153ed98b885f9c43ec9bc2aa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\ui-strings.js

MD5 35d5c7b80ed270a94872c0e56a6c59c6
SHA1 bbc4ed04ea6c922213d7cc19c62c3c4cd23b7113
SHA256 5c03e31975b96b3d151d9e034b884cab9c6fb29576d2b5653c375fc5661b6dd1
SHA512 57ec341f6ff49f24516e117d5c0b119ba4c62dc0537cfcaa15bbba248729c06d29ca224462bb331c44ff1b3abd724df86d0b2ec473ae9f5d54e31ae2002e8bdd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\ui-strings.js

MD5 29dbb24810bdd7f802c1165f8bc3a714
SHA1 9ed5ed2ea58cb6d9196e8d88fccdd8f0d522ea47
SHA256 c9fdf06266cf9e6d61f7989471abe569239a93cc2c0f65a7c596a81af8d6a67f
SHA512 3802320bcf7b20a6656460456d5b03ac4f85e4572d7530518dcf99f28162964adc211c5adcfb7ace603b6734271581cea26c9e85821b88b1915e13780a19ec24

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\ui-strings.js

MD5 7a232b079f30771ada44ab6a1843ec14
SHA1 72349db2853443af021d538be9417fe32369d2ab
SHA256 e33edcde1654c47b3f834797623932ff5dd99a4331b255b60452d69d61ccfb4c
SHA512 431073f497196ad03ba92a8087aa6c50717ae137b05aba341cd8f7ec1705b46f2878b30455c10d7339f89ef16022ca5d054b0f96e5956ef0590121ad8e1a6638

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\ui-strings.js

MD5 b54b9c5d611b062aea9d8ec0d192335d
SHA1 a6a96602b80181ef494a0da49dacae1c44f7c739
SHA256 d70a13e9b9e9f4026679200872160d667979bd0ae57e6527d44090e49bbc2c83
SHA512 e56e4a0dba26c3bd824bcd397d495249466a3732bbe1466f9ed1c23ec3a25d79e44e360fb5ee5a229fb24d6961ac32a2a57d0a29fe669e767bd33b956f57ebf5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ru-ru\ui-strings.js

MD5 3b8883ab58438b245c89bc76ee848752
SHA1 7b01b457344fcf92362d14247f2c389ed0c89b6c
SHA256 b3b87c3ad568de5a1f07702392e3bfc76f41a47b2fa1d710198406c3c5172697
SHA512 200a52dd5e9334f2c768fb2d152a82cfd551c0991eada79ee92ae41e8beb82a1eac2d90fdac2d9741afe0b7edcbe046cb92a6cf339d25709b53d51f5feb55b1c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\ui-strings.js

MD5 edbd91ead174c60fdacb765349ea4fcf
SHA1 e55660206658be80e2033a93abd8854653246eea
SHA256 dfd68e26d32c27e8c7d096cd558b12da3228019525baaa2d4b32030339fb0b6a
SHA512 9c664370c6c102a0e6992f2fe711e7fe7f6ac732a8562bcc1839a0d99d828e4ab0b3dc70f33f3cba444d04161d0df13b70e72b9079c5aabc7a85543168d58854

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js

MD5 ffaab524b0c94fd06a44c1b5b683e0dc
SHA1 17dcce5e4d3b9f718c902863652cb67e060e2f3e
SHA256 d0a34414103960973357a239952bb0fab5f988ccda1b67ff8e6864afcd806272
SHA512 a7ecbd3e9656cb0fc1304b4b86980e97680c73b673c4284bbca08c4a3f3ade0699a7de61f0905aee9d521da4beaed61d3ec943090ecc44833118f1f5a29318ab

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sv-se\ui-strings.js

MD5 5af99e838bada8e34b660d7fcecae2bf
SHA1 ead4e402f4696ede69adb3e4cd694e7d52925844
SHA256 e3f604ce27fb93d417b9e8a4a5f10f6fd17b59a76aad9754ea0cc5c56b31687a
SHA512 e69f6f12a51382491b4bec6f19260df249dc6dd9a33fc590a90a055baa5f6dcc80894e2c65ecc7dd0d10040c90740dcfcd2f98dbd1f2fbd94c34941897f6ecd9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_thumbnailview_18.svg

MD5 9b4c8a5e36d3be7e2c4b1d75ded8c8a1
SHA1 1f884298931bc1126e693e30955855f19447d508
SHA256 ad47fd9e87159d651a53b3dfba3ef200684a9ed88c2528b62e18f3881fe203b0
SHA512 e1acc0b10c92c2895fc916fc8feead869e04315e5e6e279f8e61b344545103b4c9ff808c9ca2121d1b013879071364f677da128caeba89bf918ec2791e5ed094

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small.png

MD5 3d55e1e012d3824e53e84d404a6e2f2e
SHA1 9983296698d4e2736faf1c529e8d27f8071d7939
SHA256 6559f403524ea6ef9bf2e1d0bb66d1af8152920fb002ec2c4ced993083124a88
SHA512 ec75d4dea30bf7567b2f6e30ffed408815c57680a38659f6055d770c85393d8a5678d38a066ceb7fd0ff9c5ef49cf9fd73d7e8eae5a9a83360a41ca74343f576

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons.png

MD5 45ad813c887294a1c5c88358f6e6fd12
SHA1 45266d0bda31888b67b10c601d303caca8786d30
SHA256 91ed5badd0d99f45c65c0ccdec04fc59fffb1f6d055a4d2722dccde82a6bb73b
SHA512 b06ab5889fdf50735ff0c3cfcac3e526b9f32d694ac631e7c2a06eceff357f17e92540df5f84426f8e8f75726c1e7df3592f1620728b70a4b5290c9e49e377f8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adc_logo.png

MD5 5c4cbc56377969e41dcf39d60690feeb
SHA1 a20120d0d043af4d3b6a72db517ab8a623b3febc
SHA256 c0601bc1bac97e69da3ef3e2898aafe64aec5ae4f3ccbdb7649471f76da4ca0e
SHA512 4accc91aeb47949f1137ac69a0740a25c957853f59ff8d18077e64b1a3262488b71fc4bd45714075a0652328e1a49a602c7950b86edabbbd7e5abbd9000b705f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png

MD5 f2f1d5a683617b2bdb6cb0b1eae67135
SHA1 3e0dda160b0f8b963dde8036b45aabab5d86504f
SHA256 96497e49c11ebeb0f73bc01b033b7f45cd9f8eee478176e11b1c7342efa63569
SHA512 cc9688ee19a6391296abbae9fb1422a6d72d87b7abe8552e860eeb092f8cf7e6864a7f06dae6a60784b77353c38103abd3632492f8b33b7b3d900531cdb673b2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png

MD5 a7a19c86ac01e03111c30032ba417b55
SHA1 fd7f42ef37d82cf1704b65762a8bc6b4a868234d
SHA256 494032a3293df271c7cc5d26a5753acffc5f6df811d024e9b573f2fa380f3591
SHA512 728d4755dd7d21c5ca285906d5f043728fd089de42d2fd04beb514563224104f7672e5f5144e4ed68770b933dd1069d76b26d140eb692d83d907176330f3f6dd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png

MD5 5991993dd41d6d2b062d58bb70971e0c
SHA1 1a75ce12ef1c4cb6a85225d0bf4f68d4a3edfce5
SHA256 bd66e8f62d34f70917102405af895c0b07b79c13fd2d1ea65ebfba3bd4853aeb
SHA512 75511589b1937aca668348061728734718d02065ae76446b61e3292834709e3b66f2a453717fd593a8fa1db92ad7b97af03f7d2e7f5538716582ae7d8c11e09b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png

MD5 4eefd60f439096ed98b6d8a585da12ef
SHA1 75cb70498807b0c823cac760e00652842c1a63c3
SHA256 e743d6195ff2f42282e101f9471874e8df79dc05a69ca20abf22015d48d28c6c
SHA512 78241e2336f4ee826719d5adc70543db0f0767a1660f723ddfce72c170322a13c0f3c547eaea6b6cfc47cdf6d8e5edcaff4bd003cbf3eb9d3435bec5158fb8d2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png

MD5 6018a4862e3cc6b434d517a47858a2bf
SHA1 23769e9ae485bb2c35630db9a6ecc8a40c2207cf
SHA256 fde09d85ac7ec84dc0b5f2bf1c1f935b80a3e45dd9257af499d412302602f310
SHA512 4fae17ef027649315cbc73ea47a2fbdd8c8c05b9d818af5b41439e9e5fd81d62ce13f6ad125a2817d0bb4b24a831358803c53003628520cb9c2a8376ac8e1aa3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js

MD5 cf69901e6d4609009dff8be5b3045c96
SHA1 712afbf4bdf24b6fa059f0fcd837449d75432800
SHA256 16d0edc8b7ad7705b23a14058f366ff1c0dfa16a0ad14f741924c308754cf8d1
SHA512 84b63e071f56e8e406fe361473dfd6eb17daec1809eed425b1b977f0135d6a78a3375c9bd1a65daf1ac7977f712b63ed735eac8ebc91e55c1a3f366e288a9ed6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_checkbox_unselected_18.svg

MD5 8c8fd1cfdc60f513bf20132a1d5aeea2
SHA1 40167e542ddfd848fd138e2914dbb7f116a8f99f
SHA256 f438a4e713df6a982afbe2eec993cd582edc37a876fee88e1ddabb478f2b5ee0
SHA512 e5a985404619bebfb615d4b5378942b56089b40170e4072c61eb9ddf722639941e820f039437b59cd3859944b3e06ed72ee49e879522e81fd9d49b56c8e40d35

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js

MD5 8ab4b211dc3d2947d2466033f6d524f7
SHA1 7c457aa6cb3b704da3c977bbcf3953c3c1a7a7bb
SHA256 5bc633d52bc4345c9cc4ea7cf49422a85a9fe401faf3239ef72b53aa0dd667ee
SHA512 0b7e9cda1a82a15fc9492a35808bd1ea43966cf5e55d84b9831f79d64f36a66583a14f0ba95eb12098bf9df6a95eef0bec6606aba1cf56bdee0e046aa60f8d5f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\close.svg

MD5 2518c2304a390e60d20b53b101fc0056
SHA1 aae24d58011859ff6986508882dd7eecaaa7f604
SHA256 03e98670a1d9049b8e1f02c4fdd449d098465f7578ee0eebfaf3f138a78301ae
SHA512 b7457acf824d68e7728088668cd8d44e06566dc71d156db7e9480b957305f2268778907a8e93e4e2d1937b3c3cbfeeb327399cd7f33a60274d91efab2ec3f534

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe

MD5 6b0a4731a12f99ceab2a3a60aa2062d7
SHA1 22105cea1a8f82d2825ce76553abffe85687e804
SHA256 da0864d98fa6599601257e4d098d40dd2a3611382f66baabf5b4bbde70c5167a
SHA512 b8425eb8d548226e06e6272eb77ab6ea54549f6897881122ea437521a13acd219ee63ad0af0bdc1a107adbdfbbf92b4fbd524b5b2813a5176366eb6f7ecaac1e

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

MD5 9842e696038411863a0d52175392a28f
SHA1 14f436cbb6b86f1c6d7b2dc49c94e498663cd88d
SHA256 2d62e6cdf7e735f18c1ba97ad8c87c48636250eb7fc72fa576ff1d360a7b4b8f
SHA512 51dcbcde7b416bdc9398cfb5f96a1dac59c46931976e677510e05de6d7e9b8c41f732c82caea63eb54bec5f678375167f4474759ad0fe0b14611ba04f9890f2c

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

MD5 9c59ddbd6efb94149ccba07c086de145
SHA1 e2c98419b84e37c1c4a394b8ec6451072a1b8dc4
SHA256 dec84d95197eb2c166e8a47b085b02ec2d21dd7b2f0d657d832b4f38dd257e5c
SHA512 2355f97c7435734a675f1a25068f0a77fab08e29868c82b107813626ee8f705dedf63500bc6ee5e898451de147d9a0d999217385a42050f9a7ef071974b1809e

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

MD5 b8f31bac1be89bec86839ea45c0b8055
SHA1 27cdfd69fdf474ec4d961c599bcb66ffcf9f3a2c
SHA256 e41ae236411596b566331da7f5f798299db5629cfb05d1b43074f5975efb4c54
SHA512 b7844403a8b1ec7d976372b2c2a84315ee92c00b0d97ee95a264f8ae7c29f9db5e5ee415aab0a5b83f2188997cad3e702395eb1720f80df09c1570bcf35dc1f4

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

MD5 8991abd1fce1ec520bafd50a5e04e08f
SHA1 4e85cda9c5a1b64fe7e9b93a217a739d95f40186
SHA256 3a12117fbcde5289c5aa488bb4d304c748607e6725f80abb2031436b33360f1c
SHA512 68c1f0b484448cb8132fc0ab3098311e4fa71f5f2df50c872886329931812b2657c4a4ab2118c9c077f560b1afa8eefd8dc61dec57d655e95f52aff276675a40

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

MD5 c107f93db71d6562cea157d4f5c761ec
SHA1 747ab8822bbea5e1580d38a3f270048223123758
SHA256 eb1a06f1463f499bb148fbfa0a46b5cefe7e2b2648ce8af163e095cbe451afa7
SHA512 cffb86819c05d2fa6d00f3f1c21c77800ec0a13fa24025bbe4b49fa16d386bc050c7e96e87e6f2f903f7ddbba516f05b4af55336823ea6ca0153795617a4cadf

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe

MD5 648a2de249b93c97992bfa1b091378b7
SHA1 8ebffecaabc9bd80da4ae8e543dfe2f195eec3e3
SHA256 79cbe36f204b682248295dfc99ba1838b9b473d61c81b0b12811dea9c15e04f2
SHA512 cf4686f2a1efcfcbc87ea64a5a3621de725fea877855fd641bb34f0c898c17d07c6d8396b2e5e2075eaaf36c43060f0d71ec9711047dae56d317ba8e01a07ff3

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\javaw.exe

MD5 24aefd930cd0067bc1bec3a181d14570
SHA1 218c007ee9e37224488dfb849c80f791902d78aa
SHA256 1fc7d0e532af4bd685206932715ccc46019e8333b57adf2e7417fdfa2d756ee9
SHA512 8c9ffc265527391be4972c9d7620f00da4523f4834f9f4fe0ea79537c3f166c5f18d6cd9d5cd5444df2a420fbc1541fc78e29ae10d080413460c08c987dc80eb

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\javaws.exe

MD5 728747e82b337373a05772a52cfb2d9c
SHA1 3dbad154ba7298bcc16ec9c226f52718b778d8b5
SHA256 be1d040714fd32b9a3574d41fdfe407d1f87fdbbc568003ca06258d13d5c7b46
SHA512 0f62926da147a65218a464d096b18c9514370f40b69fd658ad6e56cb5bc8c0f58513c1a55045cd7b805989f66b4572d30c883f42b250848c4054e8a4fd3152cb

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe

MD5 6393e803f97c7fca713d899cb9886d18
SHA1 9172e7ae4f35a478cd416ece868cf308d303c3ab
SHA256 e7fe1ff96b2dcb1512bc530e2ac86ded63c495618d18aaf3c3db52e6ea3e2b0b
SHA512 de53203ad785d523124aeea4f5ede064dfa635d13b99db991728976bef4af2fa9afdc17f27a31c2b854a38cd2f37edd2343a2bc14581141217d09495dcac9970

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe

MD5 1b9cc7e46765f3a07113568a76fa2f1f
SHA1 6c7b7494d4cd17c8f2fa99313a0ddadd45bdd471
SHA256 ae5b8d19cc48f20ba8c466e0122ed37279e9ba335d751e9f7bf6e3f5aab608b8
SHA512 fcb61565b91f3d58a207a7893be8ce808bf6d6f582ee353e74de2d284ce81248904b7f7eabc179666764704c386219786599fae61651c071f063a6bd9b5c9746

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe

MD5 d7ec8fa051fd1a84482d8c75fd4874b9
SHA1 5feeb949ea637dc6119075a99395dd1264195140
SHA256 119289acb5bb1aaac9b7de849cb67b8019d36a4b863e34043eae264eb578c558
SHA512 a914cdc117f60d3f663a17338f1701caf76481e46d1ded5752d096aea9534bb2a22086976adadd54773dbd6deaacaaca52ade243a15472c317ad25352d7f4a1a

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe

MD5 85bd227cce35af823b04887a113a0f3c
SHA1 be356b131c3061d5840e249c4d99dc6aca9d61e4
SHA256 951faed1264f3f2ecfb91334347895c55e06a5752aa562dfea600faa4ca0a3f8
SHA512 c127445719721b9ae8abf940139bc03b9a360c2047ca67b4c0559b3fba4398a0c86b82524eab2721e0545781d6d2820a7d53ff5ae5ecbfc15d1cfb3158dc9b80

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe

MD5 11b808a636ca2514df18d3b8a4e0e6f9
SHA1 77e101fa15da2fc0032a9fb7c4f3e8aa8d426295
SHA256 eadb833ae0dc8e459473e17769228508d0cd2099c9468ddbd7ea18fb2bbf8360
SHA512 664748827ba087b851861f65e7013910fd56347e3b5018891d633d43e4ccbce954267304ad6c952350ffbfcb3f6bce1aff2f38d7dd95d500efc34fc41d566fb1

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

MD5 5bfc589d17d6fd6077affdcff278ccb4
SHA1 6ab62ee661fbb8510a5c9dbf1650babace18528b
SHA256 58d5c00fb6c0b65b5b313b96a2fcd5cbf352ae6aa3c1d9d86fda4f73716f7d39
SHA512 85ad6035333de189b8014da3a611854e415e90ebac57d8038103eb429325f2e57d239a774c9bc2d7aa17981b49ac57d36db8a4df575015a9d2057602fd3aa525

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe

MD5 f56016801a5b2519db6b6494fe7ce550
SHA1 9d0ce2450c5159c6a8b1c31378ef1796761c4793
SHA256 e59d39f2567740c96310849df1e9656b804b60e64c5783e0aedce95508fb5d79
SHA512 f22ba79c36d513ced089b5e3a89fdc1e0caa3ab19265fcbf665e99c0575318a4d91682774c7252c8dc3adbb7ae02892ec7bbd9fa975e9d76b411dab4d430bf84

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe

MD5 5e08d87c074f0f8e3a8e8c76c5bf92ee
SHA1 f52a554a5029fb4749842b2213d4196c95d48561
SHA256 5d548c2cc25d542f2061ed9c8e38bd5ca72bddb37dd17654346cae8a19645714
SHA512 dd98d6fa7d943604914b2e3b27e1f21a95f1fe1feb942dd6956e864da658f4fbd9d1d0cf775e79ceaae6a025aafd4e633763389c37034134bd5245969bec383e

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 9ae0995f753cd7c197d9a83390d6ae4e
SHA1 e56c1bf33e05cf6f4e0bc05ce189dc7c8a2a3d59
SHA256 50a4a25533e20571f51b89ba172328800217f53a2736e5e012be23eac32d5858
SHA512 8dac7fd0a289b0a6c80809153d9e7b0aa64b9ff77a3fa1e87aa467a6a9504fdd09b429287804631c95038d88dc5ac466686196cf00cfbbd15ced19d9f4b8e666

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

MD5 f2c13e37d477a5ef7b0f0886afbed857
SHA1 025587f7b15dab4e98503b7d703ac3b295af4b9e
SHA256 4f55e11b91801073662bd201d1352c873f5b4e7587bb883bcf03787b16a2d840
SHA512 69856b7b7f9056173113ee08deccc9e47ba773796e0b848aaca303b4c5bc3b8524f3470db4a1294fc38cff9f3386c37565b56f50d14ea76642486fc15cbb91a1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

MD5 0c498fd66a3e7e395bc2ae698704c8be
SHA1 c1aec0199cbe5136db9065af79a88c01ba7f70dd
SHA256 3df6f0fb0eeca1d980343288b6332f87f7e0895359b2749b98ff2eca64ab5bc0
SHA512 7bb745daa445d8b65a14489a7ed2f637d08fabc57e3c2c3368d5ee4091dd12ce7cd3949a03d61d1ec2d752105420276f02c3b8a77fc0ac178d3329e463e562bc

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe

MD5 bdeda518b2258c65a53d7090fdaa28d9
SHA1 72c6e7e99c684d918965515da24e5482719dbcc0
SHA256 c2215779c9b0974f468c31aeafad7870210db204e0454426d4c7957c1cfcd942
SHA512 8c6637ea46a6ec266570b69ae60c8fbc14829a2eb11a7bd44c5b2bcca5ab0e3ca3a2bb69a51c159c46aa79d413bdda5790a30995d272d8385410fec65db7ec98

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe.sig

MD5 d8d0face111912e6dcc93f665bfa10ad
SHA1 e171cc8b4abd73e2e6f9e0145e8e3d46e333133b
SHA256 5efe288bf88e3a66ead387ee327d7f2ae6637fa507e14271cd1c30024279945e
SHA512 2bedc86a79225d3c23067a042a219976a670ee164222cbde077edc2bf5618181eb5e26edf86946e2797016c5a87f3534e47dc4ac76d40487354a701ef77aa51a

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe

MD5 a5a7b7278e23c215ffecad88ec0b17f5
SHA1 8f8473fcfcd2096f5c7a7ba5645966fbf7132fce
SHA256 3d8bb84b9e2955a40a475ea7183592b7928a323fc10f2149e95765a6a99ec567
SHA512 acb35e08c3c6d0634dc235ef9410db55018c0eed35ce29c5d874ee386fa28289003b492777cba2ecd30d652982a521c7de1d4e17732ae107e9c62edf8d11d665

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe

MD5 56868dc18ca2a7b382a6f793d46f6c5f
SHA1 b1e9cbcc325dc1a643a25a87a84bb858a783446c
SHA256 85e818b844c8a3a70141ea2c10afc9f3382486c06e5f757ee98475555e315c25
SHA512 c0b20c68b4075dcaed8f95fdc7644326e272cc4c258b1dd74c227d3acf4aa5169f8025899c44dba4caac5b8588491284b7999fdd59957f9c885a20ba7c9fcb42

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe

MD5 ae990a2008673629a6b48bfadf53323d
SHA1 c489543479ed315ea68563119d2c8121399cb54d
SHA256 d69590d107273de4a721e346a0aa9082c422974795914ee9f910b02b14d70ba7
SHA512 6a3c41f31f3eacbe3aa652b5fe9def71a63c1e970d5b2d98ad93422db04b946c88f293f63c486243b726f68a35a6f442bd816eed0431b170cf31a7700a49aeb2

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe

MD5 1e47a7f8e04105419cc42f7e772f8d01
SHA1 3aee077892dc9439dc6f8064b4eaeb66c63ac836
SHA256 c5d1b7a4ecb0e5b0b90eca811a5ae8e5c559df1799b7f0c20ad9f3ec0a58085e
SHA512 356f82bc3a4d6078dbd3ce563d0c0b6aa756154992067f25f773f0a796efb3e54b872624f84c18ff39006068076afa0f8e01a2fdcaa653238142881b631b16fc

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe

MD5 c9d5dddfc861cc4d45299759c3bc4d28
SHA1 265104cc490c6928ec1926fa34f9214d9395d46f
SHA256 321d1163fad8646d2dc9c9a2e168e66ca5727edf489a339dc156304e2455df7d
SHA512 c8df5d807da6c4d44ecaa9bc8df3e50fb296eab8a8fbf2445af7dbdf1644fe6ece02c7b753fd8caf8d7d93f09b89a8b16d46409773f040eaa177be7c1d9c765e

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 282abb98d7425eaa3b9ffd8ba1bc81ba
SHA1 0d5668d8011069285121227db5edcc2b3fb5d2b6
SHA256 17ea8bc0fb9dbc677a458fd0cfb4ad11d62b083f9c95b142f9689d07790b565f
SHA512 f7422fc7b5e1dd27b17716232ce8766a099436d84ff265cee14de6a98f1f14325da36291d593265b58fe6bc3f48a5891cf247f8ab9dd20cc9704944f7502776d

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe

MD5 b6d902c9b56f6769048a6776240b6b62
SHA1 7e8c4204c4049d1085b0e667bde9877b884d5fca
SHA256 f71e9f586bbdd78e11ff60335632cf6b084b3f1e5e0d8495024e82329a1d6198
SHA512 45840202ebf543e18f9f0599c33cc83bbc3bc78358a4d3831251eeb3d72391dc7b8a49a79bf10fb63ce5f1638845c5309f85b8a3bf95f92abc83f5f5dbe7b656

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe

MD5 af1ba10ded46be6b8b9634fd6b9b7efa
SHA1 2073c6594201f63318c58621a58e07e88cef674a
SHA256 26b24e6441cabaa874d376e5638fec3a69823f52db0ef5a0b1a60822ec355917
SHA512 56b41b70cba6030ad8e50615c09f2386bb1c4919e582e854a59a092f93444c384d8bfe26967bdb12463914bfbdce1a5c1b3b319b5f498f519fda510b5f6ad28e

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe

MD5 c3e09356a54aacffc742ecb34decab8c
SHA1 3f9daa1b96b2c4373fd3d0608c77d75709a18758
SHA256 a5a9084ddc3dc6585694b2a7c37274da99601495ed69c1f059f0d4ae6d8fdf36
SHA512 1f0aa7bd0a318ae591fc681f04e9d8a587caa0917ce251ace5a9e2395eeadf3921144a5fcd8c7ca6faf9a2d480f21a7383857ad415519ac81fe17da905e43765

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe

MD5 1e46495486fdeb5402c53cf0567992e3
SHA1 9a00d784d8cda69ea87842814105c8853db48f8a
SHA256 2f0a579e27d9ccee1d1ae0e400cf9fa88c5fe201074218c4dee1b71700f53ef9
SHA512 c3399827ccbee6072dded2cc7c0d9961221c13e7016405ced6115fb4962eca36064fa8ab7e31a9a125150102ebbc214225964cc3a74bd47d5330e72030a114f6

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe

MD5 639fc900adfa4162628d4656394c04c2
SHA1 30560ccc02b816cd6089b82685b2802ff253fca5
SHA256 8cf3e564a10b44277e6f6960fbe001403d9eb3a60dec9cae26bbcd7a84578690
SHA512 974c40ff8c734b4ef09fa4c6d098c21cc0780b684743adbe1db422b2d54d2589a4e4a18f4c53dda8c883417bc42ec597aa99cd2f74170cfcd2b3bbb5146abf52

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe

MD5 c5c4ce70ed0f3e25c7b4c7979fd480c5
SHA1 2a3154b51ff2d4d380b6c7556537da0399ac8063
SHA256 e964b449f06ce942fb84186b7ab20f0dd77471f75821fd7949009fd91c3d5168
SHA512 7761eeff6708c49619eb9a5e14c7516ca16107939f7a3f2873091dc5629799ea4603324cae5869a6de5912858676340e429b8bbdf1382baac9761d748723ee97

C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe

MD5 ae91d609f41c01512a760d2a48c537e3
SHA1 3b43d719bdf38e8ba493897937d99d7b0582128c
SHA256 ec9fade9478b126a77105e32fadf47b8d1cc6943e97393fb7900f1f142ff2d74
SHA512 9247884f97caa9cc84bf46f18a97d56d85f26f14ecdf695ca57225ec9d925c84b8c48ac087f96cbd0664c36a6d54378b6d6e601f09b14326b34633f9634fa1d9

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 4c0a44979bb984470f56bb3cde4dc1ea
SHA1 b4e80e639b7871deac7f81b6ccec35e73158c379
SHA256 8969cbd521a9cabfb5afee05b4993efbf6ed3912f574073a7064c46defd767d9
SHA512 118f606812069d45fe05d6cf8fc90274fcc1fbe221ec6b259984c1c6c2e93960d972bece55ed09f02189ec9c308f8c97f12b940e4d4ae1ea4614237a7ac978f2

C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini

MD5 1bf37c0336c12ccaa1c62386acacc858
SHA1 f1e187c79588e4e9fce931997443d7e5cafd1db6
SHA256 a9044f3c6877f4fa6789bd90f11813a22696bda53e0be17bf52229b70fa87673
SHA512 f75100874b1dd43c49f54a9aa4621e8bd1efa84359ce44ece2444b639c7bcbddf6564f6c4be089f5d656550c7293b9f5ec4a4b20880939fbeb5ebc21e30866b1

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe

MD5 05bdfd8a3128ab14d96818f43ebe9c0e
SHA1 495cbbd020391e05d11c52aa23bdae7b89532eb7
SHA256 7b945c7e6b8bfbb489f003ecd1d0dcd4803042003de4646d4206114361a0fbbb
SHA512 8d9b9fc407986bd53fe3b56c96b7371cc782b4bac705253bfb0a2b0b1e6883fdb022f1ac87b8bfd7005291991b6a3dfbaceab54f5d494e0af70f0435a0b8b0da

C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe

MD5 ce54e8bd17b1b7ea9d1e268798a567af
SHA1 37c3d6f0d1ecc1ab658fe80f83bc56bf64edbbd4
SHA256 f1457a95ed5988da9de85586a9055fed520f31738d82a485474b9fed2f7fadb3
SHA512 c5cd1cb66ce26bb34346705d9c04d856f26895fbf3e83bdd3a4cfe09070eb0c6ce98e21df524183815ab1df8c222809c054c97bc910e2877859b931195c7b410

C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-Eco3PTelDefault.json

MD5 ab9d8ef2ffa9145d6c325cefa41d5d4e
SHA1 0f2bf6d5e1a0209d19f8f6e7d08b3e2d9cf4c5ab
SHA256 65a16cb7861335d5ace3c60718b5052e44660726da4cd13bb745381b235a1785
SHA512 904f1892ec5c43c557199325fda79cacaee2e8f1b4a1d41b85c893d967c3209f0c58081c0c9a6083f85fd4866611dfeb490c11f3163c12f4f0579adda2c68100

memory/4152-10176-0x0000000000400000-0x000000000041B000-memory.dmp

C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\6ffa25dc-c89d-3de9-3601-df09bae65a75.xml

MD5 af98b62b3f9d6e70c082f05969c0d2b3
SHA1 2a78fe6ace36668a1505ce949dd5415cf172590b
SHA256 77544451f210250b90637e7ecfebfc0ce00398ef964a2d46f1b92adf4d6f97a2
SHA512 6a8d54bbaa9d6f04de832a60fed8f471eaf38bce9f95942d2fa84dba035739b65cc4fbe58904a7d2220af89d735b96be1bb6aa43aedecb83afba6c4d3be20850

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk

MD5 8b550761ab80413c9c09f7fb472dbfaf
SHA1 67122822562203c17dd3f762194e470f90ddfa97
SHA256 f5ea79165516de2e7e1efb53d016983f5d18c3184413f044a4002f4b751c918b
SHA512 9546013cf4d45a2c4c609524b7ed4adecc7dc2fecded7c3b7085415a1bcd1c25db5d88bb591ac05fa5a6313763a8e8d5d8fc6ee6610b454cf7696b647e7781fe

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe

MD5 a781800433def8446b0b631e3b7db830
SHA1 1ce441e9a4a9da03c5eed0a979b68f7c6961cac6
SHA256 e49020dbff46224343726fa09eed56fd05a11beeb0ccccc53c40a8a5d3d57959
SHA512 168ca24668d05613aa129a81a9b38b902bbf76aed988facf67df25c15392d002832ab19fb19a3e6e0804490886dfd57f0c5c7acc233d75b056aba737ac4e6026

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe

MD5 ba49197d84e5d25c79991e47feb9b94a
SHA1 5803101592d127b2d011bdc42148648c70a8b629
SHA256 aac45a850c05974a5f716019c498f28276fd6a37b2b8dfa7dd03567ee65cd531
SHA512 6a635634bc65474db7dbde74cf32fb9126fd1e00d09499266370f606e23275c692d7e40c8a8c3707418f5a2745c09b61b104e9f6fb7b6658a70c8b8a52ea91ab

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe

MD5 975242fd7111e8dcf34e8bf9e09a69e0
SHA1 e6ae61074c1d3da1fefbd00d28b545c154847c6d
SHA256 c06799236914f05b85cee021aadad78ed67a3e20ea0e8e129cee88f23add4982
SHA512 2cad0f2e68bae3fb3a693a5619b72caaf5519f0a2e559f91acd58d7f0a1c7d88fda5d5734e550dd39e0327e4822c6d36bb6883f8b20c4a57c1b58c606963c7a5

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe

MD5 f24f4503e4aeb32e479b3f908b050cdb
SHA1 9c70778a4c5b544d6754182469ed89560c6c77f6
SHA256 cb9692ed8b4b7615f50b39afc8b86885ff4d0f2b9452a3a8cd8546e2d163c63e
SHA512 2592b75eb1ce7953326cf9f727583b77fa13268f3fcc90b11c2d231760aac66f6f10af1138d30ed73ed5a0b01e9481ac26591d045edbbe6ca1794115527deb62

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.2_0\dasherSettingSchema.json

MD5 310614b10980392ebdb5a5a8b90b527c
SHA1 8c8fb36e7c2a1574cde7fdea30e8e5f14fad7691
SHA256 445c811c35e2fbd4aa59389ec805492c7b2db50d65f5d161417ce8302b103fbe
SHA512 416650adf9a61cbbb6eff7af635264e5bdde903477465cce05b63773927b8afb35e75fb68497882bce7778f524b9c7f3f2befcfe3840e99bff90ccd305bac66e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.2_0\_locales\hr\messages.json

MD5 798b4a7c5a9f20d24f36ba8daf7b8f70
SHA1 0f007b82783ddea5da7374c96925b77a7fe9f57f
SHA256 e5cbc8e3a6e843009fc9a9de7a83df9d05532e08d48da06c66f907f58d0c745e
SHA512 e3faa4376d03dad6cd714dee6349733abe29d0c2118456f80bcc4c758015b12a06b4ec6532a6e98d512f5c6dec7a7ade5c1d2a418db0f739ed17f18c0cd6b54b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001

MD5 f5cfd73023c1eedb6b9569736073f1dd
SHA1 669b1c85ecbafe23c999100f55a23e06bf59ead7
SHA256 9e1736c43d19118e6ce4302118af337109491ecc52757dfb949bad6a7940b0c2
SHA512 5d8c1aa556fc17d6dc28d618f521aee37fc0e1826fdbcf8d106e456fc3bcd3c76e712d23fef3378bd2be17b80eb5bfd884ccd89b67490b63c7bd118eaac471d8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT

MD5 4ae71336e44bf9bf79d2752e234818a5
SHA1 e129f27c5103bc5cc44bcdf0a15e160d445066ff
SHA256 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
SHA512 0b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser

MD5 f536fbf78e26387affb82ee89943b870
SHA1 3ac8e44a9491c16bcd86dab6781acc4f7e1f76a7
SHA256 34dbd6bf55d0d075d666181d9278b8387482a8b5804e44e1ddaafe6876dadc15
SHA512 d9ad640884f40495b4255bd221f0902ff64f84e3136053d03abee7ca417d32a1d72f24a75cb67bc50629e102bdb2f81c0bb087e0eb5cb82fa3d67c4fa5d92450

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 b203621a65475445e6fcdca717c667b5
SHA1 c17fd92682ca5b304ac71074b558dda9e8eb4d66
SHA256 17b0761f87b081d5cf10757ccc89f12be355c70e2e29df288b65b30710dcbcd1
SHA512 ed68f5f49945dcd0d81dfebe2f2fd1fcfe016807d5c64ee0377d046efeb0a7fd9b4b9589b3df8a14194d51dcffbd89c8aaa072cea2ad4e7976bdf53528ea90cc

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin

MD5 1595ed4372d33dbecabbfd411c6c8f46
SHA1 8b8ba962b765110f762f873edbc3193adef48b33
SHA256 8f6abb9e202dd8027ac9abbd475a24e62659a0b2683613f219c21d1238816ed7
SHA512 e0017291c0d0685ede7a6492c2683a90b37482d21037840ab3e2cef4ed381bbffa8c31ef3c8d06db0a800eff69ba4505012886f88a911997657b3f26284142f1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini

MD5 897208d5df122e307ab837d982b2c085
SHA1 cf4ca14a7adcbc197cd84c1997efdd076911d608
SHA256 eaae98aa73fe0b561c8b02607a524fb4853bbe81c6de8c3d8a9b7449366809d4
SHA512 b0aa03063c42515de12fbf6d89924a3ae7d8bdd64d7c9bae94c75d571c939655253f3e87368fcd96f5784b2aee8fedac8f66200b8672ab47cc8b37c57a9ad334

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6E1TJXL2\Windows[2].json

MD5 01b53ab60d1307f1db2f793377d3af08
SHA1 aead0b1b398828d1bb81e91a52f28e504d717e1c
SHA256 b5afda9531d50eca02d7e10dd6a5e5a9346ef452f1aea17049b4acf84be62641
SHA512 ee7663533aae47cae26d9605f045b9165ed9ba387789a09db6e4bd0d76ca08aaee685d5299a8ec40ee086123f4e3ab766a793d9199c639d18d56d87c37cc8f6d

C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

MD5 61d2c715839bcfa06ce4d23dd84e7457
SHA1 cdb61e6100ac4882ba4863875f63e38b8b804ddc
SHA256 1f9ec15f6ff239e14a3a243a98f19ae7db16d425a63b2da0908cc0ffcb1258e7
SHA512 cb6577068e0b746a0ff0148238fd5be9e02e4ff6218fc21d78194a06ebd3f54aa12a1a9b80a4cc9a9f66f72f49eb875eb367b344f674807af11373770f75d952

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\safebrowsing\ads-track-digest256.sbstore

MD5 017813103ef615c6e4e41c106f0d8540
SHA1 a7bb21ac882f35d671d5f0597f8962f9e04e371c
SHA256 f18f13c653940384b01c154887477150b1c0669d5620d263f72bfcfa57daee09
SHA512 0a615cbbde1ce71e1e3623454e2dc355f5ff2e2480520ec0598de70a9cdbb287959bf7958435ed05457957e3ae09d2db2884ffd743806191b773d91a5c882fda

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png

MD5 535ee7f4b7959a29e1d1be5a67e00334
SHA1 c8b3bcb1c1fbf79c59a847510d884da10dc62f19
SHA256 46dcb7a9e7bde1f57e5ed2eef9257d2d0ad622c1b3da32700f6d9e2ec4a0e287
SHA512 b0f9d39cb8200c35c564053454dc9fc67e68140861255f77dbe63679375ff3f892426109e95633fcf6e285b9547d890d1281d8ae4ef97cfb78433608961934b4

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png

MD5 69016e6a597d194701476b8e04d4e028
SHA1 71a24ddb0c5bbd321d3f09d7b322c3655fb5e129
SHA256 4740d289d0a31bc1fc00e255845b3d8ba7cec2d6d0ee92177d23aa293f9fca3a
SHA512 a9399ea57f65c6569e2a9e9ebe9fa2da7184ec92a555549f39cbbe9dff15530ad526107a2a2304d822be37580a965c6ea4e88a46adebd8ff3af402d2c25321ae

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c698cdb5-4dae-448a-a5b1-066ca909f6ab}\0.1.filtertrie.intermediate.txt

MD5 ca9c491ac66b2c62500882e93f3719a8
SHA1 a10909c2cdcaf5adb7e6b092a4faba558b62bd96
SHA256 8855508aade16ec573d21e6a485dfd0a7624085c1a14b5ecdd6485de0c6839a4
SHA512 65faa9d920e0e9cff43fc3f30ab02ba2e8cf6f4643b58f7c1e64583fbec8a268e677b0ec4d54406e748becb53fda210f5d4f39cf2a5014b1ca496b0805182649

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

MD5 a50b718c3518b630251fb54b92bde360
SHA1 a9582222b6f4df2b4e3e4ee5fe91d25ff086b943
SHA256 9d2ce1c032646d2a3381b68bc9201e3dcd53b764e83a0d356d67cc4926ece015
SHA512 95e0676e3177262d29c4105edd4ce1fa1c2a2da5cd3289ab0f873fba782a0185e4bbede5d64fae1f6c4cea5ca3ae0697d7113e6ee63f229431bfaf3f8990c517

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

MD5 80be6efdf5a776659777bf07d4aff891
SHA1 1f98e7ba8de8c6b39f4b202739ca71fa2629fd6d
SHA256 9ebc694d4895efc802ea27714a71986f293edf4b63e9918c27d65871b06f43a9
SHA512 03a5434f25209a74a0abc6045c66a45e098d487227cab71004363c8c823840b49596857e8f757f42b8953f9bc2066209b1e8f52104d1837705828cb2676119cc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_5C1009244D39FCE23AF8F277537F2613

MD5 a75d7d422fd00bf31208b013e74d8394
SHA1 3d59f8de55a42cc13fb2ebda6de3a5193f2ee561
SHA256 7a12e561363385e9dfeeab326368731c030ed4b374e7f5897ac819159d2884c5
SHA512 af3a1e15594a0bf08ae34a5948037ef492e71ee33d5d4ac9f24b18adf99a34563ab40ba8f47f2adff5d928f18d8a8cd60fc78e654e4d6cf962292d2f606def66

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A

MD5 8c1d71b2bf2d4d1eea6a825412dd4544
SHA1 7160c20079f39f98532f42db23209435edeaacd7
SHA256 0441772f66559a1c71f4559dc4405438fc9b8383ce1229139257a7fe6d7b8de9
SHA512 5d70cd72a6f162cb39167337001b791347abc07b9edc095516489de9e9427cb824bc79596362b41f78e73144d3e224dad14f3dbf48cdd0fa08f4b5073ab702ec

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk

MD5 8776c367699ad807af292f1f5d085d4c
SHA1 9209e352bf9d3999f94881a75d6f7d39bc6d7f77
SHA256 18b602cdbb7656129a359046fc68faf1b990da88c6c3b3e6b20c1df399cc0645
SHA512 83a17d98d175a122fe98cf89c476826769d8fae0d74dc93c8fe48d12089e26bfd501a586db3783a03e1bfe07864ebec2a6b5a48415554c61cd565131ed40a9e1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\previous.jsonlz4

MD5 afffb14251fdb8bbe7d064f77e3d60c8
SHA1 3c0975c4c816c8a556ccd5d01a3b675b25bfa0f6
SHA256 8e1b2f3c38d9583ec30e0f44459700b5d81f4b6a2b2eefe88198c9230ec408ec
SHA512 18ede0f0164d1e1f20a795a77114cd912839dfb758e259e803d029e3022908f1bd3f6f3f3289aca6ea4ca71466b4e6508a83f72fb85e2f393a82eec616c98e52

C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

MD5 7a4228aa2003a72a296e741bfa8246f7
SHA1 e94ca8cb43d671cdc3ed759980bfbaf73cf4c6f8
SHA256 462fa5c6568794276673c9159500918afddf8f170e580fd1f3d483c48934b050
SHA512 ed66dc35762f661f760eaf0feb82e22c823f11e552c9f938748a8b158ecf0828f40d48afc4d5cc07122f41a13e7b322950b9f156808b125bc7a1ae19e066d304

C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini

MD5 6e36ba0fe61f7c6334305d61299c04cf
SHA1 646aaf623a9b65f3054571ba8680342cf02b6225
SHA256 367467f43d580c3c07040a78c7890ae4262dad4778878f9a49d5f652c81689a5
SHA512 ee5d694d66bb3ee0d55129c96c83116e7af28b6838854d110cafe9dcb530fc05ef8b97469d7fe0c864481298fba5008c97eb2b503e90b58b1e33f8856cb132d2

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

MD5 35705a33e80294bdc078f5582784f4fa
SHA1 3b8d2bc3650098d604e3363fdc41e9bfc2f4609e
SHA256 d0e438519a8e2075e13430b66debeb7204e5e8ab41fb24eaab20db0bdb66d835
SHA512 e560c350940f15a8d5c5187ed833190cdef9e4862e8f06dde9b0204ad1a0decb9adaadd27c4b7015ea5e7fabe7d7a63538ba72def9997e56300cc8ddc4249061

C:\Users\Public\Libraries\RecordedTV.library-ms

MD5 a9d5728f9b0e997753288b3a140c5335
SHA1 a44e9168f2e351f3ad4ee2f7c0e0037d64f65066
SHA256 84ba348aafb41879cfa434256c8657baff00a9bf41d5ebe041b0ef87e7419f28
SHA512 13380300950d351ffb3256e3b65f6dcfda8c52dcedf6627e10ef231925e45b178d173e7a24406bdef42949f9919326e7abf8a9101e2fee0127c578a46a1df294

C:\info.hta

MD5 4f0051f1069f63998fce0061a356edbe
SHA1 c924888c75b3d52a74e99f9b6ad198b3fa2345cf
SHA256 f0b4fdb0b27592d8f558c4f9dcb68200a40348f510b2668b0680424d042a6e2d
SHA512 32ac3323bd881351e34da362db098920c5b43d747288b2b02e9013a0f866b6a5b0cea6570b91ac397ee2ac1a271e0f314482ff620e634a6ead86a22710a5db07

memory/4152-16812-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4152-16814-0x0000000000400000-0x000000000041B000-memory.dmp