Overview
overview
10Static
static
1000260c390f...f8.exe
windows7-x64
1000260c390f...f8.exe
windows10-2004-x64
1001bf78841b...16.exe
windows7-x64
901bf78841b...16.exe
windows10-2004-x64
90545f842ca...49.exe
windows7-x64
100545f842ca...49.exe
windows10-2004-x64
10068ca3e92c...fd.exe
windows7-x64
10068ca3e92c...fd.exe
windows10-2004-x64
100b856337d9...c9.exe
windows7-x64
100b856337d9...c9.exe
windows10-2004-x64
100d38f8bf83...09.exe
windows7-x64
100d38f8bf83...09.exe
windows10-2004-x64
100e35a681fc...5e.exe
windows7-x64
100e35a681fc...5e.exe
windows10-2004-x64
100f178bc093...35.exe
windows7-x64
100f178bc093...35.exe
windows10-2004-x64
1010306702a1...dd.dll
windows7-x64
1010306702a1...dd.dll
windows10-2004-x64
10160c972897...21.exe
windows7-x64
10160c972897...21.exe
windows10-2004-x64
1019f7d53c4a...a0.exe
windows7-x64
1019f7d53c4a...a0.exe
windows10-2004-x64
101b109db549...18.exe
windows7-x64
101b109db549...18.exe
windows10-2004-x64
101e10e08cda...18.dll
windows7-x64
101e10e08cda...18.dll
windows10-2004-x64
101eb0b48ca7...1d.dll
windows7-x64
11eb0b48ca7...1d.dll
windows10-2004-x64
11f0e4cbc1a...7d.exe
windows7-x64
101f0e4cbc1a...7d.exe
windows10-2004-x64
10239c9969fd...90.exe
windows7-x64
10239c9969fd...90.exe
windows10-2004-x64
10Analysis
- max time kernel
138s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
18/03/2024, 09:01
Behavioral task
behavioral1
Sample
00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral5
Sample
0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049.exe
Resource
win7-20240220-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral6
Sample
0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral7
Sample
068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Resource
win7-20231129-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral8
Sample
068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral9
Sample
0b856337d9d3255fc3b07635fdadecbe83e23eb5c205eccab83c21c2fb76edc9.exe
Resource
win7-20240221-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral10
Sample
0b856337d9d3255fc3b07635fdadecbe83e23eb5c205eccab83c21c2fb76edc9.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral11
Sample
0d38f8bf831f1dbbe9a058930127171f24c3df8dae81e6aa66c430a63cbe0509.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
0d38f8bf831f1dbbe9a058930127171f24c3df8dae81e6aa66c430a63cbe0509.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral14
Sample
0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral15
Sample
0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral16
Sample
0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral17
Sample
10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd.dll
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral18
Sample
10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral19
Sample
160c97289764c37afe1a11f72537e95843a9c37a9c5fa02e1046f6b002315021.exe
Resource
win7-20240215-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral20
Sample
160c97289764c37afe1a11f72537e95843a9c37a9c5fa02e1046f6b002315021.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral21
Sample
19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe
Resource
win7-20240221-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral22
Sample
19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral23
Sample
1b109db549dd0bf64cadafec575b5895690760c7180a4edbf0c5296766162f18.exe
Resource
win7-20240221-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral24
Sample
1b109db549dd0bf64cadafec575b5895690760c7180a4edbf0c5296766162f18.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral25
Sample
1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518.dll
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral26
Sample
1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral27
Sample
1eb0b48ca74c119b53d372de7d639f0bcb1337fb526347fb3b22f62214280e1d.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
1eb0b48ca74c119b53d372de7d639f0bcb1337fb526347fb3b22f62214280e1d.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
1f0e4cbc1a4b52b6d7e4188e4a835a904cf783c75db9a066df4201452bd9647d.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral30
Sample
1f0e4cbc1a4b52b6d7e4188e4a835a904cf783c75db9a066df4201452bd9647d.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral31
Sample
239c9969fd07e1701a129cfd033a11a93ee9e88e4df4f79b7c5c0dd5bba86390.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral32
Sample
239c9969fd07e1701a129cfd033a11a93ee9e88e4df4f79b7c5c0dd5bba86390.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
- Size 147KB
- Sample240318-ky38dadf6s
- SHA256 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd
- MD5 75256873a03f4a4bc073185f48c1097c
- SHA1 e9023061def67ba21c09826fadc1607fd7f71d88
- SHA512 4b718093ad42d7b7b72498dfcbcfd1b39c980ef44e999b7035e6bfe6b782aad6b7553832f1efee45003d9b0c56bf2e408ca55082c550ac4faa19f199f366dede
- SSDEEP 3072:s6glyuxE4GsUPnliByocWepvdHFdjFpZ/fgyVF0dj:s6gDBGpvEByocWetdHZ/fgKF0
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\cHpfiXA9s.README.txt
Ransom Note
- ~~~ XeqtR Ransomeware The world's fastest ransomware ~~~ >>>> Your data is now stolen and encrypted, pleaes read the following carefully, as it is in your best interest. We are sorry to inform you that a Ransomware Virus has taken control of your computer. ALL of your important files and folders on your computer have been encrypted with a military grade encryption algorithm. Your documents, videos, images and every other forms of data are now inaccessible and completely locked, and cannot be unlocked without the sole decryption key, in which we are the ONLY ones in possession of this key. This key is currently being stored on a remote server. To acquire this key and have all files restored, transfer the amount of 500 USD in the cryptocurrency BITCOIN to the below specified bitcoin wallet address before the time runs out. Once you have read this you now have 36 hours until your files are lost forever. If you fail to take action within this time window, the decryption key will be destroyed and access to your files will be permanently lost. If you are not familiar with cryptocurrency and bitcoin, just do a google search, visit bitcoin.org, go on your mobile to Cash App, or pretty much just ask someone and most likely they can explain it. Once again, 500 USD in the form of Bitcoin to this wallet address bc1q8wqyacjzzvrn57d2g7aj35lnr5r8fqv0dn0394 The second you have sent the bitcoin and the transaction verifies another text file will appear on your desktop with the website to get your key, and the simple instructions on how to use it to get your files back. 36 hours starts now, we suggest you do not waste time. For any reason you should need customer service, email [email protected]
Emails
Signatures
- Renames multiple (12699) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation 1605.tmp - Deletes itself 1 IoCs
pid Process 5672 1605.tmp - Executes dropped EXE 1 IoCs
pid Process 5672 1605.tmp - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3270530367-132075249-2153716227-1000\desktop.ini 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3270530367-132075249-2153716227-1000\desktop.ini 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP3r09__39bk0i617fx29k24j.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP_x8s93mjnvnrf2svx0i6wsxhd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPw3m8op8br0o0iiu7e8_9hzeld.TMP printfilterpipelinesvc.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\cHpfiXA9s.bmp" 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\cHpfiXA9s.bmp" 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 5672 1605.tmp - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\lib\classlist 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.CodeDom.dll 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ar-ae\cHpfiXA9s.README.txt 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-30_altform-unplated.png 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80_altform-unplated.png 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadco.dll.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\cHpfiXA9s.README.txt 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\ui-strings.js.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\2.jpg 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SEQCHK10.DLL 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\ui-strings.js.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeBadge.scale-400.png 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-white_scale-125.png 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\cHpfiXA9s.README.txt 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\Example2.Diagnostics.Tests.ps1.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\cHpfiXA9s.README.txt 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon.png.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\da-dk\ui-strings.js.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_contrast-black.png 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_en_CA.txt.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FetchingMail.scale-400.png 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\cHpfiXA9s.README.txt 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Net.Resources.dll 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\msmdsrvi.rll 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdaprsr.dll 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\icudt58.dll.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\MedTile.scale-200.png 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSOIDRES.DLL 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-100.png 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\vcruntime140_cor3.dll.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado20.tlb 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80_altform-unplated_contrast-high.png 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\da-dk\ui-strings.js.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check_2x.png.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\contacts_variant2_v3.png 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuuc58_64.dll 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.MsiProvider.dll 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\logo.png 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-16_altform-unplated.png 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OSFROAMINGPROXY.DLL 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d9.png 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96.png 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\WindowsBase.resources.dll.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nl-nl\cHpfiXA9s.README.txt 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\Desktop 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\Desktop\WallpaperStyle = "10" 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cHpfiXA9s\ = "cHpfiXA9s" 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cHpfiXA9s\DefaultIcon 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cHpfiXA9s 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cHpfiXA9s\DefaultIcon\ = "C:\\ProgramData\\cHpfiXA9s.ico" 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe - Suspicious behavior: RenamesItself 26 IoCs
pid Process 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp 5672 1605.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeDebugPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: 36 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeImpersonatePrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeIncBasePriorityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeIncreaseQuotaPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: 33 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeManageVolumePrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeProfSingleProcessPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeRestorePrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSystemProfilePrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeTakeOwnershipPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeShutdownPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeDebugPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeBackupPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe Token: SeSecurityPrivilege 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3472 StartMenuExperienceHost.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4844 wrote to memory of 5504 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 105 PID 4844 wrote to memory of 5504 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 105 PID 5792 wrote to memory of 5592 5792 printfilterpipelinesvc.exe 108 PID 5792 wrote to memory of 5592 5792 printfilterpipelinesvc.exe 108 PID 4844 wrote to memory of 5672 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 109 PID 4844 wrote to memory of 5672 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 109 PID 4844 wrote to memory of 5672 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 109 PID 4844 wrote to memory of 5672 4844 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe 109 PID 5672 wrote to memory of 5932 5672 1605.tmp 110 PID 5672 wrote to memory of 5932 5672 1605.tmp 110 PID 5672 wrote to memory of 5932 5672 1605.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe"C:\Users\Admin\AppData\Local\Temp\068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:5504
-
-
C:\ProgramData\1605.tmp"C:\ProgramData\1605.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\1605.tmp >> NUL3⤵PID:5932
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4032
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{AEC6BC24-503D-4AC5-9D3A-CB6AE13D2473}.xps" 1335522616704200002⤵PID:5592
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3270530367-132075249-2153716227-1000\AAAAAAAAAAA
- Size 129B
- SHA256 9edf6f9e6574e10beee70c32554c5954f31e3f564e6388eb2b3cf4e95e2da39e
- MD5 80b5704df05c40ebe32e227e06737c1d
- SHA1 37b994130097fdd76d9f0debc442552f9cdb3a4e
- SHA512 52615d8a4da4454be9df9887749f3c95e8378e07d12e2d5d4783c2d2cb831e6e494b8cb39c7cce5617eb6654947d924d2e79e3262f30c5ec51e54ae0440251c2
- MD5 SHA1 SHA512
- Path C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui
- Size 56KB
- SHA256 e619d37f47da662d7b991d5957e31dfe7b02e16b291611f620d8f069dfe57450
- MD5 a895526b78876da3dea61f8cf93b79e4
- SHA1 da40d0565a2e463d89a098cee4206cfab5456aa2
- SHA512 c1f20bb3789f92c3951e0d418f01d5561fd25f28871e2efc148689dde2558145f28dfe44ce47f0359d21cad938eeaa53f111cd788989ed1b539b3c718fdc636d
- SSDEEP 1536:yq9PkmSWstx1u53rlGJRrdWf6ARmctk3k:yq9PkNLuyMf6Km4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui
- Size 47KB
- SHA256 dd3a8fcd1c85caaacf055d02fce761076f87f47dacb2c2d58e625e0bebda713f
- MD5 1a4bd35e1663322f8a3e02edcaa29002
- SHA1 001f1171197b675910dbecdd8c306dc451d9ece5
- SHA512 263e3680d43668fa95f85adecba27cd02c24aac9a42de580b32fb52a188cb95569bba8b5748c9d5dfdd906f208c7645a1e94dfe23e7b1424c7d9b1b569437263
- SSDEEP 768:DlDinYrxvlzmRrL15+G2Dks1AhEEKoJ6A67aAVJ175mhgcnS5wCQ+T2qJA1XzykX:pDinY1lSRriG2DfAhEEKsg7aAVf75mn/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui
- Size 47KB
- SHA256 3a5121d5f44fd586971031a36938e91d28cf7ca4ad8ff2a1bee8c6af0a22a3bc
- MD5 b346fe0fbe64afe80fb6babe6b9a9ae4
- SHA1 d8a0bc0ab2cd66472aad34710f7621f9b70fe8cc
- SHA512 dd3329d87dcf7d092688cf0afad9baf11b7db13fc7eee22e0658975fbf606bccd94b889bad225c6f1ef618603dd529eb403cc6e54dce79d1b1290adbe7374925
- SSDEEP 768:k/wkUb1+Tfjwv53Yxju4EKj+EhOFCnVU8VesE8ycKz7teE5AzjB8pFxcaBLkd0Ps:k/G6fjYlcjunu+UOx8V/P4kQxnmd0F6B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui
- Size 43KB
- SHA256 17f1d4621507d7885b4abe7c2145efe5df769c8954dc966c3fc3dd7ab07ed8a3
- MD5 fce871f08128852dd3ab73dc5f835a2c
- SHA1 9a860e43fe62849bcf9da07b5d41eff8a318bf96
- SHA512 bbe215b4a83f9f973f242597b4e25cee4fcd91ad5306e807d81b71f26b83381f078d01ca5144271a2015e0ba817c4d0f77e8c8b1751441baaf909ff8b3f4178f
- SSDEEP 768:tWfSi/9N1b6Km+BCEn7w4c8L6zFHOF/Omr4FWvZIDntSnajw5c9gciU4:tS5jTCEn84HeuOSGWvZIDntOl3V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui
- Size 53KB
- SHA256 8a956a620836ac070eff9357dc7f8daee31a04967da72775a241279f8addc791
- MD5 2852bab90b94997af0b41c4fc9bc84fa
- SHA1 a9f0e71b543af9f65022a372b0c3216e9f6131c2
- SHA512 e2374a86cc9ce8b0a7e4bb1ec9365f2a2609647229db3d620d4b35dc023f1b43e8f633eb38042ca97ba313dbac1a10416a699014d8e27fdbfaa8906336534b75
- SSDEEP 1536:5p69TcCpJFB/3Dudyd8XzZTt1qa8Mgv4P4p4fVBv7kU1ZtidzUsN:PvCj36oyFTqJbvu4p4deYiNUK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui
- Size 47KB
- SHA256 aaa21ba17bc408374e2202e4a93b212dccec3a20c0ca5504fd99a07cd6dfbc61
- MD5 c3ebf14c3eb9574d8bb946a9eee4edd5
- SHA1 4e5d60548becbbd4f1d0ded1d5fba1f584f2562c
- SHA512 b4086f398176ab16784aaa0da1814e3167c5830565e9effcb52168e1b82a50f0becce2022700696755d0e2b231cbcd03a5535ad2dcb3d1656d3087b7c7244c64
- SSDEEP 768:iMpAUGiNgZrIY69uxNRTMegRCWSQcd2tSZZKJM10vsxZw39m4vQ0OA6r:iSAKNg5S9uxtgRY2VJMqvGZJ487
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui
- Size 57KB
- SHA256 cf025e7f4724e9a28e2ee726e5d39d44eb2a4661dea82ab456be100d4fc008cd
- MD5 844858c0a73d5a4aeff3072b6964ad50
- SHA1 f44571842993ab7fa2f6bf2a50232c07741ada4c
- SHA512 bc036df10c51cfd71378a26d3c6e3b952c619738e2d455315ac629982d9a29093f590b9591a00b84a9812a8c4aa22a517e7d9cf43eeb915a6433694debd9869e
- SSDEEP 1536:VeHUpc8tpFfS/asjLkxSwUeS42BT+FPdcuA7:5pc6DfS/azN6BTuPyuA7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui
- Size 47KB
- SHA256 5bd88271b2b82117f822b7ef29f65d768ce69fb1979e97e16fac0d7002e04e39
- MD5 8ebab46cb8bfb7b6d4215734a18170a8
- SHA1 c0a09029955fb1c542e2741049778ef5c18803d1
- SHA512 8d2143ab64abc818c94dd514d69e3786fd290822cc899303a5ac83c636d4d61d264676c9b1add79eaf7924edb83d0228830d7ce8fd832a5f818fa6b1260f5044
- SSDEEP 768:BKm5S7Gu2MN/zODqJYlo0hWECHsa4tfmbESySdrHsRPB:t5Squ2uzODyYloIQHh8fdjsHOPB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui
- Size 54KB
- SHA256 de6f21a55380002776245c1ffbbaee9d029d9f3f98c4f77b95aefe34d5c224a1
- MD5 7349c222b04b380cb35fe2cc27a2e6f2
- SHA1 83b86fd8a7467268b7f58e0789c00a8302cbd391
- SHA512 f2f8a8af76a8df23e8b320bb2354d69bc915cd8feecb732a0c6ea4de05b6c6754baa589fb41c3216f23c8b053d73ea18387dff5e96d95d08873b76b41d831c2f
- SSDEEP 768:GqDjO2dqpGbYZ+vosI7mq2mj/c+SLMsGLtDN9jlw/pCGsbOrnvxEK4Mn9cf+WvK6:QtpGEZ60SqQdq1Rw/RWUd4M9cf+uUc/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui
- Size 47KB
- SHA256 583642cfadfae5233aef49150fe4e3f456b5220d2f31befe3acd7d2585843871
- MD5 4507b08ddebd3f79b9e0c7f23165ab7c
- SHA1 984b76b0c50b3f7b427613783f3bac772e585a6a
- SHA512 dee8351b3b2ed045b734160f7c97ffd165a5c330f19b95b3d1fc9026beb8c811ced14bf994b34731321a7f213f55c03daaa3e706f6d75b8cc16939e19c7a57d0
- SSDEEP 768:TfEDobjhS8xoR0J8X3aSB+xxkgwRDyCIXWnNBiSxI2eSscahQpwtc7BZ61vsk7+6:TUEVS8uR0J8iXkzyzcN8SxfeLc17ytl9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui
- Size 32KB
- SHA256 120ca6ff43e8aee2d020a9fc3e38e9956b7bf458a2f60294f2689a0665803305
- MD5 5d4105a70656f1ced3c927bb587e980e
- SHA1 3e0f87b44ee774dfae96da683b6e192817ea2446
- SHA512 69dc7d6e629a7dbf0f80f3a17eb1db29627b7bd572783ce205f257bf857ad72bc8a926b6eaf96205e13e8b674283c3e809279b90f932ddfc606a9de2ba8a1da5
- SSDEEP 768:RJAxEM77eDwumq+xpP/ChjdvuqfBdGe7nmvmxwDO7Gv79:RJAeu7eRmq+xpPUuqLGUkmxwy7Gh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui
- Size 37KB
- SHA256 82934c001ce5135cf4e8c770be3721707d944d8c41f900ac4143aba25f566ce8
- MD5 e880efd582a9722e20f04500776d2466
- SHA1 f4e36fa48e2ceed48c4e621c69b611fe10231372
- SHA512 89c9364ac8da4d38d7daba4783a42b2867f4c8030f159aa0101b8d06fceac72fea69aeaf4e1a0fae44ebcc38660eb7948020195e0a7e7ff6711e6735aa9a63a7
- SSDEEP 768:kpS9kK9GjdKZyhntAqq5QexL2reDEEOOwDTTMZl8qXtDj1qBe:kpS9kYGjdKZyhnwme52rMjrwbMZl84fX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui
- Size 20KB
- SHA256 2d344f114d6014f53d3a25b028052e2ef495c277294667b848f7af03e0322e5c
- MD5 0137e026400c6e5aa6e7f60ee1118b82
- SHA1 9ef6f80d134ed9bc3fe2bb112ccb2a7a1ca8ed83
- SHA512 00849f3faeea0454d26fc74efa467b680c52eff40dc0333edd13302f5975811b75dca89687ce9c7c3a93d5ff77c50af827a8b64ab3b658f9c1a626fba7c1dbfc
- SSDEEP 384:ON9S4DEOKe8j3IY0TVb4pSGbKN+RDSrxEHo0Ocss7JOj30UFHEM+Iqq7K:q9S/wy3cipS4Kg2rxEI0wYU3zqqu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui
- Size 17KB
- SHA256 02b40d9b034bb9458ddacbf9c7bdbb72d79105eb9da5b5e7892f0932c3c6c152
- MD5 a4561dd15657ad8ffcf07101698dd214
- SHA1 687d75475154734ab01cfb4f32a2c749951b0e1c
- SHA512 da84273577e8fe24dbbab0df7d27909051a1ca933b09f517b66b519bb2f1a1defd9083d7602c022040f666e82835e8e92795a1181793cca03b895076606d72eb
- SSDEEP 384:c/geGeSiuTGOU4TSON9YeQcG/BvPAumMAV6KYcb8JH7K:cZD3ONpNWFtAugkKO0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui
- Size 19KB
- SHA256 f5868636f3011a5ae3cc03d2c8b68212d747b6a5e4bcf12af1b50eebb3e4186b
- MD5 c4345015596d671f4efa4bac4f1f5189
- SHA1 bf1f13ac2fbda835d3b3a4fcfba8b1dc89b0c9cc
- SHA512 7e1405f82abb2fb3fcc9391a0a774541fec05105e0a07d5c8cb734e7d11011537aee38a4645e2e2173464cdb923d3282b9be58a6ed725873ce75f40258785bda
- SSDEEP 384:kGhNbd0bXpQy8rTvvbvVAE/TWo4+trMmpaGM7zvf6uTCMgMeITeMV9XMDRbaK:kGhNhEXpQxrTvvLF6mMmpaR7CEgMTeUY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui
- Size 20KB
- SHA256 6b7c70a39f27e31520e72bf176b14b9a598e744660833b00c9362ef590f4c674
- MD5 a19f875670f356978dc1a3c07e7c8cd2
- SHA1 ed0206eb63d61c6bd852d9a1411a5e4560aeddde
- SHA512 bfd1272a8105f8d34c8916121a86c4e8519bd3beaa2d6f4ffe936f6f8ba43f58829b5317c03e563776230f7d2292eca529b952b3b8275daec41945144abf7e16
- SSDEEP 384:aEbyDfuhHR6ML5CBd16hKUvWx+YWCQ/9b+dr704Sccq2cplSV5sLa2qOb3QK:aEb5hHRC1bGa7ZSLsplSHkasb3Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui
- Size 19KB
- SHA256 8d7ee5bcd0a9bdc482a278b8779691a49d26410c3b6daa0d28e71f1aa9b82214
- MD5 bf9a06fea1c6a05d1dfb9ca71aa421a9
- SHA1 4264f34a1337329e30e1bcd16605bf9de57375e8
- SHA512 0cc459b5e83c34eb81be333c7df0aedec068276f44908e467367b9c9c233c4526af0c1602873b5fcff83b6e97748c93795dabd1e4f7196bae25b9fb07aa25f1c
- SSDEEP 384:hF9AqXs9c1AbFPe89EE2X/gaHpgG0AJLGVFc5PfiDzBv1/TqxBqKK:6BsAJe89Ex/gWL8FwfiDzjrqxcH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui
- Size 11KB
- SHA256 9524be5e57a2ef54c814de2b77404abd9d8a41cd9d26356abae74cffaaa5ee15
- MD5 67a8377d1aa9d5cafdf0d5dbd09cf2b8
- SHA1 221aa53a396d56f900be1681f15ef90c89edf9e6
- SHA512 ce8e5c020873fea306635ee3f578cc21e1fe35c19a8243646b4d9256b7adcc6b4709ebb040470286736b6f48c4c889ce967c414630bf83704bb6049e5affaf0b
- SSDEEP 192:EeGnAX41LdDblbpsEzLD4L84fbH9RAjFK5UX05S37X/ftAOa3jQ+WWdOKyiRjxvA:PG8GXlbpBKfbH9SjFb05k7vMjbWi3TDo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui
- Size 102KB
- SHA256 5795d5f8e9af1c9490949bbecc175a58d7a227ae5e0954fa226fa03d3b656902
- MD5 6709af5f04656f8de1593f02073518b3
- SHA1 7a6174409acadd3c8445af31630baacccb3f785d
- SHA512 d0756381aa3d4649438e278ca6e2893270cf5bc45e4ff372b9b9ed2d43541fd57b7fb906aea6e0cbc149eb2b398eeaa71239a9953dc57bf26b6588a0482ce7f5
- SSDEEP 3072:37ytIAB+HCZjpINSvTiyx2y9Dxlo6aojr0:LytTjpjGyx2y9x+pojr0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\en-US\wab32res.dll.mui
- Size 92KB
- SHA256 4c31f372352661b5ecf05e6a082c729a7c8515364bf2152eb72cf0d4dc6444f4
- MD5 f6d8aab36769abfc9d94a3994e18c76b
- SHA1 3d2765fb61f7ddc3d12e24d3222afd85569baa5f
- SHA512 a79048d6c3d312755266f1b6ac7439d5dcd23784c8f713c3b843df69927c6f95c365192a9ee42399f6cfd00c90799c058567e05d49dfc19c2e3e182c5870c073
- SSDEEP 1536:t2hmgutoDETUQkF2AMc2uPTlmnuAgOsARvN+CSNHwv4apfrr+EC9PhNq:t2hmNtohwePUnbgfnCSNwvvpf+EC9Phg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui
- Size 102KB
- SHA256 d8d5f2b54a60e78d6bde7b07e5c53d1c7be235cfeb9429189213091ca0a1fe1a
- MD5 0b7f29d934e596c31d9e702f9e0d0a00
- SHA1 d4de5196a03d3e3ca0a7a32b1b09a5b5899794b4
- SHA512 0ab85a6b4dca95107e898a44659509810faf2e9df59a35304b89e9364789b2ff27383514d30f023904d241692bc90ccf303b988ed388783d8feb623b335399bd
- SSDEEP 3072:44HeTI8RUlusuSCA78i3660XH1CgFl99gTZv9F:4dUYsTfgi3L0X0U7gtX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui
- Size 104KB
- SHA256 995cdac44e60cfe42a019699196301fe401267f005bd405326c50746375175e6
- MD5 189fe9d915ed2c6d8b11ff570a91ab3e
- SHA1 8f87ce748d0e0630aad58d14ab291ab7b577da2a
- SHA512 c90007d0694ddf43c5de9bc8708c90f3d35fe10fb38b0344225477bfb5dd2bc3b64ccb318541f7259a8e8216fbf2899b50ffbd9aee0a34abdf7d54944624f2c6
- SSDEEP 1536:sPjhx8xGQzvPG8BzYtnpqtFe3bALlvB3BskDlYaNJBaKjDNZYTDcRB4qFQ+:sP0xGsJYFr+lt5BaSDmDcRB4u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui
- Size 97KB
- SHA256 2bad9a8cdcb70e437e0a0e1fe33e3b6845581fbe93fe332970a9861d2ca5ff04
- MD5 4e8bee4b02c44ef9e05ea99ee2b010d0
- SHA1 bf9213d9f7105f2e2b2104d7cd73baa7c7bc2851
- SHA512 2d3371e21982d4f1f5a93a3239d5ddbb19a5d350cd7e3a689d671da1ed4376340672114dbcd1a98da68fe558d1ca8966be3a190943766db7a005d029966a5374
- SSDEEP 3072:vzp2UHGGJ/yaqwB8BTYd+UXGKlfg1pLwgh:bp9NYilH8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui
- Size 69KB
- SHA256 35f90525fe0711ef0391a62e1b8ccb8d65681e6a39228936dea77c82280953ec
- MD5 a7ecc05796fe7f102490b2e1930f7749
- SHA1 ce416afca9564ec05e176114b13bc7a6859debaa
- SHA512 ab9136d98a51787178de66a208d07509af4c38fe122767fdafe6eaf4dc1a162f200aa89f667c18a3d573bf8a1624ee749763eeff7b93358868aea442cc4df49c
- SSDEEP 1536:ILikScPRtiWv9oXJ3NRdeTMsf+sUUBJpVZ5SUEobFHV905aGpaUmwA:eikSc3iWeBNRdqMrJUBjVZcPaD90/a6A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui
- Size 12KB
- SHA256 6b572dafc2fe3412e544bc94584e072e8f84b8cdc289a02f87d864a5819e523d
- MD5 f8d760158c7132d11182d38daf2cbd47
- SHA1 68f2998e01e25f14b50819ef026bf28f62ce7a17
- SHA512 1a3dc47472fc7682031729fc900d787c676933a4c1f64a190493c221d9a3ff8f955b14ffafff8fad0b5d020a9807279a0427829ced1ee6608c1aa63686e5a22d
- SSDEEP 384:U1t1Uo3+Zl2hqy0fk/30wu8Z+KBtYXEiPt6K:U7+we2hC0u8Z+0OXEiPt3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui
- Size 9KB
- SHA256 58e5de889255e4a8fd263b97613b5e69d0161e70c34a4b80ef13eee024073a41
- MD5 00bb8a8aa666181768330dcc9ddd6b6d
- SHA1 7f79defd1f740cb67ff80e1f73625eb3bd444b66
- SHA512 a864b8c3d9a9aa92106d99b928baa23cff4d2fcdf2dc7e9f59f5bd4da0d973a9bfe1ea906ccb841053649463286a1d24fb0331943ccfcdf4a917bdf86bd7294e
- SSDEEP 192:TUBjvTUKHvUUfQkJzue2f5vJf1Nas9b5Z6ipK:o8G8UfVN2f5hfj9b5lK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui
- Size 10KB
- SHA256 7e47d84efbd33ef384e1198ffd9f6a37d6c587eb32cad044ff1209bac2b2b036
- MD5 0ecfe3be647abdc14e3126ec92c3dcb3
- SHA1 434a5dffbd1c38219ad2a17c3b6a723ed6c03943
- SHA512 af77bd2d0fab9786ee28330da686b3ac93856e932f36fa4dba2ed29178c132134fd10f184ed0909053871f39cfc43ca31d5f53aebcc1b8ec2e9a6ed6c580ff77
- SSDEEP 192:DPzH+jnjZSGOB74I65ncqah3pxmBNOmkojl5vXGJWi5L5iLBGLVKKRTwTF98vK:DyjnjgnEL5ah3mWmkoDvWEib/p9iOvK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui
- Size 7KB
- SHA256 b37c648fc1901ea2e14d10152945746f816e6786f1be16304ceb18c6f9a30d19
- MD5 c460861e92b9e6746557d4eaffede051
- SHA1 200749aa146c6ae4bd255bf89b4e58399921de8f
- SHA512 aa3b9e31a4454855fcfcfcfc0e46a9695185acdf059cba762ae3de0bf1d570f2fe7d3786c5ab4ebfb9f1492385fff50a2a15613c6650ffdf2b017865507fd875
- SSDEEP 192:pDzyxV5hZVW3iD39nkidiCqhAL3AUswTr6tCS9BGC3OS2KzM5nATQxQ6dK:p6vW3U39MCn10/9BGC+SaHx5dK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui
- Size 11KB
- SHA256 a6d1bf1d81e76608aeb9bef8b44f8334b010a293ae3c3042a42c6bbe5c10bbfa
- MD5 84bccfa3ae5a9bb571ec41511c0369d2
- SHA1 d50e269f4b007c2fbcbda2c0295d2db38090ab5e
- SHA512 4d22e6e55a0edcfd540cd8a556b596cee483e097c6e4dbf8399ce11d7ff426e988f310d02d4285b9bb45522fa82d319fbefc87370055a5392fc94dc81a075446
- SSDEEP 192:s69wdbnQyjNExDJa7K38v8tNa2S84qdjuj08X1k1SNH0dL96JAfWj7VK:s6WzQyjSdJg8tN2qowM12CqLWjZK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui
- Size 8KB
- SHA256 71fb8e9d6558d9bf85b9bf4c1d88d93baa397f215168ec41fa4fb87529dec442
- MD5 25acfbe23b9c7c829b51768f8596094d
- SHA1 7c00d837db5f4782f356b802a5c384bb396a0492
- SHA512 22122ca6e9fe091acc92e9a08d829982cb3ce36341fa1ddcb162b21733823af63954a40f224bb3b4ab7b88323a9f72d12c9aeb5e1c687217664bba620f8f7c28
- SSDEEP 192:KAdpVMiPBAOmRdSJQZuDWfwu2bhN7V7E92X9Ipv0xr1MPn7flT6hHbvh062CCK:KAdf9AOmXIquyDcPE4G10xrW7flyHb5H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui
- Size 12KB
- SHA256 c1db746c4fc2f72378502749e73e4f81fb94e929e58022a33989138704203b25
- MD5 c206697a2d9e1ef17928681e33b543cd
- SHA1 083e0d827de8916870b853f1ace3771b21854b3e
- SHA512 3eb718f3be3b43f89d61408e59eee26c33f527c7fde61416c318f96b9fe8758fad9171240b9fcf8c5c473307aa6a10ee17b4472be1cb0299d85ee5a698f588e7
- SSDEEP 384:mXFE66/JhCOUnRuUdOoHdKGAAVidrEssRgHxuK:yu66BhCOWk3KViQgHh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui
- Size 9KB
- SHA256 c13619229ca48cc02e3aa995d5d6951ec752d0fed3fc14b882d825c132cc37dc
- MD5 9018dcff175d92deb37569930b813199
- SHA1 68cf8ff6ce052d12b26a7c0165b02a83e1bcaac3
- SHA512 7b7a0c0385223902bb1c124c3ec06af310097ea4e98146e6c0d89e569496ce23cbf1703bdf31d5de964af5e1562d0b0a2da328e3647addf6cf5c5cec48447dfb
- SSDEEP 192:Ocu2cFbsTCvfZ0SK+j8QDsuLUrpNYjqKLK5zjePIEkYR9I/GqA+vK:2bResDNI/Kq0K5MIEfRe/9fK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui
- Size 11KB
- SHA256 bc0f98b7f5b628bb558385bac44b4b79eb23b827af376a4e1d9da13bb10e1b46
- MD5 ae9dd7eab9ddb2b1269ac46a8ace894d
- SHA1 2abba40437b5a5d7e9ff8c9694c1d83728bc684c
- SHA512 c382b008f86c2d7b8afcf3c9b3f255e4a92b0fb25863a1a3d07295532b223853f4d9dd9a990e09537a93c4a93db4cf6f5c274df698c9a4cb348b081f7c51818a
- SSDEEP 192:fXy+SbqKfo+6x8J4asYfuiit+JAru/gmGfLHHgi6nCXA+q4Qwdt2XChYP04LK:fXRWqKg12+7pi30R6nCXAR+twC8XLK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui
- Size 9KB
- SHA256 ec923b6c4e68c2c0534839e47996a31a8890008e6487bdff6ae70b591039dcac
- MD5 7206ba7e687be682d2236ef1e9c2abfe
- SHA1 7992b79fc2af78a527b68410e8edbad02b9581e2
- SHA512 10567874811ef28dbe2cfffbbafd812759e6f8b97b87e52fcab0ab107545f3714335aac09a89e2f5009a929e0f5558b73afa719717859769a04de389fbe48ecf
- SSDEEP 192:aJwKJbRZPH0Wi5sDBTHNsULGV1/LmbxONusVgvmQgs3hhOpW+OIYK:aJwKRcWLBtsX/6INcBhhObOBK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui
- Size 6KB
- SHA256 9ebafc63cc75f1be8dcc515e851c73b213403ed16a0547483475d7ffddc8e1bb
- MD5 fce65161c52c16d68086690c3ea46e46
- SHA1 65c8bc789aa7df0e94ef0edac780c347f28206c5
- SHA512 2cc50c86c86801cebc8fddd7da55b4f6b1bd9be2e9d25a5a589ef9e8739c0727d22aa48ee5ad9a01a2f71c8aae70dc58cbd3d04a0940dcfcea082ff982e86f49
- SSDEEP 192:PETXRG0aERLEqJErI2trBQspnOVgGHqJ/R980GK:PETXRG0aERLEqJErI2trGspnag/Z80GK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui
- Size 6KB
- SHA256 f8f5d6c9c8ce835c9b60b1ee0827125ce605b354a9d66889bfbb9169b0bdeb45
- MD5 e9926809e2450ff252eaced1a170cf54
- SHA1 69c271b6f5b60f7a80c7e874a96b4a3da5cdbdcd
- SHA512 b1d43fddfbc8156d84071adad9a3c9a8c8287e9d72baa01d771af2a650161a7866ab0e0045396cd284b2cc16a40d62c4326d4987b7da03a033cc360c07eb3e60
- SSDEEP 192:aCFNcbZhlmJMSfQxz0eU0ZuanhAjiDXzB4cxV/p6K:aC6C4xzjUauanV4cxV/cK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui
- Size 94KB
- SHA256 610debc0e8016980256bbe36f7213fbbf4f06286c775c6ba4c1acf503dd6f888
- MD5 095c4a5cb69459b355ec10c00045080c
- SHA1 61c5fc091652891a93be3e68128d4c9cc2972f3e
- SHA512 dee45effc047df07f3ab7c56256b1a220e9591156f9130d38387a50237391dab47de09727f799eb4ebfec8fed17ea6bb0f4d6495f798757053353e7eb21b4d04
- SSDEEP 1536:Wce3XGzdIwPyvFgVh2k1l4YI9FXBNvnsQkZIDiB7qV3G2WUFh7O1AmIt0zxyyVPd:WdHGOLvFut+XBdkZlQJDWK7O1nIt0AG9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui
- Size 5KB
- SHA256 244aa3e66c840ce1f1dcc3204c19faa15672da838e3660315e841c696dfbccbe
- MD5 b2f15dd6d0589cfeea1df50cc33d65ed
- SHA1 1e89efadd7b9744e6cc99b8309f1966232b86b8e
- SHA512 1610015645f451069d383f3f46f5caadcb440df5ef471d69954989583fb040ec295d414734b691f54ed8c1666fa1330ef447f6a8b254d2c65b0411957abbf064
- SSDEEP 96:0TxI+6La625Tjl4mSooj2iJR/jdwhADJKQHFEpfT3jlkJzk5zfEA66VcGSTk2NrJ:0TxpTl4+oj/Fxo7QHSfT3jlkdurCXAM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui
- Size 27KB
- SHA256 fb14ec4a7a1141f8fa64546b4dc0b4e9857831ca379f613df56668d224d9b584
- MD5 915f407be1a5cf711f40dcc21e52e3f6
- SHA1 6cefbb4d462541d5150a9597af907ad5a1c286be
- SHA512 c4e9390777cb9a0c93426ee5602acd20002cde9299bc6965ba81a3f208d0bad0c5160a046fb6b2f122b143275856d1ddc9f99717ce3a31bd27f2700ea860e340
- SSDEEP 768:Th2k91QuhWvpSTuxCaQI7reCXSMisR+lwPyS:NsST4SIRXN6eyS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui
- Size 3KB
- SHA256 541ee688c19d52b066acb9246481e0645d50ef6d1e93f24bb18f7e54d0bc726a
- MD5 1d680873029e16f3361a87f505fa1e2e
- SHA1 07f9eadd672ef0999951822e8ae0cb405c5119df
- SHA512 ecee275017c528e082ae23f8f0615ada9dc8f1f97bd2c37ebcaa7749823e96277d4af13c7698c8f06a0cc8763704018bcd4222cb85276fe0a805fd50b7a1c554
- MD5 SHA1 SHA512
- Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui
- Size 3KB
- SHA256 5aeda56470092244ac552367a26594a7163d51104820a5f066fd511a459caeca
- MD5 a3134a901556f45c64c8b0f9377823b9
- SHA1 fdeb6811560728926412f11e259408051ee7d13e
- SHA512 a3fad7d7b668dff86b986aa8150dafe26a4aabfc7ef8dc68ce37099b67cc10e18f95beba67d21a93aefe837763a273072630626ad00dc1840c17fb4187779431
- MD5 SHA1 SHA512
- Path C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui
- Size 5KB
- SHA256 680b7ced634c050b0c738ec3d6cb666ef23b8ea92a96231d57385c54e72858fb
- MD5 ee79bc143a36a5f39d60e07ca53949af
- SHA1 cae038e5947688b33b24f4e14d52ef4e8786d3f0
- SHA512 f6851a12df68f17c4e895ccc01fd96c7416475d2c1f6d289396f9af014eed4aefab0ed55fcbb55a589f043f4a0100f3c0dfe055e34b47e0b20fb0564d6e62a48
- SSDEEP 96:XyM5BCM3O3owjgwwJnf1q8py3tJFycY6vMW3MK2jUy1/5J0HiJ87JK:Xv5Z+3BjJOn9M3tJoJ232jUy1/fdKJK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui
- Size 24KB
- SHA256 2a0abaff6da29327b8c83dc0571a3cea0fc5f6c2d7c7f0e10ccb617cd61ef965
- MD5 0207829253404138c6c8ad26c01213ab
- SHA1 c0bf9650c8e04300fb8acc95961ffc772bc70135
- SHA512 f2bd3d24c6345fd7b0195ad9385d200b7850a8625e2c77dd35855a3041145f62b24077d53c1ac087881889b2cc0fd2c246dc45448b9638e9ccfa2eb5226d7781
- SSDEEP 384:qgjxvJ1AWbqmgggXvRkZw6nBX9uc11cRTs+Gh68re4hA9HhJ9tEfibC4JxSYjIpv:qgTpmmu/UnXZ1CsqZvJQfQhIpGe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui
- Size 3KB
- SHA256 1ce5f9fba25d6d22edcb6a1b42ac0eabc2ee9d3fa0d4241aaff2b89deebfbe64
- MD5 7ef58a359e20ffde08064e7e6b2047be
- SHA1 847bddd506f9dc578864003fbf79027be1a4aa89
- SHA512 84843ddcdd277a2f4929f90ef4ce7c6341dc42b2579ecb550876f625dca3a90dfd9f8389e8f24c8fa11de2d2b160af99779c849b1993fb6f5ce7225233fcb3bd
- MD5 SHA1 SHA512
- Path C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui
- Size 9KB
- SHA256 2dcc303a045a0001d430e7fa7d3172f632c75abbeeaefb37337fce1fec5a6288
- MD5 9b14eaaceb4e9bfeecc5ab2f5661c395
- SHA1 1e3d23824cedd3b3410a7fd002b082972eb9665d
- SHA512 17dbceb8e18700b6d5ee4b0e261504e435885c2246901f43876e058075156c896c8281f40f76a928a410ca39214a2cfb61c5d4607993e7271f9e6e33ca70c33e
- SSDEEP 192:f73h18K3OkjutafdBUj/nGhR68MMMw7BunrsLLtFy3W9cYZXTIPcFiuVR7g:D3hFjC6YnssY34noL0W9cYhJFigR7g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui
- Size 3KB
- SHA256 90a4b4e6816005c97874195ec229c43f1f0096129cd35abd3ede88f7f98fa032
- MD5 6d9a8c99877052f7c36fd642c0d2bbff
- SHA1 8639d09ef023474a3a7b6749d8fa13368100c426
- SHA512 311aa110ac7c9134339bc0af361280a80f4f69e89e333ba738e9712102cdb34303d01872a53d404a7c6334cf5b00a0b09c3936914d58fa9316652eb7d9e85d12
- MD5 SHA1 SHA512
- Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui
- Size 5KB
- SHA256 de59fa0844965fc2175f292d45c2182410ace38146e5c219b90dd1a48789822b
- MD5 f97c681a6e0bca8b2e11517aa9e1df65
- SHA1 70a85cc13b54ed6fe6671093d6dc440f34b1609c
- SHA512 842899c11d1c79aa6b2b21fc71900392f7619683a372359ce2bd430d0bebd40b3e375e3f7c0dd6b3b900d0fc1c3cd459088576a90484a912ed6b7ac009d19bc8
- SSDEEP 96:VECYKddBCkeK2mvDirvy4JPe8uvtMuAl5rV/nujEZ+UUtSStr5axkFqjyM0:KCYKddEM2mvDirvHp+NAnrV/nu+1cSyx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui
- Size 27KB
- SHA256 9931034feac29c980e868959407b7825277828bdbf7e9145a613be4ab7c3465f
- MD5 e1be0e4540ad1c0572dc4aa30118e2c8
- SHA1 08b55f354b661828b4797c85f37e40bb41656950
- SHA512 4633613572836d58c3ef46e60b8dfd557f8c425cd2598d437cc3da2a560429198eaa8d77ed61829bc36be5cce569ea9c1845f160d4411a6c86d7d324d1a3ffe3
- SSDEEP 768:nDVd80EHPyNDFE3S1uXTuaFmUuXsPLb1gnIw81hDj:DHCHqNDS3Sc6amVXM1wUDj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui
- Size 3KB
- SHA256 8271e694b2393dd0dc3e37e6883e51e72be2bcffe021e2cb31587dc9ced0189a
- MD5 0181d7434a13d103b24b3c4be5f43b6c
- SHA1 d808ed75f65932e03d90a1c26cc3ee622b2888dc
- SHA512 5d75e7736b93eada0ea6d6a5f6e643fd892a32b8bbd07f0c5c189dd9d7b212004e1c202820f4a946dd32b8f2ec34539eff7d63e6667b811649d0345cad0809a8
- MD5 SHA1 SHA512
- Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui
- Size 3KB
- SHA256 2caf42bf6d3323a9c8fab4a1bb6d4973655ec832174cd7db7966de33a6453d27
- MD5 af39acb395b7ae7a565a1f10476532e8
- SHA1 ea72f2f11dd31d12ae3203793ec7c76822931381
- SHA512 707e7a256c7175ae2393145b2f96548852e25b30951d936d2722f4888d4bef5c37d60b2c0fe6454fec60279d80b043c29c8f8d120713598280df5bf607417713
- MD5 SHA1 SHA512
- Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui
- Size 5KB
- SHA256 3ca730c55dce7d8050a0b1007fe002e1e08e3a3fb57a111a62550b77d4074ce5
- MD5 802842b5b4fa7cc32dbcaaf7f30d5673
- SHA1 0315bf28d85898f410088626c97f0b8de05afe89
- SHA512 e0021b1e52894bdf220a0657a58d41ba13e83703ad3c0b3f187ce31366436471e02d5272eff5f235fd15dc4edde3b80ae7f4de7e0b8942f1fc5f7d962243cc01
- SSDEEP 96:UTT9dhm07MmY1zwgUngFjQk8OXD/WpI4OJvqLgG4eG0op03KpQDt7WK:6TYlBxUnOQFOXD/WpI7+hvFo6yK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui
- Size 27KB
- SHA256 d83ebd06705a30985bdc2ab8c001c3424996ba6147dc51814915122e69ee954a
- MD5 e5daa979f14b66e39a966b0285c130d4
- SHA1 d8702fe552704b30a2a0d74d7de42c0bb0c51214
- SHA512 1db64b59e58ced9d5595fff8a20515650753ba3a7243c2030fed076be23610198ed9aaba60d65700876ec732d7bb5c92ed34c3359a1ff4488acb9bcaa3f29237
- SSDEEP 768:iig7iBh7TJz4Z7/bRDlDdVIDRUnDogUNtreT3:87o07/blNIRUNwtrY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui
- Size 3KB
- SHA256 23c61295f223d60eb2bdb9d06b1ce9b12bc2f70795aa0924e9ff8fc123811ade
- MD5 e4785119a48f92af010e19b3885ef037
- SHA1 d0d75d6b7325ba10934bff78571529ccf8206f3f
- SHA512 51820fd0e78e99d461d802af1c781cd98aea54669c9d10f88239ed7314c152007da549d921e9c64c791fa70a310497f888fb39b4096a640cd259d9e7e72a938f
- MD5 SHA1 SHA512
- Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui
- Size 3KB
- SHA256 4128135fff71f302380d0339deea81fc3bce4d4cfaa81608c9b8d1c0c64cee32
- MD5 3060d95f21611a5d4e8425090a03ec8a
- SHA1 965b6c9ad13e43eff1162752d9b8a931953d829e
- SHA512 0389d58f65325bb6929e1b38112b89de93ccd32675e5e45642df7cb3657751a971d451923439c3d252180f9d87d668590809972edfd862e48155b35a098a2b9c
- MD5 SHA1 SHA512
- Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui
- Size 5KB
- SHA256 f1224fd9333e21c5f99ec235dea9ecf36959ed5d62b5dd976bd2ac62a33579d1
- MD5 e6b9acfc1598c17633fc32a8411681a2
- SHA1 dfa44373771fee3765c45a6c41dd121e6e1468f7
- SHA512 e78b2011be16265cb3c34bff8022c5c80423944979526dc7a2fdc8980e1b3e2a10b01c1d6c6ce2ee54966cc95b63d4730093481a8f4b5e7341bbc662be9c1ad1
- SSDEEP 96:EVXK1KkbH2TcyX6272EjeRFpW/y/kMySe2zx9Rw7RF/SYK:wY23B7ebwycfL26bK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui
- Size 27KB
- SHA256 62586f740f624674a19bcc7cd17fb8f3530214a6f64cd37e4783f7756056bc41
- MD5 a8081f1bddbe92865bf42dc95a9b8a43
- SHA1 e6111a4336cdbf3c5008fd10956e442bc008969c
- SHA512 9f0669ce128e01649ecd749bf21cf0acab6be76a175a175761bc1e15183b3d0fee720806bb31e59afd5f577b4380c5178b3d1e9b9006a10b6cbb698924810e58
- SSDEEP 384:MZuzG7QJX3fwa0oIhdqElKzzDogdlfGg1bo5b46iot2j003ix5aQbqe1wbvTH5gX:WuMQJ/CdqCKcgP+ebo1NtqSxQVe1McRR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui
- Size 3KB
- SHA256 9b14ad55372347cc3b22617807a5c38759b047ad62563ed8920215a2621c528a
- MD5 b19c77d3f0a2d175656341240dafdccb
- SHA1 5b797389414ce10d84a873d08ef0110f2c389678
- SHA512 b311e8eaea0a9b2f117fb8a66af5c23c3cf19bf960d42066542a0d8767a9085a4ff0591422d68de0a5c87584b490bd86ecaa82922dbcd6291f06dd58a3762f1f
- MD5 SHA1 SHA512
- Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui
- Size 3KB
- SHA256 6c7c10d731c28e7798ae37055c40a8e857cf89a6a15da00b0d5b25cca3ef6fcb
- MD5 62a477f5c174a12dc346034275ede225
- SHA1 1d53af1357221bd80b0524df8a117106719f100c
- SHA512 e9962de37a81cb4fe66dab2b4da231ef211afe670ba342758bcef11f80d57109d769713ab8511d605a5c92eaa780ff35db0faacb676ea4c6b6124ac304ea0860
- MD5 SHA1 SHA512
- Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui
- Size 4KB
- SHA256 cd3488b7843f1b5b33f1f18ca953096af7aeb4157e300217d1359e50d5a6731d
- MD5 1d90b4ab0e656f5c9185fec002342730
- SHA1 a26a6e22e35b77c4e0e502d3935e8b35c15e9f1b
- SHA512 bd7ac33ed169b3ae3bd771d154f592bdda962852f3f094f4711594052fa3cb6dac397de2a3efd5443441cf4243e2fab7c2ed4baf551a3391e7be474a5f2aba9e
- SSDEEP 96:agxcgL/NFNW3l2zSIXCifnL8viz+fjBZ+qHqQ3EjmZiK:aWcgL/fw3HIXCiDrz+ft4qHlEvK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui
- Size 16KB
- SHA256 ee3b37b7701e29fbca1846251b93bd2555932b9c95870daec39976ddc330ae17
- MD5 f1e6b97e2696425b698dd64c0726d2aa
- SHA1 d68d0dc2647c204bee7ca7b303b2e3a5b666f8dc
- SHA512 39185156e5cda729df74c38112aa6df678ff58676ebf6d85dac7395302719f5e1793a478895eff19689a21e3c3494c4115b32ff5fcd1c395b78fa2e899e2f791
- SSDEEP 384:M7pn2DZceu48xqtGJHxg8Vmizj9yM777x8ne8LYz5iXOBi7K:W2D/f8xOGJH8izj9yQn2Coo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui
- Size 3KB
- SHA256 2b39fbd52513567c472d2bb154d8fa148e083453db76fd8758615715f78fded0
- MD5 5b7cd407899147992e7a0cc93eeb563b
- SHA1 548d46c716a167287e0699109fbcb8e360e8afcd
- SHA512 fad762a1489f3f7f74c490e9724a69a9b10c2f449c6ed95b2ac6f3fb583f198972de1708f351f9667be4c2c80424d46cf206d28330583363ada4a41831535b6e
- MD5 SHA1 SHA512
- Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui
- Size 3KB
- SHA256 ff690295152cc8980c5cd08c9146215c8c8fb60dd0f9f8dd0868e868a66599fa
- MD5 312f40f604b2854f21690ebd152d32ff
- SHA1 931b5a95e26569a01db8c6c11491b5d5aebbf2cc
- SHA512 226eb84550377e292892d8a66bce41609168bda16b5ec0cced1d431ed982826f9829a8e0132fcb3a9337d6cf35546b32741dfbaf4d638a3cabb6322c9e296ed7
- MD5 SHA1 SHA512
- Path C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui
- Size 26KB
- SHA256 78f6827f0d08d1c6518b003c441387966b68fa26bde925c33cdb09e0ed4ec684
- MD5 ebb0856add2129ece7256738f1e0b464
- SHA1 1e13f8492024399309b6b8fa33942a4261dca885
- SHA512 c5410dd3ae1d41a454acabd66b960f13d885e0d76ac38291978a7cf346f6d758707d79d9fabf631a99adde6a9874089cbd5ccd0c362febcea6e8d9a06a96a8e8
- SSDEEP 384:864cETdTJV7NrFwl92dvq+i6P98LC9zlK9vSMBSnCgiqSQIywVR+tjdSI5PsLVw9:86LuVBKn2dFPiLglGqQnEIRoAI5KVly
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui
- Size 3KB
- SHA256 3fb0b7ce78c730ccadf5b4cbb64858195ca384d7de8ffd7e55825263074ac970
- MD5 31752b791c8eaa66fd9a791a34cf7989
- SHA1 f3c2c164163ad4332ae7f5c3ae8226629ab271f6
- SHA512 64a2eea58bb31e5a63084779a326f09dc985ee0e49aa0626305fe5581d6f89fa8fa1660b4a708133107f62ff8db52d0840e662a564147e29370bf652fdd63928
- MD5 SHA1 SHA512
- Path C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui
- Size 6KB
- SHA256 19e4686f86740a86f9c76dc55229fc5ae6249ea177741d5641ce921727ec5f5f
- MD5 b8d4784ea885ed33891fab8f4a12e047
- SHA1 05a06f3ae56ef98bea9b12de9469ac6224bd1d25
- SHA512 aa489c801d442afabc54cf0bd02f938968d609791ffbd07d8afde3d03d96a6439a98b81dd5e89b94ef305b1e8981b14d299891829690a171571998f9850f53a6
- SSDEEP 96:4cW9+nu8SuN8DPPdfLBkJMD0rxnaG6S3wfJOBvLqGNFAQxSM7Umu0YFt/itaW0Ei:Ep8SxPhLBqe0laG6cksB9N7sl+cEtauK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
- Size 5KB
- SHA256 c4ef1b31b3b3133b602a1fb515c8c9e9a71cd198fa20f1b5cc5b611f8361dca2
- MD5 2e2e813d03399674f384b3096329c915
- SHA1 7244df98cab19cd01fcad9dee6ff03d15b59bff0
- SHA512 f686fcf80e2f546c2e2bbd96ae68d9abef746e5fd72f4e97445406b332239759dd4fe664ed18fa56acc6d8bce811dc8de47167715a7460d414fd7c393b209e55
- SSDEEP 96:PsPHidT6l3Y0Px/c/sUl4U0TPeDBPOTrSkL5bsKInm2sOQMahH/EVV2Q/uXZR16R:kPH2ujp/cEIH0qDBkrVpsKfmdahH6jWG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui
- Size 6KB
- SHA256 fe72c42946b8bb6e72cbe45782b9d7ee967ac66e364e4399ffcf6ffe9c37ae42
- MD5 0c45b8fbd9513e67b92edde52699d67a
- SHA1 1ab047c1cb6f9ba9736e42d3f1ba5b6629818f8a
- SHA512 884b65c9281768f38d3b0e132c73f6991edbb069b8b6b2ebf13b1be6f143f13ca31d076fe00621d9e4362e9c8d228c458d6708b3f4025f0f50a4a212aac99991
- SSDEEP 192:dU6Q/qcY0ZMQ+Zi0HfbShtp6vM6IqZ03NjdK:3kqclMQ+z/bSFZ6Ih3NjdK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui
- Size 6KB
- SHA256 e357c7e1e02b38e2510d6ea9b07d0c371cd3d2bf2f32836355a71bbf97eda580
- MD5 5594686a4b21600bc5b027c528987d0d
- SHA1 bb4c7142277eae2c29100c86becf79633f4f317f
- SHA512 0f252d9f2c31150a932073fda0e20c5fa3b8e63b32fcecad03766d2bf63df18dbb3cc3846d4369dd9e2fa09a8eace7f2bc0193b047765c19202e801c76e46d0b
- SSDEEP 192:BwtK1bjjdh+dqiaNtJVTXs60N26F2BvNUMN1UK:Pj/AqiwJ9c72WeNUMoK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui
- Size 6KB
- SHA256 e1106488e4b23b9d767c161c748f6fb31b521436a030e9e2d93ed9717c764076
- MD5 04de1a0b2c2a7ec15640f82715545cf7
- SHA1 5eacfeca09fdd35378d108cbc4cc06103388d67c
- SHA512 5df90f94038b96f2884970cbafd0961e9b5db1d85d50ab5c52c69b92339833c39f7fd3bb0075ef5b9925c3c80be94198ffd94ec4cccc594e826f4d9ff63c0230
- SSDEEP 96:SE0TT7lsER1hziteu/QBTacMMRPloDBDU0oCFnK8h+rRJ+LdoftE86a6b9wXcp7T:SE037llC/JcDl6FFdlk6VuMp7hLfAK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui
- Size 5KB
- SHA256 f7c33cbca6153f13f4ce8c6d2cdaa8cf8af7cdecd4ee6f0ac3af9258857fd5fe
- MD5 2edb71daad10b152f515abec1ae83150
- SHA1 97ea48359cf3b6b1a93d0fe005cb37e0d2221b5f
- SHA512 081ac6e0876825258fce43593d036bda3b72a839c00ed09140b8a317ff4aab6082d67b713dd4b07afafb0a3b765f747efc0b20f2015fb4c8cc1df6fea22646e6
- SSDEEP 96:1zv+RGIKQqTM3J/jQGIsrT5cJSSfxDYzjVGhTozgoSvdNY5uXw9vJqQrK:1LjMyM3Zck3wDyjgOADC97rK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui
- Size 6KB
- SHA256 c70170f04dedfcb02eaed4d31c2f7444db8bc55abf24c724d90b2beab72e39da
- MD5 1183faf868d4404ffb3374960f83da76
- SHA1 6db3a9bef452491f6d5a1f0e9f09c391ceae20b5
- SHA512 a38f4f0a3aa0ba9e244e9d9cc8196f65a994439cfe1d7056e51fcdec201927d180993bb8ee507703f5955efb6bc8395d361c253653e3fd5dbd0feddd822d1a8d
- SSDEEP 192:V0OldCbCsJoZx6Tok/x17kUu+DQtXgaPK:V08UlJoZx6LFkUnE1gaPK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui
- Size 2KB
- SHA256 6a519cd443fa29d336b84ec9fbafc7441364e6766e9b5b6fd8fa820e092a4ad7
- MD5 74e985d189c4d55d0f736d9fadbac3c7
- SHA1 400e832845610431ba7c846beea4370575224d13
- SHA512 f5f5e3b455caa438da8250f07ea771f1b82a342a08ec179d59ba4dc55c79a4d894e31d92f5c4eef0d365a491dfc8daa4bed9d9c12fe1ded2827966661aadf20c
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui
- Size 60KB
- SHA256 072b4221c7ec7b65b7fd94d3cd6f01d44fa196a05e62be7494946ce5e563e9f4
- MD5 24c409fa29cd24c7410ad07f278a4121
- SHA1 5c4154c70c155ba413b47e4671c8c4011cd2c812
- SHA512 cfc92557ba777078da26bc7eb8c68bfe47804d8e7cd423d5bf4cec00d4635f7fe7d10958a3cb0ab9658c80cf5050d9b05ec5189a673440034edcfda142b03aeb
- SSDEEP 768:YniYn/w2OtRxLCSD7bEq2KrCotWmtgTaYvIMUcboXZKom9F19uJw/de2AryLbFD9:RJh39v7b/eoMq6epI3cw/muh4v9BipeY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui
- Size 3KB
- SHA256 abc2e1df09a75ac97a9d178139975690d83018deaf4391f37f65d81685a23bbe
- MD5 55858cd9299833cb9b486158dad00e1d
- SHA1 0232f70fa1621027b75e665afba552cca7dda952
- SHA512 9d3003cdfb11887806683dfd873ae2d028f683362da6d991f11b011598c18139812007cbe1172dffa9464a8aefe512d98e964542ea4c6a3081ca19cc74b70720
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui
- Size 58KB
- SHA256 0909e154642a051829c0c89902a462c17dbb984cb52e87290850afd6a7506ac9
- MD5 6e63e601f892e4edfdc0b15d91259be2
- SHA1 51787fabb319ad0fa0dd2abc82a557d96d0b73f6
- SHA512 1f2c0a2975bc1c8c71231e2e3119dc38b23d551a762b699e890725dae2e7c252fc56ca6134eaff7ef2fe3d8d38e5476e48e19d9d2124184f71f5da909f8b0b6f
- SSDEEP 1536:pFZcZE23c7vm7Hb/GzIRy50ZJOJ7mGuy29vDWiToA9yLl:p1Ac6b/LMik1mTXpoA9yLl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui
- Size 3KB
- SHA256 ae51184f2852d1e198999f43a3f79e5979beda1581c92e02737e00833d9cf26b
- MD5 affa6a87f217f6a39f242e0839b798d7
- SHA1 468a0c7d4d09d05552aeef52322f073a37f72518
- SHA512 e4132ed764b402c45a7b289baf7d169d9a06c829bd450e7da040b023aaf49eb9fc7fecf5f41b71f5ef4f0eb1a8091c1a2588fa0e0d5e9b5a33dd39e226eb320f
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui
- Size 61KB
- SHA256 4558ae8a92314379a690dd25059dcfef09e557d307af20411ae25f7f5180fa50
- MD5 789a77c91f0018d66dac61d5da2b6c85
- SHA1 4244e23703545a806bab9b053e97745ff9e9dbc4
- SHA512 c4340a5db8943e1fbceb4e4802dd1d7f2dbfb76bfa1dcf19d86a13c04e40824fa7ce396505489db04bbdc7b99e5625397694568f582780d6d4e3408d5e7cc05d
- SSDEEP 1536:tSkkW1LEIm8PfcPCVg3e0+IT87pLYUvMFAFmvcFrz:+W1YImqBg6FkU4vC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui
- Size 2KB
- SHA256 ad1f7d083a81bc672304550aea65fe8352b38f4fd2ba2c63d8394319e60bbdf5
- MD5 4b6a15c7f51e3d6cd19126b489768e7e
- SHA1 9af77900c42143845153b44fe445420ffa7c1f86
- SHA512 212cc22265941ce98f44cb8e0d725dce66df9b3fb36ab85a4e8ef40f77c3f4d8b2b70d544ba2331cce9e8b7800e9c3e0ce47d721565969f725a1dd1c9c957b9e
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui
- Size 57KB
- SHA256 28f273cc993b40d9c00fc1d461965b41fa4d934365244a6265767457f30435a7
- MD5 19f492c23400f64913ecba3d95003045
- SHA1 a82a1687905a86097ed53a6ae99928a262c7e79a
- SHA512 8ee481dae98f69038d4c380c2347f3056a54050a22ee3155b95ee07f35e53888b3d33d023606e4faf9980ad1816fbb9803278c5ae62240e7b530b5d7a11f63cf
- SSDEEP 1536:Ts+SVkvgukMEKVcgHNNsnXx1TKicWmmZGnO:T9SjMEShHPwB1TPcOgO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui
- Size 2KB
- SHA256 950fe2ad4e719d274c40c0b008398eeb1464d93a834b827d65d63a46f8202f11
- MD5 548ec13bd5009dd633facd396d5acd7b
- SHA1 42d39b6871bca479550fbe1a8f9286933928cadf
- SHA512 29245458ef96ce639a677ebeaa4b201b21fec30cb121ee58e518e087bcf562094ef3d8035eb66753976350330d96424de54b1e4b5c52aa9d41f4708ccade1d33
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui
- Size 31KB
- SHA256 3899dda01856ee0497f60326fe375bd5c203be5a387f05ed3751f906a18346c0
- MD5 a630d229a9ac13206cfa0a47d75120e0
- SHA1 9e0b81e276b6fe7ec67768d540f20265567590fa
- SHA512 0ff4b2f626ecc06855b8f675b97c94ae2e7fa7610675579c14de9e53340f9d0154a4a8aad64ffa756888af9ad68ef10a380fdadb2c7c512c1d3807cfd538c17f
- SSDEEP 768:2rZIibLB/JsDEsaqO5uxewniDQ8OyI0UF86l3F3NIC:WZ/Dso5ZaewU/OyazVF+C
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui
- Size 3KB
- SHA256 f51e585c2e10c5636f06e73c6b35d7ecde638d96f79a3f819e2e69f5decdb51a
- MD5 9418ac8e57ff5f3d21fbebf5b5c7d9b5
- SHA1 79cbf0f1286dc7b9624f1e333c0e3ff71d4b0028
- SHA512 eff6e8fdc5dcfd84048c69fc190f6edf727614b732db5c4c1cdf343b5a8df1a4021f48cd96ac4809642c94004df15ea901a0b5727640b4e614325f608e1c68f2
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui
- Size 56KB
- SHA256 1343a3071b002a12d6142edbbe45b51f04de350fe77dd1af49759c5b46c8843b
- MD5 a157887af2c7b5c386e2284fb2ab711a
- SHA1 59c7514f69515fc71b26dc4b87fa3d031d6bfef8
- SHA512 f16d228089979de0fb8b374da913b3c69dfd92a43db7a9f65da5c34a51d16bbc7c28d59b8f6d1371c9c54ee110f5ceb92c517011bce71a20bc053d0b758c3192
- SSDEEP 1536:yAewbt94l9wf/H1qPIRhZ5Gu6TKxGyEgVP:ytM94laVqADDGdQSgVP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui
- Size 3KB
- SHA256 7afc9bcdebae2f897a93dea99227dac210dac47031085f55bbec0cc1734a1ed5
- MD5 0effb8176243f17434965d1429b73df2
- SHA1 b67764f37186c5b79c12ffc81fcfc1f32877005b
- SHA512 52b682ee78f64284e2badbd57a689259bcb6d8094285689e1e376e499938eb2b11aa98b4bb26a5ea6fc99fc3d822441102635fcf5fc1c659e8b131517519bcc4
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui
- Size 3KB
- SHA256 d060a9e7e481bf28a858bbbf0cbd7521508ae8f666c60b2fc46c8f6466ca7849
- MD5 bd6317bae7017a1b33ac2ba1aa30106b
- SHA1 f996786cc9d4aabdfc853df53af0969130f563ee
- SHA512 862e89aa19ec562555af17dcd6c6afbb2d0c9d5817276a87796f8fac66e625f6891610a7a2bceeb4ea9f81fd50ed6600597b111944ac26a1002ba76dc3d2f7ad
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui
- Size 61KB
- SHA256 3a4e01dd7ee169597c5f48e0d1cafe9d89365da7a93e508e6266b71a78a03de1
- MD5 df537cf7ce98e90832528737b2742a55
- SHA1 dec1377dbe025e78e3403d44333906d22201aa92
- SHA512 96a32dfac80c5d1339832aaab82ee60925670f5226aefa8a9520ed3c44be59e99de2adb028f49e0aa0cf24c89d089fe3908a8101884114f94d97376943f56d70
- SSDEEP 1536:Wju8ywaUHhI+ywFM0rBUanr5eSzC//24rpN9:WjuXUHO+yaRRlPz+20N9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui
- Size 2KB
- SHA256 f44e82db5de960b4af4db3cfe7d03e426c7d42a31a6a2f27e22a0a27cc06199e
- MD5 4d737760af8135e54fbef0356a131369
- SHA1 8eaab43f1a5df86c3f27c4318199f8276443a5b6
- SHA512 672339d566f5c92cbf0011c8ad8307f2237b8b387b301b852414443f6e017c285c0eb2dde6e7a493b27abca26ab1af90729d3c397e1be2bf2eb993ac6fb6e79c
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui
- Size 3KB
- SHA256 b7068db3812d446291c5a0133023d77e9e1e61fa63839628af99f7accd436acf
- MD5 f2b431b03f9c387340f7be858a6728a8
- SHA1 33391ea44466203cd16cf05468b0b5623d96d483
- SHA512 7fd74a22495bd902e776c8f0b0e98c96e291049bcb664a08e588a88abcefe5cbca2af980f6ba0b9ead504b0d8bd940883b9b12d98f94e5a2bd6b9bf536024fa4
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui
- Size 4KB
- SHA256 ff8e34b985983a91c3f559d20c23cb5a1e2a3f0a76ae8c52ad73c73f7d1875bb
- MD5 b961f11ee8ac9a2c28cc16ec6708267a
- SHA1 fc875f31ffefb90a2e34e81b7912745b1bae350e
- SHA512 05e55d80e442f3a9afa7096d1ef5e3d25b939b36ed482f391b94e99a9026a434db53f8c791ac54631ea7a2618bdb4807fd334e1ccd6f48323fe7905fc1e6c5c2
- SSDEEP 96:RkavV3z6UJppEpmDoHRxTqVTZG0WqeZYG0bGZC1BM6yGNFefs+adciE1IkLCK:bLJ/EpITZGy/NbGZCRNFF7/K
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui
- Size 3KB
- SHA256 0d7df13d24b36e7cb0a9f5e5f22784967bb46e6a526f9aba0a7333fe38f48564
- MD5 b4fc2a1bb3cdf38f1b794bdaf7d33dd5
- SHA1 31df6d9c6c8466b2d59b7c5b3c45e8d6ddb2bafc
- SHA512 0b496d30f70c0bf100a7bcc0e0603da1393f2038247cfe824e1294b552bdc2a86d84e8294e231c4fb8ba5e8a29886d69bf45a0f3eb859852eb9a93472a028850
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui
- Size 3KB
- SHA256 08bd5e4734092b88d8a4a3e73c7926d2180a6d023d692e1bbd0c7b34121d3909
- MD5 54da9a4d968056c5762a78d6c797b108
- SHA1 e0d3df29bd7b9946607b9429067b5659bd641d36
- SHA512 8f3980219dc1b277c265644da7aab6650d0c15492e862f7b6bee41407fd81488ef6ce0471228847e3c780b06e658770a07bae69e33dc151fd2925a9c182ff2cc
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui
- Size 3KB
- SHA256 34e13c1c23aaa9036cf1fc9e761f8b57c4565c9335b640f3ec6d80d001add8d3
- MD5 8bb0f71a3a46acaad428d9d2832b3f61
- SHA1 bcc75e6ae9210c7b42bf94fa1828ed12063d97f0
- SHA512 d27ef2e0de88f62252da10cac8388680446c5c398644693ad4c6673c65102271d7a93658db74229d95651462ef0524df111e91a68eac278114a74b0caadac04a
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui
- Size 53KB
- SHA256 c400190077dd685df606747457fc34f65888e67e5ac4b4dd4529a10bffddc889
- MD5 58d139ffcd7145b699fb98c2aef9f096
- SHA1 8df86db1df0bfc897da4058e7ce0f0ea8481df96
- SHA512 f523257cad72049f65c7dec6effe0ef80285f99e15e4fd6e3e25cb1967c3a90e8305c28d27d79c18a98ba6de09c134b7ce41aa50a805d654c9ae5ccbccf68f1a
- SSDEEP 1536:cWy96qYiPz1S9rMqS13nKsjoEmQ7t3lK3eRTYTt0:UorMqkTmExGTt0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui
- Size 3KB
- SHA256 bca16417fd22f8ffd6cf5fc6830bcf01f3cdaea120b391d83f07f6bfaa83f6f0
- MD5 1fe5523eb185dce51ea60e0ab28d7ea8
- SHA1 bd429cb0787b182411d0dd0268143c2c77136f80
- SHA512 3dbd1562eb68e5186146cfb4fe1d51d92c2e0f96e81a7b6c608680cd75ff2329e18b36dbfab7d110f0a827a57facbd1936957a54d3cc42d43de2baaa5cf2f200
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui
- Size 4KB
- SHA256 4b0248df6d879a60c46bde1717719d12e160309211e3b9062a659da270e51780
- MD5 95e46741a64e17c30f2b18c2744eeeb1
- SHA1 1183ab196eaea564bca4cbd3b1084612a260d7bd
- SHA512 97e290b08fd820ccc58c986c010068610bbe716ee5e8fd6bd3f1137989cd760190053a31b7b62063240b94206d3750792edd17db9fda5d631252ef63448c9646
- SSDEEP 96:DUO8zYvroC2t92R3G11yTsdCAnv9xTUhNn8H0VUG5ZK:4OIYvroCga3FWCA1pUhsmUG3K
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui
- Size 3KB
- SHA256 54b51a91b4e7d63945ec719b76e0e96680c82b2cd0ba94a8e2076831a673fded
- MD5 d6b4640b269786501f2106b3e9650051
- SHA1 859076d8b5ccba5e4c53ff21859d0e51d163356e
- SHA512 63f9c5157c7db410cab5035862efe7350ee2ef7919245e0f4cb4760507c73eecb14e295ff75ba5ae94005dbb2fe7b4bb40a5398f62aeaca49aff63517985d196
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui
- Size 3KB
- SHA256 ec38dbaf4f875d995e5e7457d305892492f25abc86c012754e0284d1f3443cbe
- MD5 5d27ecc79c7a9d1ac4da2bc282a49d2e
- SHA1 9e8d3b427775c23c655a7f60d9b37e418f8c00d1
- SHA512 a2c0cf93c9cbdde3fb394ce8f5c8c493709562bc1cf42a46150eb6404bd119a0bd5b4fd528a1cfb2b964faec8ad7519d002a4ca05c786848e0f57a456bd14cf1
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui
- Size 3KB
- SHA256 3da6d562abf809af82d19787866400e357fc98b3b2c3e306984e54568216017f
- MD5 e3456f6ec3749ab7b21b25cb8b7e72f7
- SHA1 7917ed33984a39b1e6a2e7c26747912e6a59528b
- SHA512 06efcd093e7326cdab07e89468c48f3ed7b0d44c6106685e64d754502661811012bd243494883ad83fbb0374ec70c22cf2d30ba36a4be44e2c76137b68cebc5d
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui
- Size 62KB
- SHA256 62417b6100c17e904552f1f0e41c0e70a52159fe36f8d798b61830cf0de5e599
- MD5 6ce13afd109d7e38342c0e98d685e1b6
- SHA1 045606f2c8746af5e39e570bd7793315843f31a7
- SHA512 d179c3685a75b1a713581ff0243ae2a8a81637b885fa8d7715c4039210f63f735b4048a0067296adfc300ef0ee7328dd65566d449fe1e4748fbc7a8b9b8984df
- SSDEEP 1536:5+h33tbqc9l7KXEihtgFOK9FmIrFeeEEIFwUx+21i9MlqNwHoGyyVAIL:5+zbr9l7iEihtgFOK9FrFeeE1FJ+S9WO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui
- Size 2KB
- SHA256 522d1814c6d3fff480bce26f5b92f4b1ed420404a59fc36368c33e5c4e74ce0e
- MD5 f3850b500fba6250dea69359a467d368
- SHA1 17143a39f735c7db6019a5060dec066d79a7a118
- SHA512 45fd8d273647492eca6f6a64260efdd57e9bdcd8939b446b8a4438acc6faf3259ead2bf7c6065b0f45483802dc2af9e6315a3ee5e614cbed702bcb404c9d3c01
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui
- Size 3KB
- SHA256 eadcf5edcfe163c60d1a8624cbc071942b9b43aeb5db74414d5b7d9b4220646e
- MD5 2aa55ae49a04f8e0c94fc99f72d0b7c7
- SHA1 0fa83ec8df933cc0a089f26277baea17f680b5a0
- SHA512 939b9d24c16b0f982cc5ad55e3a214e69578cfd1c508534e2f33ba306b884308f7901103be135f631eb350631d03d7abd85d7e600753c9781fe7f3761608f39d
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui
- Size 4KB
- SHA256 fe922e46bdbe10b5f9f77575412cb2123ae204fc436a17695852b50ee08d2d8c
- MD5 e0925bf48153e71c3f8c28af0438f75d
- SHA1 12715a4ba67bf8e7e5191d5487e06f85459b42d1
- SHA512 ebda1587fd61b0e86a4186f48e65bd8c91b3b9b769eada2632e9752b052c70c070a69cf4ead5995dc8f6141c79a82b0d8e9af566585560ec8ea9cfbce0be1e2f
- SSDEEP 96:lehdshYGyC7B5UzXevj1dDy8qiJz7a0LHvvIYTPvfA9Kw1PuyTK:lehdshYGyCVyavj1BTqcz7/LHv/TH2KR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui
- Size 3KB
- SHA256 25d8f00c8fbf3b97cd6f69193faa15a0dd025aee17c5c833e13c11329b18b8bd
- MD5 f4ef066face523987e971e569e452bb8
- SHA1 20e0e3916115a657f79ded5cff51565755461f30
- SHA512 f42173c3ff2652d720dd6dcb52b2f42849e101ccbd699d08798a54a4ca64f5685ca91fe3f55ac98956c880694a5e6796b9181f36b52623462db3d944cce8c2d8
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui
- Size 3KB
- SHA256 ddaa8488f1f027a735d06dd4db5b25831cc2c583193d12190855c59d6ee82bed
- MD5 9c9111561867aff8eb60b43824892ef5
- SHA1 e62357f871a24c3ad2b1bddcc21cc458f33e229a
- SHA512 10f70ea8e0b64919ad68a017139b0fe617735c6c4c55c0340058bbc8ab0783ff9b6c3632d3320e84612ef507a008ac026b709ad8350b6684eba8e53bb32a934a
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui
- Size 3KB
- SHA256 b1da21bbfbb8a794ec351c109a2cb9dbe4ed1d43656e9269e154e9699fe11048
- MD5 f9aa43f392c09e15ebd6596c4e69505d
- SHA1 b9b2fb51b59acb2f0be6b6f264237961739526ec
- SHA512 98df83d5e698d4444db843d833ce63f7715c9f9b5f6b2f18a8f7abfc30f8e7aed85e0d261bf0fe91085454ba6118feb5d70395820fa970c7ac7803a7b64b2a2a
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui
- Size 63KB
- SHA256 9ac01a60e060573e358977184308c515ec5fc57e08ea4ee173783f2266a4bee5
- MD5 fec06e89041c1df7b10c6edb1ea1f891
- SHA1 d29e9541a61229bd19b1bf264fc40c4c3f9070ff
- SHA512 150662a41c768d0586c7a5a36fc47cace9e88affb163270ef2a6aa6ea9a2a0a692cac4f76fb8e6c2ad8751c0bdc3dc48f9c006912c42480605ab3977ea8701f0
- SSDEEP 1536:zwMPhXNd/omu0rxQM8ayINy7VHfJoLZlGrE8Mq:zwMPh9dwyxQFaWxKFlI5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui
- Size 2KB
- SHA256 4dc570632fec1c99641eb8b0c774703dc60535dc53af8363a4434e2f9a93ab56
- MD5 f30ee5780575b87cf557006579f63fe5
- SHA1 d8365a9fb0091b6b7684b4a229d58e4ff0dfbdfa
- SHA512 608174ec036b721a1ff1d9b3e4a5bb32da716b12871f45d2a1d4d66c7d205c64b92185708cb8d641e297aa2f9567198822b894526382cd3676ee9352885ed93c
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui
- Size 3KB
- SHA256 fbb78d66cddf6b8ad037a4082c316a5e677bffbbfd5f7c73893847eeeaeec1b7
- MD5 be7a57567fae9cc0050c3899b23cc294
- SHA1 667902ddfd8a0a09e0fe7a0582ae98b10e77e0ad
- SHA512 1817b64fa5610f59fda815f8a82844474ef8cd6481b4f413d481560da5b5eff43162bdecccc837951c6044523daa1856108454ca355cbb2b58779124a48883b8
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui
- Size 4KB
- SHA256 037e229f8889e0b08f004f3dfa980b7c4a03bcc53223f5f03c2d0cd1993ff801
- MD5 3932e59ade1c865d8c06ea95e8b3ffd5
- SHA1 f27d8e301d17fe603ff0d4cafcb5627edad1dc64
- SHA512 73927da8ae06e5bd9cef50be1df8a1674ef7a1a2ef5d03cc73c646bfce9a112618ebcb809f6966666dd8033bd518f3dddfded376bbbd6340ae48adaa887a204e
- SSDEEP 96:7Cu81Oe+tUs+KZjqAbwQt5PdrGSlFhmzbSD8dxGzmnSqx731Y5gRgAK:7Cx1OtUs+K9qsl5mdddS8T1Y5guAK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui
- Size 3KB
- SHA256 96bbb9a66cbc63130cb647f5a0fc1d4173b1de8efe7640ab1bb1dc837ee24b71
- MD5 fccb31eb1bf17b3089d63e69b1096be7
- SHA1 d10595491f08326fb28b0193ecd6ce79ef4d875c
- SHA512 e9e87a67f543d2c575d0dffd2cd4d7b1f60a1c1f8047c878d44bb883a6508c51003c81d4033f3337bd880d2b947210bcece3429a6c09d7d2ec807977c94aa7d2
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui
- Size 3KB
- SHA256 3b07dbdaaeb3534f586a1eb2c248a12fe2ab7fe177e1a010e2ccae941dd55dcb
- MD5 2ccc546ffe6655150794d237e0f62606
- SHA1 6fbd4638ea1ab784cde33f7176da39cbf67fa683
- SHA512 d1aa907bc5b104cdb174a90652fc9065f6c8719d46910212f41c831088dbf5694675bf2d2e37ea318f707add65f99af7069f0862cac3893d5801bd6fa5a91ebf
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui
- Size 3KB
- SHA256 4923c82054beec1bcb71892617a4b6bce63de6c186a1c64460d54dcdf76121e1
- MD5 76fea0d7f02d323ac39d8cb85a71cc2a
- SHA1 22a39eab6e22e5c29d47f025e359c5ab42d81dc3
- SHA512 187170a5f6d0cbdfcc027e177deb0266c9148a378a009dee1460cf18b29ea37cb7885ec252bd2b80f27a9a3c830e29b04788c29d2a479f64c85f099f1ffe773e
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui
- Size 61KB
- SHA256 1fe5066255dcfbcb1efee60bf60f0857b51435aa46bfd4c980abfecb57df7e70
- MD5 1dfb0b8dafd5da4a8942154c42977a7b
- SHA1 567129ac34576517feadd94adb55d8f2dfff7bba
- SHA512 971ef261a3e4eaa56e20345121df109788cf105345a7bb2f8bf0b318725ff7274a4bc0570206192ca1d433a5239e52a29e422e2a1978a4eeea5fa4a8ffc6bc2d
- SSDEEP 1536:0jiYjEXB0b1jvmWBJqyuWOlaqPWD5SGvv8fTMPrnVF/aucovGo0:03hjvmHyuWODPWFSRrMPRku76
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui
- Size 2KB
- SHA256 dd34fb38e9565455682cf3a11ebd6f6ccfb5c387bc22c2c8ca519d94efdd46dd
- MD5 95f57adb7e45bade924b9fafe0920bef
- SHA1 f1a182240ca1669a10525b62e68472b0f58d8bcc
- SHA512 0532eaef5ceb40def1d467d3aa11880e4e512dc0fe2146c7ab7a1a8b10fd091f1a6df8d56a7cca9c8357196091ca06610eee2128eb64c8e808e374b06a2c96f1
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui
- Size 3KB
- SHA256 8bcf361e8fdea982c889c832920ae7f627009cce18b000b737212fe230bf08ad
- MD5 4731a7fc62931c1a5d6df20747d4ac68
- SHA1 20d310fb1a1ee7b1c8f809c1500a4a4e20749453
- SHA512 6f6e982bbf482bb6022ac43ab1438ed19ca8b7627ea39d591a07e4062f66e9f001d04fe29bf8af287899bcaa2d9e1d18eb32a81c810cbccd719689785a8b1e7f
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui
- Size 4KB
- SHA256 0ad62560bf9a745f7c6173ff07a24856174d64d7d2ee3cf9e48f5da5d013f9c0
- MD5 88197284fcebf455705714db8f18b8dc
- SHA1 34a05a3c11ecf18b00790669652f6b0bf0218c02
- SHA512 690c15273df35cbed92f4a67ff4f01e7ee5ebde5a8c45d6ecbfc5725df8a92d70d6b2c12c2e4b0c80af598d53c85dac356520c382bd7683f52737e4f329bebe2
- SSDEEP 96:fxXfRcBrDxMJ1tpY010WgHoVYw3hVtX7jD2+havK:fxXOBrDGZn8HBiHrjD2NK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui
- Size 3KB
- SHA256 735960544fc02c486aeb2d1f61b222cd05aaf8626520f742bbcf0aeba3891f8c
- MD5 6a9f1bd3f226941ee3a9bb3081915f4e
- SHA1 d5aa11d17e6095ed3876b11cb3764fb6be607d4b
- SHA512 7ee4384e66f8992d4ba2eaddd3dc6932b9e2020e6de979549701370bfb7446eed52040e5d400ff7d3c762ec25c76ac423095809e80efe48c6511737c8895ee3f
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui
- Size 3KB
- SHA256 5f39ae3f55b1ad2b5d0e8892293860e6cfe6da295679f312fd3cf52cf4f86dd9
- MD5 c88d353c6db486c0e239d574e4cbd8e8
- SHA1 efba97e064d0b3c7c6107eff7dc048e5362cfdda
- SHA512 b287ad719cffef50e017dcee4dc0ad08bb255112fc12b64879b8f3e07c2a1fcdcded114213c7c1c11b3be673b850b74f45c4e357154a0868daca7fd961b44e6f
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui
- Size 3KB
- SHA256 8af72318dbdc731fb7940c6c2327b52bc5858c4774b389a6d3f1e91fd031b99a
- MD5 34373cc61f3f7c662f14f2f68290ae1d
- SHA1 8bb0ccb500fa30fa0b91be2d328a61580004ba03
- SHA512 7d1487a0f7461fbb8a98ca62a22644966a0dc6ff8cf7aea7f419dfecc9719a291be363322785b37c732b771b1f503a43ae4a32ddd475b11cdeb008fe63fd6acb
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui
- Size 40KB
- SHA256 1d6dfc144708af94ae505f0c74fd1239beae3df239339947a4aed7a2fb6dc1d2
- MD5 274b7e0145ecb1de100ea6ba93bb38d1
- SHA1 96b48317e30c00b27983f07dfea9b8166b29cf90
- SHA512 a03ae3c9d04d569df212beacd13fdf38da7b4d987a1ab2ee4bff6ce4ec9ab607eae0429f81dc59a05addf0b9aae372446799790be11f737ebffc26cb3dd093e0
- SSDEEP 768:Uc2+NTlGCC4zpE0OL2SSXXtHE9VkI4kpStY8+EIp3ILmrYuf7AGoI1IMK3:UcFhTptOLLSXC9VDdpkNo384ViL3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui
- Size 2KB
- SHA256 10f6b87c036b5f6f631b4efdc7d89569bfae2ca348a779cddfb63d990178ac07
- MD5 01ca26447d036193d616a49e5962d1b5
- SHA1 924b2ba2a663de7979b4f0c04486652708048e3b
- SHA512 4f6be492a01d8e3a5377488dd89bad261905c05f04bdb5c84a24843e203485b0d925ac8f3062941b662b1a72b5c7284aec206fdedec81f48c02a632ec31a2f68
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui
- Size 3KB
- SHA256 3668a2a0f92118a267bbbdc61fca77773467930784b9d9d745a588c71304dd69
- MD5 ecffca3a566e8a5fb6a7f8a378e9b181
- SHA1 a83b8473588262f8ce88676f4b64b10f65e8d59a
- SHA512 c95d75285ee876b937e9bf5fb98342fc720bba902b1c46fedb439d009be7d682c187ab272981c6dfeede571251d64211eea3cda2eea40dc9e77b3170480c030f
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui
- Size 4KB
- SHA256 64816b6063971b7a4e6cd1876d264727ca528e4cd8b98e561c389e5b2b4fb9b7
- MD5 b46d9f6afb517981c847a67ad3dfc72f
- SHA1 1bb2aa0737616d743e3315862955ca444446afa8
- SHA512 7ebd9857cb185676ec29365246f93bf3802791473ff633f228ed0f6e6b89a0dce812132c7612f4365c7e957f385263faffd7c25a72885fe2931174930cf536b7
- SSDEEP 96:RQWQQ0ah7uYWXK7cGvE8SHoyJkFEvn73uq3ZuICOujAJOP0HLK:2nQ0ahxc2cQuJkFMn6UxZlOP0HLK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui
- Size 3KB
- SHA256 368dd33f00b05f32cffc8bfbc6d621a964f977e975e61ea658ae9e1932f6abf3
- MD5 91ff16b4d8d4ccc0ad065988e9312a8b
- SHA1 b141630cd049e142eb95aafba98b014c4961c9ce
- SHA512 f052f29508a46c1e2c9dcc8df5c338fe3466a6f7938dc2170746a5bc414be07364cbce3e5a2e9b27dfbf34a95bb3605e94f2970602e19e2b0128bc5f44745f07
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui
- Size 3KB
- SHA256 1fdfd7e0ec90d61174211ea198362daeafd8263011d52d0e445c4562e0948dac
- MD5 4a6a29356703f030d769a0a8e4d1688f
- SHA1 78d987b05018475c6ccfafaf93d3fd8e43a5d540
- SHA512 6b58a5014aaa1996db22e58539bce4efeada6347603e9d82ef3e6ffd01de420d46ec445bba37b51f19619d00348d0d8aab28f92b92f47723f7ac68ae5ae0393b
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui
- Size 56KB
- SHA256 96f334dbe821374426fe81844f013245b0c06391b861d7e2aaa02683e8c2e5df
- MD5 5c0e9c7b805c92c3bea8dd30f1f3c27e
- SHA1 f2a2375b966d35a1b89c141cd506bf17c3bf8131
- SHA512 a74b766ebaf9597e9ca237ef3093f58f91bb3dcec2ef7e8cd5c1e6683aad0623168545e9855de35d1ba173a001ce9edad783957f3a05743349012a61e832f135
- SSDEEP 768:Bp5wEFMmsM4ruesT02ibyRPOF5FO0uwIuarH4S5nQq4lNbxCf0+jRTFyrVmE:B1FpsTrueso2ibrFOV/4S5nRabG9FAwE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\uk-UA\wmlaunch.exe.mui
- Size 2KB
- SHA256 ef108f269415c8c702a778f529a94ad46403e8d566977b7688e4c2f82674d457
- MD5 37c799c660cf09ff30fb4a645203ac1f
- SHA1 bd70cb4a79316ff70440459ede475eb90e407c15
- SHA512 8aecf2ef5501f9cad1db32961ba6aa04b88f4034b40dc799291a1c8886673490bc2b0987521f7e8fe272e1b76d9030e4637ca26e19e025297cafef69c533c79f
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\uk-UA\wmplayer.exe.mui
- Size 3KB
- SHA256 2cd9b1fb73116d3103d3777f1a97886b5c85efb8f63d609ad24443724ed961c4
- MD5 e8f830db03d94a8d3fc9b281e8b6a583
- SHA1 6d5c166b8a3d22940d6dc27fe0a32c165402a10c
- SHA512 f0a0f4e2fb92e77ac73c751d6951da5b8c1de202abe46dbd2e96f68cef84d376bd1b5b7a05d861494651f9354dee6b6c4477745f7ea6ab3be4b49e9766863ec8
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\uk-UA\wmpnssci.dll.mui
- Size 4KB
- SHA256 021e83e791097312b8bf88654ac48a1abf6b65fd39ac5295f664eee48cf978d4
- MD5 45b5dc47aa7de0fa39907321e6af7204
- SHA1 75a074cc2a64f305f254e6897bffcde9b855b7b6
- SHA512 68bb6854b5705d9b5932d661a47ae471e621d661cd8c0da4b218832b98688c2a38a5a120205f070aa67ab6d499cabd4837dd05614ee994efc3acee5d06976f52
- SSDEEP 96:fRQ1wu6PE9ZrRvtfL4s1Afoul9z5gmx1aN9NeGmLDPXZwQ6t7QPftXmhK:fWWS9ZLT4su3zzjCNnm/lEUFUK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui
- Size 3KB
- SHA256 cbbb87008842e2ec74692ca041023b19cef83fea505872b0ba3a8830af5dc264
- MD5 249ed01797b04976d5b35cc650e134e4
- SHA1 c54913e5b0adefc1417e313363ace14a2c73e655
- SHA512 3a44397b6a70b65b5256510b3dc8031055d64e1b031e73733ed486bff47c162f7992c55c50f873b149adf61652f23972c8ce18182a91316750cfd4b6efe5f2d7
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui
- Size 49KB
- SHA256 a34bc25fac4615eee32e3817d155b06342c307791afd40c7a1ce26f7407f50af
- MD5 affb5eac04ccb1049b266921a4462ee5
- SHA1 3e126d4646d9e13ccacc2dd741630d4cdff1fde1
- SHA512 b9cd030d86e124bd1924f96f16f3fa14c8a5605ba1ebb43f1590aef79f7242cde9d05e859defb56246d8b224c8a206542e9cd9bb980a267ac81918b84d2c232e
- SSDEEP 768:XXnrPglG7UMBmr/t99XKHMy68ZJYZvOyaUKqbIcKop0aahkr5qBLIuru7uQ89Mi:nnrzfmr/r9XKDYgydbpyCr5qEav
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui
- Size 8KB
- SHA256 bb3653870565054d1cde408eeec7104acf0d749d67c93abfcc812138d1d3a3fa
- MD5 6cc954a81011cc69a8bc9b8be67c5536
- SHA1 0ada0b16f4db791bce67b435a7bf613d58edd3ed
- SHA512 8f73abacfeaa2c44eeb45ca981e00829614aa76b7def874704b8214d5d85851be6233f2a851dc00c5df0a21aa554cf92bf175bef785e8b3561e9075c8a769975
- SSDEEP 192:MS3CTveqTWO6dIhQsyNEU3XGG7ifRzikeRj5R7UWU3jsYkz:n3BqTWOVQsy6Un7GdilRQ3m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui
- Size 18KB
- SHA256 a063234da535ab16103f27263a7700c985903c70593843a5407b6e9da092b05d
- MD5 bf4a00ea97d5fbe25269247f311a209a
- SHA1 271a3ac4a04b132f68ecd28daaf23e1dfe2f587c
- SHA512 f31b41b54c4d060e62b9ddf550bc57b96c04cf73ea2e9886d410f55536755aa02c7d90371e74b50eecdb3818662473ff8f0b1c395b9ca7d0e0dce81f2fd078e7
- SSDEEP 384:3dfVuKhsqCyArccYncJl9YNAlNFxYeNNRC+AUFKft/0Y0Su1vPH+dttTaqKq:3dVuKeqxLJAlnxYIRJAgKVl0Z+LNKq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui
- Size 16KB
- SHA256 73061b7c5591db548bd7796b823c5c3bffaa4a241b50d3b9dfc99da5965f9b00
- MD5 d7bf8225929281eb94d3647d2bcc8316
- SHA1 f1491fd582579ba30289726741541d61a02ba0a3
- SHA512 a84f3b665d655d96f7bf95aff9b66c7fa77b6d741f2101b6cfb6db5cc0a2544e129ed61279202449508f427100ee00baf93cdc3baf530557fa3472d80b491fec
- SSDEEP 384:umd3M14up1vaLMNVY3Q1+6gSqK9/d6lZum5nRPxE:tM+up1mMMg1JqKKlZum5Ru
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui
- Size 18KB
- SHA256 b24dc0d176bd615686106384f3d12c161f2e3dc00e956d847f51b81014ca2ab9
- MD5 ea18945bb573222e83ad61e75a0742b9
- SHA1 f9e6825642fbb6b0aef4359611837406f2f7e96f
- SHA512 e10ba9fb17b09cbb3b210d0dc1d490de15aa289764ecbf123bb058b776a4bb807dfe85529bcb33c0e5a16058b1e96bdc638a7fbb1f323ac360b9449fe6dbde05
- SSDEEP 384:PCpbE4ul+MF9fJDzBabplXjLsqGiLmQQ1zj7YiIEq0pZ6SnXzF4B3Kg:mXk9fJ4p9LfGiLm1/xE96g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui
- Size 19KB
- SHA256 260df2b6cad95de985917c0240677b48eb938857626a3f49fc4592aafa583ab0
- MD5 0c0f890402048f6ce4670a7716e88042
- SHA1 2f30a8c00494da43915a4e10faeff0a4af838297
- SHA512 307deffb4dc0fa0707fd4f7a90d0fe0d9dd5137c8f662011019d7ff40a0161ac95ca46c6a2af62c04c88766bad9604ace549e71f9d8d692a3a5bcd17d859a6c1
- SSDEEP 384:83MGIrFpglarh2+QK2KmrjpMkfLwupnAgkjmAUox2jFXx0GpAw3TBKTG:832glGhsHpBDtNkjvTYrtloTG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui
- Size 18KB
- SHA256 884c01cd5a3a4107db7713c0931854d7e13edc4d50c955503015833f5f6326fd
- MD5 bc442a2c0919a8ac3bdaa930f3e2df0c
- SHA1 141fb4b35a57a762fb4e4d55a99d623f65857160
- SHA512 33e111fa0888a653fa838f4ec9a8c3283c664007b59f0306b4b17575794f7dc972bfd76b5960a7e58a777ff261d5959d970c869b07b07695c2560ef2b41de14e
- SSDEEP 384:wgUhDAJ1WAe8A6r4aPQ5D+mPJkldrk/myoxYoGdv35E4uZRtx+0M3j:mDAKxgrIPoxYoGdG4ujO0Cj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui
- Size 11KB
- SHA256 eb585a1dd387b2fe8926c8720e58c07ac8c8e5492012f7c1eba8773d5c526681
- MD5 3997b583fa6ed77bd51e44d846b7469c
- SHA1 5b6bc0b8b842af24c55585e7b0e38a8072656d63
- SHA512 ac27ef896637eb417375f5ebbd7c98e3d421df27c9b744c8807edbe90ad5ecf4e27c4d499a9fa056993941f2c6297b2742c1a04486685b49f85d1724c6c30713
- SSDEEP 192:M5Qz5RZC3bfP8scRwOPLppMmIlgpRgxGILzPJBFwpmI6Kh9/f6L:M507ZC3j89ZI1JBF3I1D/e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui
- Size 17KB
- SHA256 39f63f45fba9462928c35f7fe0ecb19749316c8f2e1b4a3a67db646b5ba1d3d2
- MD5 3eacd167c68762043a01e0315f5a51fe
- SHA1 bf4ddff850103d4e5e9f9c26e7b0d4f21689116a
- SHA512 1359e1442820976d46a9b6ccb69f5acbec1145046962b6e1aa67f2ed83231359905bfe3db8f02cb40b1cc9c44159a0fc2a490c7236e548511c2d3b34ea5150ef
- SSDEEP 384:sEsMPO9R7JVD2gQNu8Bli5tLHM7e2W/7R7q85OeI62zJLLV3p68:sEO9R7Jl43m5tLM7RWjs8Ued2NLj68
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\1605.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\cHpfiXA9s.ico
- Size 14KB
- SHA256 95e059ef72686460884b9aea5c292c22917f75d56fe737d43be440f82034f438
- MD5 88d9337c4c9cfe2d9aff8a2c718ec76b
- SHA1 ce9f87183a1148816a1f777ba60a08ef5ca0d203
- SHA512 abafea8ca4e85f47befb5aa3efee9eee699ea87786faff39ee712ae498438d19a06bb31289643b620cb8203555ea4e2b546ef2f10d3f0087733bc0ceaccbeafd
- SSDEEP 192:jpBaAlHSa2vU9G/8MMBD7O1lXFMB8VMJP7:jpjmkMYD7IFMRx7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
- Size 13KB
- SHA256 e96cfd408348951bfff2a8b8430142dbd40287db7d1deaf165aa14ba67487bfb
- MD5 b82d8240f9285e63992f5a3b6b4cf2d0
- SHA1 58c411d631cfa0889558c50dabf7ad1b00a0e1d8
- SHA512 d7e8747cc75bbaa90bc098d6c30d1da72fa487599db236000053f7c00a1d1ce7ff4da8d0eb773a291f8fb414ff03c03ebdb57110a9d08a06fe1f067e8fea3f3b
- SSDEEP 192:zJPyFMU/9I7vIiy3zkYJeko/tkpCk5NDuZAksz2ZUhmkDSRRPQReqjfQOVjeQ8RB:zJ7szkkeZ/tBAJtpmcfQOVjeQ8RJoEF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
- Size 13KB
- SHA256 568ee500542bee6e33e83eac9589996b632a7c724207774a54574861566ecf99
- MD5 04181cfeba8297e48dc816c8e7e6dc67
- SHA1 5681daae0a49eac731aad76ec754d45241f17f19
- SHA512 333f728c7777c7f3aee7874ba15c6b6800ffdf3e255f46de18d37a5cbd46c21331abc8f163d2a508696e879c1ff57be305e99ae1fa5be478139b853449f56589
- SSDEEP 192:tJPyFMU/9I7vIiy3zkYJeko/tkpCk5NDuZAksz2ZUhmkDSRRPQReqjfQOVjeQ8Ri:tJ7szkkeZ/tBAJtpmcfQOVjeQ8RJo9F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
- Size 147KB
- SHA256 298705751198eeaa14ddce39daf9f341315c586c68146386bc1b91bef05c0de8
- MD5 1233261baa035e646eff338c5c95ec7e
- SHA1 d73c0a0ce6dcbe176a1b681cb73c6f3203475b1a
- SHA512 134e0d0aceb954cc72aecd46353415f6ad9bbeea22ced4aac7d23414cd5ee63ff377d6c86a17926c0620d92ae0102c8245800f3300c93449b4146b9143091e3b
- SSDEEP 3072:Vu/j9cShbOK7s51vNBbQpge3Uphk9Z0nsUnu/j9cShbOK7s51vNBbQpge3Uphk9Q:Vu/jVbOWsdNyDZYDnu/jVbOWsdNyDZYD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\cHpfiXA9s.README.txt
- Size 1KB
- SHA256 0ec8c3830d53015c531dd0d8c540bc961f67888bb44731f87af6ba8be1268df3
- MD5 3605fdc69caa6b331eaf96ea07e4157d
- SHA1 fc6bce8fc36aa774fb5e02cc1b25df8b59c6fa44
- SHA512 8b3eddd76b231bf1cca7e26d83756d418fab432afb6c7fc46e3e1356c8a580b78e09f29ef3adbadf72a8258c29d4855dac9b4b5c4519535b93a982469519c226
- MD5 SHA1 SHA512
- Path F:\$RECYCLE.BIN\S-1-5-21-3270530367-132075249-2153716227-1000\DDDDDDDDDDD
- Size 129B
- SHA256 7a9fdf6d83f175a7196c3322703fe4feaf6db113ab58f6ba042deb88ce53e8a5
- MD5 a1a5a08d16f2f7dff18c16a31781d42a
- SHA1 e7ef43fd5b81f03db3bfcccc794e143e78a43767
- SHA512 27a2e5a6ab9629a10ad172d647645908a36fed0609b9b42fac5c60fae810f1bc1fab8b9daba68ca18c6d1ba25db694a3bed860eb92036a153b37028b9be194d4
- MD5 SHA1 SHA512