Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 04:27
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe
Resource
win11ltsc2024-20260710-en
General
- Target 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe
- Size 56KB
- Sample260821-e3espagm3z
- SHA256 6429a30e8c9c7146388b4512520d6eed1f16239bdd21fbfe173a6a2257857543
- MD5 68b8c1199cf0501da10e2bf3bf71b74f
- SHA1 628b72a18555280e0209b572dbf1dab0f0e26cd9
- SHA512 a042751e54576f8d9f9627cf3f9da4a082f8420a94ed48eb69b464bfe50577068301e28be7d776c5c45b805617ad9a8537ee18fce1c17bd76443eaf9c20e4c67
- SSDEEP 1536:gNeRBl5PT/rx1mzwRMSTdLpJ4J1lw0BFrDgA:gQRrmzwR5Jolw0BF/
- TLSH T17B43C006B06984B2CE614570293E6F5F4EBF540540B894938F794E9A3FC4532EB3E37A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
-
C:\Users\Admin\Desktop\info.hta
- <!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>encrypted</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #EDEDED; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>All your files have been encrypted!</div> </div> <div class='bold'>-What Happen to my computer?</div> <div>Your important files are encrypted. Many of your documents, photos, passwords, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for way to recover your files , but do not waste your time. Nobody can recover your files without our decryption KEY (if somebody will tell that they can do it, they will also contact me and I will make the price so much expensive than if you contact directly)</div> <div class='bold'>- Can i Recover My Files?</div> <div>Sure. We guarantee that you can recover all your files safely and easily But You have not so enough time . So If you want to decrypt all your files, you need to pay . You only have 12H to submit the payment. After that price will be higher also, If the transaction is not completed within 24 hours your files will be permanently deleted.</div> <div class='bold'>Send e-mail to this address: <span class='mark'>[email protected]</span></div> <div class='bold'>Write this ID in the title of your message <span class='mark'>F08AE0D6-2936</span></div> <div>You have to pay for decryption in Bitcoins.</div> <div class='note info'> <div class='title'>How to obtain Bitcoins</div> <ul> How To buy bitcoins <a href='https://buy.bitcoin.com/'>https://buy.bitcoin.com/</a> <br>The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. <br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a> <br> Also you can find other places to buy Bitcoins and beginners guide here: <br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li> </ul> </div> </body> </html>
-
class='mark'>[email protected]</span></div>
-
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
- Family: Phobos
Phobos ransomware appeared at the beginning of 2019.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 1432 bcdedit.exe 4864 bcdedit.exe 2328 bcdedit.exe 5992 bcdedit.exe - Renames multiple (860) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 5100 wbadmin.exe 4584 wbadmin.exe - Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 5176 netsh.exe 6048 netsh.exe - Creates a file in the Startup directory 1 TTPs 3 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes dropped EXE 1 IoCs
pid Process 3100 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos = "C:\\Users\\Admin\\AppData\\Local\\2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe" 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos = "C:\\Users\\Admin\\AppData\\Local\\2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe" 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Public\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files (x86)\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Users\Public\Music\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened (read-only) \??\F: mshta.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libwebvtt_plugin.dll 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner.gif.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\css\main.css 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Trust Protection Lists\Mu\Content.DATA 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ct.sym.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\PGOMESSAGES.XML.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\UIAutomationClientSideProviders.resources.dll.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\PREVIEW.GIF 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecuritySplashScreen.scale-400_contrast-white.png 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\editpdf.svg.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sendforsignature_18.svg 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_gridview_selected-hover.svg.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationNative_cor3.dll 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected][F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README_en_GB.txt.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\DenyUnpublish.tiff.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\Java\jre-1.8\bin\unpack.dll.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.boot.tree.dat 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\rss.gif.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.dll.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeGreaterThan.Tests.ps1 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Locales\bs.pak.DATA.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\ui-strings.js.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\ui-strings.js.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Trust Protection Lists\Mu\TransparentAdvertisers.DATA.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\ka.pak.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\MSFT_PackageManagementSource.schema.mfl 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\PresentationUI.resources.dll 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hi_NEUTER.pak 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\TASKREQL.ICO.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-conio-l1-1-0.dll.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\PREVIEW.GIF 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\plugin.js 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-win.css.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_checkbox_unselected_18.svg 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\BREEZE.INF.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.resources.dll 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_proxy\beta.identity_helper.exe.manifest.id[F08AE0D6-2936].[[email protected]].eking 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview2x.png 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Trust Protection Lists\Sigma\Advertising.DATA 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe - Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2404 vssadmin.exe 1752 vssadmin.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 3592 WMIC.exe 3592 WMIC.exe 3592 WMIC.exe 3592 WMIC.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe Token: SeBackupPrivilege 4972 vssvc.exe Token: SeRestorePrivilege 4972 vssvc.exe Token: SeAuditPrivilege 4972 vssvc.exe Token: SeIncreaseQuotaPrivilege 3592 WMIC.exe Token: SeSecurityPrivilege 3592 WMIC.exe Token: SeTakeOwnershipPrivilege 3592 WMIC.exe Token: SeLoadDriverPrivilege 3592 WMIC.exe Token: SeSystemProfilePrivilege 3592 WMIC.exe Token: SeSystemtimePrivilege 3592 WMIC.exe Token: SeProfSingleProcessPrivilege 3592 WMIC.exe Token: SeIncBasePriorityPrivilege 3592 WMIC.exe Token: SeCreatePagefilePrivilege 3592 WMIC.exe Token: SeBackupPrivilege 3592 WMIC.exe Token: SeRestorePrivilege 3592 WMIC.exe Token: SeShutdownPrivilege 3592 WMIC.exe Token: SeDebugPrivilege 3592 WMIC.exe Token: SeSystemEnvironmentPrivilege 3592 WMIC.exe Token: SeRemoteShutdownPrivilege 3592 WMIC.exe Token: SeUndockPrivilege 3592 WMIC.exe Token: SeManageVolumePrivilege 3592 WMIC.exe Token: 33 3592 WMIC.exe Token: 34 3592 WMIC.exe Token: 35 3592 WMIC.exe Token: 36 3592 WMIC.exe Token: SeIncreaseQuotaPrivilege 3592 WMIC.exe Token: SeSecurityPrivilege 3592 WMIC.exe Token: SeTakeOwnershipPrivilege 3592 WMIC.exe Token: SeLoadDriverPrivilege 3592 WMIC.exe Token: SeSystemProfilePrivilege 3592 WMIC.exe Token: SeSystemtimePrivilege 3592 WMIC.exe Token: SeProfSingleProcessPrivilege 3592 WMIC.exe Token: SeIncBasePriorityPrivilege 3592 WMIC.exe Token: SeCreatePagefilePrivilege 3592 WMIC.exe Token: SeBackupPrivilege 3592 WMIC.exe Token: SeRestorePrivilege 3592 WMIC.exe Token: SeShutdownPrivilege 3592 WMIC.exe Token: SeDebugPrivilege 3592 WMIC.exe Token: SeSystemEnvironmentPrivilege 3592 WMIC.exe Token: SeRemoteShutdownPrivilege 3592 WMIC.exe Token: SeUndockPrivilege 3592 WMIC.exe Token: SeManageVolumePrivilege 3592 WMIC.exe Token: 33 3592 WMIC.exe Token: 34 3592 WMIC.exe Token: 35 3592 WMIC.exe Token: 36 3592 WMIC.exe Token: SeBackupPrivilege 1436 wbengine.exe Token: SeRestorePrivilege 1436 wbengine.exe Token: SeSecurityPrivilege 1436 wbengine.exe Token: SeIncreaseQuotaPrivilege 5028 WMIC.exe Token: SeSecurityPrivilege 5028 WMIC.exe Token: SeTakeOwnershipPrivilege 5028 WMIC.exe Token: SeLoadDriverPrivilege 5028 WMIC.exe Token: SeSystemProfilePrivilege 5028 WMIC.exe Token: SeSystemtimePrivilege 5028 WMIC.exe Token: SeProfSingleProcessPrivilege 5028 WMIC.exe Token: SeIncBasePriorityPrivilege 5028 WMIC.exe Token: SeCreatePagefilePrivilege 5028 WMIC.exe Token: SeBackupPrivilege 5028 WMIC.exe Token: SeRestorePrivilege 5028 WMIC.exe Token: SeShutdownPrivilege 5028 WMIC.exe Token: SeDebugPrivilege 5028 WMIC.exe Token: SeSystemEnvironmentPrivilege 5028 WMIC.exe Token: SeRemoteShutdownPrivilege 5028 WMIC.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4544 wrote to memory of 5520 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 91 PID 4544 wrote to memory of 4748 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 92 PID 5520 wrote to memory of 2404 5520 cmd.exe 95 PID 4748 wrote to memory of 5176 4748 cmd.exe 96 PID 5520 wrote to memory of 3592 5520 cmd.exe 100 PID 4748 wrote to memory of 6048 4748 cmd.exe 102 PID 5520 wrote to memory of 1432 5520 cmd.exe 104 PID 5520 wrote to memory of 4864 5520 cmd.exe 105 PID 5520 wrote to memory of 5100 5520 cmd.exe 106 PID 4544 wrote to memory of 1320 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 113 PID 4544 wrote to memory of 4692 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 114 PID 4544 wrote to memory of 3152 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 115 PID 4544 wrote to memory of 580 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 116 PID 4544 wrote to memory of 5292 4544 2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe 117 PID 5292 wrote to memory of 1752 5292 cmd.exe 119 PID 5292 wrote to memory of 5028 5292 cmd.exe 120 PID 5292 wrote to memory of 2328 5292 cmd.exe 121 PID 5292 wrote to memory of 5992 5292 cmd.exe 122 PID 5292 wrote to memory of 4584 5292 cmd.exe 123 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe"2⤵PID:5496
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2404
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1432
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:4864
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:5100
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5176
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:6048
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
PID:1320
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
PID:4692
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
PID:3152
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:580
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1752
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2328
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:5992
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:4584
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4972
-
C:\Users\Admin\AppData\Local\2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exeC:\Users\Admin\AppData\Local\2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3100
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1436
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3328
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:5280
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\ended_review_or_form.gif
- Size 807B
- SHA256 cadbea407cb411d2ed1c47c77536b622eb7d53d4fd3ee3b9897d554298683fe3
- MD5 b024a04198ed894b334178e411856122
- SHA1 ca7552399eca0ceec6a3dbf393396fade2f5f550
- SHA512 466ef38a6bd49fc816e208b408e5bcc7d366dc7eb9072600ab21510b6e1417894bffeee5ec96f5a0a535d8e541fd505ae3450f2233e5a128bb073394c530e879
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png
- Size 1KB
- SHA256 467082e15a8ddefd51088e12a6189f9923dadfdf363ac1b0448ec43dc483cb3d
- MD5 eedd2d13e3671d589714446755b78b38
- SHA1 2fdd23507187a259f5a7edb01611a37b6b09f4da
- SHA512 ef47a62ce6ffb0c5b34b2c6d72f5874dbad4109b98aaa21f56b8b2d83471f5ebf983f6dfd889399abe4fead6296cf2ca3f409a4aa4badad8cc3c48f688323837
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\remove.svg
- Size 1KB
- SHA256 4717e5fb82c0ee85a7c97d022f410990a62efa2492070e42385cfeab67afd619
- MD5 b651e9101be833e87337050028831efd
- SHA1 ee594ba38a6324369ffc7b4dc89407d3436e34d9
- SHA512 3552858c2a688c95a76c0bb8a6a76b119b744b2e8ae7e7f30135ccd8a145318762faa52c1783a639fb179056317caeaed20c15f211db1d45bc957bc3ce591aef
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_comment_18.svg
- Size 1KB
- SHA256 a9044f3c6877f4fa6789bd90f11813a22696bda53e0be17bf52229b70fa87673
- MD5 1bf37c0336c12ccaa1c62386acacc858
- SHA1 f1e187c79588e4e9fce931997443d7e5cafd1db6
- SHA512 f75100874b1dd43c49f54a9aa4621e8bd1efa84359ce44ece2444b639c7bcbddf6564f6c4be089f5d656550c7293b9f5ec4a4b20880939fbeb5ebc21e30866b1
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-default_32.svg
- Size 547B
- SHA256 3d89171c24a889bce28f04adb60f08a141584b7c345b158536a72a8070c252b8
- MD5 81cfb9735fea15ca8791a3c34a78d992
- SHA1 9b4962166a47f5edc62e5fe3c4f8772446db9296
- SHA512 f6ac853f4012ddcb29e5079ec00bf058343af1a6d6cedbc9613056db0575c77e964b0864c9693a6e02a525d5e13ccc54e0e7fd938ea39c3d2c6005db959b346a
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-hover_32.svg
- Size 642B
- SHA256 e94ac27227c8a25c3f8ede219fd80ace01e7176a12111125b31ae1dcddd487ae
- MD5 55215e8f92d35f26cca06fa9d5d221e9
- SHA1 994838c8df5921e3828749a7703ebfa8383e43b6
- SHA512 7972d3fb8c305a1b41f3ec4a618c9904c1e655fc757f1dc83f9d9041433f3c30e6708ed3d4fb3166cc41d9773df3f159aa44333f76fdde28f317676046bc9c67
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_newfolder-default.svg
- Size 552B
- SHA256 0345bffb28f80f4d0ded1a2af09a337b18ab3a80c68205bc8321a6ad4d409500
- MD5 2807924fc18c958c38a7004a5dbd4091
- SHA1 85534040543c3306284e6a475999c46249a35e4b
- SHA512 264d29c6b920b3005ebda1fdb0e0ee6e17059c69d63969c61ea4b5c5464022166ccc04b2c1f69b91052c3e3dd551a087e8e5379d2a62c452184a12b278a8ac3a
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_opencarat_18.svg
- Size 850B
- SHA256 e9288289beec2fe3b6ac24c1311451c8d079786a09515b95cbf2eda7f87f0b22
- MD5 d3e4c2fefeea6e6c467df305f7a8f3af
- SHA1 a4468bf4d5abcb4d720b0fefb396dce5864e4717
- SHA512 b81a9d38a4a6cd54c2081289192ce7aee3e34d71f834c9b94eac8cd79a5cb90a0dbd3ee0da89be68e4fb69a82903c658addc272a9d70d8f8f8f8cff5c2c18f10
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reminders_18.svg
- Size 1KB
- SHA256 30f1d12f90b61f22130b22667f722aeca0aadd59ba3e19d866d72a99a3f0ce3d
- MD5 3f16cc51cf788a50e6cc1ae60897bbf7
- SHA1 e5a8c8f5227ca6da79589192892e81b6a3f43686
- SHA512 17686bb9e01aa108b9b62b33bb70bb8aa35e4d88199281aaacbc8d8da7d54f1f353bf31a109dc22a4e404780ece4cb3d23f0ec81f80e9553ef060011e568134c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg
- Size 711B
- SHA256 038589c0f8f0b9fbed7fe7835de0237de4a28ea404078955a78c0b8145fa323c
- MD5 cd5d2472a2bf9ac7eb4e15146b30bd2f
- SHA1 bca600423f99b87df44fde9d96ff874017037afe
- SHA512 dde83047b85cf0afd4ac77c9f4e850ebba48a1e1d581ed78c30733f58a9d5e2e22d34a2b2e57e4527f3c314f84922c3aecd6366052d46e0d6157990ed888a27e
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_18.svg
- Size 783B
- SHA256 ad125b854735c81b5782a65b5b006c7c991e28688b6dd8e5998f432976b9223c
- MD5 0498cfb8aae1383c049e8ccdd85f3abf
- SHA1 c5fbfcc70b441e91a5ecd23295c745aaf076aa4d
- SHA512 113f19bf726f79473ae2b4406a76676ec0bc4709a26f374aaa3bbd9d0b5790ee4fdd8ebe1a3ab68995973923ae33df7c1c6798e93bf060643c14acfabd4e9302
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_up_18.svg
- Size 979B
- SHA256 4b10fc416763ad7b65a6d6fb3c0016505ec5aaa7a117021a26e4dd6d11fe7d1d
- MD5 30c9bd1aee3794fd46bc99fc2a359212
- SHA1 9817640da0b98babc461d277a39b323dc9a76cd3
- SHA512 bae367b7555f5f7f677abbad1dd548225c2580ffe21bcae5022f8eecf8c97cfe8f7813fd86c31a7f9052c174610ae9d2ae21ac22b381701975492e2386f67f94
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-right-pressed.gif
- Size 56B
- SHA256 d4817aa5497628e7c77e6b606107042bbba3130888c5f47a375e6179be789fbb
- MD5 e3c4dd21a9171fd39d208efa09bf7883
- SHA1 9438e360f578e12c0e0e8ed28e2c125c1cefee16
- SHA512 2146aa8ab60c48acff43ae8c33c5da4c2586f20a39f8f1308aefb6f833b758ad7158bd5e9a386e45feba446f33855d393857b557fe8ba6fe52364e7a7af3be9b
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\ui-strings.js
- Size 3KB
- SHA256 ee0352f75df1009fa6f5eaf323a1ed55c127cc679ac6b9de70b1b3f8dc9ece76
- MD5 0d3a12fd3f68decc694da04b57e61d8c
- SHA1 f73d4d591f6ef0b2b04fc90d2e840329f7590743
- SHA512 2c58a879d4022b441056c85c301ce26401da5f7bc9619debd35fa3bd98b5f1cab8f21e2ae5a177865c64e741dae18f39f99fac1cf00c468ba0e281037d5e883c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js
- Size 1KB
- SHA256 bf9b3f1f9a3a163d41b1b20a2c410355e6ee72ae97725a7bad97ad23993b0b5f
- MD5 68b6f0644d50595a97c9fd60b8d8e697
- SHA1 a4d0edf9264ce1922dc419c7f3b3cedb2814bea7
- SHA512 d1a26cc27c302f06419abf97507c0a4d06729aeadab615acaaac0c3fcec6d7715e10642121a4d773ad3d5f613030728e49fb3d07303fad05f7a342352ebad003
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\ui-strings.js
- Size 1KB
- SHA256 a6f6e59f677587238a2b472d2f214b1c95d61d86a7973cdd89a61e2c05ca7594
- MD5 5f3c20c13de3ac54a574e3dfec50a560
- SHA1 ff983979d46433ed43e738f5c34c5340083cca11
- SHA512 4caa9867ce2b6bb9abe419a9306d1e417a2da05d5af5624bd92f433872338f39d5b88cbb4d94efc34ff29ced991cb38ac531ff6b6bcd9f899bc7061c906f228a
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover.png
- Size 388B
- SHA256 8de76ee7eb6b32c307d4a46a43ac55bc15b917e2a24d36c3d001878a97fd39d6
- MD5 65c9f3fb24b80d8c470d518f901b9c60
- SHA1 b9521c39944357d4b55b91f9f3739575d1f3bef1
- SHA512 6572d65abd587055a69980558b2568266ff76555faadf3ddc93fa65bdd7a009a2fbca10f37f44c27ae889d3de99a3673c2b9ba6e6456242e951703fa32d9c636
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\ui-strings.js
- Size 1KB
- SHA256 d5343776747d802d64faedd9954d2a4bf555a6cd85396c55c39a8fce4c5353a6
- MD5 a778c47dd8521d6a12093b3e97ed8474
- SHA1 2099d940cc672373884e1c622bbb606e9e9438b9
- SHA512 7c9c9b406c1b79b3298e975abb3f64927b6beb9e8784b75927e19ba649936c19f04d958d07499a5d5c52049cf2d3600e32f6f437c98b2946a977ca82c71e7224
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\ui-strings.js
- Size 1KB
- SHA256 4cf9816ed1062189ff0c8d427fba5e912cc68fc9af76cf7f08fd255977de3b33
- MD5 dd24e91615f1963a5c64bc9878a0a8d5
- SHA1 407ece3322d57d16a448b5522d4f29229f80b8b1
- SHA512 a88d5e6fcfd998b0abe79b5b314f3f83f424be9447dca01e1a64a3e7313eb247baa894c10c5758c6788cad27582c09207d00d2e7bc41515e7f1751e05aa812ba
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
- Size 683B
- SHA256 d9de646d51650572b66a6cf8a52ad1efd46b7a47830fa7972da0bc05baa2fad0
- MD5 3f7323acc829bc8b3799148d439b3d47
- SHA1 3d3c540c4080462a8013d6db9383ad69606779e8
- SHA512 09e2a175dd874ac369331fbfd863be20c9ecc005bfd6c7eeadac071804653265e4f7195d70058f2f73951a6a6e202fc96930f2ce71c2d815b228edf01729b559
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\ui-strings.js
- Size 1KB
- SHA256 655a3ef0465a9f30fddf25f4dde0c19a05c6f9069b83961800c1944165955273
- MD5 fb4aa89fb89bf94d0590a3174d1193ff
- SHA1 c3812f2105099071c24141a994a9d5087199dbf7
- SHA512 a494c0d9faf3defa9ff320421d0c00e4e39845f7e998c6a06c50b5e7edbb1ed7a948dda23ace06a3433843615553d2357f1cb04acb4ad1155ec43f1d07511524
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png
- Size 1KB
- SHA256 ca17d6cc1f7ab317c34a7cb767ad017163e71726ac648518679c6b1c59fa86dc
- MD5 7ab2ac51d33778dac850c5dd8b4ba45d
- SHA1 b3f47f20c438aa488fe835e0145c014853ee48aa
- SHA512 c14ac0ad209625e0acb2ca9e0afc5f6c98901b01f92b675d073b72929455f47ccf29cbfdaa248c602b02fc2bce484c56753b1a54e66f6ce9df2ea57bed88962b
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\ui-strings.js
- Size 1KB
- SHA256 bc9df2774317cdca8e5a702f249a6994fa3b63852e7749124e82ef1f37b89aa6
- MD5 07bcf4e882ae521ec6ddfd0bb2a608db
- SHA1 88e2ab25dec6ba9fedced9bbd21da03639da9409
- SHA512 ceafee63fb03e94b418bd87c6af91a53c9bef53b86eddb51a7aee77d8ad5e6654045da12c3c28f3ab4486d2f6f135f7f834790991037708b0301085f62e22fa7
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\ui-strings.js
- Size 1KB
- SHA256 8267479623714339b61159b2f8235b15a38ccc1199eff859e5dc13359f8711c3
- MD5 0ec670fd70f5e89c3d2727df9f2a5398
- SHA1 d19c88c8e11361d4f29719518b8543e0ecf5ff09
- SHA512 a429234afdc29df1276238d3e329299a6fb5b1ef6044429c1acd8abb95c0b76a14836b47805c5d464cfc95978f5e3b10eceae6c26a2964e2c352fafe1d7dd6f8
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png
- Size 445B
- SHA256 4eae979bb805992739f77e351706e745076ed932d3ef54dd47ba119c4c2fb5c6
- MD5 2a78f84427d1d591409740722e60d793
- SHA1 304f17d9c56e79b95f6c337dab88709d4f9b61f0
- SHA512 d687c646bba8b801511a17b756f61a1209ea94938940fbe46d9e4893f14606f9e1e5ff468ba4a77474603f5cdbe0cb9df3d24767e5c9ac81a0b373dcf4a4f3ac
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png
- Size 611B
- SHA256 4049b739e6322c7d7caa241ac41c8e0b1f2893957204a910c9708c7731a7a8b5
- MD5 c7fc95def1d53bd3e747248ecbd3cd5e
- SHA1 1b251f02465f9c7dce91aac5aa0679a3c34318e8
- SHA512 f4b90435a3b250c1d3dc8df9bb4d331dfe9b1c0212eeb1768073afb81b3915fe61a7c4af151c8090565f778dbdf1f4fad7b5f545c9a21b7782cd7671be2ac96e
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\ui-strings.js
- Size 1KB
- SHA256 c960c819e997c1c9d080235a5e24e65059b63cf66b95ff3da9a44773ebf81c1b
- MD5 1ea3b76135bb4a589027d6243075a936
- SHA1 2951fdafcb862ef53fcf213572368bd5e08094ad
- SHA512 3c10075e71d2e44535e19c8660bee7071a110d07dbef67ccc4cc94c45f93afd72f8ce6b24be31e6193549823b7db204e20950e5c1a075ae159c39682db295d27
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected]
- Size 162B
- SHA256 7b3bae54e7a2931a1957c1ca23189cdf913f567e92af15089f033b99e33351f1
- MD5 6cbbe3240a203b0ff387d9bbdadd49ef
- SHA1 2c65f6ea9acd8d164ece87edf2f142942d8cdb42
- SHA512 cdd8e32fdf610a0c00f7e8093c98d421f6c60bb75be67fe0a22ca1b5144351526a2b56ffd955f350039e4dca823e45a3f1f4595c3f9f209b3de28cab972cd140
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line_2x.png
- Size 550B
- SHA256 25778f162c4243167f8eaa876f1b0619e67afc158de7805600471a563ec5e8b7
- MD5 b513ae819f7d8d10fa4f6cbfdf055b22
- SHA1 b4228971cceadd4a698f3c206d8f4bc24a37f991
- SHA512 c11266406d79494f7d74f8f8a5f955e2bad14b8924877e882fb3e7cc7442998cf6e7a9be3aa7f1a945af8bb2add9dfcdec0ef54239f6ee80748d77444dafe6fe
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ui-strings.js
- Size 1KB
- SHA256 82a1cc52037ccd1ee4a73cc41b86ef4c9b45db28025d56105566bbc9f06bc41f
- MD5 b17a6a8826832fc2e1098d0286242861
- SHA1 8ce2bb5944d61be2b628fc80ebabc769768e0b48
- SHA512 688757cebb6aaf1a9948ce1dd30318ac2b7afb7a47938e6eecf1bbbc1be058ba78744c208d71a9747ae514242b09322489ad314119cf612a7e4a717907521962
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\ui-strings.js
- Size 857B
- SHA256 088d391d696ec15140e7b4dbe6fe17e95296af9d09c7eeff17a0a9c241925b89
- MD5 a3f07671642038caece41ff2a52d8673
- SHA1 53442624b01b79a3729a23d4f12efc8dae4b1002
- SHA512 5d1ab4b072eec924d13d760da6aa958cc81fa58cfec3de8ff239d131d37b31cdd547eac0fa5ab34c060f0f28a2295e071a1a9573815541c5b92cf0c63f11bdb7
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\ui-strings.js
- Size 856B
- SHA256 ab9ac8d62fd064748c921e6bd4c123f5cc8910a384d1804bec33ffe27da27c4c
- MD5 74ca2c01b07af0dda4bb39ac330fc49c
- SHA1 7cc7781cca7798ce0940fe9be999e85f8b5064e1
- SHA512 cd71201d364c7cfc9d317f091a9dc318d77bdc7340ec4abceee2fa23e3f58cfb1a8f45b5216f5ebb40b3738fef28eeb37717b2508aa1369316da6b7c82c510fa
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js
- Size 1KB
- SHA256 e27e5eb93a24a2d866e30bf027e4f0c3da9fae8968cf5eb69446e7f668356164
- MD5 df3b4d35decc08d05ef8ee0644ab7274
- SHA1 6b0381b9ee40dc8470a63218e5cc5feb579f7334
- SHA512 257c770416a94f5b79ed837fa0f5e7926cede3ce06c1a9b819c1ca77c645f37bd366564cb028b0ba6afc5444aa5ac774c3af36cd7c108164d1000254cf85c94a
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main-selector.css
- Size 802B
- SHA256 359f38eef400e2fa3924a3258652e74ee19cd46cb92e47bce91f1194fce25e9e
- MD5 651bcf535ed50ffa7724c8751bec1a66
- SHA1 5758c4862740517ba28026c298d1b3a61f43716d
- SHA512 492b73f1622e8a1a064141a2edbac9fb29e5f604b629b063fc7251289d237e50721e1295b4f3450322fe72f01b57561a79f0ad4b3a20290cf3214ccf0204d372
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png
- Size 179B
- SHA256 5e06bfa9ebccfa3d8759270620b6860f0b92be9d69ef7d7802b78ee5b5f07f96
- MD5 bec4473fc43b77e28e60f89da4e29c00
- SHA1 d5dbc7c6642a8a23da14f952a0f64fe874e8191b
- SHA512 ff2c101c1172e64481be5e98b2216d5eba93b81210a1a67adecfe05bcf37c3d965c06b368ddc1ffb7e4187cda0373720f6a27476f036a41517762d5cb3729aea
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png
- Size 703B
- SHA256 4985216f1f370fff03c45d4a711c18b3f49165f8278e6cfc231bb38b920095a7
- MD5 39e7048d412b94bb2dad145a2daa5875
- SHA1 08778bbd84d9411f2e531867dffe45fee5d60d24
- SHA512 65803d69def3517f0021a291748b55cb5bb2e8437732e6cb9b99b1f778f766fbff2c484b664d16ccbedcd51c14f89e99cd5f977cf97d680eca78a9d4f8b87fb0
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\ui-strings.js
- Size 823B
- SHA256 4ecb5e390829b5b11dd02db2f22ac1349e32a24e5bd3a8489f6fb5fb0f07eeb6
- MD5 92f1f77de0ce17e9486d53787f69618e
- SHA1 41198fdd6a18321c15c3d4647962e687fc036af6
- SHA512 b389c8364936fbb96a407fb1a848254fd8b7bcbde05637ac1acfb48ba0b30e887dd44b2447e1e3eb75a902241d67571584a819927cc8d0a91d325f5df79f12ce
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ui-strings.js
- Size 1KB
- SHA256 3b17f8b83bec3e72acd0d014f58e7de206106a7644bf3293f93c7456ced47419
- MD5 72542b122d453927f3d6c59552165606
- SHA1 6e2b7f049b60f10edcdec06f357114448c0896f8
- SHA512 25eade5c88cc35325978ba2e103050608fed4330a1677280eb2e0445946a3367d26796ca1233aa6d7ec4c87f04faf7706d82c72b3f3485d80c18e088813f7a1f
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\dd_arrow_small.png
- Size 289B
- SHA256 6559f403524ea6ef9bf2e1d0bb66d1af8152920fb002ec2c4ced993083124a88
- MD5 3d55e1e012d3824e53e84d404a6e2f2e
- SHA1 9983296698d4e2736faf1c529e8d27f8071d7939
- SHA512 ec75d4dea30bf7567b2f6e30ffed408815c57680a38659f6055d770c85393d8a5678d38a066ceb7fd0ff9c5ef49cf9fd73d7e8eae5a9a83360a41ca74343f576
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js
- Size 924B
- SHA256 ce7c16adff608d624a412164fdc692305fb461f4b14f9167e6efa78dbbad12ba
- MD5 421cd12b43e660f10da31bee36e85f4b
- SHA1 b568bb931d5bf4b5805d20fc339b06f9b3763c9d
- SHA512 f56bf5a7a713cbf018203c24a7f9dd426a2cf018cb3ddf9e27f3a7765be3571339421fa5a2cc68f677eb4929a2a2835238a723db4de07bb0634e3f151878ac86
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\ui-strings.js
- Size 931B
- SHA256 899ad5e0b3501d7e00d2f3bd3c7729b4223839e8629c61328db0f818ba0870c9
- MD5 7d8302df4582de342a31d0335e979ae7
- SHA1 7a3e918e23dc8002dfbe1695f8e8fd52db995d1f
- SHA512 cbc23b3285f6d8d72221d0fc05ff59336402005e7d3f50d66249ef6076648ec2e22d33ed64f5436767c123f59d37dae45270a259153ed98b885f9c43ec9bc2aa
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\ui-strings.js
- Size 1KB
- SHA256 7037318dbcb8809fd3d03ab0293d58666df18363f0144ef65b738ca3fbe028f0
- MD5 0900039f6502c5c4418f5b712f0dc94e
- SHA1 cb39e28be0988298003a966ac208c54f83a6ae27
- SHA512 be9fc36c81963737569c65e4f295f347585bcec88b4fa6ef9da1478f4e0f947b64b8ccaaffb816a74216f713060ae0a56f58c3bea1d12b16bb8488a7663db391
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\ui-strings.js
- Size 1KB
- SHA256 5c03e31975b96b3d151d9e034b884cab9c6fb29576d2b5653c375fc5661b6dd1
- MD5 35d5c7b80ed270a94872c0e56a6c59c6
- SHA1 bbc4ed04ea6c922213d7cc19c62c3c4cd23b7113
- SHA512 57ec341f6ff49f24516e117d5c0b119ba4c62dc0537cfcaa15bbba248729c06d29ca224462bb331c44ff1b3abd724df86d0b2ec473ae9f5d54e31ae2002e8bdd
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\ui-strings.js
- Size 855B
- SHA256 c9fdf06266cf9e6d61f7989471abe569239a93cc2c0f65a7c596a81af8d6a67f
- MD5 29dbb24810bdd7f802c1165f8bc3a714
- SHA1 9ed5ed2ea58cb6d9196e8d88fccdd8f0d522ea47
- SHA512 3802320bcf7b20a6656460456d5b03ac4f85e4572d7530518dcf99f28162964adc211c5adcfb7ace603b6734271581cea26c9e85821b88b1915e13780a19ec24
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-il\ui-strings.js
- Size 849B
- SHA256 e33edcde1654c47b3f834797623932ff5dd99a4331b255b60452d69d61ccfb4c
- MD5 7a232b079f30771ada44ab6a1843ec14
- SHA1 72349db2853443af021d538be9417fe32369d2ab
- SHA512 431073f497196ad03ba92a8087aa6c50717ae137b05aba341cd8f7ec1705b46f2878b30455c10d7339f89ef16022ca5d054b0f96e5956ef0590121ad8e1a6638
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\ui-strings.js
- Size 851B
- SHA256 d70a13e9b9e9f4026679200872160d667979bd0ae57e6527d44090e49bbc2c83
- MD5 b54b9c5d611b062aea9d8ec0d192335d
- SHA1 a6a96602b80181ef494a0da49dacae1c44f7c739
- SHA512 e56e4a0dba26c3bd824bcd397d495249466a3732bbe1466f9ed1c23ec3a25d79e44e360fb5ee5a229fb24d6961ac32a2a57d0a29fe669e767bd33b956f57ebf5
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ru-ru\ui-strings.js
- Size 852B
- SHA256 b3b87c3ad568de5a1f07702392e3bfc76f41a47b2fa1d710198406c3c5172697
- MD5 3b8883ab58438b245c89bc76ee848752
- SHA1 7b01b457344fcf92362d14247f2c389ed0c89b6c
- SHA512 200a52dd5e9334f2c768fb2d152a82cfd551c0991eada79ee92ae41e8beb82a1eac2d90fdac2d9741afe0b7edcbe046cb92a6cf339d25709b53d51f5feb55b1c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\ui-strings.js
- Size 1KB
- SHA256 dfd68e26d32c27e8c7d096cd558b12da3228019525baaa2d4b32030339fb0b6a
- MD5 edbd91ead174c60fdacb765349ea4fcf
- SHA1 e55660206658be80e2033a93abd8854653246eea
- SHA512 9c664370c6c102a0e6992f2fe711e7fe7f6ac732a8562bcc1839a0d99d828e4ab0b3dc70f33f3cba444d04161d0df13b70e72b9079c5aabc7a85543168d58854
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js
- Size 1KB
- SHA256 d0a34414103960973357a239952bb0fab5f988ccda1b67ff8e6864afcd806272
- MD5 ffaab524b0c94fd06a44c1b5b683e0dc
- SHA1 17dcce5e4d3b9f718c902863652cb67e060e2f3e
- SHA512 a7ecbd3e9656cb0fc1304b4b86980e97680c73b673c4284bbca08c4a3f3ade0699a7de61f0905aee9d521da4beaed61d3ec943090ecc44833118f1f5a29318ab
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sv-se\ui-strings.js
- Size 1KB
- SHA256 e3f604ce27fb93d417b9e8a4a5f10f6fd17b59a76aad9754ea0cc5c56b31687a
- MD5 5af99e838bada8e34b660d7fcecae2bf
- SHA1 ead4e402f4696ede69adb3e4cd694e7d52925844
- SHA512 e69f6f12a51382491b4bec6f19260df249dc6dd9a33fc590a90a055baa5f6dcc80894e2c65ecc7dd0d10040c90740dcfcd2f98dbd1f2fbd94c34941897f6ecd9
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_thumbnailview_18.svg
- Size 1KB
- SHA256 ad47fd9e87159d651a53b3dfba3ef200684a9ed88c2528b62e18f3881fe203b0
- MD5 9b4c8a5e36d3be7e2c4b1d75ded8c8a1
- SHA1 1f884298931bc1126e693e30955855f19447d508
- SHA512 e1acc0b10c92c2895fc916fc8feead869e04315e5e6e279f8e61b344545103b4c9ff808c9ca2121d1b013879071364f677da128caeba89bf918ec2791e5ed094
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
- Size 1KB
- SHA256 91ed5badd0d99f45c65c0ccdec04fc59fffb1f6d055a4d2722dccde82a6bb73b
- MD5 45ad813c887294a1c5c88358f6e6fd12
- SHA1 45266d0bda31888b67b10c601d303caca8786d30
- SHA512 b06ab5889fdf50735ff0c3cfcac3e526b9f32d694ac631e7c2a06eceff357f17e92540df5f84426f8e8f75726c1e7df3592f1620728b70a4b5290c9e49e377f8
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_listview_18.svg
- Size 1KB
- SHA256 7f4da80ffddd6aa6f53fc5e1280294406187d5f5f3506d4664f4f31cba4f5f1e
- MD5 20ab4748ba537536027813d9dbacaefb
- SHA1 1b69f0c6279381ecda8f6f94b0eed0f2c92b907e
- SHA512 e2844bf2ab0ea8b7f2e756464d19dc95e1d61ebdb3c5dfaa17d4274c8b4cd55f6e3a768ec2212eb4227c8d86fd6943656067c799ec3c189910f95d2ee629620a
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adc_logo.png
- Size 1KB
- SHA256 c0601bc1bac97e69da3ef3e2898aafe64aec5ae4f3ccbdb7649471f76da4ca0e
- MD5 5c4cbc56377969e41dcf39d60690feeb
- SHA1 a20120d0d043af4d3b6a72db517ab8a623b3febc
- SHA512 4accc91aeb47949f1137ac69a0740a25c957853f59ff8d18077e64b1a3262488b71fc4bd45714075a0652328e1a49a602c7950b86edabbbd7e5abbd9000b705f
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png
- Size 2KB
- SHA256 494032a3293df271c7cc5d26a5753acffc5f6df811d024e9b573f2fa380f3591
- MD5 a7a19c86ac01e03111c30032ba417b55
- SHA1 fd7f42ef37d82cf1704b65762a8bc6b4a868234d
- SHA512 728d4755dd7d21c5ca285906d5f043728fd089de42d2fd04beb514563224104f7672e5f5144e4ed68770b933dd1069d76b26d140eb692d83d907176330f3f6dd
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png
- Size 2KB
- SHA256 96497e49c11ebeb0f73bc01b033b7f45cd9f8eee478176e11b1c7342efa63569
- MD5 f2f1d5a683617b2bdb6cb0b1eae67135
- SHA1 3e0dda160b0f8b963dde8036b45aabab5d86504f
- SHA512 cc9688ee19a6391296abbae9fb1422a6d72d87b7abe8552e860eeb092f8cf7e6864a7f06dae6a60784b77353c38103abd3632492f8b33b7b3d900531cdb673b2
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png
- Size 385B
- SHA256 e743d6195ff2f42282e101f9471874e8df79dc05a69ca20abf22015d48d28c6c
- MD5 4eefd60f439096ed98b6d8a585da12ef
- SHA1 75cb70498807b0c823cac760e00652842c1a63c3
- SHA512 78241e2336f4ee826719d5adc70543db0f0767a1660f723ddfce72c170322a13c0f3c547eaea6b6cfc47cdf6d8e5edcaff4bd003cbf3eb9d3435bec5158fb8d2
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png
- Size 1003B
- SHA256 bd66e8f62d34f70917102405af895c0b07b79c13fd2d1ea65ebfba3bd4853aeb
- MD5 5991993dd41d6d2b062d58bb70971e0c
- SHA1 1a75ce12ef1c4cb6a85225d0bf4f68d4a3edfce5
- SHA512 75511589b1937aca668348061728734718d02065ae76446b61e3292834709e3b66f2a453717fd593a8fa1db92ad7b97af03f7d2e7f5538716582ae7d8c11e09b
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png
- Size 2KB
- SHA256 fde09d85ac7ec84dc0b5f2bf1c1f935b80a3e45dd9257af499d412302602f310
- MD5 6018a4862e3cc6b434d517a47858a2bf
- SHA1 23769e9ae485bb2c35630db9a6ecc8a40c2207cf
- SHA512 4fae17ef027649315cbc73ea47a2fbdd8c8c05b9d818af5b41439e9e5fd81d62ce13f6ad125a2817d0bb4b24a831358803c53003628520cb9c2a8376ac8e1aa3
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png
- Size 826B
- SHA256 3719dc770c1dc78bf2dfa4053224bb68d58f81c8c18c44e3d312e298f4746324
- MD5 b54fcc17e63f9858a2f50c46d3dbe6c7
- SHA1 ae2d07bae4a55aa5fe408cbb300fa658c08befbe
- SHA512 407cb72e8cf4f3c6c1701847fc295623ca5ba6e19ddbf9f7e3d3e7746cb7afc0fe1a96b95dbbbed34548caf8383c76f1c4bf624f8a02c252b6d0f2279bb04b83
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\ui-strings.js
- Size 840B
- SHA256 16d0edc8b7ad7705b23a14058f366ff1c0dfa16a0ad14f741924c308754cf8d1
- MD5 cf69901e6d4609009dff8be5b3045c96
- SHA1 712afbf4bdf24b6fa059f0fcd837449d75432800
- SHA512 84b63e071f56e8e406fe361473dfd6eb17daec1809eed425b1b977f0135d6a78a3375c9bd1a65daf1ac7977f712b63ed735eac8ebc91e55c1a3f366e288a9ed6
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_checkbox_unselected_18.svg
- Size 952B
- SHA256 f438a4e713df6a982afbe2eec993cd582edc37a876fee88e1ddabb478f2b5ee0
- MD5 8c8fd1cfdc60f513bf20132a1d5aeea2
- SHA1 40167e542ddfd848fd138e2914dbb7f116a8f99f
- SHA512 e5a985404619bebfb615d4b5378942b56089b40170e4072c61eb9ddf722639941e820f039437b59cd3859944b3e06ed72ee49e879522e81fd9d49b56c8e40d35
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close2x.png
- Size 631B
- SHA256 68df674391ddb32170020e5b55b8df9ac1bb5274419dbf8748ce53efb18584cf
- MD5 5e0d423694dc87169e1124f26d755117
- SHA1 340b47ffc7ffe45c30ce927f1c839d01600f6161
- SHA512 17ace592b7b00dd530d923711160c39417b6c6412c3528cecb002fc065a16dc439555f61e4f6de7ac86291cd9cac5f5ea8411bec8ffe043faba887026fd2ec77
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js
- Size 1KB
- SHA256 5bc633d52bc4345c9cc4ea7cf49422a85a9fe401faf3239ef72b53aa0dd667ee
- MD5 8ab4b211dc3d2947d2466033f6d524f7
- SHA1 7c457aa6cb3b704da3c977bbcf3953c3c1a7a7bb
- SHA512 0b7e9cda1a82a15fc9492a35808bd1ea43966cf5e55d84b9831f79d64f36a66583a14f0ba95eb12098bf9df6a95eef0bec6606aba1cf56bdee0e046aa60f8d5f
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\close-2.svg
- Size 490B
- SHA256 2a673f683c99c311b1f2dd2d94e1545ebbbdab96daa5a16a334194f7aca7a603
- MD5 186129784bd76837125350e15ff96118
- SHA1 4b974a13b5473cfbf60edfb66b201a364d38960f
- SHA512 6ed19c507b1dc4d02176c83d2fbd1c0d28c0f4c3370e083b7394e77eab597a4f486195af1f460b140eacb8a7bc09c27127113c874e77fd7b423b5426da507f73
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\close.svg
- Size 1KB
- SHA256 03e98670a1d9049b8e1f02c4fdd449d098465f7578ee0eebfaf3f138a78301ae
- MD5 2518c2304a390e60d20b53b101fc0056
- SHA1 aae24d58011859ff6986508882dd7eecaaa7f604
- SHA512 b7457acf824d68e7728088668cd8d44e06566dc71d156db7e9480b957305f2268778907a8e93e4e2d1937b3c3cbfeeb327399cd7f33a60274d91efab2ec3f534
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Extensions\external_extensions.json
- Size 99B
- SHA256 4b298058e1d5fd3f2fa20ead21773912a5dc38da3c0da0bbc7de1adfb6011f1c
- MD5 fa8715078d45101200a6e2bf7321aa04
- SHA1 d991c16949bd5e85e768385440e18d493ce3aa46
- SHA512 6edf7ff286dc9038e790e27b600abadeccf74542ce91196b8ee6c4ac9308529cbd7dc65c82f82021f01863e2c08f846621e1930768e6f3590b2315c72298fba1
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Trust Protection Lists\manifest.json.DATA
- Size 132B
- SHA256 115bad14f1c9f2c027a84de21b107015722cb76be8d0abf3760ad8e00d6c24a5
- MD5 e7633aa6a479bbbe82dbe794126bbeca
- SHA1 1df5935d4cd349ac78102af001ced100f31449b1
- SHA512 a191f83247bb1ffc8f4fac4531427cc5546ef7b9991b65bd361be41382708cacbd56c15cec16495909419f9b2026c6e7048be9256d9c755f5f5ca97484f794a0
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Trust Protection Lists\Mu\Cryptomining
- Size 1KB
- SHA256 45eb891154164864eaa29c5e99f304dfd3fff33db977755c5a7add6526b577a9
- MD5 64bc13a1e8beb951a6c890a812434054
- SHA1 904114a3fec55820899bb5bb278f2e97ed0c48e1
- SHA512 121c0b474d3831d004dec8fc472784cc9f9b49d4639fc6a43a7c5f74b2a0256fc01374128501ba4233dc93e5c091cc1278900ca497de108929654d84e58b3f95
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Trust Protection Lists\Mu\Fingerprinting
- Size 1KB
- SHA256 9f22bcaca2c0d810d0bb367eab8a1e3786828e3b3d2a537b88e8ce5cdd947c9f
- MD5 54192418fc28772e40477dd7ef0ef3ef
- SHA1 68d00eddd58cb000c5b47ed667ffcbf812dbea70
- SHA512 9d2b6a646461990a48d84473cb68443bb81def172de7fbf451abe477cdda1187afe0e74ae8a31e0bdc9264816cdc4fb37ea778f6e4bd8521f39d893a3a8d7d60
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Trust Protection Lists\Mu\Other
- Size 34B
- SHA256 eb142b0cae0baa72a767ebc0823d1be94e14c5bfc52d8e417fc4302fceb6240c
- MD5 0b91f1d54f932dc6382dc69f197900cf
- SHA1 3173532552077d0d796c3628ac35c76343dc3a04
- SHA512 f5c17634c4abc78cd6dce4b04d0e24bb8b7d5cf2d3a7702776b2b221b99ab0d760d119c2d2a7b95d5663a415435d3fabfe492ffefd7388c8f47d9e160329b18f
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Trust Protection Lists\Mu\TransparentAdvertisers
- Size 105B
- SHA256 523c41464ee47d61350e15bc091bc970d73ae2d00bfe7a88bc7fe00ae6202c75
- MD5 d1950d80f172e80f1c48685c51835807
- SHA1 ae9fb8e72137c1729ffb559aa5f541bff78661c9
- SHA512 a6af7912278d814025fd2825a16943917461c881a8f2ff1972497a3a9f6998e349c5e375d69bc8697ae7197054083e0988198c4fc57cab3184f98f82a07a1a1d
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Trust Protection Lists\Sigma\Cryptomining
- Size 32B
- SHA256 66687aadf862bd776c8fc18b8e9f8e20089714856ee233b3902a591d0d5f2925
- MD5 70bc8f4b72a86921468bf8e8441dce51
- SHA1 de8a847bff8c343d69b853a215e6ee775ef2ef96
- SHA512 5046adc1dba838867b2bbbfdd0c3423e58b57970b5267a90f57960924a87f1960a6a85eaa642dac835424b5d7c8d637c00408c7a73da672b7f498521420b6dd3
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Trust Protection Lists\Sigma\Fingerprinting
- Size 172B
- SHA256 58f218aeb259309eeb545345a8f5c715987967b0ec724806d448394da578d0b0
- MD5 5363c96604a0db55e0fafc787385e36b
- SHA1 e2ba623eec3a2d412268dbfdac05749a4f5cb0f3
- SHA512 0a964dd34fb0e3e83aede78822ea1269b7731cd6720560caa02c278293f6b66099dee1f32ff26cf45f6c636936973e5265697bbbb698a80e8c6d1b73d75e6179
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_proxy\beta.identity_helper.exe.manifest
- Size 1KB
- SHA256 ee2c0671bfe6befd9a3575be6511608057b044a870a40244feb39b121db5818a
- MD5 97ece9455ee886dcad0b5ba56b1d8e8f
- SHA1 0917cf1ecab906ffe543cd38f958a728b82d64f6
- SHA512 a8780fa48c3e6f44ae5fa77dd418ab0571ccda0a1b8191c58357103ca4993a57c877bcad0884d16bdccaa1196a511f440df16063affb9a89dd4476deb55b27f4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_proxy\resources.pri
- Size 3KB
- SHA256 72ec3570721e1cd0ad873a1c8c7ed33ce0e5e849551dfb84aa781082657160e9
- MD5 5550c996b73e84bad5b392cb46f7d706
- SHA1 cbdfefcf36e404542b168da200efc4ad5330b2b8
- SHA512 da9bbc2dd7bd8b1d11738122433d23bcb7334ddb50da665ce19134fdcb36f2015d23237f9c371aba0a53ceac2af833eaeaf6dea30ec6ba34599e5878f27b51ad
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\AdSelectionAttestationsPreloaded\manifest.json
- Size 128B
- SHA256 38723a2e5e8a17aa7950dc008209944e898f69a7bd10a23c839d341e935fd5ca
- MD5 f09f35a5637839458e462e6350ecbce4
- SHA1 0ae4f711ef5d6e9d26c611fd2c8c8ac45ecbf9e7
- SHA512 ab942f526272e456ed68a979f50202905ca903a141ed98443567b11ef0bf25a552d639051a01be58558122c58e3de07d749ee59ded36acf0c55cd91924d6ba11
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Sigma\Advertising
- Size 2KB
- SHA256 f2d2bd16382d3b140d16662729b5720cdef6543d68f350dbe112ef18263c6bd9
- MD5 2f45a26df703a0703d1a80fa8a86dabe
- SHA1 93708c58e054544727be37ac0e57182df1fd7bd3
- SHA512 35ccf89cb03e8de37fb3cdaa948a050a22dca5f0545638de715073342f5c2890e8064d1b586601582916e4da797eec9bcf1483ae8fa713d4f042058e87db985c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Sigma\Analytics
- Size 432B
- SHA256 1fe2373734955e60c172999142934b52e69ba7ab9039b3c18ea54082ba32afcd
- MD5 023fb285bf9850ccc10287a3a8db3603
- SHA1 7f07762fad599cd96c903e7f279ff06607db667a
- SHA512 18464264cdad2a1853715161bb0a38d2a85f5e62f223e3c278d3aa68345850edbafa3f5770b5bd83354991cab8b39837ca06bb3437b32097ebdf3eee5ad3a12f
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Sigma\Content
- Size 48B
- SHA256 17b0761f87b081d5cf10757ccc89f12be355c70e2e29df288b65b30710dcbcd1
- MD5 b203621a65475445e6fcdca717c667b5
- SHA1 c17fd92682ca5b304ac71074b558dda9e8eb4d66
- SHA512 ed68f5f49945dcd0d81dfebe2f2fd1fcfe016807d5c64ee0377d046efeb0a7fd9b4b9589b3df8a14194d51dcffbd89c8aaa072cea2ad4e7976bdf53528ea90cc
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Sigma\Other
- Size 91B
- SHA256 2795ec931b5b17c9e0e5e5adb2ce787d413ab0c2bb29cfbf554668fea090eeea
- MD5 67130d31b6048171a64ed87d36022a6e
- SHA1 3355b6761da0494a9c736fd492ffb13bcbbc83de
- SHA512 c4e61253d52c63b227943f42691201bf61321f7033c08888ca14d13c2587a3d97d40849f946e407df3a569aeee4f2aaa7ee44bb63b4d17694d31106e880f53fa
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\edge_game_assist\VERSION
- Size 10B
- SHA256 01d448afd928065458cf670b60f5a594d735af0172c8d67f22a81680132681ca
- MD5 a63c90cc3684ad8b0a2176a6a8fe9005
- SHA1 9694c4ebd673a5e2fd26e4b2e64f92e914ebd95f
- SHA512 19bd3cbb62b1937957a11cabd0d39860582b6928e77d0e0ea5ee7f3b2f8cacb3dea8ea0972651adc3245fd10926f2f31e80377196e4e6c7ee2bd74051e58bcba
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\dev.identity_helper.exe.manifest
- Size 1KB
- SHA256 a036842f845435a083749b3732f6956929ad0a253e3829bfa0564abeafa5e010
- MD5 8c2f9ea9337e630b2b4bac5f92ffc4fa
- SHA1 a0c4ecfaa2fe7805d869f06e14b0cfd75fe422b2
- SHA512 5a4827332d2cc8bf31d3fc1f1ae41d4f795edee35be0b2b51ca831671f341190dc5ae99a5cc915f2acb325bcbe5a69334ffe9badd8150e50d7243ce7171fd020
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat
- Size 270B
- SHA256 04bd11c311f0107c20d95e65d9a593ee5c92c7cb53507e10b680ece3de7add1c
- MD5 0c0753b0057a2f8db2ff040d916b016d
- SHA1 bb20f782ab94dda71ff84f162adb9d02cf3df34b
- SHA512 869cb0eb1c0d9a3d128f5dd7d49ca4691df77822c20db7d86b0cab49fca6089b413be7d26dbcc96050818d1d78b0a8796e7f7453522798d6467cf4d7d8381c33
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\122.0.2365.106.manifest
- Size 228B
- SHA256 fb678f67aea5293efa9930a41b828fdfb475dc2b427628588640e080884f0e45
- MD5 f4332cb4ea9179c3b4d5f039fe518947
- SHA1 12b445e0dbf65060bfc3dd1a0958f2524d48d324
- SHA512 d442a078daf7a151d437edb8a8e2b0dc3eba06818a318a38c6f0d926112496870802fb171cfffaba6f884c8fd5cc4ca615d1762e22e2d052151db9ac2740c512
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Trust Protection Lists\Sigma\Analytics.DATA
- Size 126B
- SHA256 ebc47d1683f1e8b6d506bf43f07f93e64fcb54ea8310a90211336139a80e706a
- MD5 91492f3350f4a1c513741f6aa8a96b5a
- SHA1 339820e6c5f6ba11a584e7c37c936e3778147a0a
- SHA512 d4bf12247a7396ffc0b16bd3b0094eb7cd3cd8558d961f77d9f1898dcf04e8559715f78cf6d80579c8dc2318631d1954a8a0599269ac5a4ea9b1331a3ab9a487
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Trust Protection Lists\Sigma\Advertising
- Size 997B
- SHA256 6418268f98c5af1b1546abbaf804ead2e50773df179d9551fcc01321d4de43a3
- MD5 3905c62201a248ec1c59ea0c0f117117
- SHA1 e340aa4e77d8080fec0b526b33aab32218c5029b
- SHA512 693d3fa78824a12f5708584c71d1ae3a8635b74501a5448268e5e13e6caa97c2a26dfd3fc82b3d9fef809b1aad822f2e3f9b187c8498ffe1c6a8cbe899826d69
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Trust Protection Lists\Sigma\Content
- Size 36B
- SHA256 6db65fd59fd356f6729140571b5bcd6bb3b83492a16e1bf0a3884442fc3c8a0e
- MD5 81684c2e68ade2cd4bf9f2e8a67dd4fe
- SHA1 8696cf0f4655636cc93c566c1be2dad311da646c
- SHA512 85531d8882578fcf9bcd90c2a24c5ca2fd6a49966f0d4a9b47e2017b21aca0d2c2b66905bd56c7dd40a0014f44997698ed06f03ea247be353fb1d12ec22cb658
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Trust Protection Lists\Sigma\Other
- Size 75B
- SHA256 367467f43d580c3c07040a78c7890ae4262dad4778878f9a49d5f652c81689a5
- MD5 6e36ba0fe61f7c6334305d61299c04cf
- SHA1 646aaf623a9b65f3054571ba8680342cf02b6225
- SHA512 ee5d694d66bb3ee0d55129c96c83116e7af28b6838854d110cafe9dcb530fc05ef8b97469d7fe0c864481298fba5008c97eb2b503e90b58b1e33f8856cb132d2
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Trust Protection Lists\Sigma\Social
- Size 3KB
- SHA256 e439e9bafeef51aed6b6a2f53cc9a1bb4e62c12d360c6d0fbcc1911ebfbe0c45
- MD5 ddccb48021436cd363ab21eb7171c3ff
- SHA1 b6f829658652241053ebb582743923244639a692
- SHA512 d9a9170f7683e641c07922afbb35612e9adf1bd6a13b9fbaea9b9df6d946d680e4e536bdf4318e94ca9321383ceb977f2b7e5b62e506af1065af0533e7e30981
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\WidevineCdm\manifest.json
- Size 1001B
- SHA256 2f33b022758805a3bfcb77f61472e4a4a12fadeaf344698757ad4b124a823473
- MD5 036c0c5b41328a203d5679ff965dd0cc
- SHA1 ec625e9a58edaddab81fec59b7818d2f8b636cd1
- SHA512 a04a62839c84607d309b4a69111392b481163af1163e66fa27ca8d1c6bb4d75a93f2cab5c212777f35ed24cbb560c318e7a39f6152fa1e39cc64562030fa07c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_proxy\internal.identity_helper.exe.manifest
- Size 1KB
- SHA256 68d63c6adfaa76b9608a3dd3c1708ef4b82ce3ac0021bbcdabd605c1a608b3fe
- MD5 9f2a664f76b8a4ccb6b27d1cc38bc066
- SHA1 f2970074313cfdf7ad4b1b497a197700631ae06a
- SHA512 55b0c68ab7a4655f10951acf8f9c471360a55665235f0e6b9ab21d5aba14b75d2164b1297b9635e897faeab72c24fa05c12e9da4183dcb61b5f4284cbc85ed37
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\AdSelectionAttestationsPreloaded\ad-selection-attestations.dat.DATA
- Size 63B
- SHA256 c7723fa1e0127975e49e62e753db53924c1bd84b8ac1ac08df78d09270f3d971
- MD5 65cecfb980d72fde57d175d6ec1c3f64
- SHA1 0b8bf9fc37ad802cefa6733ec62b09d5f43a1b75
- SHA512 a405dec5087e201200212d9b99c62298c3b126681b5d607f39e9356bcfbf5fe618c53d5c31d31903d5a1d76f7ef8225d8c6dca92df040c6cc7ca3393f25131dc
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\MEIPreload\manifest.json.DATA
- Size 238B
- SHA256 4be9668951428368983f9e78c4f352be61634b5aae887a12d0907b31c6d6babf
- MD5 4034db804ab2f325a46c8c3d1a6c2d73
- SHA1 5beebcc1796841c6bdbc985142b539144d4ec45d
- SHA512 fae7f08c2ad5562d09e3e480751ea97544b9d070cbd83b9a172471298d547275f2e3a41f86fa9025c3ef61f75594b8bbda0c44a4e6de261e9adb5c038c6483f9
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\CompatExceptions
- Size 689B
- SHA256 046e251c8d58574ca6362949021c1f74aa445a60c3b04840eb80f674477b1a1d
- MD5 a91b280e87a9586dfd346cc1ed01c453
- SHA1 b559d7ef3f423179c9b5c1245b6392576291cc06
- SHA512 30c1e4897375476d3576e7b14e1ae105687dece8f779f40259f342a99631c257290ceff2b62c1258d0f6d332c54f2a9400f6acfd3fd767df588e6ae9936a7756
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\Social
- Size 355B
- SHA256 a9347ccf02030f25db15a92405e0dd5de6e3743e4017c6d0a304b004707a2ff3
- MD5 ea331ac42de50273f00ee4b73fda90ad
- SHA1 84b5a89159d509644f5a93a0fc25d6b70902cddf
- SHA512 d320724f4e63c39195314d91469c2b24be23b950c50a95dc666dfa5d80a7b1a3248fa8615fd06820b1990714b3a9be7ac792f90032ff59675fd4c2c25c68f210
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Sigma\LICENSE
- Size 66B
- SHA256 efbb03b7a7f6fd3c29391d4d0281e1830a85caadd831c3f04716faca4107a42e
- MD5 402535c9f22ff836ea91dd12e8b8847b
- SHA1 707efc314ec536abed535cdb1b2414aba4713577
- SHA512 6c0e9557cf0fadf4db740e203df3d499f7247a472d9132b7e474420b142ae83e6cab592f93aa096d51c04f732098fa7355622e955b459f1c6d87bae8abc73264
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Sigma\Social
- Size 3KB
- SHA256 2b8406bed52e21233e0ef19ce7014ddd2a49b9dccfdbdd5f238b9d0a4d95993a
- MD5 107251685e64c2cc8943d95b89ca4d30
- SHA1 6ec521db1316ea1148854a8aa147b3e2d05f71f1
- SHA512 90b2e27ce1cc24dde1707ee3d4258627d35220f23a9b8c24d216a2997e743c7139cb9d08be75444fdc17e6acb5123a84fd7cbc362640d882445363f0b06f2012
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe.manifest
- Size 1KB
- SHA256 4740d289d0a31bc1fc00e255845b3d8ba7cec2d6d0ee92177d23aa293f9fca3a
- MD5 69016e6a597d194701476b8e04d4e028
- SHA1 71a24ddb0c5bbd321d3f09d7b322c3655fb5e129
- SHA512 a9399ea57f65c6569e2a9e9ebe9fa2da7184ec92a555549f39cbbe9dff15530ad526107a2a2304d822be37580a965c6ea4e88a46adebd8ff3af402d2c25321ae
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.sig
- Size 1KB
- SHA256 5efe288bf88e3a66ead387ee327d7f2ae6637fa507e14271cd1c30024279945e
- MD5 d8d0face111912e6dcc93f665bfa10ad
- SHA1 e171cc8b4abd73e2e6f9e0145e8e3d46e333133b
- SHA512 2bedc86a79225d3c23067a042a219976a670ee164222cbde077edc2bf5618181eb5e26edf86946e2797016c5a87f3534e47dc4ac76d40487354a701ef77aa51a
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\vk_swiftshader_icd.json
- Size 106B
- SHA256 34dbd6bf55d0d075d666181d9278b8387482a8b5804e44e1ddaafe6876dadc15
- MD5 f536fbf78e26387affb82ee89943b870
- SHA1 3ac8e44a9491c16bcd86dab6781acc4f7e1f76a7
- SHA512 d9ad640884f40495b4255bd221f0902ff64f84e3136053d03abee7ca417d32a1d72f24a75cb67bc50629e102bdb2f81c0bb087e0eb5cb82fa3d67c4fa5d92450
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\MSFT_PackageManagementSource.schema.mfl
- Size 1KB
- SHA256 1c55f2acd075736d1fccd0e7bca9292072d933e2811b8e042c172e9e7f112f39
- MD5 1fb20e4a02ba1ad84aca9d99fb1921cc
- SHA1 169ea6ad71a5c4f4d8312668259ffb793e6cac0d
- SHA512 3516ca18f6f5b64fdb2de80c950d114b2c5d979c24764cad4328411eca14c47c4758816bce45c3a691adaef50fdeeef64ca51a7ce603aa5ac11bd308a9166621
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\MSFT_PackageManagement.schema.mfl
- Size 1KB
- SHA256 424c38504d88d0f7b3691471d18b1a21141b9e31b1cee5dad278963613252480
- MD5 125863dbbbb069fd535aaf5f8b17bfbe
- SHA1 ba601b96a414c6e3dddc42e6a0608ecf099e6310
- SHA512 18e068cfb976f972322e12fe755aa37a3f44fe79e2da094042f22f1a3b0a6328033e05a625f4faa2a373c654751ed1094f9c04d9411e86888448e367ded915d6
- MD5 SHA1 SHA512
- Path C:\Program Files\7-Zip\7z.exe
- Size 549KB
- SHA256 1bd00b5a51df88d9f9fc4e3359af3a0b73cdef1fe4d1f903cdf712a15b0ea4ad
- MD5 6d17fd9a8ac00a6535b02deb2aba4732
- SHA1 424b4aab54c6331bf2f10c73e791f3bcc784fc81
- SHA512 c072a2f5d6f36759d8a1948350ee843a3a681b487c29dc15f58ec25f6fdab9cf8bd663edba1d325d5f484ec544c44dfe7aec7f2fee8ad1bb152084b8563ba1fa
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\am_MASCULINE.pak
- Size 18B
- SHA256 60daa3a5f7dbfa200f8c82840ecf5b42640b70f3b7218a4c6bbd67db542e75a4
- MD5 ff035bff2dcf972ee7dfd023455997ef
- SHA1 a770e927c71c77a0a9ba32e12cd7eae07148f0e7
- SHA512 b6814eb4bf32768b13c7a5dc04f7efb18d5fbb48f561505511567f7ef183a03b776a097aff26f098703766e1c97940c087e3e0a4f6e2ad60646ec9d3218c6aed
- MD5 SHA1 SHA512
- Path C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md
- Size 2KB
- SHA256 0c19ba9eeecab3cbbdf38da08c3fa0266f10ce8166e056715931efc543335eeb
- MD5 ddc4cb14453391bcb5f4d645b2916a6c
- SHA1 c4738d174c90c285e17bf51a9218256f45f96ea7
- SHA512 34a32b92ffb2945608439653b5ecacba49fd3312ba5487ba14796c75b07655f0d8f735453dac117d46d204d3f810126f8a189f82c015fa8bb6ea37d9b8e0e30f
- MD5 SHA1 SHA512
- Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
- Size 190B
- SHA256 07ec9bf950252d0254d4d778698c2e4173f36dbc3f57f51f34d1b85a07c2eab0
- MD5 c5b7a97bda04c48435a145f2d1f9bb42
- SHA1 bd94219a79987af3e4d4ce45b07edc2230aaf655
- SHA512 7eb1a26cf8ef725ba6d1934ca4802f70cc22539017334c1d7a6873afeea6236bcd643b52630f7fa9d8a9e692f718ba42cc704ed5f8df17757028be63c3efad80
- MD5 SHA1 SHA512
- Path C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif
- Size 153B
- SHA256 f1663cceeb67ba35c5a5cbf58b56050ddbe5ec5680ea9e55837b57524f29b876
- MD5 d13b5ffdeb538f15ee1d30f2788601d5
- SHA1 8dc4da8e4efca07472b08b618bc059dcbfd03efa
- SHA512 58e6b66d1e6a9858e3b2ff1c90333d804d80a98dad358bb666b0332013c0c0c7444d9cb7297eff3aeee7de66d01b3b180629f1b5258af19165abd5e013574b46
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml
- Size 744B
- SHA256 1b66520d471367f736d50c070a2e2bba8ad88ac58743394a764b888e9cb6f6be
- MD5 809457c05fe696f5d34ac5ac8768cdd4
- SHA1 a2c3e4966415100c7d24f7f3dc7e27d2a60d20c9
- SHA512 cf38e01d3e174ff4b8070fb88ead7e787143ce7cf60b91365fafd01cacc1420337654083a14dfb2caa900141a578717f5d24fa3cadd17c1a992d09280fd8dc44
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK
- Size 114B
- SHA256 802bbf1167e97e336bc7e1d1574466db744c7021efe0f0ff01ff7e352c44f56b
- MD5 301657e2669b4c76979a15f801cc2adf
- SHA1 f7430efc590e79b847ab97b6e429cd07ef886726
- SHA512 e94480d20b6665599c4ed1bc3fc6949c9be332fd91a14cef14b3e263ab1000666e706b51869bc93b4f479bb6389351674e707e79562020510c1b6dfe4b90cc51
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Office16\1033\OUTLOOK_K_COL.HXK
- Size 113B
- SHA256 951b1c95584b91fd8776e1d26b25d745ad5d508f6337686b9f7131d7c2f7096a
- MD5 b9205d5c0a413e022f6c36d4bdfa0750
- SHA1 f16acd929b52b77b7dad02dbceff25992f4ba95e
- SHA512 0e67910bcf0f9ccde5464c63b9c850a12a759227d16b040d98986d54253f9f34322318e56b8feb86c5fb2270ed87f31252f7f68493ee759743909bd75e4bb544
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\DISTLSTL.ICO
- Size 1KB
- SHA256 a338f849bbccace695e284ab83c0cecc84876fdb292078f1186b31e9b6a07127
- MD5 8722af8683c6dedfa35cf708f04e507a
- SHA1 e411318d7904624a56946cec0059e380b0a4bd0f
- SHA512 1341ce0453aeae411696a7343f2f6a6fa991fbd483433841cfd4b202ad476d77ba62b66ff547baf4e29a5bd38e7c1f2f78ead201ed1bb8ec50b98eb763bb11da
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\DISTLSTS.ICO
- Size 2KB
- SHA256 ea3a2d1ae34d98f545d82a53ff2d1c6e5334ab4a0a4cd902e3fcd0fb697bf32d
- MD5 d4a7e4b0851785143ecd98f019ace3c9
- SHA1 99d3d7b7167a9ce2fe67a0d296bfdf60ba7a8a8e
- SHA512 cfaa3e8c5f61f0b662c6e04296ae67b83d81fe96eed7872bc503c131cdf47576777d1857d0575ca309652f63f5de2a8ad6fe072bd3c3127eda3d353e61260c2a
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.CO.UK.XML
- Size 810B
- SHA256 9b8747ddedfdcb06f34ca5161281e28aafe3bec2e4b21aa731e17bb46dabc6c1
- MD5 938fcac2676e99d92efee069eacacc37
- SHA1 575b35480aab9ada77d22f922bc57cb49a7580a6
- SHA512 515074b8b8c14986ab86913a659ffa007cab07db5c6798ef6a4e12279ad3bf68262ac42ce991ed20a06825a8e5b8d0efc48aca38dad5503178d1dce0ef68c33c
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.COM.AR.XML
- Size 812B
- SHA256 15dfcf446deb114d465215cf49907aa5efc5fb8531f97607d50148cb4b680288
- MD5 dc5794fd7e35debdd2e25f3e22761cce
- SHA1 348034e08eaa9434bcf5713e9880f60bfd33ba78
- SHA512 6a9b27a6702e40ef03367ce611716816cc4debac9086983148ff75c4e8656f10ff5edf73e95e18efe9e0ef7b721350e86a20919061d0ce1266258384ef98b1d2
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.COM.MX.XML
- Size 806B
- SHA256 f860ea6cfbfe8ddb3862a09c1b443f3273dac1a4757ce9e7a3b34d46f971ff10
- MD5 b4052c951a5d5df0482bec08dcd1a1d9
- SHA1 99f3e0929eabf972e94c276c6423499860202f65
- SHA512 c26450d504e58cdbba0ded009158837855dadd8040b0c05845ee25b540567758c650df3d6b28c3571adff47e39d8ef99b30144250477524a19ab172d0870ef82
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.IT.XML
- Size 804B
- SHA256 60107be66c9efe4d6aa0a3864f71d60b3800c8d6400daa36c05609d099b5f891
- MD5 0b0d4b77b1494ca873f4311cc88a9fde
- SHA1 e88f8c3100290bbcdc224f4db05a77811726fe90
- SHA512 0a2410540f096ebd0464f16681b7375152fe8844ad2fed5fe86b352a61d6c65695051c82a36b77156a79ac633943463739752163d48b26abedf2db2c49ba794d
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html
- Size 1KB
- SHA256 1777e4f7955cb5900c97d92081efc4b11704ee3b265717a7d7152972b49a36c4
- MD5 3be680b6a8edfdeed37bf5068a37dccd
- SHA1 75bc261fc558634731e683e431e4a31c5b463107
- SHA512 a3c8a91689105a14c49b020826944d32540353c56fb9e9a011639ff5107d25e1d3466f0fc487ef953c6bbf0c006abc5204e3a8f0093e1c633013a547f8ecab21
- MD5 SHA1 SHA512
- Path C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-Eco3PTelDefault.json
- Size 57B
- SHA256 65a16cb7861335d5ace3c60718b5052e44660726da4cd13bb745381b235a1785
- MD5 ab9d8ef2ffa9145d6c325cefa41d5d4e
- SHA1 0f2bf6d5e1a0209d19f8f6e7d08b3e2d9cf4c5ab
- SHA512 904f1892ec5c43c557199325fda79cacaee2e8f1b4a1d41b85c893d967c3209f0c58081c0c9a6083f85fd4866611dfeb490c11f3163c12f4f0579adda2c68100
- MD5 SHA1 SHA512
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk
- Size 1KB
- SHA256 f5ea79165516de2e7e1efb53d016983f5d18c3184413f044a4002f4b751c918b
- MD5 8b550761ab80413c9c09f7fb472dbfaf
- SHA1 67122822562203c17dd3f762194e470f90ddfa97
- SHA512 9546013cf4d45a2c4c609524b7ed4adecc7dc2fecded7c3b7085415a1bcd1c25db5d88bb591ac05fa5a6313763a8e8d5d8fc6ee6610b454cf7696b647e7781fe
- MD5 SHA1 SHA512
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini
- Size 338B
- SHA256 4bafbcbc4cbbda94d0a315a09176de0ce6872cf1d85113539a7b04ff2360efa1
- MD5 fc91658bb81ea407fd37a59d65f0d86e
- SHA1 6cb269ab1a592dfd2039dc8c50c00b86af94d3e6
- SHA512 c5b8832097ab5e74a0c31cc243c98c6a2b9734da4eb6e25cfc28070529ff4b6d77de1e97388f188f00148cd8db32f3ea62dc86aa841d47e25da8d8dd2267061e
- MD5 SHA1 SHA512
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
- Size 686B
- SHA256 636caa873773a9fd59332ebbaa7fc07c9ede7a528d2895fbe4967f2036691a15
- MD5 bf471a8e510e61a31dfbb1696594d56d
- SHA1 af8229d15eee475a2b8039e0558e9b1b55b9b717
- SHA512 d8877f7976a8c815663b0b3c413de71529965accd7b0ad5a6bbf4593030f5ee81c4a8e8a61f70391f859f326e7a88767362e9bcb7bac3817a9bc9498da1cace7
- MD5 SHA1 SHA512
- Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
- Size 46B
- SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
- MD5 d898504a722bff1524134c6ab6a5eaa5
- SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
- SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
- MD5 SHA1 SHA512
- Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm
- Size 634B
- SHA256 18b602cdbb7656129a359046fc68faf1b990da88c6c3b3e6b20c1df399cc0645
- MD5 8776c367699ad807af292f1f5d085d4c
- SHA1 9209e352bf9d3999f94881a75d6f7d39bc6d7f77
- SHA512 83a17d98d175a122fe98cf89c476826769d8fae0d74dc93c8fe48d12089e26bfd501a586db3783a03e1bfe07864ebec2a6b5a48415554c61cd565131ed40a9e1
- MD5 SHA1 SHA512
- Path C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-IoT-Enterprise-LTSC-2024.swidtag
- Size 1KB
- SHA256 612b129d85371da757ca47f9c8169434118e261ad99c09fe20e04d49ce9a6b01
- MD5 18413bfe5a3f3e07d27140cb4c995480
- SHA1 bc589d1f8c05fda5755ec0f833ad4227525c0644
- SHA512 646e1933f0e26d0240e1e1050b04c485ffa13859f123032e9254da1c6a5ee06bff7a39c68e0e597da1b04c68fa19d07d321ca3ecab13c9a387d8b03cff058acf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
- Size 1KB
- SHA256 d152e28f32dc55c02f9852767076656b57a02a9fd9708ca7722639dfbb9f5cfb
- MD5 41448d3bd72f665ee77c78bef386c258
- SHA1 7d8075883a43da9c0eebb284af56b26251544583
- SHA512 307d0bba88467bbf21c24082ad7d6a9808e31fa45b775f409e4054945f6a5fd5c6fde97eaf50af68846ee5f515315f18878388a1e708ff1c6320afff7d60e3c4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
- Size 471B
- SHA256 9d2ce1c032646d2a3381b68bc9201e3dcd53b764e83a0d356d67cc4926ece015
- MD5 a50b718c3518b630251fb54b92bde360
- SHA1 a9582222b6f4df2b4e3e4ee5fe91d25ff086b943
- SHA512 95e0676e3177262d29c4105edd4ce1fa1c2a2da5cd3289ab0f873fba782a0185e4bbede5d64fae1f6c4cea5ca3ae0697d7113e6ee63f229431bfaf3f8990c517
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\2026-08-21_68b8c1199cf0501da10e2bf3bf71b74f_elex_phobos.exe
- Size 56KB
- SHA256 6429a30e8c9c7146388b4512520d6eed1f16239bdd21fbfe173a6a2257857543
- MD5 68b8c1199cf0501da10e2bf3bf71b74f
- SHA1 628b72a18555280e0209b572dbf1dab0f0e26cd9
- SHA512 a042751e54576f8d9f9627cf3f9da4a082f8420a94ed48eb69b464bfe50577068301e28be7d776c5c45b805617ad9a8537ee18fce1c17bd76443eaf9c20e4c67
- SSDEEP 1536:gNeRBl5PT/rx1mzwRMSTdLpJ4J1lw0BFrDgA:gQRrmzwR5Jolw0BF/
- TLSH T17B43C006B06984B2CE614570293E6F5F4EBF540540B894938F794E9A3FC4532EB3E37A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\CURRENT
- Size 16B
- SHA256 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
- MD5 4ae71336e44bf9bf79d2752e234818a5
- SHA1 e129f27c5103bc5cc44bcdf0a15e160d445066ff
- SHA512 0b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
- Size 279B
- SHA256 74ca16b1138459ef2afb19324097332626ee7c897687c5adc5488f93bf0c11ff
- MD5 2dcea950234175e3edf672936843ab5f
- SHA1 4ca6dfb9ed642bbfc0002cd47abaa2dc895ce0d4
- SHA512 483866f3ee1d730f1052b0ce34832e0e42145296df490a68901b95e616f2dfdc39fb13e2ed80bd259c43475830f6a74257a5fc8d163e7f1dd17d39556501dfa4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\MANIFEST-000001
- Size 41B
- SHA256 9e1736c43d19118e6ce4302118af337109491ecc52757dfb949bad6a7940b0c2
- MD5 f5cfd73023c1eedb6b9569736073f1dd
- SHA1 669b1c85ecbafe23c999100f55a23e06bf59ead7
- SHA512 5d8c1aa556fc17d6dc28d618f521aee37fc0e1826fdbcf8d106e456fc3bcd3c76e712d23fef3378bd2be17b80eb5bfd884ccd89b67490b63c7bd118eaac471d8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
- Size 297B
- SHA256 d99258f5d81067df4e95825381104fe6c90d04d01bdd2915954dd06f75d07c10
- MD5 9ee38aeba19f4d46fcd9eda4661325d2
- SHA1 d458ade2d50d219b089b0985ef765a80843602ad
- SHA512 f352805d5ebb6b3351dee65dd1f66ae5493ea36dc342c31d8e714fd11095739f755a50d865b9bcfc40c60616c9bcee4cbbcabb6c18566fdb73e778cd41112738
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7585ce0c4f7fafc6_0
- Size 340B
- SHA256 480c52f030d9e55cec53a16e454ffe8f12b56b9d93a0dadd28f226af89393195
- MD5 f129cbd00a7078a50655d1145feac97b
- SHA1 cac04499074ed54e382ee370bd1d39f6f317dbad
- SHA512 5ab6bc4ad83f0f393e480e42f95e86c65b9c113392a85c40a2f4d5e8335b602bd6ae373d15775500b20e6199b129d6a0bbfe544dd5f029450026e289a5c18014
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\792b03fcfd4144c9_0
- Size 257B
- SHA256 6c934d0cdf9dba94b474d6d1929f16739bd9a8ed31d0c3bcaf82c283fb7a3568
- MD5 9b7eeab7d5643bb97d4595d6b3ba7c6a
- SHA1 5ee50d675c809fe59e4a7762c54b65837547eafb
- SHA512 bc5bfa962850742a502759b477df26cd53716fbd3864a53f3eb726530b535e8074bc55b5d95a8b516c835564037b6c4a8dc41b561ec5e1a8b8f01d4a0b765ada
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\hr\messages.json
- Size 935B
- SHA256 e5cbc8e3a6e843009fc9a9de7a83df9d05532e08d48da06c66f907f58d0c745e
- MD5 798b4a7c5a9f20d24f36ba8daf7b8f70
- SHA1 0f007b82783ddea5da7374c96925b77a7fe9f57f
- SHA512 e3faa4376d03dad6cd714dee6349733abe29d0c2118456f80bcc4c758015b12a06b4ec6532a6e98d512f5c6dec7a7ade5c1d2a418db0f739ed17f18c0cd6b54b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\dasherSettingSchema.json
- Size 854B
- SHA256 445c811c35e2fbd4aa59389ec805492c7b2db50d65f5d161417ce8302b103fbe
- MD5 310614b10980392ebdb5a5a8b90b527c
- SHA1 8c8fb36e7c2a1574cde7fdea30e8e5f14fad7691
- SHA512 416650adf9a61cbbb6eff7af635264e5bdde903477465cce05b63773927b8afb35e75fb68497882bce7778f524b9c7f3f2befcfe3840e99bff90ccd305bac66e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
- Size 429B
- SHA256 a6df5cb2b51fa56609c7daf08d28f0e41801b96f9514a9d179992a63afd516b5
- MD5 d7d2fed9b7c55fe72a6cda66725cb7e8
- SHA1 2cb154a1c4a0553658801a088edf87b5816cbbd2
- SHA512 0ba4d570d624cc5aa6af629260668ad805285fcedd61002999734fe04cae47016cf52022c327cf22935ded99b30c52d9f041ead60a3425365116bf1bf4cbcf5e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
- Size 40B
- SHA256 2c34ce1df23b838c5abf2a7f6437cca3d3067ed509ff25f11df6b11b582b51eb
- MD5 fd4b38e94292e00251b9f39c47ee5710
- SHA1 b80de5d138758541c5f05265ad144ab9fa86d1db
- SHA512 1080f871e39cc839e5bcc9f852f9a8f3ddc03cf7e72e9fd1d6e4a71d7e74936f58adc646c9a9dc382fde85c5d281c2a44a459caf6afa58272d7fa006152e4cb1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
- Size 326B
- SHA256 abc51024312e319b92a2072de099539bca24e378e04e96f2a142fba8864161b0
- MD5 f66bbd2e5ab92eb20b68e23e0e7e2865
- SHA1 52e6fe8181f5154cb78ea7586afa7f53d1652403
- SHA512 a0dd02122fd9fa1645fe5a4963d5421128fbeed7e826443b45da910e1b2467255782bbb2d462fd6ea62c0a41b26d164b30549537be92c774d31282c79ce50e6f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
- Size 322B
- SHA256 68b138c89671b1f8435c3ebeeff7720bc4ee002e907fe77787caed1d35d40e07
- MD5 b43e3b0286664b420fa6ac3fe4cbff8b
- SHA1 e228d2fc712a98603e69bec71ca7dd6fb950a56e
- SHA512 cfad2fa8990f41c91f37244767bacdfcc24db8688dc6305fd8c6c2f9dd9795d87fc69213254965f622c7551bf1a6d3fa9e0d18aedec5eaef540d9ef7b16dc08e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
- Size 848B
- SHA256 4925b9b6329f24346bce043f2cdabb940199fd87188f3ae77c9559bf7cfa9f43
- MD5 e66d4ab75e9862302da5825bbf066c5e
- SHA1 fd5c26be1c56ae0af5e626741ca5896858e43073
- SHA512 ed179e34d1d6f2ddc85fa6cd8b866f192c1c4ff2e2b715d9ddd95bff6e8f45318dad7d4da607960268e1cdfd78d48f04b4ea1a9b01ae70fc1c7da856a178d8c8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin
- Size 1KB
- SHA256 8f6abb9e202dd8027ac9abbd475a24e62659a0b2683613f219c21d1238816ed7
- MD5 1595ed4372d33dbecabbfd411c6c8f46
- SHA1 8b8ba962b765110f762f873edbc3193adef48b33
- SHA512 e0017291c0d0685ede7a6492c2683a90b37482d21037840ab3e2cef4ed381bbffa8c31ef3c8d06db0a800eff69ba4505012886f88a911997657b3f26284142f1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin
- Size 347B
- SHA256 3e747b82fcaac02d19811fb7b619d63110c496fb0da885bb4c581471775bf481
- MD5 b2d9d5b06c044b2b0e6ecb4e66d28f1d
- SHA1 e0d687858b744bb9c6ee2632d5cf0a8f9b7360de
- SHA512 0c8f9dd1ad33ef4e32b5383f045b926c334b7eb789c28d89946623986063b5985d97d8d9c43864f26d7686f8cbf8504c723c4da1e43be57ca6b065700a9b187b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini
- Size 174B
- SHA256 eaae98aa73fe0b561c8b02607a524fb4853bbe81c6de8c3d8a9b7449366809d4
- MD5 897208d5df122e307ab837d982b2c085
- SHA1 cf4ca14a7adcbc197cd84c1997efdd076911d608
- SHA512 b0aa03063c42515de12fbf6d89924a3ae7d8bdd64d7c9bae94c75d571c939655253f3e87368fcd96f5784b2aee8fedac8f66200b8672ab47cc8b37c57a9ad334
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db
- Size 24B
- SHA256 9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
- MD5 1681ffc6e046c7af98c9e6c232a3fe0a
- SHA1 d3399b7262fb56cb9ed053d68db9291c410839c4
- SHA512 11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
- Size 1015B
- SHA256 1f9ec15f6ff239e14a3a243a98f19ae7db16d425a63b2da0908cc0ffcb1258e7
- MD5 61d2c715839bcfa06ce4d23dd84e7457
- SHA1 cdb61e6100ac4882ba4863875f63e38b8b804ddc
- SHA512 cb6577068e0b746a0ff0148238fd5be9e02e4ff6218fc21d78194a06ebd3f54aa12a1a9b80a4cc9a9f66f72f49eb875eb367b344f674807af11373770f75d952
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Form_JSI_API_not_a_real_file_Hermes_perf.cache
- Size 886B
- SHA256 a3653744379deeabe4198ccb180e4659a1990eb9f997ab7967d5ba5eb6552129
- MD5 cc9fde7e84b9a905cacd8eadca610fd6
- SHA1 dc05e28b682154c668ab89c38807a8ee395069d9
- SHA512 9563c271e51c6420080548ca2ca64a51a28c2bc2c6a37d06fa9539808e77e62d7a1848c918aea808c0ed20863e321147ecb41d310ca41c9ddc385aa99377ae06
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{65de6d19-73ec-445a-a218-0aab175d9eb2}\apps.csg
- Size 444B
- SHA256 0673d7ed815afd3f6341211be04d352854005d1567022503d86a1b623e7d9566
- MD5 da73b095989c3489d615e0d1e05961c8
- SHA1 2ebcb54e6c3382197700ac83cf1a0d3857d5e7e9
- SHA512 47277f7b85ac06c7539fb0a063289e4bd16b4ece187bed114abe5dc3d55bf91f01e630567abc37f9b64e19c9288621956c3da7528a1252aaee126f9d1853b189
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.acl
- Size 2B
- SHA256 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
- MD5 c4103f122d27677c9db144cae1394a66
- SHA1 1489f923c4dca729178b3e3233458550d8dddf29
- SHA512 5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\pkcs11.txt
- Size 517B
- SHA256 966dcc535f89f9dca556dd4d93b4a1b0aca714cd980834431dc9db2de711dfeb
- MD5 bb5e3d4ca343bd970eb03674b015b9c5
- SHA1 fb3388c98d8b2ab628fd1659cce10feff0a1f385
- SHA512 aa0a529a8127b2a079fab49d67efd76327aea58d8023ecbfdec3a8f156870eed49a05b3db90dea543adbac25d4871f3c4dbf757e986e6323f05266ffd88c1226
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionstore.jsonlz4
- Size 902B
- SHA256 8e1b2f3c38d9583ec30e0f44459700b5d81f4b6a2b2eefe88198c9230ec408ec
- MD5 afffb14251fdb8bbe7d064f77e3d60c8
- SHA1 3c0975c4c816c8a556ccd5d01a3b675b25bfa0f6
- SHA512 18ede0f0164d1e1f20a795a77114cd912839dfb758e259e803d029e3022908f1bd3f6f3f3289aca6ea4ca71466b4e6508a83f72fb85e2f393a82eec616c98e52
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Contacts\desktop.ini
- Size 412B
- SHA256 9ebc694d4895efc802ea27714a71986f293edf4b63e9918c27d65871b06f43a9
- MD5 80be6efdf5a776659777bf07d4aff891
- SHA1 1f98e7ba8de8c6b39f4b202739ca71fa2629fd6d
- SHA512 03a5434f25209a74a0abc6045c66a45e098d487227cab71004363c8c823840b49596857e8f757f42b8953f9bc2066209b1e8f52104d1837705828cb2676119cc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Desktop\info.hta
- Size 5KB
- SHA256 4ca48959e081aa1a3b9be71fe1ffe920646c2939f8c41f53c92ae81a89639f78
- MD5 20ce37c1c1b1bc157606ce1a992350d1
- SHA1 9b65de2ba052430ad7f0a58623c0dcb2d54ed6aa
- SHA512 47c352bb98cbb32d08e16d08861eb33aeb6af81e35cad0448dc0916071dc73f9e2042f741c6a573432da75117d4290ec32790aa7c681cb1a9cb2252b0fc1bbc9
- SSDEEP 96:nHg7bGs1Q9vQXTTVWKt+1I7Dz64m2OwGyVwsESc7lVgNYnX:Hg7RQAn7fkaEVgNYX
- TLSH T17DC1D83BEE41900111B353E1BF767702FF2AD56B8356C5627ECC52266FB0419AD63A8C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk
- Size 1KB
- SHA256 462fa5c6568794276673c9159500918afddf8f170e580fd1f3d483c48934b050
- MD5 7a4228aa2003a72a296e741bfa8246f7
- SHA1 e94ca8cb43d671cdc3ed759980bfbaf73cf4c6f8
- SHA512 ed66dc35762f661f760eaf0feb82e22c823f11e552c9f938748a8b158ecf0828f40d48afc4d5cc07122f41a13e7b322950b9f156808b125bc7a1ae19e066d304
- MD5 SHA1 SHA512
- Path C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
- Size 334B
- SHA256 c87a7e9ae92e9652dd12d266f4eb2e12dc3e3715105dc108092c5b67553dc8ec
- MD5 f59ae39607f4248f731a3f754ba2bb0f
- SHA1 a26699655c8428e9116cf64a5dfbe718fe907e00
- SHA512 0393d5a84dc5b603d835d4c5bd3d81b783c9222ec62cd1b3110f0027a6e7deb75a8c66b4e0e51c6f2c99adb7c161ac8768c054c2a17bf3842dd182f6fa306646
- MD5 SHA1 SHA512
- Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
- Size 1KB
- SHA256 d0e438519a8e2075e13430b66debeb7204e5e8ab41fb24eaab20db0bdb66d835
- MD5 35705a33e80294bdc078f5582784f4fa
- SHA1 3b8d2bc3650098d604e3363fdc41e9bfc2f4609e
- SHA512 e560c350940f15a8d5c5187ed833190cdef9e4862e8f06dde9b0204ad1a0decb9adaadd27c4b7015ea5e7fabe7d7a63538ba72def9997e56300cc8ddc4249061
- MD5 SHA1 SHA512
- Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\VoiceAccess.lnk
- Size 1KB
- SHA256 b908af45846d55c8e3ae4483ce41d571c1c1fe538a7b16ea45a4b1e6a85b1483
- MD5 f20832006ca53c689de48ead26b7b804
- SHA1 ddbb4d95a159968b9dca10ce21f3e35f93c7129f
- SHA512 90925a97f6954027a76f9d6a12baeb16ec82caf763996442ad0f545b09ed5d8e5745778b6c3c23ba1c52a807cedea2b948700342cae0ef0cad0bd08c8769d13b
- MD5 SHA1 SHA512
- Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini
- Size 170B
- SHA256 d07bdfd8af965e4283a5f77274fc59bee1379af9f221358b81099df31f696345
- MD5 7ba69f4ec41007c035beb73aa29d6b32
- SHA1 de53c85a814d9addb1160cea893c73cf98c4dccf
- SHA512 2e209dba34b3daa898c15f5ce479e40a71424e9e52c5b818badb04630206fb73aacb96910484b3369a11030bf0286e018ef9f59f32cff27ac0525573fd7619c8
- MD5 SHA1 SHA512