Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/03/2024, 10:04

General

  • Target
    LB4.exe
  • Size 146KB
  • Sample240304-l4ebwagf57
  • SHA256 9b5f1ec1ca04344582d1eca400b4a21dfff89bc650aba4715edd7efb089d8141
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Path
  • C:\Users\xa1Xx3AXs.README.txt

Ransom Note
  • ~~~ LockBit 4.0 Ransomware since 2024~~~ >>>> Your data are stolen and encrypted Price = 1000 $ Bitcoin = 328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2 Email = [email protected] >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Your personal DECRYPTION ID: A3138014A48684D6D525F3F372263313 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
Wallets
  • 328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2

Signatures

  • Renames multiple (9357) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LB4.exe
    "C:\Users\Admin\AppData\Local\Temp\LB4.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:440
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4588
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2996

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          desktop.ini

          • Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini
          • Size 129B
          • SHA256 5af7482501e777357635b785eb99f8d5d95a3e357913e9480eaf3c2e0b573c25
          • MD5 SHA1 SHA512

          iexplore.exe.mui

          • Path C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui
          • Size 6KB
          • SHA256 caaa7bc703b01332fcc3f5070ed9b6fe6ea1a2f199ed6a3840f28a278586e422
          • MD5 SHA1 SHA512 SSDEEP

          iexplore.exe.mui

          • Path C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
          • Size 5KB
          • SHA256 3684483c40a956517e549a3ec5947c8139525112be22a4172d2ade0127bb4ad2
          • MD5 SHA1 SHA512 SSDEEP

          iexplore.exe.mui

          • Path C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui
          • Size 6KB
          • SHA256 97b47cce023f1e2401b45a1a1a9845959ecee264cc9422d3f668247d8e2cc810
          • MD5 SHA1 SHA512 SSDEEP

          iexplore.exe.mui

          • Path C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui
          • Size 6KB
          • SHA256 843d09f916791375685b7233716db2bf906020c3701779eacb431cb00a8e3cc1
          • MD5 SHA1 SHA512 SSDEEP

          iexplore.exe.mui

          • Path C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui
          • Size 6KB
          • SHA256 9e6f82a3a97901c190822b226e510031260b1f76539991f1864d600553f3f985
          • MD5 SHA1 SHA512 SSDEEP

          iexplore.exe.mui

          • Path C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui
          • Size 5KB
          • SHA256 44a066223c7b14539df1b2eab27a39d1c6d51231f69260e00916702c0059c3ca
          • MD5 SHA1 SHA512 SSDEEP

          iexplore.exe.mui

          • Path C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui
          • Size 6KB
          • SHA256 0ebffe4d2fd95b024fa1e169c4b13b9a91410c9664917bfe833bd5ff29e856da
          • MD5 SHA1 SHA512 SSDEEP

          EppManifest.dll.mui

          • Path C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui
          • Size 2KB
          • SHA256 9b87d3918c381707746e1d5e5c6ee1833728bb2b1d8164f23f09c3ba5e7e6d64
          • MD5 SHA1 SHA512

          MpAsDesc.dll.mui

          • Path C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui
          • Size 60KB
          • SHA256 6d8ee55d176c031335394ec0b82cc5cec22aa62136fd50af3cb4645b02077415
          • MD5 SHA1 SHA512 SSDEEP

          EppManifest.dll.mui

          • Path C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui
          • Size 3KB
          • SHA256 601d4c39952de1d2a05c3a51badc76d860d9110ef53cdcab4f63c326a5d1815c
          • MD5 SHA1 SHA512

          MpAsDesc.dll.mui

          • Path C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui
          • Size 58KB
          • SHA256 6365a54de60d6d9b7a912883f26c23f08b14be40bc487aa68aac4d8144ad5c0a
          • MD5 SHA1 SHA512 SSDEEP

          EppManifest.dll.mui

          • Path C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui
          • Size 3KB
          • SHA256 78c095f04b720ebd465eec53cccc6453e3a1192c2325eb318b8f0680403f5c06
          • MD5 SHA1 SHA512

          MpAsDesc.dll.mui

          • Path C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui
          • Size 61KB
          • SHA256 8f7337e037d15032ee2a86d69f533cb7adc96fec0b619f8d9032009b49523ce9
          • MD5 SHA1 SHA512 SSDEEP

          EppManifest.dll.mui

          • Path C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui
          • Size 2KB
          • SHA256 614ec2d557cb648e915f4f5e8461ea3e3236e64457af828ba2ca02a46431e9c1
          • MD5 SHA1 SHA512

          MpAsDesc.dll.mui

          • Path C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui
          • Size 57KB
          • SHA256 0d4cd50cc649ab95b3b145c5d5fbbe0ec01a509edb13bf106f8b249b62d97c4c
          • MD5 SHA1 SHA512 SSDEEP

          EppManifest.dll.mui

          • Path C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui
          • Size 2KB
          • SHA256 072b054b7f879ddf772238e5c240e459b8be09fbeb3ed3bffd004434638db626
          • MD5 SHA1 SHA512

          MpAsDesc.dll.mui

          • Path C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui
          • Size 31KB
          • SHA256 1d232605678f63d874bd628d847262c464225815f0fa11945a5c01ca4b67b392
          • MD5 SHA1 SHA512 SSDEEP

          EppManifest.dll.mui

          • Path C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui
          • Size 3KB
          • SHA256 0c68fd23de86d860cad29ab8c956163330e192f3182d6e16318669edc2b541ce
          • MD5 SHA1 SHA512

          MpAsDesc.dll.mui

          • Path C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui
          • Size 56KB
          • SHA256 c0281801e24cf22a194753faccd367e29f04d666f488155704fc32a4a6d5dd41
          • MD5 SHA1 SHA512 SSDEEP

          WMPMediaSharing.dll.mui

          • Path C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui
          • Size 3KB
          • SHA256 44671e8de7f8b47d90fe49adc4236116a9884ac3a3e77d40ee78f27f0496206e
          • MD5 SHA1 SHA512

          mpvis.dll.mui

          • Path C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui
          • Size 3KB
          • SHA256 be4cdc4d9088caf3375be484cb07a3c8fc4cb9fbf80e8d9d40ad08ae5a45d1f3
          • MD5 SHA1 SHA512

          setup_wm.exe.mui

          • Path C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui
          • Size 61KB
          • SHA256 f4167b38cc5809b993644eefbfcfd5803aac984ed143434302532a440848b66d
          • MD5 SHA1 SHA512 SSDEEP

          wmlaunch.exe.mui

          • Path C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui
          • Size 2KB
          • SHA256 049297b41468cbb082ed8d6f5a23e29d0f4034cce1ca9ed8137c56cd59a2934f
          • MD5 SHA1 SHA512

          wmplayer.exe.mui

          • Path C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui
          • Size 3KB
          • SHA256 86d4a277ce64b9edff115c500bdd53503be7940d9193a06df68f7cb8d30ae09a
          • MD5 SHA1 SHA512

          wmpnssci.dll.mui

          • Path C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui
          • Size 4KB
          • SHA256 4d574c8773440f4150a293bbb3ca50190bec0b0ee573c3974ea7308dc03c2948
          • MD5 SHA1 SHA512 SSDEEP

          wmpnssui.dll.mui

          • Path C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui
          • Size 3KB
          • SHA256 dc39303b87940e2d882511c2c27cae6ba112985351759b396f13b400eca5f60b
          • MD5 SHA1 SHA512

          WMPMediaSharing.dll.mui

          • Path C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui
          • Size 3KB
          • SHA256 4336ccc9c7cdd6c351368506ed74a1fe4144fa3b565650e9f1e6c43f03855ed9
          • MD5 SHA1 SHA512

          mpvis.dll.mui

          • Path C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui
          • Size 3KB
          • SHA256 e0b03619a592a0ed367c8752d1a7c705abfdfc588a6392df7d6b426ede680c5d
          • MD5 SHA1 SHA512

          setup_wm.exe.mui

          • Path C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui
          • Size 53KB
          • SHA256 5ca789deaf62ddf8d3dfa03d6f4e1f4ea339fd55dbf8c7284837be570b448085
          • MD5 SHA1 SHA512 SSDEEP

          wmplayer.exe.mui

          • Path C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui
          • Size 3KB
          • SHA256 cd1d3d064e8bd464c3ecf6df7cb29810c7c30714b5f7e3e3ab75b6c576d11b6a
          • MD5 SHA1 SHA512

          wmpnssci.dll.mui

          • Path C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui
          • Size 4KB
          • SHA256 a36c4a0e0c06401fdb8c50cc07633d8e922860c37d98a485d0362b24afbde8f9
          • MD5 SHA1 SHA512 SSDEEP

          wmpnssui.dll.mui

          • Path C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui
          • Size 3KB
          • SHA256 1bafe76b34b2cb1c85a9a3442a814113baafed4beb8bd3d2aefaab2e0dd9e323
          • MD5 SHA1 SHA512

          WMPMediaSharing.dll.mui

          • Path C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui
          • Size 3KB
          • SHA256 be314ec4c78489209362e53605abf1f236411d11fe0b45c73d7c0912c5d7d25e
          • MD5 SHA1 SHA512

          mpvis.dll.mui

          • Path C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui
          • Size 3KB
          • SHA256 ace25d7eee2dd190bf4b0be9a6d9f231c42a60d3545ccb940f1a3dfbeecb5b84
          • MD5 SHA1 SHA512

          setup_wm.exe.mui

          • Path C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui
          • Size 62KB
          • SHA256 32ac9c946c76d1b61c7ed50cfe50a904f2ad531ef7a41135a7906a8383e2864b
          • MD5 SHA1 SHA512 SSDEEP

          wmlaunch.exe.mui

          • Path C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui
          • Size 2KB
          • SHA256 709071244529049900542a1f2fd079501620b3cde99013266cac31e388d12b90
          • MD5 SHA1 SHA512

          wmplayer.exe.mui

          • Path C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui
          • Size 3KB
          • SHA256 e70420a9a94c761d3d7609eeb30228cec6c984b53cfd322c526b32e12d37a8ff
          • MD5 SHA1 SHA512

          wmpnssci.dll.mui

          • Path C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui
          • Size 4KB
          • SHA256 8a00621a3a8f8c26734e79506ae72a705780f484b6855e3642370a5140c688a5
          • MD5 SHA1 SHA512 SSDEEP

          wmpnssui.dll.mui

          • Path C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui
          • Size 3KB
          • SHA256 5045a826503c63e747c9cd17a859cbc2895f3e8a1baf19f1b589872f89888119
          • MD5 SHA1 SHA512

          WMPMediaSharing.dll.mui

          • Path C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui
          • Size 3KB
          • SHA256 c8aed87c28132e007781cdf5427629628aaebfd1e46aa76c93ed3c5f1fb45b0c
          • MD5 SHA1 SHA512

          mpvis.dll.mui

          • Path C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui
          • Size 3KB
          • SHA256 f8f42fd12ce8cf5ef703dfb6daeb087a9169d147d7b71f072e8bc3662fd6006e
          • MD5 SHA1 SHA512

          setup_wm.exe.mui

          • Path C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui
          • Size 63KB
          • SHA256 b5020918899fc7586b2f1d4aba8586393841d27508cbc029ba75d937da8b99da
          • MD5 SHA1 SHA512 SSDEEP

          wmlaunch.exe.mui

          • Path C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui
          • Size 2KB
          • SHA256 73914a0ef9359d5482e831a558b7f31f3c17feab9a5a28fb45e2646d37fe2e1d
          • MD5 SHA1 SHA512

          wmplayer.exe.mui

          • Path C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui
          • Size 3KB
          • SHA256 9c776a9e9ce16864a486054f3f6852548420f0961a70656b261ce6b4fbf99675
          • MD5 SHA1 SHA512

          wmpnssci.dll.mui

          • Path C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui
          • Size 4KB
          • SHA256 b3c9f4f08c6d08b7699af3cd08bf05aed08ec74ecec766e4180019fcfbbc9a3f
          • MD5 SHA1 SHA512 SSDEEP

          wmpnssui.dll.mui

          • Path C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui
          • Size 3KB
          • SHA256 b25a051ad68f2e290d4cb2f520d22cb5ba7da746053e5c4a8b532144e2597e9a
          • MD5 SHA1 SHA512

          WMPMediaSharing.dll.mui

          • Path C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui
          • Size 3KB
          • SHA256 dea94ddfcc567b9dbb391d6b6623b7afa96c304088b4cc432fd919a49d8c1f8f
          • MD5 SHA1 SHA512

          mpvis.dll.mui

          • Path C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui
          • Size 3KB
          • SHA256 e5e04687110f8ecfbf219d2bfad5d896f2870f923ae111424fa7cdc56c5af7ea
          • MD5 SHA1 SHA512

          setup_wm.exe.mui

          • Path C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui
          • Size 61KB
          • SHA256 6d4a65f54d0831e14907aaafd41659976ed3580bacd45ac42be0c5d644b2ca58
          • MD5 SHA1 SHA512 SSDEEP

          wmlaunch.exe.mui

          • Path C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui
          • Size 2KB
          • SHA256 e44ebd0863d8c17e6d8706b95e0efd47d522a668a3e9f661487806cba0fbae45
          • MD5 SHA1 SHA512

          wmplayer.exe.mui

          • Path C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui
          • Size 3KB
          • SHA256 d27b7178fe6993236d3a03f626da926c262fa6368829971088629b8fe3073499
          • MD5 SHA1 SHA512

          wmpnssci.dll.mui

          • Path C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui
          • Size 4KB
          • SHA256 28c863207b541e82eb9a1104064a1d510ff57f3f7310842ef0418089f259d1ed
          • MD5 SHA1 SHA512 SSDEEP

          wmpnssui.dll.mui

          • Path C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui
          • Size 3KB
          • SHA256 cf416d84f94752d877e2db08dd12c2c140497345ec00127689e0915559643d09
          • MD5 SHA1 SHA512

          WMPMediaSharing.dll.mui

          • Path C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui
          • Size 3KB
          • SHA256 5cd82bc64a71974842654029c0552b4cf5fb0828eb8b660157fb79de7c1c674e
          • MD5 SHA1 SHA512

          mpvis.dll.mui

          • Path C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui
          • Size 3KB
          • SHA256 53709bfddbbf43fdc7085634785212d2ba0dacf8b0b28a7679399ec0da952e4a
          • MD5 SHA1 SHA512

          setup_wm.exe.mui

          • Path C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui
          • Size 40KB
          • SHA256 fa7fd1815dbd6edd060bb1530a4acaa7a191a7c6ee7ddee7e0114aeb02969bfc
          • MD5 SHA1 SHA512 SSDEEP

          wmlaunch.exe.mui

          • Path C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui
          • Size 2KB
          • SHA256 0ae1d4c983a43e17b76ccfe72d856278b26cea0288e1a187033c6d8c47ddb9b4
          • MD5 SHA1 SHA512

          wmplayer.exe.mui

          • Path C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui
          • Size 3KB
          • SHA256 3d0595ac9f773d8464f5fa98bc1decf8e5985bf16418df3fc35a67f595e79f63
          • MD5 SHA1 SHA512

          wmpnssci.dll.mui

          • Path C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui
          • Size 4KB
          • SHA256 3b3953ad766758b3b29eec2a25fb04f166a6f18880c327f24bdca3c1c37278f0
          • MD5 SHA1 SHA512 SSDEEP

          wmpnssui.dll.mui

          • Path C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui
          • Size 3KB
          • SHA256 bb41e0f89cf1c545091acb3e9ef462cba6a846b23136d386987d8de3cbb0cfb4
          • MD5 SHA1 SHA512

          mpvis.dll.mui

          • Path C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui
          • Size 3KB
          • SHA256 5071de60cc6bbe2e8aa42586f7f647510bf62f8c621dabd63875bc4e81f32a84
          • MD5 SHA1 SHA512

          setup_wm.exe.mui

          • Path C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui
          • Size 56KB
          • SHA256 a30f289171fe4571ecb456de0908abb91026aba4bae61dbaecbf4b889faf2bf5
          • MD5 SHA1 SHA512 SSDEEP

          wmlaunch.exe.mui

          • Path C:\Program Files\Windows Media Player\uk-UA\wmlaunch.exe.mui
          • Size 2KB
          • SHA256 b061fda8a92f8294ae9f1713cd5594cf45f1390fa539ca01fef355a86ff4ea24
          • MD5 SHA1 SHA512

          wmplayer.exe.mui

          • Path C:\Program Files\Windows Media Player\uk-UA\wmplayer.exe.mui
          • Size 3KB
          • SHA256 566e3efc36d0639f1947ebf3e6a67a0b97a6a123bddfe4c7fad5c354c7eadf5b
          • MD5 SHA1 SHA512

          wmpnssci.dll.mui

          • Path C:\Program Files\Windows Media Player\uk-UA\wmpnssci.dll.mui
          • Size 4KB
          • SHA256 48ba06b2d4e2a6d53679f9cdec4694620645f3176bb7aabeda3f67e8f23dd2a1
          • MD5 SHA1 SHA512 SSDEEP

          wmpnssui.dll.mui

          • Path C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui
          • Size 3KB
          • SHA256 4301d0c15b5ca4db5539ba967f210d562324fc87b254bc0485882da63698b2bc
          • MD5 SHA1 SHA512

          wordpad.exe.mui

          • Path C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui
          • Size 49KB
          • SHA256 02a0f05ce0d7d20f49c237bd72ee2554d435a9b209fc9b0a193426219d6145cc
          • MD5 SHA1 SHA512 SSDEEP

          TableTextService.dll.mui

          • Path C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui
          • Size 8KB
          • SHA256 0ca67c5fac4c0e1b7fc4f5b86a521307c53f76bdf322de6da1df2099c89b4fd7
          • MD5 SHA1 SHA512 SSDEEP

          PhotoViewer.dll.mui

          • Path C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui
          • Size 18KB
          • SHA256 f2fe710081eae207f2d7f9848bbbc1daba121d58b26588aa654cc1e3d2aafd69
          • MD5 SHA1 SHA512 SSDEEP

          PhotoViewer.dll.mui

          • Path C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui
          • Size 16KB
          • SHA256 953e46a4f6d9f29bbffef2e252b537d7c307c3ef2082c0a3ae86ba8674662552
          • MD5 SHA1 SHA512 SSDEEP

          PhotoViewer.dll.mui

          • Path C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui
          • Size 18KB
          • SHA256 a799092f709a417c344ef7ac0fe14cd165610464028f6fd308a8011e2f325584
          • MD5 SHA1 SHA512 SSDEEP

          PhotoViewer.dll.mui

          • Path C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui
          • Size 19KB
          • SHA256 ae6b9f56435b696f32a28a56528759e94b26d0c6c726e4a2503c14c4e4eec355
          • MD5 SHA1 SHA512 SSDEEP

          PhotoViewer.dll.mui

          • Path C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui
          • Size 18KB
          • SHA256 f401f17aa1f2820137632558f2d0d8e90db01004a7b504c70e6573a9ef26cafc
          • MD5 SHA1 SHA512 SSDEEP

          PhotoViewer.dll.mui

          • Path C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui
          • Size 11KB
          • SHA256 2fdbd4b491adc388a45a23510b9678b80d4e31483314001d15ca537bcb87f4af
          • MD5 SHA1 SHA512 SSDEEP

          PhotoViewer.dll.mui

          • Path C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui
          • Size 17KB
          • SHA256 220e2e1465fb19d141588feac0581fd881f767f01a8aa7b61953cfdf0cc84710
          • MD5 SHA1 SHA512 SSDEEP

          StartUnifiedTileModelCache.dat

          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
          • Size 13KB
          • SHA256 d56c4ed8d71505e643fdc385afc90bde35171e76abcd11692253e3fa45a66a64
          • MD5 SHA1 SHA512 SSDEEP

          StartUnifiedTileModelCache.dat

          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
          • Size 13KB
          • SHA256 4fe4c74d79fd94e165d0665bdaade219eb79e5fa363ad82a05ed3f261bedfe96
          • MD5 SHA1 SHA512 SSDEEP

          xa1Xx3AXs.README.txt

          • Path C:\Users\xa1Xx3AXs.README.txt
          • Size 1KB
          • SHA256 c99243fd5b4b2b5be708c0f30d095e515517f1e26a01032d05ad5ec6d6e4e2e3
          • MD5 SHA1 SHA512

          DDDDDDDDDDD

          • Path F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\DDDDDDDDDDD
          • Size 129B
          • SHA256 95f93a25c9e194345561cf33ddeba1ad65fea70b03ddf97c8bb520e3a700475f
          • MD5 SHA1 SHA512

          memory/440-3095-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

          memory/440-3096-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

          memory/440-0-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

          memory/440-2-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

          memory/440-1-0x0000000000DA0000-0x0000000000DB0000-memory.dmp