b7147a76c6695b750a84de55d4569f71f694b33aeefeef5daa09318ebabd9a24

Resubmissions

20-03-2024 09:55

240320-lxzn8sdh94 10

20-03-2024 09:53

240320-lwzb3sef3x 10

18-03-2024 09:01

240318-ky38dadf6s 10

Analysis

max time kernel
138s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2024 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Size

147KB
MD5

75256873a03f4a4bc073185f48c1097c
SHA1

e9023061def67ba21c09826fadc1607fd7f71d88
SHA256

068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd
SHA512

4b718093ad42d7b7b72498dfcbcfd1b39c980ef44e999b7035e6bfe6b782aad6b7553832f1efee45003d9b0c56bf2e408ca55082c550ac4faa19f199f366dede
SSDEEP

3072:s6glyuxE4GsUPnliByocWepvdHFdjFpZ/fgyVF0dj:s6gDBGpvEByocWetdHZ/fgKF0

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\cHpfiXA9s.README.txt

Ransom Note

~~~ XeqtR Ransomeware The world's fastest ransomware ~~~ >>>> Your data is now stolen and encrypted, pleaes read the following carefully, as it is in your best interest. We are sorry to inform you that a Ransomware Virus has taken control of your computer. ALL of your important files and folders on your computer have been encrypted with a military grade encryption algorithm. Your documents, videos, images and every other forms of data are now inaccessible and completely locked, and cannot be unlocked without the sole decryption key, in which we are the ONLY ones in possession of this key. This key is currently being stored on a remote server. To acquire this key and have all files restored, transfer the amount of 500 USD in the cryptocurrency BITCOIN to the below specified bitcoin wallet address before the time runs out. Once you have read this you now have 36 hours until your files are lost forever. If you fail to take action within this time window, the decryption key will be destroyed and access to your files will be permanently lost. If you are not familiar with cryptocurrency and bitcoin, just do a google search, visit bitcoin.org, go on your mobile to Cash App, or pretty much just ask someone and most likely they can explain it. Once again, 500 USD in the form of Bitcoin to this wallet address bc1q8wqyacjzzvrn57d2g7aj35lnr5r8fqv0dn0394 The second you have sent the bitcoin and the transaction verifies another text file will appear on your desktop with the website to get your key, and the simple instructions on how to use it to get your files back. 36 hours starts now, we suggest you do not waste time. For any reason you should need customer service, email [email protected]

Emails

[email protected]

Signatures

Renames multiple (12699) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	1605.tmp

Deletes itself 1 IoCs

pid	Process
5672	1605.tmp

Executes dropped EXE 1 IoCs

pid	Process
5672	1605.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3270530367-132075249-2153716227-1000\desktop.ini	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3270530367-132075249-2153716227-1000\desktop.ini	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe
File created	C:\Windows\system32\spool\PRINTERS\PP3r09__39bk0i617fx29k24j.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PP_x8s93mjnvnrf2svx0i6wsxhd.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PPw3m8op8br0o0iiu7e8_9hzeld.TMP	printfilterpipelinesvc.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\cHpfiXA9s.bmp"	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\cHpfiXA9s.bmp"	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
5672	1605.tmp

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\lib\classlist	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.CodeDom.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ar-ae\cHpfiXA9s.README.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-30_altform-unplated.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80_altform-unplated.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadco.dll.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\cHpfiXA9s.README.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\ui-strings.js.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\2.jpg	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SEQCHK10.DLL	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\ui-strings.js.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeBadge.scale-400.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-white_scale-125.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\cHpfiXA9s.README.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\Example2.Diagnostics.Tests.ps1.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\cHpfiXA9s.README.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon.png.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\da-dk\ui-strings.js.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_contrast-black.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_en_CA.txt.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FetchingMail.scale-400.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\cHpfiXA9s.README.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Net.Resources.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\msmdsrvi.rll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msdaprsr.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\icudt58.dll.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\MedTile.scale-200.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSOIDRES.DLL	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-100.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\vcruntime140_cor3.dll.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\msado20.tlb	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80_altform-unplated_contrast-high.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\ui-strings.js.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check_2x.png.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\contacts_variant2_v3.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuuc58_64.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.MsiProvider.dll	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\logo.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-16_altform-unplated.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OSFROAMINGPROXY.DLL	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d9.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96.png	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\WindowsBase.resources.dll.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nl-nl\cHpfiXA9s.README.txt	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\Desktop	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\Desktop\WallpaperStyle = "10"	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cHpfiXA9s\ = "cHpfiXA9s"	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cHpfiXA9s\DefaultIcon	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cHpfiXA9s	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cHpfiXA9s\DefaultIcon\ = "C:\\ProgramData\\cHpfiXA9s.ico"	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Suspicious behavior: RenamesItself 26 IoCs

pid	Process
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp
5672	1605.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeDebugPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: 36	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeImpersonatePrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeIncBasePriorityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeIncreaseQuotaPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: 33	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeManageVolumePrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeProfSingleProcessPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeRestorePrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSystemProfilePrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeTakeOwnershipPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeShutdownPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeDebugPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeBackupPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Token: SeSecurityPrivilege	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3472	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 5504	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe	105
PID 4844 wrote to memory of 5504	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe	105
PID 5792 wrote to memory of 5592	5792	printfilterpipelinesvc.exe	108
PID 5792 wrote to memory of 5592	5792	printfilterpipelinesvc.exe	108
PID 4844 wrote to memory of 5672	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe	109
PID 4844 wrote to memory of 5672	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe	109
PID 4844 wrote to memory of 5672	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe	109
PID 4844 wrote to memory of 5672	4844	068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe	109
PID 5672 wrote to memory of 5932	5672	1605.tmp	110
PID 5672 wrote to memory of 5932	5672	1605.tmp	110
PID 5672 wrote to memory of 5932	5672	1605.tmp	110

C:\Users\Admin\AppData\Local\Temp\068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
"C:\Users\Admin\AppData\Local\Temp\068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe"
1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  - Drops file in System32 directory
  PID:5504
- C:\ProgramData\1605.tmp
  "C:\ProgramData\1605.tmp"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\1605.tmp >> NUL
    3⤵
    PID:5932

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4032

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{AEC6BC24-503D-4AC5-9D3A-CB6AE13D2473}.xps" 133552261670420000
  2⤵
  PID:5592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3270530367-132075249-2153716227-1000\AAAAAAAAAAA

Filesize
129B

MD5
80b5704df05c40ebe32e227e06737c1d

SHA1
37b994130097fdd76d9f0debc442552f9cdb3a4e

SHA256
9edf6f9e6574e10beee70c32554c5954f31e3f564e6388eb2b3cf4e95e2da39e

SHA512
52615d8a4da4454be9df9887749f3c95e8378e07d12e2d5d4783c2d2cb831e6e494b8cb39c7cce5617eb6654947d924d2e79e3262f30c5ec51e54ae0440251c2

Download Submit
C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui

Filesize
56KB

MD5
a895526b78876da3dea61f8cf93b79e4

SHA1
da40d0565a2e463d89a098cee4206cfab5456aa2

SHA256
e619d37f47da662d7b991d5957e31dfe7b02e16b291611f620d8f069dfe57450

SHA512
c1f20bb3789f92c3951e0d418f01d5561fd25f28871e2efc148689dde2558145f28dfe44ce47f0359d21cad938eeaa53f111cd788989ed1b539b3c718fdc636d

Download Submit
C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui

Filesize
47KB

MD5
1a4bd35e1663322f8a3e02edcaa29002

SHA1
001f1171197b675910dbecdd8c306dc451d9ece5

SHA256
dd3a8fcd1c85caaacf055d02fce761076f87f47dacb2c2d58e625e0bebda713f

SHA512
263e3680d43668fa95f85adecba27cd02c24aac9a42de580b32fb52a188cb95569bba8b5748c9d5dfdd906f208c7645a1e94dfe23e7b1424c7d9b1b569437263

Download Submit
C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui

Filesize
47KB

MD5
b346fe0fbe64afe80fb6babe6b9a9ae4

SHA1
d8a0bc0ab2cd66472aad34710f7621f9b70fe8cc

SHA256
3a5121d5f44fd586971031a36938e91d28cf7ca4ad8ff2a1bee8c6af0a22a3bc

SHA512
dd3329d87dcf7d092688cf0afad9baf11b7db13fc7eee22e0658975fbf606bccd94b889bad225c6f1ef618603dd529eb403cc6e54dce79d1b1290adbe7374925

Download Submit
C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui

Filesize
43KB

MD5
fce871f08128852dd3ab73dc5f835a2c

SHA1
9a860e43fe62849bcf9da07b5d41eff8a318bf96

SHA256
17f1d4621507d7885b4abe7c2145efe5df769c8954dc966c3fc3dd7ab07ed8a3

SHA512
bbe215b4a83f9f973f242597b4e25cee4fcd91ad5306e807d81b71f26b83381f078d01ca5144271a2015e0ba817c4d0f77e8c8b1751441baaf909ff8b3f4178f

Download Submit
C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui

Filesize
53KB

MD5
2852bab90b94997af0b41c4fc9bc84fa

SHA1
a9f0e71b543af9f65022a372b0c3216e9f6131c2

SHA256
8a956a620836ac070eff9357dc7f8daee31a04967da72775a241279f8addc791

SHA512
e2374a86cc9ce8b0a7e4bb1ec9365f2a2609647229db3d620d4b35dc023f1b43e8f633eb38042ca97ba313dbac1a10416a699014d8e27fdbfaa8906336534b75

Download Submit
C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui

Filesize
47KB

MD5
c3ebf14c3eb9574d8bb946a9eee4edd5

SHA1
4e5d60548becbbd4f1d0ded1d5fba1f584f2562c

SHA256
aaa21ba17bc408374e2202e4a93b212dccec3a20c0ca5504fd99a07cd6dfbc61

SHA512
b4086f398176ab16784aaa0da1814e3167c5830565e9effcb52168e1b82a50f0becce2022700696755d0e2b231cbcd03a5535ad2dcb3d1656d3087b7c7244c64

Download Submit
C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui

Filesize
57KB

MD5
844858c0a73d5a4aeff3072b6964ad50

SHA1
f44571842993ab7fa2f6bf2a50232c07741ada4c

SHA256
cf025e7f4724e9a28e2ee726e5d39d44eb2a4661dea82ab456be100d4fc008cd

SHA512
bc036df10c51cfd71378a26d3c6e3b952c619738e2d455315ac629982d9a29093f590b9591a00b84a9812a8c4aa22a517e7d9cf43eeb915a6433694debd9869e

Download Submit
C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui

Filesize
47KB

MD5
8ebab46cb8bfb7b6d4215734a18170a8

SHA1
c0a09029955fb1c542e2741049778ef5c18803d1

SHA256
5bd88271b2b82117f822b7ef29f65d768ce69fb1979e97e16fac0d7002e04e39

SHA512
8d2143ab64abc818c94dd514d69e3786fd290822cc899303a5ac83c636d4d61d264676c9b1add79eaf7924edb83d0228830d7ce8fd832a5f818fa6b1260f5044

Download Submit
C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui

Filesize
54KB

MD5
7349c222b04b380cb35fe2cc27a2e6f2

SHA1
83b86fd8a7467268b7f58e0789c00a8302cbd391

SHA256
de6f21a55380002776245c1ffbbaee9d029d9f3f98c4f77b95aefe34d5c224a1

SHA512
f2f8a8af76a8df23e8b320bb2354d69bc915cd8feecb732a0c6ea4de05b6c6754baa589fb41c3216f23c8b053d73ea18387dff5e96d95d08873b76b41d831c2f

Download Submit
C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui

Filesize
47KB

MD5
4507b08ddebd3f79b9e0c7f23165ab7c

SHA1
984b76b0c50b3f7b427613783f3bac772e585a6a

SHA256
583642cfadfae5233aef49150fe4e3f456b5220d2f31befe3acd7d2585843871

SHA512
dee8351b3b2ed045b734160f7c97ffd165a5c330f19b95b3d1fc9026beb8c811ced14bf994b34731321a7f213f55c03daaa3e706f6d75b8cc16939e19c7a57d0

Download Submit
C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui

Filesize
32KB

MD5
5d4105a70656f1ced3c927bb587e980e

SHA1
3e0f87b44ee774dfae96da683b6e192817ea2446

SHA256
120ca6ff43e8aee2d020a9fc3e38e9956b7bf458a2f60294f2689a0665803305

SHA512
69dc7d6e629a7dbf0f80f3a17eb1db29627b7bd572783ce205f257bf857ad72bc8a926b6eaf96205e13e8b674283c3e809279b90f932ddfc606a9de2ba8a1da5

Download Submit
C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui

Filesize
37KB

MD5
e880efd582a9722e20f04500776d2466

SHA1
f4e36fa48e2ceed48c4e621c69b611fe10231372

SHA256
82934c001ce5135cf4e8c770be3721707d944d8c41f900ac4143aba25f566ce8

SHA512
89c9364ac8da4d38d7daba4783a42b2867f4c8030f159aa0101b8d06fceac72fea69aeaf4e1a0fae44ebcc38660eb7948020195e0a7e7ff6711e6735aa9a63a7

Download Submit
C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui

Filesize
20KB

MD5
0137e026400c6e5aa6e7f60ee1118b82

SHA1
9ef6f80d134ed9bc3fe2bb112ccb2a7a1ca8ed83

SHA256
2d344f114d6014f53d3a25b028052e2ef495c277294667b848f7af03e0322e5c

SHA512
00849f3faeea0454d26fc74efa467b680c52eff40dc0333edd13302f5975811b75dca89687ce9c7c3a93d5ff77c50af827a8b64ab3b658f9c1a626fba7c1dbfc

Download Submit
C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui

Filesize
17KB

MD5
a4561dd15657ad8ffcf07101698dd214

SHA1
687d75475154734ab01cfb4f32a2c749951b0e1c

SHA256
02b40d9b034bb9458ddacbf9c7bdbb72d79105eb9da5b5e7892f0932c3c6c152

SHA512
da84273577e8fe24dbbab0df7d27909051a1ca933b09f517b66b519bb2f1a1defd9083d7602c022040f666e82835e8e92795a1181793cca03b895076606d72eb

Download Submit
C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui

Filesize
19KB

MD5
c4345015596d671f4efa4bac4f1f5189

SHA1
bf1f13ac2fbda835d3b3a4fcfba8b1dc89b0c9cc

SHA256
f5868636f3011a5ae3cc03d2c8b68212d747b6a5e4bcf12af1b50eebb3e4186b

SHA512
7e1405f82abb2fb3fcc9391a0a774541fec05105e0a07d5c8cb734e7d11011537aee38a4645e2e2173464cdb923d3282b9be58a6ed725873ce75f40258785bda

Download Submit
C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui

Filesize
20KB

MD5
a19f875670f356978dc1a3c07e7c8cd2

SHA1
ed0206eb63d61c6bd852d9a1411a5e4560aeddde

SHA256
6b7c70a39f27e31520e72bf176b14b9a598e744660833b00c9362ef590f4c674

SHA512
bfd1272a8105f8d34c8916121a86c4e8519bd3beaa2d6f4ffe936f6f8ba43f58829b5317c03e563776230f7d2292eca529b952b3b8275daec41945144abf7e16

Download Submit
C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui

Filesize
19KB

MD5
bf9a06fea1c6a05d1dfb9ca71aa421a9

SHA1
4264f34a1337329e30e1bcd16605bf9de57375e8

SHA256
8d7ee5bcd0a9bdc482a278b8779691a49d26410c3b6daa0d28e71f1aa9b82214

SHA512
0cc459b5e83c34eb81be333c7df0aedec068276f44908e467367b9c9c233c4526af0c1602873b5fcff83b6e97748c93795dabd1e4f7196bae25b9fb07aa25f1c

Download Submit
C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui

Filesize
11KB

MD5
67a8377d1aa9d5cafdf0d5dbd09cf2b8

SHA1
221aa53a396d56f900be1681f15ef90c89edf9e6

SHA256
9524be5e57a2ef54c814de2b77404abd9d8a41cd9d26356abae74cffaaa5ee15

SHA512
ce8e5c020873fea306635ee3f578cc21e1fe35c19a8243646b4d9256b7adcc6b4709ebb040470286736b6f48c4c889ce967c414630bf83704bb6049e5affaf0b

Download Submit
C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui

Filesize
102KB

MD5
6709af5f04656f8de1593f02073518b3

SHA1
7a6174409acadd3c8445af31630baacccb3f785d

SHA256
5795d5f8e9af1c9490949bbecc175a58d7a227ae5e0954fa226fa03d3b656902

SHA512
d0756381aa3d4649438e278ca6e2893270cf5bc45e4ff372b9b9ed2d43541fd57b7fb906aea6e0cbc149eb2b398eeaa71239a9953dc57bf26b6588a0482ce7f5

Download Submit
C:\Program Files\Common Files\System\en-US\wab32res.dll.mui

Filesize
92KB

MD5
f6d8aab36769abfc9d94a3994e18c76b

SHA1
3d2765fb61f7ddc3d12e24d3222afd85569baa5f

SHA256
4c31f372352661b5ecf05e6a082c729a7c8515364bf2152eb72cf0d4dc6444f4

SHA512
a79048d6c3d312755266f1b6ac7439d5dcd23784c8f713c3b843df69927c6f95c365192a9ee42399f6cfd00c90799c058567e05d49dfc19c2e3e182c5870c073

Download Submit
C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui

Filesize
102KB

MD5
0b7f29d934e596c31d9e702f9e0d0a00

SHA1
d4de5196a03d3e3ca0a7a32b1b09a5b5899794b4

SHA256
d8d5f2b54a60e78d6bde7b07e5c53d1c7be235cfeb9429189213091ca0a1fe1a

SHA512
0ab85a6b4dca95107e898a44659509810faf2e9df59a35304b89e9364789b2ff27383514d30f023904d241692bc90ccf303b988ed388783d8feb623b335399bd

Download Submit
C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui

Filesize
104KB

MD5
189fe9d915ed2c6d8b11ff570a91ab3e

SHA1
8f87ce748d0e0630aad58d14ab291ab7b577da2a

SHA256
995cdac44e60cfe42a019699196301fe401267f005bd405326c50746375175e6

SHA512
c90007d0694ddf43c5de9bc8708c90f3d35fe10fb38b0344225477bfb5dd2bc3b64ccb318541f7259a8e8216fbf2899b50ffbd9aee0a34abdf7d54944624f2c6

Download Submit
C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui

Filesize
97KB

MD5
4e8bee4b02c44ef9e05ea99ee2b010d0

SHA1
bf9213d9f7105f2e2b2104d7cd73baa7c7bc2851

SHA256
2bad9a8cdcb70e437e0a0e1fe33e3b6845581fbe93fe332970a9861d2ca5ff04

SHA512
2d3371e21982d4f1f5a93a3239d5ddbb19a5d350cd7e3a689d671da1ed4376340672114dbcd1a98da68fe558d1ca8966be3a190943766db7a005d029966a5374

Download Submit
C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui

Filesize
69KB

MD5
a7ecc05796fe7f102490b2e1930f7749

SHA1
ce416afca9564ec05e176114b13bc7a6859debaa

SHA256
35f90525fe0711ef0391a62e1b8ccb8d65681e6a39228936dea77c82280953ec

SHA512
ab9136d98a51787178de66a208d07509af4c38fe122767fdafe6eaf4dc1a162f200aa89f667c18a3d573bf8a1624ee749763eeff7b93358868aea442cc4df49c

Download Submit
C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui

Filesize
12KB

MD5
f8d760158c7132d11182d38daf2cbd47

SHA1
68f2998e01e25f14b50819ef026bf28f62ce7a17

SHA256
6b572dafc2fe3412e544bc94584e072e8f84b8cdc289a02f87d864a5819e523d

SHA512
1a3dc47472fc7682031729fc900d787c676933a4c1f64a190493c221d9a3ff8f955b14ffafff8fad0b5d020a9807279a0427829ced1ee6608c1aa63686e5a22d

Download Submit
C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui

Filesize
9KB

MD5
00bb8a8aa666181768330dcc9ddd6b6d

SHA1
7f79defd1f740cb67ff80e1f73625eb3bd444b66

SHA256
58e5de889255e4a8fd263b97613b5e69d0161e70c34a4b80ef13eee024073a41

SHA512
a864b8c3d9a9aa92106d99b928baa23cff4d2fcdf2dc7e9f59f5bd4da0d973a9bfe1ea906ccb841053649463286a1d24fb0331943ccfcdf4a917bdf86bd7294e

Download Submit
C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui

Filesize
10KB

MD5
0ecfe3be647abdc14e3126ec92c3dcb3

SHA1
434a5dffbd1c38219ad2a17c3b6a723ed6c03943

SHA256
7e47d84efbd33ef384e1198ffd9f6a37d6c587eb32cad044ff1209bac2b2b036

SHA512
af77bd2d0fab9786ee28330da686b3ac93856e932f36fa4dba2ed29178c132134fd10f184ed0909053871f39cfc43ca31d5f53aebcc1b8ec2e9a6ed6c580ff77

Download Submit
C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui

Filesize
7KB

MD5
c460861e92b9e6746557d4eaffede051

SHA1
200749aa146c6ae4bd255bf89b4e58399921de8f

SHA256
b37c648fc1901ea2e14d10152945746f816e6786f1be16304ceb18c6f9a30d19

SHA512
aa3b9e31a4454855fcfcfcfc0e46a9695185acdf059cba762ae3de0bf1d570f2fe7d3786c5ab4ebfb9f1492385fff50a2a15613c6650ffdf2b017865507fd875

Download Submit
C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui

Filesize
11KB

MD5
84bccfa3ae5a9bb571ec41511c0369d2

SHA1
d50e269f4b007c2fbcbda2c0295d2db38090ab5e

SHA256
a6d1bf1d81e76608aeb9bef8b44f8334b010a293ae3c3042a42c6bbe5c10bbfa

SHA512
4d22e6e55a0edcfd540cd8a556b596cee483e097c6e4dbf8399ce11d7ff426e988f310d02d4285b9bb45522fa82d319fbefc87370055a5392fc94dc81a075446

Download Submit
C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui

Filesize
8KB

MD5
25acfbe23b9c7c829b51768f8596094d

SHA1
7c00d837db5f4782f356b802a5c384bb396a0492

SHA256
71fb8e9d6558d9bf85b9bf4c1d88d93baa397f215168ec41fa4fb87529dec442

SHA512
22122ca6e9fe091acc92e9a08d829982cb3ce36341fa1ddcb162b21733823af63954a40f224bb3b4ab7b88323a9f72d12c9aeb5e1c687217664bba620f8f7c28

Download Submit
C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui

Filesize
12KB

MD5
c206697a2d9e1ef17928681e33b543cd

SHA1
083e0d827de8916870b853f1ace3771b21854b3e

SHA256
c1db746c4fc2f72378502749e73e4f81fb94e929e58022a33989138704203b25

SHA512
3eb718f3be3b43f89d61408e59eee26c33f527c7fde61416c318f96b9fe8758fad9171240b9fcf8c5c473307aa6a10ee17b4472be1cb0299d85ee5a698f588e7

Download Submit
C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui

Filesize
9KB

MD5
9018dcff175d92deb37569930b813199

SHA1
68cf8ff6ce052d12b26a7c0165b02a83e1bcaac3

SHA256
c13619229ca48cc02e3aa995d5d6951ec752d0fed3fc14b882d825c132cc37dc

SHA512
7b7a0c0385223902bb1c124c3ec06af310097ea4e98146e6c0d89e569496ce23cbf1703bdf31d5de964af5e1562d0b0a2da328e3647addf6cf5c5cec48447dfb

Download Submit
C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui

Filesize
11KB

MD5
ae9dd7eab9ddb2b1269ac46a8ace894d

SHA1
2abba40437b5a5d7e9ff8c9694c1d83728bc684c

SHA256
bc0f98b7f5b628bb558385bac44b4b79eb23b827af376a4e1d9da13bb10e1b46

SHA512
c382b008f86c2d7b8afcf3c9b3f255e4a92b0fb25863a1a3d07295532b223853f4d9dd9a990e09537a93c4a93db4cf6f5c274df698c9a4cb348b081f7c51818a

Download Submit
C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui

Filesize
9KB

MD5
7206ba7e687be682d2236ef1e9c2abfe

SHA1
7992b79fc2af78a527b68410e8edbad02b9581e2

SHA256
ec923b6c4e68c2c0534839e47996a31a8890008e6487bdff6ae70b591039dcac

SHA512
10567874811ef28dbe2cfffbbafd812759e6f8b97b87e52fcab0ab107545f3714335aac09a89e2f5009a929e0f5558b73afa719717859769a04de389fbe48ecf

Download Submit
C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui

Filesize
6KB

MD5
fce65161c52c16d68086690c3ea46e46

SHA1
65c8bc789aa7df0e94ef0edac780c347f28206c5

SHA256
9ebafc63cc75f1be8dcc515e851c73b213403ed16a0547483475d7ffddc8e1bb

SHA512
2cc50c86c86801cebc8fddd7da55b4f6b1bd9be2e9d25a5a589ef9e8739c0727d22aa48ee5ad9a01a2f71c8aae70dc58cbd3d04a0940dcfcea082ff982e86f49

Download Submit
C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui

Filesize
6KB

MD5
e9926809e2450ff252eaced1a170cf54

SHA1
69c271b6f5b60f7a80c7e874a96b4a3da5cdbdcd

SHA256
f8f5d6c9c8ce835c9b60b1ee0827125ce605b354a9d66889bfbb9169b0bdeb45

SHA512
b1d43fddfbc8156d84071adad9a3c9a8c8287e9d72baa01d771af2a650161a7866ab0e0045396cd284b2cc16a40d62c4326d4987b7da03a033cc360c07eb3e60

Download Submit
C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui

Filesize
94KB

MD5
095c4a5cb69459b355ec10c00045080c

SHA1
61c5fc091652891a93be3e68128d4c9cc2972f3e

SHA256
610debc0e8016980256bbe36f7213fbbf4f06286c775c6ba4c1acf503dd6f888

SHA512
dee45effc047df07f3ab7c56256b1a220e9591156f9130d38387a50237391dab47de09727f799eb4ebfec8fed17ea6bb0f4d6495f798757053353e7eb21b4d04

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui

Filesize
5KB

MD5
b2f15dd6d0589cfeea1df50cc33d65ed

SHA1
1e89efadd7b9744e6cc99b8309f1966232b86b8e

SHA256
244aa3e66c840ce1f1dcc3204c19faa15672da838e3660315e841c696dfbccbe

SHA512
1610015645f451069d383f3f46f5caadcb440df5ef471d69954989583fb040ec295d414734b691f54ed8c1666fa1330ef447f6a8b254d2c65b0411957abbf064

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui

Filesize
27KB

MD5
915f407be1a5cf711f40dcc21e52e3f6

SHA1
6cefbb4d462541d5150a9597af907ad5a1c286be

SHA256
fb14ec4a7a1141f8fa64546b4dc0b4e9857831ca379f613df56668d224d9b584

SHA512
c4e9390777cb9a0c93426ee5602acd20002cde9299bc6965ba81a3f208d0bad0c5160a046fb6b2f122b143275856d1ddc9f99717ce3a31bd27f2700ea860e340

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui

Filesize
3KB

MD5
1d680873029e16f3361a87f505fa1e2e

SHA1
07f9eadd672ef0999951822e8ae0cb405c5119df

SHA256
541ee688c19d52b066acb9246481e0645d50ef6d1e93f24bb18f7e54d0bc726a

SHA512
ecee275017c528e082ae23f8f0615ada9dc8f1f97bd2c37ebcaa7749823e96277d4af13c7698c8f06a0cc8763704018bcd4222cb85276fe0a805fd50b7a1c554

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui

Filesize
3KB

MD5
a3134a901556f45c64c8b0f9377823b9

SHA1
fdeb6811560728926412f11e259408051ee7d13e

SHA256
5aeda56470092244ac552367a26594a7163d51104820a5f066fd511a459caeca

SHA512
a3fad7d7b668dff86b986aa8150dafe26a4aabfc7ef8dc68ce37099b67cc10e18f95beba67d21a93aefe837763a273072630626ad00dc1840c17fb4187779431

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui

Filesize
5KB

MD5
ee79bc143a36a5f39d60e07ca53949af

SHA1
cae038e5947688b33b24f4e14d52ef4e8786d3f0

SHA256
680b7ced634c050b0c738ec3d6cb666ef23b8ea92a96231d57385c54e72858fb

SHA512
f6851a12df68f17c4e895ccc01fd96c7416475d2c1f6d289396f9af014eed4aefab0ed55fcbb55a589f043f4a0100f3c0dfe055e34b47e0b20fb0564d6e62a48

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui

Filesize
24KB

MD5
0207829253404138c6c8ad26c01213ab

SHA1
c0bf9650c8e04300fb8acc95961ffc772bc70135

SHA256
2a0abaff6da29327b8c83dc0571a3cea0fc5f6c2d7c7f0e10ccb617cd61ef965

SHA512
f2bd3d24c6345fd7b0195ad9385d200b7850a8625e2c77dd35855a3041145f62b24077d53c1ac087881889b2cc0fd2c246dc45448b9638e9ccfa2eb5226d7781

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui

Filesize
3KB

MD5
7ef58a359e20ffde08064e7e6b2047be

SHA1
847bddd506f9dc578864003fbf79027be1a4aa89

SHA256
1ce5f9fba25d6d22edcb6a1b42ac0eabc2ee9d3fa0d4241aaff2b89deebfbe64

SHA512
84843ddcdd277a2f4929f90ef4ce7c6341dc42b2579ecb550876f625dca3a90dfd9f8389e8f24c8fa11de2d2b160af99779c849b1993fb6f5ce7225233fcb3bd

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui

Filesize
9KB

MD5
9b14eaaceb4e9bfeecc5ab2f5661c395

SHA1
1e3d23824cedd3b3410a7fd002b082972eb9665d

SHA256
2dcc303a045a0001d430e7fa7d3172f632c75abbeeaefb37337fce1fec5a6288

SHA512
17dbceb8e18700b6d5ee4b0e261504e435885c2246901f43876e058075156c896c8281f40f76a928a410ca39214a2cfb61c5d4607993e7271f9e6e33ca70c33e

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui

Filesize
3KB

MD5
6d9a8c99877052f7c36fd642c0d2bbff

SHA1
8639d09ef023474a3a7b6749d8fa13368100c426

SHA256
90a4b4e6816005c97874195ec229c43f1f0096129cd35abd3ede88f7f98fa032

SHA512
311aa110ac7c9134339bc0af361280a80f4f69e89e333ba738e9712102cdb34303d01872a53d404a7c6334cf5b00a0b09c3936914d58fa9316652eb7d9e85d12

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui

Filesize
5KB

MD5
f97c681a6e0bca8b2e11517aa9e1df65

SHA1
70a85cc13b54ed6fe6671093d6dc440f34b1609c

SHA256
de59fa0844965fc2175f292d45c2182410ace38146e5c219b90dd1a48789822b

SHA512
842899c11d1c79aa6b2b21fc71900392f7619683a372359ce2bd430d0bebd40b3e375e3f7c0dd6b3b900d0fc1c3cd459088576a90484a912ed6b7ac009d19bc8

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui

Filesize
27KB

MD5
e1be0e4540ad1c0572dc4aa30118e2c8

SHA1
08b55f354b661828b4797c85f37e40bb41656950

SHA256
9931034feac29c980e868959407b7825277828bdbf7e9145a613be4ab7c3465f

SHA512
4633613572836d58c3ef46e60b8dfd557f8c425cd2598d437cc3da2a560429198eaa8d77ed61829bc36be5cce569ea9c1845f160d4411a6c86d7d324d1a3ffe3

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui

Filesize
3KB

MD5
0181d7434a13d103b24b3c4be5f43b6c

SHA1
d808ed75f65932e03d90a1c26cc3ee622b2888dc

SHA256
8271e694b2393dd0dc3e37e6883e51e72be2bcffe021e2cb31587dc9ced0189a

SHA512
5d75e7736b93eada0ea6d6a5f6e643fd892a32b8bbd07f0c5c189dd9d7b212004e1c202820f4a946dd32b8f2ec34539eff7d63e6667b811649d0345cad0809a8

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui

Filesize
3KB

MD5
af39acb395b7ae7a565a1f10476532e8

SHA1
ea72f2f11dd31d12ae3203793ec7c76822931381

SHA256
2caf42bf6d3323a9c8fab4a1bb6d4973655ec832174cd7db7966de33a6453d27

SHA512
707e7a256c7175ae2393145b2f96548852e25b30951d936d2722f4888d4bef5c37d60b2c0fe6454fec60279d80b043c29c8f8d120713598280df5bf607417713

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui

Filesize
5KB

MD5
802842b5b4fa7cc32dbcaaf7f30d5673

SHA1
0315bf28d85898f410088626c97f0b8de05afe89

SHA256
3ca730c55dce7d8050a0b1007fe002e1e08e3a3fb57a111a62550b77d4074ce5

SHA512
e0021b1e52894bdf220a0657a58d41ba13e83703ad3c0b3f187ce31366436471e02d5272eff5f235fd15dc4edde3b80ae7f4de7e0b8942f1fc5f7d962243cc01

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui

Filesize
27KB

MD5
e5daa979f14b66e39a966b0285c130d4

SHA1
d8702fe552704b30a2a0d74d7de42c0bb0c51214

SHA256
d83ebd06705a30985bdc2ab8c001c3424996ba6147dc51814915122e69ee954a

SHA512
1db64b59e58ced9d5595fff8a20515650753ba3a7243c2030fed076be23610198ed9aaba60d65700876ec732d7bb5c92ed34c3359a1ff4488acb9bcaa3f29237

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui

Filesize
3KB

MD5
e4785119a48f92af010e19b3885ef037

SHA1
d0d75d6b7325ba10934bff78571529ccf8206f3f

SHA256
23c61295f223d60eb2bdb9d06b1ce9b12bc2f70795aa0924e9ff8fc123811ade

SHA512
51820fd0e78e99d461d802af1c781cd98aea54669c9d10f88239ed7314c152007da549d921e9c64c791fa70a310497f888fb39b4096a640cd259d9e7e72a938f

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui

Filesize
3KB

MD5
3060d95f21611a5d4e8425090a03ec8a

SHA1
965b6c9ad13e43eff1162752d9b8a931953d829e

SHA256
4128135fff71f302380d0339deea81fc3bce4d4cfaa81608c9b8d1c0c64cee32

SHA512
0389d58f65325bb6929e1b38112b89de93ccd32675e5e45642df7cb3657751a971d451923439c3d252180f9d87d668590809972edfd862e48155b35a098a2b9c

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui

Filesize
5KB

MD5
e6b9acfc1598c17633fc32a8411681a2

SHA1
dfa44373771fee3765c45a6c41dd121e6e1468f7

SHA256
f1224fd9333e21c5f99ec235dea9ecf36959ed5d62b5dd976bd2ac62a33579d1

SHA512
e78b2011be16265cb3c34bff8022c5c80423944979526dc7a2fdc8980e1b3e2a10b01c1d6c6ce2ee54966cc95b63d4730093481a8f4b5e7341bbc662be9c1ad1

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui

Filesize
27KB

MD5
a8081f1bddbe92865bf42dc95a9b8a43

SHA1
e6111a4336cdbf3c5008fd10956e442bc008969c

SHA256
62586f740f624674a19bcc7cd17fb8f3530214a6f64cd37e4783f7756056bc41

SHA512
9f0669ce128e01649ecd749bf21cf0acab6be76a175a175761bc1e15183b3d0fee720806bb31e59afd5f577b4380c5178b3d1e9b9006a10b6cbb698924810e58

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui

Filesize
3KB

MD5
b19c77d3f0a2d175656341240dafdccb

SHA1
5b797389414ce10d84a873d08ef0110f2c389678

SHA256
9b14ad55372347cc3b22617807a5c38759b047ad62563ed8920215a2621c528a

SHA512
b311e8eaea0a9b2f117fb8a66af5c23c3cf19bf960d42066542a0d8767a9085a4ff0591422d68de0a5c87584b490bd86ecaa82922dbcd6291f06dd58a3762f1f

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui

Filesize
3KB

MD5
62a477f5c174a12dc346034275ede225

SHA1
1d53af1357221bd80b0524df8a117106719f100c

SHA256
6c7c10d731c28e7798ae37055c40a8e857cf89a6a15da00b0d5b25cca3ef6fcb

SHA512
e9962de37a81cb4fe66dab2b4da231ef211afe670ba342758bcef11f80d57109d769713ab8511d605a5c92eaa780ff35db0faacb676ea4c6b6124ac304ea0860

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui

Filesize
4KB

MD5
1d90b4ab0e656f5c9185fec002342730

SHA1
a26a6e22e35b77c4e0e502d3935e8b35c15e9f1b

SHA256
cd3488b7843f1b5b33f1f18ca953096af7aeb4157e300217d1359e50d5a6731d

SHA512
bd7ac33ed169b3ae3bd771d154f592bdda962852f3f094f4711594052fa3cb6dac397de2a3efd5443441cf4243e2fab7c2ed4baf551a3391e7be474a5f2aba9e

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui

Filesize
16KB

MD5
f1e6b97e2696425b698dd64c0726d2aa

SHA1
d68d0dc2647c204bee7ca7b303b2e3a5b666f8dc

SHA256
ee3b37b7701e29fbca1846251b93bd2555932b9c95870daec39976ddc330ae17

SHA512
39185156e5cda729df74c38112aa6df678ff58676ebf6d85dac7395302719f5e1793a478895eff19689a21e3c3494c4115b32ff5fcd1c395b78fa2e899e2f791

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui

Filesize
3KB

MD5
5b7cd407899147992e7a0cc93eeb563b

SHA1
548d46c716a167287e0699109fbcb8e360e8afcd

SHA256
2b39fbd52513567c472d2bb154d8fa148e083453db76fd8758615715f78fded0

SHA512
fad762a1489f3f7f74c490e9724a69a9b10c2f449c6ed95b2ac6f3fb583f198972de1708f351f9667be4c2c80424d46cf206d28330583363ada4a41831535b6e

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui

Filesize
3KB

MD5
312f40f604b2854f21690ebd152d32ff

SHA1
931b5a95e26569a01db8c6c11491b5d5aebbf2cc

SHA256
ff690295152cc8980c5cd08c9146215c8c8fb60dd0f9f8dd0868e868a66599fa

SHA512
226eb84550377e292892d8a66bce41609168bda16b5ec0cced1d431ed982826f9829a8e0132fcb3a9337d6cf35546b32741dfbaf4d638a3cabb6322c9e296ed7

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui

Filesize
26KB

MD5
ebb0856add2129ece7256738f1e0b464

SHA1
1e13f8492024399309b6b8fa33942a4261dca885

SHA256
78f6827f0d08d1c6518b003c441387966b68fa26bde925c33cdb09e0ed4ec684

SHA512
c5410dd3ae1d41a454acabd66b960f13d885e0d76ac38291978a7cf346f6d758707d79d9fabf631a99adde6a9874089cbd5ccd0c362febcea6e8d9a06a96a8e8

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui

Filesize
3KB

MD5
31752b791c8eaa66fd9a791a34cf7989

SHA1
f3c2c164163ad4332ae7f5c3ae8226629ab271f6

SHA256
3fb0b7ce78c730ccadf5b4cbb64858195ca384d7de8ffd7e55825263074ac970

SHA512
64a2eea58bb31e5a63084779a326f09dc985ee0e49aa0626305fe5581d6f89fa8fa1660b4a708133107f62ff8db52d0840e662a564147e29370bf652fdd63928

Download Submit
C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui

Filesize
6KB

MD5
b8d4784ea885ed33891fab8f4a12e047

SHA1
05a06f3ae56ef98bea9b12de9469ac6224bd1d25

SHA256
19e4686f86740a86f9c76dc55229fc5ae6249ea177741d5641ce921727ec5f5f

SHA512
aa489c801d442afabc54cf0bd02f938968d609791ffbd07d8afde3d03d96a6439a98b81dd5e89b94ef305b1e8981b14d299891829690a171571998f9850f53a6

Download Submit
C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui

Filesize
5KB

MD5
2e2e813d03399674f384b3096329c915

SHA1
7244df98cab19cd01fcad9dee6ff03d15b59bff0

SHA256
c4ef1b31b3b3133b602a1fb515c8c9e9a71cd198fa20f1b5cc5b611f8361dca2

SHA512
f686fcf80e2f546c2e2bbd96ae68d9abef746e5fd72f4e97445406b332239759dd4fe664ed18fa56acc6d8bce811dc8de47167715a7460d414fd7c393b209e55

Download Submit
C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui

Filesize
6KB

MD5
0c45b8fbd9513e67b92edde52699d67a

SHA1
1ab047c1cb6f9ba9736e42d3f1ba5b6629818f8a

SHA256
fe72c42946b8bb6e72cbe45782b9d7ee967ac66e364e4399ffcf6ffe9c37ae42

SHA512
884b65c9281768f38d3b0e132c73f6991edbb069b8b6b2ebf13b1be6f143f13ca31d076fe00621d9e4362e9c8d228c458d6708b3f4025f0f50a4a212aac99991

Download Submit
C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui

Filesize
6KB

MD5
5594686a4b21600bc5b027c528987d0d

SHA1
bb4c7142277eae2c29100c86becf79633f4f317f

SHA256
e357c7e1e02b38e2510d6ea9b07d0c371cd3d2bf2f32836355a71bbf97eda580

SHA512
0f252d9f2c31150a932073fda0e20c5fa3b8e63b32fcecad03766d2bf63df18dbb3cc3846d4369dd9e2fa09a8eace7f2bc0193b047765c19202e801c76e46d0b

Download Submit
C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui

Filesize
6KB

MD5
04de1a0b2c2a7ec15640f82715545cf7

SHA1
5eacfeca09fdd35378d108cbc4cc06103388d67c

SHA256
e1106488e4b23b9d767c161c748f6fb31b521436a030e9e2d93ed9717c764076

SHA512
5df90f94038b96f2884970cbafd0961e9b5db1d85d50ab5c52c69b92339833c39f7fd3bb0075ef5b9925c3c80be94198ffd94ec4cccc594e826f4d9ff63c0230

Download Submit
C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui

Filesize
5KB

MD5
2edb71daad10b152f515abec1ae83150

SHA1
97ea48359cf3b6b1a93d0fe005cb37e0d2221b5f

SHA256
f7c33cbca6153f13f4ce8c6d2cdaa8cf8af7cdecd4ee6f0ac3af9258857fd5fe

SHA512
081ac6e0876825258fce43593d036bda3b72a839c00ed09140b8a317ff4aab6082d67b713dd4b07afafb0a3b765f747efc0b20f2015fb4c8cc1df6fea22646e6

Download Submit
C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui

Filesize
6KB

MD5
1183faf868d4404ffb3374960f83da76

SHA1
6db3a9bef452491f6d5a1f0e9f09c391ceae20b5

SHA256
c70170f04dedfcb02eaed4d31c2f7444db8bc55abf24c724d90b2beab72e39da

SHA512
a38f4f0a3aa0ba9e244e9d9cc8196f65a994439cfe1d7056e51fcdec201927d180993bb8ee507703f5955efb6bc8395d361c253653e3fd5dbd0feddd822d1a8d

Download Submit
C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui

Filesize
2KB

MD5
74e985d189c4d55d0f736d9fadbac3c7

SHA1
400e832845610431ba7c846beea4370575224d13

SHA256
6a519cd443fa29d336b84ec9fbafc7441364e6766e9b5b6fd8fa820e092a4ad7

SHA512
f5f5e3b455caa438da8250f07ea771f1b82a342a08ec179d59ba4dc55c79a4d894e31d92f5c4eef0d365a491dfc8daa4bed9d9c12fe1ded2827966661aadf20c

Download Submit
C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui

Filesize
60KB

MD5
24c409fa29cd24c7410ad07f278a4121

SHA1
5c4154c70c155ba413b47e4671c8c4011cd2c812

SHA256
072b4221c7ec7b65b7fd94d3cd6f01d44fa196a05e62be7494946ce5e563e9f4

SHA512
cfc92557ba777078da26bc7eb8c68bfe47804d8e7cd423d5bf4cec00d4635f7fe7d10958a3cb0ab9658c80cf5050d9b05ec5189a673440034edcfda142b03aeb

Download Submit
C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui

Filesize
3KB

MD5
55858cd9299833cb9b486158dad00e1d

SHA1
0232f70fa1621027b75e665afba552cca7dda952

SHA256
abc2e1df09a75ac97a9d178139975690d83018deaf4391f37f65d81685a23bbe

SHA512
9d3003cdfb11887806683dfd873ae2d028f683362da6d991f11b011598c18139812007cbe1172dffa9464a8aefe512d98e964542ea4c6a3081ca19cc74b70720

Download Submit
C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui

Filesize
58KB

MD5
6e63e601f892e4edfdc0b15d91259be2

SHA1
51787fabb319ad0fa0dd2abc82a557d96d0b73f6

SHA256
0909e154642a051829c0c89902a462c17dbb984cb52e87290850afd6a7506ac9

SHA512
1f2c0a2975bc1c8c71231e2e3119dc38b23d551a762b699e890725dae2e7c252fc56ca6134eaff7ef2fe3d8d38e5476e48e19d9d2124184f71f5da909f8b0b6f

Download Submit
C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui

Filesize
3KB

MD5
affa6a87f217f6a39f242e0839b798d7

SHA1
468a0c7d4d09d05552aeef52322f073a37f72518

SHA256
ae51184f2852d1e198999f43a3f79e5979beda1581c92e02737e00833d9cf26b

SHA512
e4132ed764b402c45a7b289baf7d169d9a06c829bd450e7da040b023aaf49eb9fc7fecf5f41b71f5ef4f0eb1a8091c1a2588fa0e0d5e9b5a33dd39e226eb320f

Download Submit
C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui

Filesize
61KB

MD5
789a77c91f0018d66dac61d5da2b6c85

SHA1
4244e23703545a806bab9b053e97745ff9e9dbc4

SHA256
4558ae8a92314379a690dd25059dcfef09e557d307af20411ae25f7f5180fa50

SHA512
c4340a5db8943e1fbceb4e4802dd1d7f2dbfb76bfa1dcf19d86a13c04e40824fa7ce396505489db04bbdc7b99e5625397694568f582780d6d4e3408d5e7cc05d

Download Submit
C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui

Filesize
2KB

MD5
4b6a15c7f51e3d6cd19126b489768e7e

SHA1
9af77900c42143845153b44fe445420ffa7c1f86

SHA256
ad1f7d083a81bc672304550aea65fe8352b38f4fd2ba2c63d8394319e60bbdf5

SHA512
212cc22265941ce98f44cb8e0d725dce66df9b3fb36ab85a4e8ef40f77c3f4d8b2b70d544ba2331cce9e8b7800e9c3e0ce47d721565969f725a1dd1c9c957b9e

Download Submit
C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui

Filesize
57KB

MD5
19f492c23400f64913ecba3d95003045

SHA1
a82a1687905a86097ed53a6ae99928a262c7e79a

SHA256
28f273cc993b40d9c00fc1d461965b41fa4d934365244a6265767457f30435a7

SHA512
8ee481dae98f69038d4c380c2347f3056a54050a22ee3155b95ee07f35e53888b3d33d023606e4faf9980ad1816fbb9803278c5ae62240e7b530b5d7a11f63cf

Download Submit
C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui

Filesize
2KB

MD5
548ec13bd5009dd633facd396d5acd7b

SHA1
42d39b6871bca479550fbe1a8f9286933928cadf

SHA256
950fe2ad4e719d274c40c0b008398eeb1464d93a834b827d65d63a46f8202f11

SHA512
29245458ef96ce639a677ebeaa4b201b21fec30cb121ee58e518e087bcf562094ef3d8035eb66753976350330d96424de54b1e4b5c52aa9d41f4708ccade1d33

Download Submit
C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui

Filesize
31KB

MD5
a630d229a9ac13206cfa0a47d75120e0

SHA1
9e0b81e276b6fe7ec67768d540f20265567590fa

SHA256
3899dda01856ee0497f60326fe375bd5c203be5a387f05ed3751f906a18346c0

SHA512
0ff4b2f626ecc06855b8f675b97c94ae2e7fa7610675579c14de9e53340f9d0154a4a8aad64ffa756888af9ad68ef10a380fdadb2c7c512c1d3807cfd538c17f

Download Submit
C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui

Filesize
3KB

MD5
9418ac8e57ff5f3d21fbebf5b5c7d9b5

SHA1
79cbf0f1286dc7b9624f1e333c0e3ff71d4b0028

SHA256
f51e585c2e10c5636f06e73c6b35d7ecde638d96f79a3f819e2e69f5decdb51a

SHA512
eff6e8fdc5dcfd84048c69fc190f6edf727614b732db5c4c1cdf343b5a8df1a4021f48cd96ac4809642c94004df15ea901a0b5727640b4e614325f608e1c68f2

Download Submit
C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui

Filesize
56KB

MD5
a157887af2c7b5c386e2284fb2ab711a

SHA1
59c7514f69515fc71b26dc4b87fa3d031d6bfef8

SHA256
1343a3071b002a12d6142edbbe45b51f04de350fe77dd1af49759c5b46c8843b

SHA512
f16d228089979de0fb8b374da913b3c69dfd92a43db7a9f65da5c34a51d16bbc7c28d59b8f6d1371c9c54ee110f5ceb92c517011bce71a20bc053d0b758c3192

Download Submit
C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
0effb8176243f17434965d1429b73df2

SHA1
b67764f37186c5b79c12ffc81fcfc1f32877005b

SHA256
7afc9bcdebae2f897a93dea99227dac210dac47031085f55bbec0cc1734a1ed5

SHA512
52b682ee78f64284e2badbd57a689259bcb6d8094285689e1e376e499938eb2b11aa98b4bb26a5ea6fc99fc3d822441102635fcf5fc1c659e8b131517519bcc4

Download Submit
C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui

Filesize
3KB

MD5
bd6317bae7017a1b33ac2ba1aa30106b

SHA1
f996786cc9d4aabdfc853df53af0969130f563ee

SHA256
d060a9e7e481bf28a858bbbf0cbd7521508ae8f666c60b2fc46c8f6466ca7849

SHA512
862e89aa19ec562555af17dcd6c6afbb2d0c9d5817276a87796f8fac66e625f6891610a7a2bceeb4ea9f81fd50ed6600597b111944ac26a1002ba76dc3d2f7ad

Download Submit
C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui

Filesize
61KB

MD5
df537cf7ce98e90832528737b2742a55

SHA1
dec1377dbe025e78e3403d44333906d22201aa92

SHA256
3a4e01dd7ee169597c5f48e0d1cafe9d89365da7a93e508e6266b71a78a03de1

SHA512
96a32dfac80c5d1339832aaab82ee60925670f5226aefa8a9520ed3c44be59e99de2adb028f49e0aa0cf24c89d089fe3908a8101884114f94d97376943f56d70

Download Submit
C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui

Filesize
2KB

MD5
4d737760af8135e54fbef0356a131369

SHA1
8eaab43f1a5df86c3f27c4318199f8276443a5b6

SHA256
f44e82db5de960b4af4db3cfe7d03e426c7d42a31a6a2f27e22a0a27cc06199e

SHA512
672339d566f5c92cbf0011c8ad8307f2237b8b387b301b852414443f6e017c285c0eb2dde6e7a493b27abca26ab1af90729d3c397e1be2bf2eb993ac6fb6e79c

Download Submit
C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui

Filesize
3KB

MD5
f2b431b03f9c387340f7be858a6728a8

SHA1
33391ea44466203cd16cf05468b0b5623d96d483

SHA256
b7068db3812d446291c5a0133023d77e9e1e61fa63839628af99f7accd436acf

SHA512
7fd74a22495bd902e776c8f0b0e98c96e291049bcb664a08e588a88abcefe5cbca2af980f6ba0b9ead504b0d8bd940883b9b12d98f94e5a2bd6b9bf536024fa4

Download Submit
C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui

Filesize
4KB

MD5
b961f11ee8ac9a2c28cc16ec6708267a

SHA1
fc875f31ffefb90a2e34e81b7912745b1bae350e

SHA256
ff8e34b985983a91c3f559d20c23cb5a1e2a3f0a76ae8c52ad73c73f7d1875bb

SHA512
05e55d80e442f3a9afa7096d1ef5e3d25b939b36ed482f391b94e99a9026a434db53f8c791ac54631ea7a2618bdb4807fd334e1ccd6f48323fe7905fc1e6c5c2

Download Submit
C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui

Filesize
3KB

MD5
b4fc2a1bb3cdf38f1b794bdaf7d33dd5

SHA1
31df6d9c6c8466b2d59b7c5b3c45e8d6ddb2bafc

SHA256
0d7df13d24b36e7cb0a9f5e5f22784967bb46e6a526f9aba0a7333fe38f48564

SHA512
0b496d30f70c0bf100a7bcc0e0603da1393f2038247cfe824e1294b552bdc2a86d84e8294e231c4fb8ba5e8a29886d69bf45a0f3eb859852eb9a93472a028850

Download Submit
C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
54da9a4d968056c5762a78d6c797b108

SHA1
e0d3df29bd7b9946607b9429067b5659bd641d36

SHA256
08bd5e4734092b88d8a4a3e73c7926d2180a6d023d692e1bbd0c7b34121d3909

SHA512
8f3980219dc1b277c265644da7aab6650d0c15492e862f7b6bee41407fd81488ef6ce0471228847e3c780b06e658770a07bae69e33dc151fd2925a9c182ff2cc

Download Submit
C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui

Filesize
3KB

MD5
8bb0f71a3a46acaad428d9d2832b3f61

SHA1
bcc75e6ae9210c7b42bf94fa1828ed12063d97f0

SHA256
34e13c1c23aaa9036cf1fc9e761f8b57c4565c9335b640f3ec6d80d001add8d3

SHA512
d27ef2e0de88f62252da10cac8388680446c5c398644693ad4c6673c65102271d7a93658db74229d95651462ef0524df111e91a68eac278114a74b0caadac04a

Download Submit
C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui

Filesize
53KB

MD5
58d139ffcd7145b699fb98c2aef9f096

SHA1
8df86db1df0bfc897da4058e7ce0f0ea8481df96

SHA256
c400190077dd685df606747457fc34f65888e67e5ac4b4dd4529a10bffddc889

SHA512
f523257cad72049f65c7dec6effe0ef80285f99e15e4fd6e3e25cb1967c3a90e8305c28d27d79c18a98ba6de09c134b7ce41aa50a805d654c9ae5ccbccf68f1a

Download Submit
C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui

Filesize
3KB

MD5
1fe5523eb185dce51ea60e0ab28d7ea8

SHA1
bd429cb0787b182411d0dd0268143c2c77136f80

SHA256
bca16417fd22f8ffd6cf5fc6830bcf01f3cdaea120b391d83f07f6bfaa83f6f0

SHA512
3dbd1562eb68e5186146cfb4fe1d51d92c2e0f96e81a7b6c608680cd75ff2329e18b36dbfab7d110f0a827a57facbd1936957a54d3cc42d43de2baaa5cf2f200

Download Submit
C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui

Filesize
4KB

MD5
95e46741a64e17c30f2b18c2744eeeb1

SHA1
1183ab196eaea564bca4cbd3b1084612a260d7bd

SHA256
4b0248df6d879a60c46bde1717719d12e160309211e3b9062a659da270e51780

SHA512
97e290b08fd820ccc58c986c010068610bbe716ee5e8fd6bd3f1137989cd760190053a31b7b62063240b94206d3750792edd17db9fda5d631252ef63448c9646

Download Submit
C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui

Filesize
3KB

MD5
d6b4640b269786501f2106b3e9650051

SHA1
859076d8b5ccba5e4c53ff21859d0e51d163356e

SHA256
54b51a91b4e7d63945ec719b76e0e96680c82b2cd0ba94a8e2076831a673fded

SHA512
63f9c5157c7db410cab5035862efe7350ee2ef7919245e0f4cb4760507c73eecb14e295ff75ba5ae94005dbb2fe7b4bb40a5398f62aeaca49aff63517985d196

Download Submit
C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
5d27ecc79c7a9d1ac4da2bc282a49d2e

SHA1
9e8d3b427775c23c655a7f60d9b37e418f8c00d1

SHA256
ec38dbaf4f875d995e5e7457d305892492f25abc86c012754e0284d1f3443cbe

SHA512
a2c0cf93c9cbdde3fb394ce8f5c8c493709562bc1cf42a46150eb6404bd119a0bd5b4fd528a1cfb2b964faec8ad7519d002a4ca05c786848e0f57a456bd14cf1

Download Submit
C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui

Filesize
3KB

MD5
e3456f6ec3749ab7b21b25cb8b7e72f7

SHA1
7917ed33984a39b1e6a2e7c26747912e6a59528b

SHA256
3da6d562abf809af82d19787866400e357fc98b3b2c3e306984e54568216017f

SHA512
06efcd093e7326cdab07e89468c48f3ed7b0d44c6106685e64d754502661811012bd243494883ad83fbb0374ec70c22cf2d30ba36a4be44e2c76137b68cebc5d

Download Submit
C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui

Filesize
62KB

MD5
6ce13afd109d7e38342c0e98d685e1b6

SHA1
045606f2c8746af5e39e570bd7793315843f31a7

SHA256
62417b6100c17e904552f1f0e41c0e70a52159fe36f8d798b61830cf0de5e599

SHA512
d179c3685a75b1a713581ff0243ae2a8a81637b885fa8d7715c4039210f63f735b4048a0067296adfc300ef0ee7328dd65566d449fe1e4748fbc7a8b9b8984df

Download Submit
C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui

Filesize
2KB

MD5
f3850b500fba6250dea69359a467d368

SHA1
17143a39f735c7db6019a5060dec066d79a7a118

SHA256
522d1814c6d3fff480bce26f5b92f4b1ed420404a59fc36368c33e5c4e74ce0e

SHA512
45fd8d273647492eca6f6a64260efdd57e9bdcd8939b446b8a4438acc6faf3259ead2bf7c6065b0f45483802dc2af9e6315a3ee5e614cbed702bcb404c9d3c01

Download Submit
C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui

Filesize
3KB

MD5
2aa55ae49a04f8e0c94fc99f72d0b7c7

SHA1
0fa83ec8df933cc0a089f26277baea17f680b5a0

SHA256
eadcf5edcfe163c60d1a8624cbc071942b9b43aeb5db74414d5b7d9b4220646e

SHA512
939b9d24c16b0f982cc5ad55e3a214e69578cfd1c508534e2f33ba306b884308f7901103be135f631eb350631d03d7abd85d7e600753c9781fe7f3761608f39d

Download Submit
C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui

Filesize
4KB

MD5
e0925bf48153e71c3f8c28af0438f75d

SHA1
12715a4ba67bf8e7e5191d5487e06f85459b42d1

SHA256
fe922e46bdbe10b5f9f77575412cb2123ae204fc436a17695852b50ee08d2d8c

SHA512
ebda1587fd61b0e86a4186f48e65bd8c91b3b9b769eada2632e9752b052c70c070a69cf4ead5995dc8f6141c79a82b0d8e9af566585560ec8ea9cfbce0be1e2f

Download Submit
C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui

Filesize
3KB

MD5
f4ef066face523987e971e569e452bb8

SHA1
20e0e3916115a657f79ded5cff51565755461f30

SHA256
25d8f00c8fbf3b97cd6f69193faa15a0dd025aee17c5c833e13c11329b18b8bd

SHA512
f42173c3ff2652d720dd6dcb52b2f42849e101ccbd699d08798a54a4ca64f5685ca91fe3f55ac98956c880694a5e6796b9181f36b52623462db3d944cce8c2d8

Download Submit
C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
9c9111561867aff8eb60b43824892ef5

SHA1
e62357f871a24c3ad2b1bddcc21cc458f33e229a

SHA256
ddaa8488f1f027a735d06dd4db5b25831cc2c583193d12190855c59d6ee82bed

SHA512
10f70ea8e0b64919ad68a017139b0fe617735c6c4c55c0340058bbc8ab0783ff9b6c3632d3320e84612ef507a008ac026b709ad8350b6684eba8e53bb32a934a

Download Submit
C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui

Filesize
3KB

MD5
f9aa43f392c09e15ebd6596c4e69505d

SHA1
b9b2fb51b59acb2f0be6b6f264237961739526ec

SHA256
b1da21bbfbb8a794ec351c109a2cb9dbe4ed1d43656e9269e154e9699fe11048

SHA512
98df83d5e698d4444db843d833ce63f7715c9f9b5f6b2f18a8f7abfc30f8e7aed85e0d261bf0fe91085454ba6118feb5d70395820fa970c7ac7803a7b64b2a2a

Download Submit
C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui

Filesize
63KB

MD5
fec06e89041c1df7b10c6edb1ea1f891

SHA1
d29e9541a61229bd19b1bf264fc40c4c3f9070ff

SHA256
9ac01a60e060573e358977184308c515ec5fc57e08ea4ee173783f2266a4bee5

SHA512
150662a41c768d0586c7a5a36fc47cace9e88affb163270ef2a6aa6ea9a2a0a692cac4f76fb8e6c2ad8751c0bdc3dc48f9c006912c42480605ab3977ea8701f0

Download Submit
C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui

Filesize
2KB

MD5
f30ee5780575b87cf557006579f63fe5

SHA1
d8365a9fb0091b6b7684b4a229d58e4ff0dfbdfa

SHA256
4dc570632fec1c99641eb8b0c774703dc60535dc53af8363a4434e2f9a93ab56

SHA512
608174ec036b721a1ff1d9b3e4a5bb32da716b12871f45d2a1d4d66c7d205c64b92185708cb8d641e297aa2f9567198822b894526382cd3676ee9352885ed93c

Download Submit
C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui

Filesize
3KB

MD5
be7a57567fae9cc0050c3899b23cc294

SHA1
667902ddfd8a0a09e0fe7a0582ae98b10e77e0ad

SHA256
fbb78d66cddf6b8ad037a4082c316a5e677bffbbfd5f7c73893847eeeaeec1b7

SHA512
1817b64fa5610f59fda815f8a82844474ef8cd6481b4f413d481560da5b5eff43162bdecccc837951c6044523daa1856108454ca355cbb2b58779124a48883b8

Download Submit
C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui

Filesize
4KB

MD5
3932e59ade1c865d8c06ea95e8b3ffd5

SHA1
f27d8e301d17fe603ff0d4cafcb5627edad1dc64

SHA256
037e229f8889e0b08f004f3dfa980b7c4a03bcc53223f5f03c2d0cd1993ff801

SHA512
73927da8ae06e5bd9cef50be1df8a1674ef7a1a2ef5d03cc73c646bfce9a112618ebcb809f6966666dd8033bd518f3dddfded376bbbd6340ae48adaa887a204e

Download Submit
C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui

Filesize
3KB

MD5
fccb31eb1bf17b3089d63e69b1096be7

SHA1
d10595491f08326fb28b0193ecd6ce79ef4d875c

SHA256
96bbb9a66cbc63130cb647f5a0fc1d4173b1de8efe7640ab1bb1dc837ee24b71

SHA512
e9e87a67f543d2c575d0dffd2cd4d7b1f60a1c1f8047c878d44bb883a6508c51003c81d4033f3337bd880d2b947210bcece3429a6c09d7d2ec807977c94aa7d2

Download Submit
C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
2ccc546ffe6655150794d237e0f62606

SHA1
6fbd4638ea1ab784cde33f7176da39cbf67fa683

SHA256
3b07dbdaaeb3534f586a1eb2c248a12fe2ab7fe177e1a010e2ccae941dd55dcb

SHA512
d1aa907bc5b104cdb174a90652fc9065f6c8719d46910212f41c831088dbf5694675bf2d2e37ea318f707add65f99af7069f0862cac3893d5801bd6fa5a91ebf

Download Submit
C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui

Filesize
3KB

MD5
76fea0d7f02d323ac39d8cb85a71cc2a

SHA1
22a39eab6e22e5c29d47f025e359c5ab42d81dc3

SHA256
4923c82054beec1bcb71892617a4b6bce63de6c186a1c64460d54dcdf76121e1

SHA512
187170a5f6d0cbdfcc027e177deb0266c9148a378a009dee1460cf18b29ea37cb7885ec252bd2b80f27a9a3c830e29b04788c29d2a479f64c85f099f1ffe773e

Download Submit
C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui

Filesize
61KB

MD5
1dfb0b8dafd5da4a8942154c42977a7b

SHA1
567129ac34576517feadd94adb55d8f2dfff7bba

SHA256
1fe5066255dcfbcb1efee60bf60f0857b51435aa46bfd4c980abfecb57df7e70

SHA512
971ef261a3e4eaa56e20345121df109788cf105345a7bb2f8bf0b318725ff7274a4bc0570206192ca1d433a5239e52a29e422e2a1978a4eeea5fa4a8ffc6bc2d

Download Submit
C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui

Filesize
2KB

MD5
95f57adb7e45bade924b9fafe0920bef

SHA1
f1a182240ca1669a10525b62e68472b0f58d8bcc

SHA256
dd34fb38e9565455682cf3a11ebd6f6ccfb5c387bc22c2c8ca519d94efdd46dd

SHA512
0532eaef5ceb40def1d467d3aa11880e4e512dc0fe2146c7ab7a1a8b10fd091f1a6df8d56a7cca9c8357196091ca06610eee2128eb64c8e808e374b06a2c96f1

Download Submit
C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui

Filesize
3KB

MD5
4731a7fc62931c1a5d6df20747d4ac68

SHA1
20d310fb1a1ee7b1c8f809c1500a4a4e20749453

SHA256
8bcf361e8fdea982c889c832920ae7f627009cce18b000b737212fe230bf08ad

SHA512
6f6e982bbf482bb6022ac43ab1438ed19ca8b7627ea39d591a07e4062f66e9f001d04fe29bf8af287899bcaa2d9e1d18eb32a81c810cbccd719689785a8b1e7f

Download Submit
C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui

Filesize
4KB

MD5
88197284fcebf455705714db8f18b8dc

SHA1
34a05a3c11ecf18b00790669652f6b0bf0218c02

SHA256
0ad62560bf9a745f7c6173ff07a24856174d64d7d2ee3cf9e48f5da5d013f9c0

SHA512
690c15273df35cbed92f4a67ff4f01e7ee5ebde5a8c45d6ecbfc5725df8a92d70d6b2c12c2e4b0c80af598d53c85dac356520c382bd7683f52737e4f329bebe2

Download Submit
C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui

Filesize
3KB

MD5
6a9f1bd3f226941ee3a9bb3081915f4e

SHA1
d5aa11d17e6095ed3876b11cb3764fb6be607d4b

SHA256
735960544fc02c486aeb2d1f61b222cd05aaf8626520f742bbcf0aeba3891f8c

SHA512
7ee4384e66f8992d4ba2eaddd3dc6932b9e2020e6de979549701370bfb7446eed52040e5d400ff7d3c762ec25c76ac423095809e80efe48c6511737c8895ee3f

Download Submit
C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
c88d353c6db486c0e239d574e4cbd8e8

SHA1
efba97e064d0b3c7c6107eff7dc048e5362cfdda

SHA256
5f39ae3f55b1ad2b5d0e8892293860e6cfe6da295679f312fd3cf52cf4f86dd9

SHA512
b287ad719cffef50e017dcee4dc0ad08bb255112fc12b64879b8f3e07c2a1fcdcded114213c7c1c11b3be673b850b74f45c4e357154a0868daca7fd961b44e6f

Download Submit
C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui

Filesize
3KB

MD5
34373cc61f3f7c662f14f2f68290ae1d

SHA1
8bb0ccb500fa30fa0b91be2d328a61580004ba03

SHA256
8af72318dbdc731fb7940c6c2327b52bc5858c4774b389a6d3f1e91fd031b99a

SHA512
7d1487a0f7461fbb8a98ca62a22644966a0dc6ff8cf7aea7f419dfecc9719a291be363322785b37c732b771b1f503a43ae4a32ddd475b11cdeb008fe63fd6acb

Download Submit
C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui

Filesize
40KB

MD5
274b7e0145ecb1de100ea6ba93bb38d1

SHA1
96b48317e30c00b27983f07dfea9b8166b29cf90

SHA256
1d6dfc144708af94ae505f0c74fd1239beae3df239339947a4aed7a2fb6dc1d2

SHA512
a03ae3c9d04d569df212beacd13fdf38da7b4d987a1ab2ee4bff6ce4ec9ab607eae0429f81dc59a05addf0b9aae372446799790be11f737ebffc26cb3dd093e0

Download Submit
C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui

Filesize
2KB

MD5
01ca26447d036193d616a49e5962d1b5

SHA1
924b2ba2a663de7979b4f0c04486652708048e3b

SHA256
10f6b87c036b5f6f631b4efdc7d89569bfae2ca348a779cddfb63d990178ac07

SHA512
4f6be492a01d8e3a5377488dd89bad261905c05f04bdb5c84a24843e203485b0d925ac8f3062941b662b1a72b5c7284aec206fdedec81f48c02a632ec31a2f68

Download Submit
C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui

Filesize
3KB

MD5
ecffca3a566e8a5fb6a7f8a378e9b181

SHA1
a83b8473588262f8ce88676f4b64b10f65e8d59a

SHA256
3668a2a0f92118a267bbbdc61fca77773467930784b9d9d745a588c71304dd69

SHA512
c95d75285ee876b937e9bf5fb98342fc720bba902b1c46fedb439d009be7d682c187ab272981c6dfeede571251d64211eea3cda2eea40dc9e77b3170480c030f

Download Submit
C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui

Filesize
4KB

MD5
b46d9f6afb517981c847a67ad3dfc72f

SHA1
1bb2aa0737616d743e3315862955ca444446afa8

SHA256
64816b6063971b7a4e6cd1876d264727ca528e4cd8b98e561c389e5b2b4fb9b7

SHA512
7ebd9857cb185676ec29365246f93bf3802791473ff633f228ed0f6e6b89a0dce812132c7612f4365c7e957f385263faffd7c25a72885fe2931174930cf536b7

Download Submit
C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui

Filesize
3KB

MD5
91ff16b4d8d4ccc0ad065988e9312a8b

SHA1
b141630cd049e142eb95aafba98b014c4961c9ce

SHA256
368dd33f00b05f32cffc8bfbc6d621a964f977e975e61ea658ae9e1932f6abf3

SHA512
f052f29508a46c1e2c9dcc8df5c338fe3466a6f7938dc2170746a5bc414be07364cbce3e5a2e9b27dfbf34a95bb3605e94f2970602e19e2b0128bc5f44745f07

Download Submit
C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui

Filesize
3KB

MD5
4a6a29356703f030d769a0a8e4d1688f

SHA1
78d987b05018475c6ccfafaf93d3fd8e43a5d540

SHA256
1fdfd7e0ec90d61174211ea198362daeafd8263011d52d0e445c4562e0948dac

SHA512
6b58a5014aaa1996db22e58539bce4efeada6347603e9d82ef3e6ffd01de420d46ec445bba37b51f19619d00348d0d8aab28f92b92f47723f7ac68ae5ae0393b

Download Submit
C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui

Filesize
56KB

MD5
5c0e9c7b805c92c3bea8dd30f1f3c27e

SHA1
f2a2375b966d35a1b89c141cd506bf17c3bf8131

SHA256
96f334dbe821374426fe81844f013245b0c06391b861d7e2aaa02683e8c2e5df

SHA512
a74b766ebaf9597e9ca237ef3093f58f91bb3dcec2ef7e8cd5c1e6683aad0623168545e9855de35d1ba173a001ce9edad783957f3a05743349012a61e832f135

Download Submit
C:\Program Files\Windows Media Player\uk-UA\wmlaunch.exe.mui

Filesize
2KB

MD5
37c799c660cf09ff30fb4a645203ac1f

SHA1
bd70cb4a79316ff70440459ede475eb90e407c15

SHA256
ef108f269415c8c702a778f529a94ad46403e8d566977b7688e4c2f82674d457

SHA512
8aecf2ef5501f9cad1db32961ba6aa04b88f4034b40dc799291a1c8886673490bc2b0987521f7e8fe272e1b76d9030e4637ca26e19e025297cafef69c533c79f

Download Submit
C:\Program Files\Windows Media Player\uk-UA\wmplayer.exe.mui

Filesize
3KB

MD5
e8f830db03d94a8d3fc9b281e8b6a583

SHA1
6d5c166b8a3d22940d6dc27fe0a32c165402a10c

SHA256
2cd9b1fb73116d3103d3777f1a97886b5c85efb8f63d609ad24443724ed961c4

SHA512
f0a0f4e2fb92e77ac73c751d6951da5b8c1de202abe46dbd2e96f68cef84d376bd1b5b7a05d861494651f9354dee6b6c4477745f7ea6ab3be4b49e9766863ec8

Download Submit
C:\Program Files\Windows Media Player\uk-UA\wmpnssci.dll.mui

Filesize
4KB

MD5
45b5dc47aa7de0fa39907321e6af7204

SHA1
75a074cc2a64f305f254e6897bffcde9b855b7b6

SHA256
021e83e791097312b8bf88654ac48a1abf6b65fd39ac5295f664eee48cf978d4

SHA512
68bb6854b5705d9b5932d661a47ae471e621d661cd8c0da4b218832b98688c2a38a5a120205f070aa67ab6d499cabd4837dd05614ee994efc3acee5d06976f52

Download Submit
C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui

Filesize
3KB

MD5
249ed01797b04976d5b35cc650e134e4

SHA1
c54913e5b0adefc1417e313363ace14a2c73e655

SHA256
cbbb87008842e2ec74692ca041023b19cef83fea505872b0ba3a8830af5dc264

SHA512
3a44397b6a70b65b5256510b3dc8031055d64e1b031e73733ed486bff47c162f7992c55c50f873b149adf61652f23972c8ce18182a91316750cfd4b6efe5f2d7

Download Submit
C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui

Filesize
49KB

MD5
affb5eac04ccb1049b266921a4462ee5

SHA1
3e126d4646d9e13ccacc2dd741630d4cdff1fde1

SHA256
a34bc25fac4615eee32e3817d155b06342c307791afd40c7a1ce26f7407f50af

SHA512
b9cd030d86e124bd1924f96f16f3fa14c8a5605ba1ebb43f1590aef79f7242cde9d05e859defb56246d8b224c8a206542e9cd9bb980a267ac81918b84d2c232e

Download Submit
C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui

Filesize
8KB

MD5
6cc954a81011cc69a8bc9b8be67c5536

SHA1
0ada0b16f4db791bce67b435a7bf613d58edd3ed

SHA256
bb3653870565054d1cde408eeec7104acf0d749d67c93abfcc812138d1d3a3fa

SHA512
8f73abacfeaa2c44eeb45ca981e00829614aa76b7def874704b8214d5d85851be6233f2a851dc00c5df0a21aa554cf92bf175bef785e8b3561e9075c8a769975

Download Submit
C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui

Filesize
18KB

MD5
bf4a00ea97d5fbe25269247f311a209a

SHA1
271a3ac4a04b132f68ecd28daaf23e1dfe2f587c

SHA256
a063234da535ab16103f27263a7700c985903c70593843a5407b6e9da092b05d

SHA512
f31b41b54c4d060e62b9ddf550bc57b96c04cf73ea2e9886d410f55536755aa02c7d90371e74b50eecdb3818662473ff8f0b1c395b9ca7d0e0dce81f2fd078e7

Download Submit
C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui

Filesize
16KB

MD5
d7bf8225929281eb94d3647d2bcc8316

SHA1
f1491fd582579ba30289726741541d61a02ba0a3

SHA256
73061b7c5591db548bd7796b823c5c3bffaa4a241b50d3b9dfc99da5965f9b00

SHA512
a84f3b665d655d96f7bf95aff9b66c7fa77b6d741f2101b6cfb6db5cc0a2544e129ed61279202449508f427100ee00baf93cdc3baf530557fa3472d80b491fec

Download Submit
C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui

Filesize
18KB

MD5
ea18945bb573222e83ad61e75a0742b9

SHA1
f9e6825642fbb6b0aef4359611837406f2f7e96f

SHA256
b24dc0d176bd615686106384f3d12c161f2e3dc00e956d847f51b81014ca2ab9

SHA512
e10ba9fb17b09cbb3b210d0dc1d490de15aa289764ecbf123bb058b776a4bb807dfe85529bcb33c0e5a16058b1e96bdc638a7fbb1f323ac360b9449fe6dbde05

Download Submit
C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui

Filesize
19KB

MD5
0c0f890402048f6ce4670a7716e88042

SHA1
2f30a8c00494da43915a4e10faeff0a4af838297

SHA256
260df2b6cad95de985917c0240677b48eb938857626a3f49fc4592aafa583ab0

SHA512
307deffb4dc0fa0707fd4f7a90d0fe0d9dd5137c8f662011019d7ff40a0161ac95ca46c6a2af62c04c88766bad9604ace549e71f9d8d692a3a5bcd17d859a6c1

Download Submit
C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui

Filesize
18KB

MD5
bc442a2c0919a8ac3bdaa930f3e2df0c

SHA1
141fb4b35a57a762fb4e4d55a99d623f65857160

SHA256
884c01cd5a3a4107db7713c0931854d7e13edc4d50c955503015833f5f6326fd

SHA512
33e111fa0888a653fa838f4ec9a8c3283c664007b59f0306b4b17575794f7dc972bfd76b5960a7e58a777ff261d5959d970c869b07b07695c2560ef2b41de14e

Download Submit
C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui

Filesize
11KB

MD5
3997b583fa6ed77bd51e44d846b7469c

SHA1
5b6bc0b8b842af24c55585e7b0e38a8072656d63

SHA256
eb585a1dd387b2fe8926c8720e58c07ac8c8e5492012f7c1eba8773d5c526681

SHA512
ac27ef896637eb417375f5ebbd7c98e3d421df27c9b744c8807edbe90ad5ecf4e27c4d499a9fa056993941f2c6297b2742c1a04486685b49f85d1724c6c30713

Download Submit
C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui

Filesize
17KB

MD5
3eacd167c68762043a01e0315f5a51fe

SHA1
bf4ddff850103d4e5e9f9c26e7b0d4f21689116a

SHA256
39f63f45fba9462928c35f7fe0ecb19749316c8f2e1b4a3a67db646b5ba1d3d2

SHA512
1359e1442820976d46a9b6ccb69f5acbec1145046962b6e1aa67f2ed83231359905bfe3db8f02cb40b1cc9c44159a0fc2a490c7236e548511c2d3b34ea5150ef

Download Submit
C:\ProgramData\1605.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\ProgramData\cHpfiXA9s.ico

Filesize
14KB

MD5
88d9337c4c9cfe2d9aff8a2c718ec76b

SHA1
ce9f87183a1148816a1f777ba60a08ef5ca0d203

SHA256
95e059ef72686460884b9aea5c292c22917f75d56fe737d43be440f82034f438

SHA512
abafea8ca4e85f47befb5aa3efee9eee699ea87786faff39ee712ae498438d19a06bb31289643b620cb8203555ea4e2b546ef2f10d3f0087733bc0ceaccbeafd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat

Filesize
13KB

MD5
b82d8240f9285e63992f5a3b6b4cf2d0

SHA1
58c411d631cfa0889558c50dabf7ad1b00a0e1d8

SHA256
e96cfd408348951bfff2a8b8430142dbd40287db7d1deaf165aa14ba67487bfb

SHA512
d7e8747cc75bbaa90bc098d6c30d1da72fa487599db236000053f7c00a1d1ce7ff4da8d0eb773a291f8fb414ff03c03ebdb57110a9d08a06fe1f067e8fea3f3b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat

Filesize
13KB

MD5
04181cfeba8297e48dc816c8e7e6dc67

SHA1
5681daae0a49eac731aad76ec754d45241f17f19

SHA256
568ee500542bee6e33e83eac9589996b632a7c724207774a54574861566ecf99

SHA512
333f728c7777c7f3aee7874ba15c6b6800ffdf3e255f46de18d37a5cbd46c21331abc8f163d2a508696e879c1ff57be305e99ae1fa5be478139b853449f56589

Download Submit
C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE

Filesize
147KB

MD5
1233261baa035e646eff338c5c95ec7e

SHA1
d73c0a0ce6dcbe176a1b681cb73c6f3203475b1a

SHA256
298705751198eeaa14ddce39daf9f341315c586c68146386bc1b91bef05c0de8

SHA512
134e0d0aceb954cc72aecd46353415f6ad9bbeea22ced4aac7d23414cd5ee63ff377d6c86a17926c0620d92ae0102c8245800f3300c93449b4146b9143091e3b

Download Submit
C:\cHpfiXA9s.README.txt

Filesize
1KB

MD5
3605fdc69caa6b331eaf96ea07e4157d

SHA1
fc6bce8fc36aa774fb5e02cc1b25df8b59c6fa44

SHA256
0ec8c3830d53015c531dd0d8c540bc961f67888bb44731f87af6ba8be1268df3

SHA512
8b3eddd76b231bf1cca7e26d83756d418fab432afb6c7fc46e3e1356c8a580b78e09f29ef3adbadf72a8258c29d4855dac9b4b5c4519535b93a982469519c226

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3270530367-132075249-2153716227-1000\DDDDDDDDDDD

Filesize
129B

MD5
a1a5a08d16f2f7dff18c16a31781d42a

SHA1
e7ef43fd5b81f03db3bfcccc794e143e78a43767

SHA256
7a9fdf6d83f175a7196c3322703fe4feaf6db113ab58f6ba042deb88ce53e8a5

SHA512
27a2e5a6ab9629a10ad172d647645908a36fed0609b9b42fac5c60fae810f1bc1fab8b9daba68ca18c6d1ba25db694a3bed860eb92036a153b37028b9be194d4

Download Submit
memory/4844-0-0x00000000028F0000-0x0000000002900000-memory.dmp

Filesize
64KB

Download
memory/4844-16184-0x00000000028F0000-0x0000000002900000-memory.dmp

Filesize
64KB

Download
memory/4844-16183-0x00000000028F0000-0x0000000002900000-memory.dmp

Filesize
64KB

Download
memory/4844-2-0x00000000028F0000-0x0000000002900000-memory.dmp

Filesize
64KB

Download
memory/4844-1-0x00000000028F0000-0x0000000002900000-memory.dmp

Filesize
64KB

Download
memory/4844-16195-0x00000000028F0000-0x0000000002900000-memory.dmp

Filesize
64KB

Download
memory/5672-26676-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

Filesize
4KB

Download
memory/5672-26655-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

Filesize
4KB

Download
memory/5672-26677-0x000000007FE00000-0x000000007FE01000-memory.dmp

Filesize
4KB

Download
memory/5672-26653-0x000000007FE20000-0x000000007FE21000-memory.dmp

Filesize
4KB

Download
memory/5672-26649-0x00000000023E0000-0x00000000023F0000-memory.dmp

Filesize
64KB

Download
memory/5672-26643-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/5672-26644-0x00000000023E0000-0x00000000023F0000-memory.dmp

Filesize
64KB

Download