Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2024, 13:31

General

  • Target
    Lockbit4.exe
  • Size 146KB
  • Sample240328-qswt1afc61
  • SHA256 9b5f1ec1ca04344582d1eca400b4a21dfff89bc650aba4715edd7efb089d8141
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Path
  • C:\Users\xa1Xx3AXs.README.txt

Ransom Note
  • ~~~ LockBit 4.0 Ransomware since 2024~~~ >>>> Your data are stolen and encrypted Price = 1000 $ Bitcoin = 328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2 Email = [email protected] >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Your personal DECRYPTION ID: A3138014A48684D6D525F3F372263313 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
Wallets
  • 328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2

Signatures

  • Renames multiple (10391) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lockbit4.exe
    "C:\Users\Admin\AppData\Local\Temp\Lockbit4.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3952
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4456
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4044 --field-trial-handle=2432,i,12161922670941700748,3348345705955601576,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:5136

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          AAAAAAAAAAA

          • Path C:\$Recycle.Bin\S-1-5-21-1904519900-954640453-4250331663-1000\AAAAAAAAAAA
          • Size 129B
          • SHA256 9093cf560cd989d039183653c623e801658678fdf551ee281dd374d8d3e7b642
          • MD5 SHA1 SHA512

          oledb32r.dll.mui

          • Path C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui
          • Size 56KB
          • SHA256 c3e5c96158d1cb1d3f7d15183e9e254649e1fddec21368ac1d2d45c98f41b03a
          • MD5 SHA1 SHA512 SSDEEP

          sqloledb.rll.mui

          • Path C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui
          • Size 47KB
          • SHA256 36395d0cae6b0e864fcec3de2d7aeb9e4618e256c999dac83f21c6b808b71368
          • MD5 SHA1 SHA512 SSDEEP

          oledb32r.dll.mui

          • Path C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui
          • Size 47KB
          • SHA256 db8a19446204d96f9446f67b7c16132554505f192c2e3f4ebf2c3d2e02fa1b1f
          • MD5 SHA1 SHA512 SSDEEP

          sqloledb.rll.mui

          • Path C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui
          • Size 43KB
          • SHA256 edce4e3d59d9a481de3845c474e0d43246caa49068af150aca393b83755acd0b
          • MD5 SHA1 SHA512 SSDEEP

          oledb32r.dll.mui

          • Path C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui
          • Size 53KB
          • SHA256 a6fc617205248e8b107d37ea4ab01743e0e5c39d96a9727f2196e30c2a2620e7
          • MD5 SHA1 SHA512 SSDEEP

          sqloledb.rll.mui

          • Path C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui
          • Size 47KB
          • SHA256 db08d089497872c654a765a24caf24890e6fb288baec96ce003138208ad711db
          • MD5 SHA1 SHA512 SSDEEP

          oledb32r.dll.mui

          • Path C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui
          • Size 57KB
          • SHA256 a855f09a9b182ebafded8693d60218346161ae2513bbbf0bd1569b92fb348f43
          • MD5 SHA1 SHA512 SSDEEP

          sqloledb.rll.mui

          • Path C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui
          • Size 47KB
          • SHA256 0f6154951b3606b97d1de35452f1aed02911ddd3a2d9a0f8dfc999d11992ce7e
          • MD5 SHA1 SHA512 SSDEEP

          oledb32r.dll.mui

          • Path C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui
          • Size 54KB
          • SHA256 2373df0b43ebb258c999378e527f749a2567fcc570c556b81fdc8301a3c2deea
          • MD5 SHA1 SHA512 SSDEEP

          sqloledb.rll.mui

          • Path C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui
          • Size 47KB
          • SHA256 b73ff3c768efa97f7b4e8776424fec3b15a77866ede15800e0c86d0e10ed56dd
          • MD5 SHA1 SHA512 SSDEEP

          oledb32r.dll.mui

          • Path C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui
          • Size 32KB
          • SHA256 b984c2ee02270d5c78b973d17206802b74c11e8e7d061986b22151fac550abae
          • MD5 SHA1 SHA512 SSDEEP

          sqloledb.rll.mui

          • Path C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui
          • Size 37KB
          • SHA256 5d68c5245609be6a688ae45c6d5c2b6afeca79f16c92fbd689a1072b5f0fbd7e
          • MD5 SHA1 SHA512 SSDEEP

          msader15.dll.mui

          • Path C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui
          • Size 20KB
          • SHA256 69686770a59aab568dee3d8f4f47aa1d128729a620361c188f57bf02778281b0
          • MD5 SHA1 SHA512 SSDEEP

          msader15.dll.mui

          • Path C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui
          • Size 17KB
          • SHA256 48b88f00951e49a262e64c8f9e65e746eca16ebe58f9ede0a68cafbaba591195
          • MD5 SHA1 SHA512 SSDEEP

          msader15.dll.mui

          • Path C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui
          • Size 19KB
          • SHA256 3201608e1636ccf7564db99a6bd7d13d3c6b6e120c9685da2c78081b2cccdede
          • MD5 SHA1 SHA512 SSDEEP

          msader15.dll.mui

          • Path C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui
          • Size 20KB
          • SHA256 f901a1f119a1cdfcfa6a1d557964fe7b29eae84d24370c7553523bf4d61ef4eb
          • MD5 SHA1 SHA512 SSDEEP

          msader15.dll.mui

          • Path C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui
          • Size 19KB
          • SHA256 202e0ccb9ecf1b47bc5ffa6c3d8f1a93a5623626d65e97582c0b600835ffdc65
          • MD5 SHA1 SHA512 SSDEEP

          msader15.dll.mui

          • Path C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui
          • Size 11KB
          • SHA256 afbff04846ac727a8c4e3a000051f84257fbadd65670fc5cf2fa48efa989d630
          • MD5 SHA1 SHA512 SSDEEP

          wab32res.dll.mui

          • Path C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui
          • Size 102KB
          • SHA256 c4911c5ead025a0c21ddc312ff032a9ca6c0ada22a6f177836109f78c53d45ce
          • MD5 SHA1 SHA512 SSDEEP

          wab32res.dll.mui

          • Path C:\Program Files\Common Files\System\en-US\wab32res.dll.mui
          • Size 92KB
          • SHA256 d3f17085bfa75128a554a39f79f9f754df956ff34f5a5b15c60d47e7b775e046
          • MD5 SHA1 SHA512 SSDEEP

          wab32res.dll.mui

          • Path C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui
          • Size 102KB
          • SHA256 417973b7e94eb08186df7bddc176314c9d8617a6b23102913b028c42d454a388
          • MD5 SHA1 SHA512 SSDEEP

          wab32res.dll.mui

          • Path C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui
          • Size 104KB
          • SHA256 991be7dd50f44900f86a13d3307d11c6b9df36484d29f2b86b3794a208d5d79f
          • MD5 SHA1 SHA512 SSDEEP

          wab32res.dll.mui

          • Path C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui
          • Size 97KB
          • SHA256 b5c9f2b323d7f25df3009968bacc804fe85d13ad03efedf81ab371eec9b4133b
          • MD5 SHA1 SHA512 SSDEEP

          wab32res.dll.mui

          • Path C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui
          • Size 69KB
          • SHA256 4a2a4c16c5e1dd0ee453599dd6aff26a8997013c0d325b760342435a865506a1
          • MD5 SHA1 SHA512 SSDEEP

          msadcer.dll.mui

          • Path C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui
          • Size 12KB
          • SHA256 de46481cf9317b7a8e451acc36f68bc8e1ee8904b0bbed25fe677570772f2c84
          • MD5 SHA1 SHA512 SSDEEP

          msdaprsr.dll.mui

          • Path C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui
          • Size 9KB
          • SHA256 64f2945ba7990b78f06362d4f9db22b01ea8552c2f309355e58412dc5a47ce6b
          • MD5 SHA1 SHA512 SSDEEP

          msadcer.dll.mui

          • Path C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui
          • Size 10KB
          • SHA256 ab04da4463a9b8f209184ccef6ee32ccf9cd8052ed2a18215681f0727cd95e25
          • MD5 SHA1 SHA512 SSDEEP

          msdaprsr.dll.mui

          • Path C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui
          • Size 7KB
          • SHA256 fd5a138251a7a0032c8e6fbea3c69d75d3a6b2d2baabaee0308c7d4fd0623bec
          • MD5 SHA1 SHA512 SSDEEP

          msadcer.dll.mui

          • Path C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui
          • Size 11KB
          • SHA256 2ce981d9a48a72e081567e274defc1672b94835effe695502113576fff57fb25
          • MD5 SHA1 SHA512 SSDEEP

          msdaprsr.dll.mui

          • Path C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui
          • Size 8KB
          • SHA256 25fd91c350b38b0ae2525a4de5fa3bbdc7785a56ab3a6b0edfc3f2853205f6c9
          • MD5 SHA1 SHA512 SSDEEP

          msadcer.dll.mui

          • Path C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui
          • Size 12KB
          • SHA256 9ce92bb16a93b0ebdf433e915f9aefea222b1d348055ebc9e23b87876741822a
          • MD5 SHA1 SHA512 SSDEEP

          msdaprsr.dll.mui

          • Path C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui
          • Size 9KB
          • SHA256 b5c48783fe83d0761d726395f42fefa15c637aabcb1a5be77e3bf9c1f881e330
          • MD5 SHA1 SHA512 SSDEEP

          msadcer.dll.mui

          • Path C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui
          • Size 11KB
          • SHA256 544f7203cbceb0344eaaf573604b4e45b1981702a63f4e48ce8fc4e19dad726e
          • MD5 SHA1 SHA512 SSDEEP

          msdaprsr.dll.mui

          • Path C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui
          • Size 9KB
          • SHA256 996f1532b2894de19ce3b10308b7afc9be17e1cddb1a330a2c2889e329d781fb
          • MD5 SHA1 SHA512 SSDEEP

          msadcer.dll.mui

          • Path C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui
          • Size 6KB
          • SHA256 8e4b4d53eb6bfad215df7caa8981e44df654fd63c26132cecd4ccfe7e48caa95
          • MD5 SHA1 SHA512 SSDEEP

          msdaprsr.dll.mui

          • Path C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui
          • Size 6KB
          • SHA256 76f41e3a4b14314730cd5ef46060a6c72540af4f4012296c55e8ae9e35ac34e3
          • MD5 SHA1 SHA512 SSDEEP

          wab32res.dll.mui

          • Path C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui
          • Size 94KB
          • SHA256 7353d8a5715a3facbb70bbaf6a2e0b8a213abf882e5194ff18377dc590b5500c
          • MD5 SHA1 SHA512 SSDEEP

          InkObj.dll.mui

          • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui
          • Size 5KB
          • SHA256 6a169918c4e2b8ef45e293ca71176479578e1261ea0184053f677049baf0f239
          • MD5 SHA1 SHA512 SSDEEP

          TipRes.dll.mui

          • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui
          • Size 27KB
          • SHA256 181cfdf4d8f674ada910d7d0109bbd95949f33d3daf734f71c3d91a36a8d2ac3
          • MD5 SHA1 SHA512 SSDEEP

          TipTsf.dll.mui

          • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui
          • Size 3KB
          • SHA256 9006c52fa2ede3d5221ec7ad5393fba57e597d46f914eb327bf5fac210b6bb23
          • MD5 SHA1 SHA512

          rtscom.dll.mui

          • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui
          • Size 3KB
          • SHA256 7a77c03d70a165c385956887b1b1cc34aa4da6dbcb30740e088425dfd4d4818f
          • MD5 SHA1 SHA512

          InkObj.dll.mui

          • Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui
          • Size 4KB
          • SHA256 ec71bee88ba1697c476619f0b97894cc376117aa7b7e33952e4eb9d5a1e0e95c
          • MD5 SHA1 SHA512 SSDEEP

          TipRes.dll.mui

          • Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui
          • Size 16KB
          • SHA256 7d3d6a370abeed667f5837a79418c7cbcd10e5ffd105830d9194a7f4217048d1
          • MD5 SHA1 SHA512 SSDEEP

          TipTsf.dll.mui

          • Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui
          • Size 3KB
          • SHA256 da884fb7050b0af77b67165f6847b845339508b570cc72552643795138149508
          • MD5 SHA1 SHA512

          rtscom.dll.mui

          • Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui
          • Size 3KB
          • SHA256 604f69f5b137d464a49062b7b4b6b8fa5559e882ccea7201c4d7983255aa1a99
          • MD5 SHA1 SHA512

          TipRes.dll.mui

          • Path C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui
          • Size 26KB
          • SHA256 36b2eb3eb07ed0fd1495f9ee44a3d9b8d1df39a82b73a8abc5c2d3c2a5c4b6fc
          • MD5 SHA1 SHA512 SSDEEP

          TipTsf.dll.mui

          • Path C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui
          • Size 3KB
          • SHA256 7894af8aee7ac7c381f4fa873244a2e00bb4a11975feb5aad92bae9e107d5a19
          • MD5 SHA1 SHA512

          iexplore.exe.mui

          • Path C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui
          • Size 6KB
          • SHA256 fc0582b618fcb3aa88c3c13fd349d47ec9231a601e856dbaed9b21668ac3b259
          • MD5 SHA1 SHA512 SSDEEP

          iexplore.exe.mui

          • Path C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
          • Size 5KB
          • SHA256 7997f9314d0885a36669411cfcf6427328566c63ed8e18a986ff79c26b650315
          • MD5 SHA1 SHA512 SSDEEP

          iexplore.exe.mui

          • Path C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui
          • Size 6KB
          • SHA256 3a38c23353e3c5ccd4f64948e468b6f1e30e179013d5277f356d57eeb89da94e
          • MD5 SHA1 SHA512 SSDEEP

          iexplore.exe.mui

          • Path C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui
          • Size 6KB
          • SHA256 3c13e9f830bdcc50310ed98c386472e415009f936e3b8c0e9bac676092008675
          • MD5 SHA1 SHA512 SSDEEP

          iexplore.exe.mui

          • Path C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui
          • Size 6KB
          • SHA256 e4d365920fda4345e8987420c39ceeac959468d8fc544c69911247910eab89d7
          • MD5 SHA1 SHA512 SSDEEP

          iexplore.exe.mui

          • Path C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui
          • Size 5KB
          • SHA256 811249b0f2aea69e73208121c2379c8678be90b8c5823d543d09952c0e048160
          • MD5 SHA1 SHA512 SSDEEP

          iexplore.exe.mui

          • Path C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui
          • Size 6KB
          • SHA256 49fc0281e493866772f012e3059c2e137df601797f04cfe618456f64b707158a
          • MD5 SHA1 SHA512 SSDEEP

          EppManifest.dll.mui

          • Path C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui
          • Size 2KB
          • SHA256 d5a6fcf4b80381f60339579e192ba68bcdbe68a6a8a2cd2369145024087c2717
          • MD5 SHA1 SHA512

          MpAsDesc.dll.mui

          • Path C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui
          • Size 60KB
          • SHA256 bd23e685b7c0b01c8c9c03f21cbd8702c92cead3bf4c7775a664553da92bfc30
          • MD5 SHA1 SHA512 SSDEEP

          EppManifest.dll.mui

          • Path C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui
          • Size 3KB
          • SHA256 7f2d4f784d1e0582acd96b8aa6a6d7ce7c5c6af5bf03a5e478102b14b310a500
          • MD5 SHA1 SHA512

          MpAsDesc.dll.mui

          • Path C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui
          • Size 58KB
          • SHA256 439b93afce9485017410bdf5e84d2a4b747a9d324288eece7fa9989a0376a333
          • MD5 SHA1 SHA512 SSDEEP

          EppManifest.dll.mui

          • Path C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui
          • Size 3KB
          • SHA256 fcc4262fd04851724ef7b46cbc5e8b1a76001d0e5bc3fd6b7ea00ff4469701f5
          • MD5 SHA1 SHA512

          MpAsDesc.dll.mui

          • Path C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui
          • Size 61KB
          • SHA256 7247ac1e18a04e700bd1983eaae8a10da1b1ffd24e8624c8d91989c22a268114
          • MD5 SHA1 SHA512 SSDEEP

          EppManifest.dll.mui

          • Path C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui
          • Size 2KB
          • SHA256 aba0345155c089bc7913cf4ca12eb2a998f0782dffa2652a9f5a0f9378be62fc
          • MD5 SHA1 SHA512

          MpAsDesc.dll.mui

          • Path C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui
          • Size 57KB
          • SHA256 64edd12e455292f8eb093fb959b10b85b130627e1b33b2d33fb285d91d360d4d
          • MD5 SHA1 SHA512 SSDEEP

          EppManifest.dll.mui

          • Path C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui
          • Size 2KB
          • SHA256 1f83e7cf4274642243a04cec657ea767dbedddce7c5223507b0fad200eb34acf
          • MD5 SHA1 SHA512

          MpAsDesc.dll.mui

          • Path C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui
          • Size 31KB
          • SHA256 13d500683672cfee841744ca235d8c8cc10271d943977e00bd9fb3d77e972079
          • MD5 SHA1 SHA512 SSDEEP

          EppManifest.dll.mui

          • Path C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui
          • Size 3KB
          • SHA256 6d2e41d7692ae245680c6165ec0083e55b3a260a89a29c8f78fc79727caa9a4d
          • MD5 SHA1 SHA512

          MpAsDesc.dll.mui

          • Path C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui
          • Size 56KB
          • SHA256 4d0b5b4745748eeeae5e44f57517851d81a6ef1dc4644968d27a6cfa0ad759d6
          • MD5 SHA1 SHA512 SSDEEP

          WMPMediaSharing.dll.mui

          • Path C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui
          • Size 3KB
          • SHA256 09f837b0f3ad50da63bf0eebf9658b91592fa0f38b348fa89d5712f7515fdafd
          • MD5 SHA1 SHA512

          mpvis.dll.mui

          • Path C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui
          • Size 3KB
          • SHA256 67f4b9b67e304126860f0c0323d7a682d0830572f0518938b66a5268489ccc09
          • MD5 SHA1 SHA512

          setup_wm.exe.mui

          • Path C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui
          • Size 61KB
          • SHA256 eef4086b173bdfa8d752fde071ee7487541105251c687affd581fa39af4c5bbf
          • MD5 SHA1 SHA512 SSDEEP

          wmlaunch.exe.mui

          • Path C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui
          • Size 2KB
          • SHA256 94dece512137cd9d5cefdda1fe83c61fdd6a728a745a418f646e3a5af3bbec11
          • MD5 SHA1 SHA512

          wmplayer.exe.mui

          • Path C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui
          • Size 3KB
          • SHA256 0e6ca1a5a19bb149b670b6ffd90995c1599cdf8cfbe4730e1c8fd8b29a1188db
          • MD5 SHA1 SHA512

          wmpnssci.dll.mui

          • Path C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui
          • Size 4KB
          • SHA256 d711d3b9fe3da836869e3e1c0a7ca28d92f77f679d3c4af1c77f147601f78dbc
          • MD5 SHA1 SHA512 SSDEEP

          wmpnssui.dll.mui

          • Path C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui
          • Size 3KB
          • SHA256 5709db3ac031e50d655c85f133db74a34dc748a5f668affa3d5a5a591072921c
          • MD5 SHA1 SHA512

          WMPMediaSharing.dll.mui

          • Path C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui
          • Size 3KB
          • SHA256 ea53f5e9bd854fb5cf3b8833b225bc2b1fc6fb9d8e522bc19b2c602c088348cc
          • MD5 SHA1 SHA512

          mpvis.dll.mui

          • Path C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui
          • Size 3KB
          • SHA256 48b1bbe1c67d51288caaf0056b99aa619ccbd17956cf014a753157793116924c
          • MD5 SHA1 SHA512

          setup_wm.exe.mui

          • Path C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui
          • Size 53KB
          • SHA256 a7f59f6386ac27fc82d8b4c3461923eb569e7bd390616476ec8382e6c21c7e8c
          • MD5 SHA1 SHA512 SSDEEP

          wmplayer.exe.mui

          • Path C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui
          • Size 3KB
          • SHA256 edd64e6a7be981e977e6bc4ed3a88438452aafc7be553c9d154c5356fb349c26
          • MD5 SHA1 SHA512

          wmpnssci.dll.mui

          • Path C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui
          • Size 4KB
          • SHA256 4668d225e610064a2006c7f97a4c9c52e9f90cfec5f9adfe70b6871c08ede69d
          • MD5 SHA1 SHA512 SSDEEP

          wmpnssui.dll.mui

          • Path C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui
          • Size 3KB
          • SHA256 cc987712adf9fd269a2c661ce29d8dbf0925f35514e40dd17854d8c0d5420f9d
          • MD5 SHA1 SHA512

          WMPMediaSharing.dll.mui

          • Path C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui
          • Size 3KB
          • SHA256 56a1419cf3a7f317a991cc67bdfb3dee8a6239cc022b58398b3e99a7d6450dae
          • MD5 SHA1 SHA512

          mpvis.dll.mui

          • Path C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui
          • Size 3KB
          • SHA256 411786c8b63da164aef415104c8193dce13821af4acf0526d0ef8f92f28b2e5e
          • MD5 SHA1 SHA512

          setup_wm.exe.mui

          • Path C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui
          • Size 62KB
          • SHA256 f52aa68c0e3d830d7872460f290a8478b1363ac33d6277937c7a77941dff4b1d
          • MD5 SHA1 SHA512 SSDEEP

          wmlaunch.exe.mui

          • Path C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui
          • Size 2KB
          • SHA256 409dc9805b8ef537ebe86866611aed570c39f6a68935f26b60db47cee920be4b
          • MD5 SHA1 SHA512

          wmplayer.exe.mui

          • Path C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui
          • Size 3KB
          • SHA256 a42b436b60da3894f061a92178e78aab8854ef8d99ca9829afa0c991bf79994c
          • MD5 SHA1 SHA512

          wmpnssci.dll.mui

          • Path C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui
          • Size 4KB
          • SHA256 0053a729e2c12e9026498de51c3288fdc89184e8cce9e829c3500617ac995e5a
          • MD5 SHA1 SHA512 SSDEEP

          wmpnssui.dll.mui

          • Path C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui
          • Size 3KB
          • SHA256 15e5c73c0f77550e5da0cd06fa24b3eb0a8af35a282d5ace24b9dd7f9882fb62
          • MD5 SHA1 SHA512

          WMPMediaSharing.dll.mui

          • Path C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui
          • Size 3KB
          • SHA256 3eb01da92fe34ee134ee8a196ad8946d7163fad0d63af22a18a51227c961b63a
          • MD5 SHA1 SHA512

          mpvis.dll.mui

          • Path C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui
          • Size 3KB
          • SHA256 4243e870c464a8e35f6f4194b94583e32229a578cdf62d0db4919283b6e15665
          • MD5 SHA1 SHA512

          setup_wm.exe.mui

          • Path C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui
          • Size 63KB
          • SHA256 8a0f5a7790fff408bbd5ae0f0a8b5c015237fd1bd61f8622e762f88e4c43d03e
          • MD5 SHA1 SHA512 SSDEEP

          wmlaunch.exe.mui

          • Path C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui
          • Size 2KB
          • SHA256 9fa2f2731bf4c8e9a70fdefb949246d7234fa590068e143b8f350c3f8bb662ac
          • MD5 SHA1 SHA512

          wmplayer.exe.mui

          • Path C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui
          • Size 3KB
          • SHA256 0c9d166efd9074f03c265dbc2475a7b9a1d5ec5ebc1db2df55b1e9a40c6aa66b
          • MD5 SHA1 SHA512

          wmpnssci.dll.mui

          • Path C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui
          • Size 4KB
          • SHA256 a64bc1ccafde44d0b60275cb6a2edce41afa528026c591a2eae601e2a84cf654
          • MD5 SHA1 SHA512 SSDEEP

          wmpnssui.dll.mui

          • Path C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui
          • Size 3KB
          • SHA256 994b56ee2fb3ef04229c1f482e334f197bbf5df9c1ae6c2a512c28db7b28d5bb
          • MD5 SHA1 SHA512

          WMPMediaSharing.dll.mui

          • Path C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui
          • Size 3KB
          • SHA256 b6a1ffef822fb149984377a339eb0d00e27c9a99733243af908cc3eeda96b8e9
          • MD5 SHA1 SHA512

          mpvis.dll.mui

          • Path C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui
          • Size 3KB
          • SHA256 33df11b3a60eb854aeedd8b3331d12649414da1d93e3d244e767012428690a89
          • MD5 SHA1 SHA512

          setup_wm.exe.mui

          • Path C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui
          • Size 61KB
          • SHA256 4a87eea8ec0f4c99cf86bb64f00bbd243a0ad3f1b656488ac6dd2e11e1be6f95
          • MD5 SHA1 SHA512 SSDEEP

          wmlaunch.exe.mui

          • Path C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui
          • Size 2KB
          • SHA256 22407db1644ce2a211e303b6316cfb9d5c8dfb5ed3435ef88656d7b70a71105f
          • MD5 SHA1 SHA512

          wmplayer.exe.mui

          • Path C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui
          • Size 3KB
          • SHA256 db316e1aacc2179e7f8b3a1de637d1fa50b11d074a16e362171a9d1fe36ee27c
          • MD5 SHA1 SHA512

          wmpnssci.dll.mui

          • Path C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui
          • Size 4KB
          • SHA256 da8d2378602df29b6bd9a54696214308728d1886d7442cf56c7e982f6852ef97
          • MD5 SHA1 SHA512 SSDEEP

          wmpnssui.dll.mui

          • Path C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui
          • Size 3KB
          • SHA256 99260b71d6d66827c8c7f22a5686b8617fc7e7104468caab22b0cce6136d9f4a
          • MD5 SHA1 SHA512

          WMPMediaSharing.dll.mui

          • Path C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui
          • Size 3KB
          • SHA256 6a4ac0b44958555fcb1d19120d2b359bbf659e42c1997af90cfb7654396d149c
          • MD5 SHA1 SHA512

          mpvis.dll.mui

          • Path C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui
          • Size 3KB
          • SHA256 20baaf4db517702d64099fe4effdbbc8633b70225d6d847fea00db4ce25550dd
          • MD5 SHA1 SHA512

          setup_wm.exe.mui

          • Path C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui
          • Size 40KB
          • SHA256 ec49a0bf4346352f95cdab2d0be29ac60980ba1e5267bf7c1a5d14fd69e545d9
          • MD5 SHA1 SHA512 SSDEEP

          wmlaunch.exe.mui

          • Path C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui
          • Size 2KB
          • SHA256 4fcf8b8d1be8187773441a4ba030c353c43bf016668ab20108a127947885bf75
          • MD5 SHA1 SHA512

          wmplayer.exe.mui

          • Path C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui
          • Size 3KB
          • SHA256 02973d5f6c625350a6a031f8efc1550fd6e886bea8eb4eb0718d44c6eb8e5e3a
          • MD5 SHA1 SHA512

          wmpnssci.dll.mui

          • Path C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui
          • Size 4KB
          • SHA256 e30d6f2b6653424e1f55cc9aa22e71a5a82debd04612639dfb1e06d097939709
          • MD5 SHA1 SHA512 SSDEEP

          wmpnssui.dll.mui

          • Path C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui
          • Size 3KB
          • SHA256 52cd7d92aaaecef9c0dc56a8f24ae6293edc5d80f9cd16e2bca81d97f4b9dcc9
          • MD5 SHA1 SHA512

          mpvis.dll.mui

          • Path C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui
          • Size 3KB
          • SHA256 34945e9c336c0fb1fd226c6cd32b26ba3a69d881451a3d9a3a295bcfdd7a20b9
          • MD5 SHA1 SHA512

          setup_wm.exe.mui

          • Path C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui
          • Size 56KB
          • SHA256 e8105ffb21481079df83dd9fd47c6d3b9259cb6b6eb8d40423dd1166dd03601e
          • MD5 SHA1 SHA512 SSDEEP

          wmlaunch.exe.mui

          • Path C:\Program Files\Windows Media Player\uk-UA\wmlaunch.exe.mui
          • Size 2KB
          • SHA256 4e310f7a2eca28f13069ac99c0e8d943ef7237af946ac95c0070ea86e405439f
          • MD5 SHA1 SHA512

          wmplayer.exe.mui

          • Path C:\Program Files\Windows Media Player\uk-UA\wmplayer.exe.mui
          • Size 3KB
          • SHA256 064b537966526c72f114b24b044e9849521e35440985c2f60116c93280877ed5
          • MD5 SHA1 SHA512

          wmpnssci.dll.mui

          • Path C:\Program Files\Windows Media Player\uk-UA\wmpnssci.dll.mui
          • Size 4KB
          • SHA256 4ca65cfd509de0d090235bba6b3230220ea5455a08cba4d6157d4ae78fdbe9cd
          • MD5 SHA1 SHA512 SSDEEP

          wmpnssui.dll.mui

          • Path C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui
          • Size 3KB
          • SHA256 e24f398f557cf7cca9834cfaf6c5862729cb946d18b22886e62c2a03545a5063
          • MD5 SHA1 SHA512

          wordpad.exe.mui

          • Path C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui
          • Size 49KB
          • SHA256 a3b52b45aabdafb629b7e13ee1547892f87582bcdfc73f20059ec6b405121706
          • MD5 SHA1 SHA512 SSDEEP

          TableTextService.dll.mui

          • Path C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui
          • Size 8KB
          • SHA256 0c1556a9ede8c1cf4d25097ec2cfce19837527af5a6d97ba757ec8382ef77910
          • MD5 SHA1 SHA512 SSDEEP

          PhotoViewer.dll.mui

          • Path C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui
          • Size 18KB
          • SHA256 a77d04444270405d6a7c4d674b468596419e90ec11eec337aa65a63a793633eb
          • MD5 SHA1 SHA512 SSDEEP

          PhotoViewer.dll.mui

          • Path C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui
          • Size 16KB
          • SHA256 0edba8c05ff27f76990ee9e6be58379274df53da3f085552cc4d3058c3c878b2
          • MD5 SHA1 SHA512 SSDEEP

          PhotoViewer.dll.mui

          • Path C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui
          • Size 18KB
          • SHA256 2240cf220087e1c95d5fe7ed87ab50309aa96a0d8f02f5f31c6639691970336d
          • MD5 SHA1 SHA512 SSDEEP

          PhotoViewer.dll.mui

          • Path C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui
          • Size 19KB
          • SHA256 dbe4c7c829b1bdb3c84ab7a6c46d7dda29c2722dff3fcc73a305ab2a6089053c
          • MD5 SHA1 SHA512 SSDEEP

          PhotoViewer.dll.mui

          • Path C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui
          • Size 18KB
          • SHA256 03777a9beb250b4c20292ef1cfecf39559ac11a8749257716783552ca18c2b0c
          • MD5 SHA1 SHA512 SSDEEP

          PhotoViewer.dll.mui

          • Path C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui
          • Size 11KB
          • SHA256 61296f3c6131bf8243870878671c555f484cc406ea532c0a6f9aff95ae6bf807
          • MD5 SHA1 SHA512 SSDEEP

          PhotoViewer.dll.mui

          • Path C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui
          • Size 17KB
          • SHA256 1569c434204985d7c41bcbae1fe5444b78fb1c696fb8f59f121c4c97a87d87f9
          • MD5 SHA1 SHA512 SSDEEP

          StartUnifiedTileModelCache.dat

          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
          • Size 13KB
          • SHA256 93af127f1e450749fcad44768021eb1465485a7803b12c2dcf4a02b01cd299aa
          • MD5 SHA1 SHA512 SSDEEP

          StartUnifiedTileModelCache.dat

          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
          • Size 13KB
          • SHA256 79f7fcd995bbfab69b63d4a7c105d7a1ea630a48ccbc03b94f80fa7d99d6d957
          • MD5 SHA1 SHA512 SSDEEP

          xa1Xx3AXs.README.txt

          • Path C:\Users\xa1Xx3AXs.README.txt
          • Size 1KB
          • SHA256 c99243fd5b4b2b5be708c0f30d095e515517f1e26a01032d05ad5ec6d6e4e2e3
          • MD5 SHA1 SHA512

          CCCCCCCCCCC

          • Path F:\$RECYCLE.BIN\S-1-5-21-1904519900-954640453-4250331663-1000\CCCCCCCCCCC
          • Size 129B
          • SHA256 87b273396b66a504c3729b999df55964c9f52584b761a464caa37b0d20725dbd
          • MD5 SHA1 SHA512

          memory/3952-0-0x00000000028B0000-0x00000000028C0000-memory.dmp

          memory/3952-4977-0x00000000028B0000-0x00000000028C0000-memory.dmp

          memory/3952-4976-0x00000000028B0000-0x00000000028C0000-memory.dmp

          memory/3952-4975-0x00000000028B0000-0x00000000028C0000-memory.dmp

          memory/3952-2-0x00000000028B0000-0x00000000028C0000-memory.dmp

          memory/3952-1-0x00000000028B0000-0x00000000028C0000-memory.dmp