7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1

Analysis

max time kernel
54s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Size

146KB
MD5

23f8091893512fa2635817a2f51df391
SHA1

9f7f2ba48752e37baadd4c35febaa58d613e3194
SHA256

7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1
SHA512

b4b9fc55bb944c8c657cf737ba0c8de17a09ec121591faac468b9c89182d45d910301f248d78134d78504de437a124208b6038a0047503f65e6cd1125490755c
SSDEEP

1536:wzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDY4zGqaGKGcNY3XZ2Vsz1bl8HXo:PqJogYkcSNm9V7DLzxaGb522l83qtZT

Score

10^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\mqmQaLLxg.README.txt

Ransom Note

~~~ LockBit Black Ransomware Since 2024~~~ >>>> Your data are stolen and encrypted Price = 2000 $ Bitcoin = 328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2 Email = [email protected] Email = [email protected] >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Your personal DECRYPTION ID: NEWWERTYFG34A48MK4D6D53 + Name.README.txt >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Emails

[email protected]

Wallets

328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2

Signatures

Renames multiple (11147) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

2E11.tmp

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 2E11.tmp
Deletes itself 1 IoCs

Processes:

2E11.tmp

pid process

908 2E11.tmp
Executes dropped EXE 1 IoCs

Processes:

2E11.tmp

pid process

908 2E11.tmp
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	2E11.tmp

Drops desktop.ini file(s) 2 IoCs

Processes:

7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe

description	ioc	process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 4 IoCs

Processes:

printfilterpipelinesvc.exesplwow64.exe

description	ioc	process
File created	C:\Windows\system32\spool\PRINTERS\PPht8buxuwcg98jfrs2gt7x1a1b.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PPyrledd9ohdqb4_m0k4jkv20pd.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\PPb1saqj40kuemgihkovfenpbtc.TMP	printfilterpipelinesvc.exe
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\mqmQaLLxg.bmp"	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\mqmQaLLxg.bmp"	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

2E11.tmp

pid process

908 2E11.tmp

Drops file in Program Files directory 64 IoCs

Processes:

7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-60_altform-unplated.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main-selector.css	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libcaca_plugin.dll	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Fonts\mqmQaLLxg.README.txt	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.scale-100.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\x86\msvp9dec_store.dll	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Fonts\MapsMDL2.2.34.ttf	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\FPLACE.DLL.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_altform-unplated_contrast-white.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\SmallTile.scale-100.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\registry.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-96.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\mqmQaLLxg.README.txt	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_LogoSmall.targetsize-24.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libx265_plugin.dll	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\SmallTile.scale-100.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Set-TestInconclusive.ps1.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-80_altform-unplated.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-pl.xrm-ms	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\mobile_fillsign_logo.svg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_es-US.json	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-20_altform-lightunplated.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.altform-unplated_targetsize-32.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\cstm_brand_preview.png.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-80.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\ui-strings.js	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-IN\en-IN_female_TTS\ruleset_en-IN_TTS.lua	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\AppStore_icon.svg.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupMedTile.scale-125.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\error-icon.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\mqmQaLLxg.README.txt	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\Timer10Sec.targetsize-16.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailLargeTile.scale-125.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\avatar.jpg.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-conio-l1-1-0.dll.mqmQaLLxg	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\uk-ua\mqmQaLLxg.README.txt	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-400_contrast-white.png	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe2E11.tmpcmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2E11.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\Desktop\WallpaperStyle = "10"	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\Desktop	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe

Modifies registry class 1 IoCs

Processes:

StartMenuExperienceHost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe

pid	process
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe

Suspicious behavior: RenamesItself 26 IoCs

Processes:

2E11.tmp

pid	process
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp
908	2E11.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exevssvc.exe

description	pid	process
Token: SeAssignPrimaryTokenPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeDebugPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: 36	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeImpersonatePrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeIncBasePriorityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeIncreaseQuotaPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: 33	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeManageVolumePrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeProfSingleProcessPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeRestorePrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSystemProfilePrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeTakeOwnershipPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeShutdownPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeDebugPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4584	vssvc.exe
Token: SeRestorePrivilege	4584	vssvc.exe
Token: SeAuditPrivilege	4584	vssvc.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeSecurityPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
Token: SeBackupPrivilege	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

StartMenuExperienceHost.exe

pid process

3520 StartMenuExperienceHost.exe

pid	process
3520	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exeprintfilterpipelinesvc.exe2E11.tmp

description	pid	process	target process
PID 4596 wrote to memory of 6012	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe	splwow64.exe
PID 4596 wrote to memory of 6012	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe	splwow64.exe
PID 5864 wrote to memory of 5208	5864	printfilterpipelinesvc.exe	ONENOTE.EXE
PID 5864 wrote to memory of 5208	5864	printfilterpipelinesvc.exe	ONENOTE.EXE
PID 4596 wrote to memory of 908	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe	2E11.tmp
PID 4596 wrote to memory of 908	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe	2E11.tmp
PID 4596 wrote to memory of 908	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe	2E11.tmp
PID 4596 wrote to memory of 908	4596	7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe	2E11.tmp
PID 908 wrote to memory of 3268	908	2E11.tmp	cmd.exe
PID 908 wrote to memory of 3268	908	2E11.tmp	cmd.exe
PID 908 wrote to memory of 3268	908	2E11.tmp	cmd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe
"C:\Users\Admin\AppData\Local\Temp\7cb6f984f08296d33a4c316cf64ff96e352f07508a364b465a1a572bf73f4ad1.exe"
1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  - Drops file in System32 directory
  PID:6012
- C:\ProgramData\2E11.tmp
  "C:\ProgramData\2E11.tmp"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2E11.tmp >> NUL
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3268

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:6136

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5864
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{9B58EBE9-2242-4F86-8845-2DA9FD77E0D1}.xps" 133725421566280000
  2⤵
  PID:5208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\IIIIIIIIIII

Filesize
129B

MD5
c24ced5012f9e860a0629eff0eee483f

SHA1
b40af585fb500f81cb70f90a05399140579b0eaf

SHA256
181d5d7b41c116e9bda553325bc92e94a136cfb4cf13db89df0d8d5e26bd1167

SHA512
c7d3729370eb11a2da985140151f3ed0a6874da06a935036cd396afdf80b8f5bc14d83cc9669840fef079bd279e0101aed69853f4d7e7982612ab8cd1ab14106

Download Submit
C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui

Filesize
56KB

MD5
35850cd08bc466049e2eb0a422ed89cc

SHA1
bf28b46c347e9b337e3c873cbcd1ea70ac089170

SHA256
292b611f22a564d4f50d1e809e2105bd12b82397eda8b1f6c23b340529f108bb

SHA512
84912394690b38a38aedcca9a62103c8f3c114598a9eac784c308207381abe85a607b3893da71f25eac39d1c3c8d0811f6a19ece550cf17ade1aa5b53b41b8f1

Download Submit
C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui

Filesize
47KB

MD5
afc209d74f0a1587c44757ba0f7255bb

SHA1
66075583de25425f881ea2c5bbe51aeda6f6b0fc

SHA256
188b82f387516fc9496c26f8c8e80f41f57199248559979e059b7cee0adff8c2

SHA512
3a1ea2a80f7fe9c3c11187cdd37548cb6f791fd4cd4f079dabe5519e2232b3448c8c1e87a3a17f7d9df4bf1b09d51ec4a8175c875a70e1fef76f8684b4c00cba

Download Submit
C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui

Filesize
47KB

MD5
8d84457607e9b8882dbb927bccae7c68

SHA1
50945152fdfd93a139f14a15ec8db97d63d49a6a

SHA256
955e16e0e9003501a7a54c02e5907091a08874c6920e8cd737566c6cb22eb1bf

SHA512
de278d0bd3121dff8dd361a3dbace64c38d1377e3e2961fd2d2ffd2d5b616367224dbf7463505807185d483ed5531fe958c0c75eaa794497dc7609369f781408

Download Submit
C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui

Filesize
43KB

MD5
3b863cb6984d037c38f71a947763b2c2

SHA1
cf6b844e49e0f02f595634a2f9247318884e62c6

SHA256
4151e1fc755a9bb7ede52af960bfbdaccf0316285bb716d72ce4338c5e15fe89

SHA512
87919c4a6aa914553d78f3eeb23eb5fa3677b826ad625f49573a8a0e8eba388347c2a15da6ea7704c7415425aa9d9c1d38c8a002691d104439e4e735331b9dee

Download Submit
C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui

Filesize
53KB

MD5
a5065c0bbc317095f2cdd67519098bae

SHA1
a1ed5180fb3aa9ca7207db23683289703bd45a73

SHA256
77964c3f02ee2a063726456d9c3b69a807eeef9614faedb1078e66e44a251fb4

SHA512
38c97c649911142568e24aea708256c80fd170eb27854046a31a87bb5ff2d1287ce3f17e26c1d6f1f37515c66b903920bdb6e6fe1a126b2a5c7fb7cf5bf13331

Download Submit
C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui

Filesize
47KB

MD5
915e755aac7b1a930ca795b89fde7898

SHA1
813c9438647634d3bc1ca7a7f0ae1c57aa12ac12

SHA256
c36fcf8c9acfccb3752694a7f68873103c35117b78eec8124e2e40dd57c34499

SHA512
9c87b1d90043a6d7d3d14057a2d3daf9d5328118143298895742a9ff07c003efe2de93ebb7c45a7844ec4a8d45c63da21f618ae6f36a502ee74a011a31a76563

Download Submit
C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui

Filesize
57KB

MD5
eab0c372737aca43986c6ba7e98e63f9

SHA1
b19d0d9c3fe0bc25e01d498d627011cc777aa3a3

SHA256
03c76140c97f4c0caa397738aad440e457be86d40d22aa66e67fdad8f09d82db

SHA512
4b879d31e82218669bb139154af9f5c5904ca4c539eee2e733962603d44933e7c768fd80b45ba563d22208d342412931548447b7d5f21090340280edc2e30041

Download Submit
C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui

Filesize
47KB

MD5
a522f0f68bfb2c7e732ab3bc5661c816

SHA1
992682afc529f97dbee28ce36bf2a2d896fdbe64

SHA256
86cf85d8c3b46ed69b245e02918f2dc45183adb3d3db4d7e8f3f29a597cb1709

SHA512
cf768b5064d84b8de234ad964c66f64c38d8225c7f0974d8b5e2d641be7b835812949c75ad099c4882a0c378e5458800dcc9519b53eff6db00ae5bdd117630a2

Download Submit
C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui

Filesize
54KB

MD5
674be67835f034bfe235463b6223eccf

SHA1
859ee9b4d75b96cd90a2105b83d483da9ed64b95

SHA256
bc16618c44c8e93268a1653c08ea5be310993e7c98f4916573dada163afa2f11

SHA512
73b3a2b66caa95ca0cf7f05effdb5aa623bef243ef233919d279d63cc3085d8fca0df65e0a4b683dbe02749fdbf57b743959778ec47a5a214ea4c2fc3627249b

Download Submit
C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui

Filesize
47KB

MD5
c3dceaf6abc766b62f114e096cbdd8b1

SHA1
d5b8fee32887cd99fe86631041991bd99c655c94

SHA256
9cf7fa529a93377edbf1d356b188d5f0fcfb55f9cf595cd5b55481e874f88469

SHA512
bdbb9ae57ad96aa05b4575e4f7bcfb12985bf98e6595442140b87ac50e6521bd2bebfcf7d748841ba5110dbd72b4cb98aea6926a28c461ba7f001cb7d1a108e3

Download Submit
C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui

Filesize
32KB

MD5
432cd7b58fb6017e50d39e15880b5f49

SHA1
96213f2a15106969dd7823fa8e7e7d6554bdaa19

SHA256
2a89dcdc7bbba5d1fa7f42d2c2ac9ecde638eb6dbc5cc575e7b8b660f4c8f5fa

SHA512
1f7f242a38dcb7284844dc4d2c874dfa99233b86a72ce06f8728ac782c445852d324528920681f9ab02f5a04d3272721ecaef424245fed170355f2374a3354f2

Download Submit
C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui

Filesize
37KB

MD5
05c7b1440d4ac1565f6ba1e5de292625

SHA1
7aa15ff044286a5c514175679c4cd9c41821511f

SHA256
06919c020d7813d381f954dc81b3a70709fec8565394c2a503fa2f1063c9dfd5

SHA512
4c002fcb4bdff3fbb7d71723413c5d9256fee631dd8feff991190bb45a7efa43c4ab2ff59d7ef619af487e2be53f03adaa29d4cd4cb61155dccfe8d008c36d43

Download Submit
C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui

Filesize
20KB

MD5
ba795d813610de2bf377718686c4e633

SHA1
64aeefc2d0fb38eab879505ca8429502956efefe

SHA256
3393bf9a2f1f55983cbd56af79f21f46c21385aa64af947f3e906963609f136a

SHA512
13b74345e4aab5068a5508f29b70112c0ada7a04e8915b72c7a5caf63ba729c1ebea3d9443386a5c2a54ebb77d91affeb998bce74177c4ac4a778e8cbbdf5107

Download Submit
C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui

Filesize
17KB

MD5
6f1af6433265ddd05e82f1301f049339

SHA1
bbe22e3497a404aa9b3c7d3d237ecbb3281f01a3

SHA256
b77ed243e5f049063a9cc3cdf1f5ec54a61da9f9370a53e78e6c607030cce8c8

SHA512
687bde8719f6b9c74a911d5e9d53a311581d851f35d98fd08cf63c67a0a36b4af683a733afbac37394e6d87339130f7a4402e39b204241dd0bfe59b657e2d90c

Download Submit
C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui

Filesize
19KB

MD5
a505617118beb357dcbcb3210fd61e1a

SHA1
acb7eb2a58ca7686b8f8e4991b40816d65f15f1b

SHA256
b51dcceb9d73bafe37760664a31b23933d8d26b061aff2ffa8ecfc329c72b011

SHA512
94ed3f855f72476db8720ace52876665dde1ac68c8f3c62fadadeb3f07cf4f7557bc85e5cf032e91129bf773482ff56c53338682314ecf47762a08b49b267892

Download Submit
C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui

Filesize
20KB

MD5
c898332ef4a9aeb9b640c9ecd7974fd3

SHA1
794f3863dcfcf42017bf598d9639855c7edfe17c

SHA256
6ea4fc8dbff058ab92994a21581ad7b7b336f614bd7b71fb0f28200242481c40

SHA512
e2fd9ce53c60cc56130f05f88c65e8e859c6d893e982d0745a6614106205f637e398dcd96e62ff9bf07cdd2ede5dba1ab9c2d73211e30d3deb77c5ddb5be9279

Download Submit
C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui

Filesize
19KB

MD5
2dea45b3c7eb9f1c163e85116a33c368

SHA1
12fc5a185c4906f19692d99bd1ae691380e129ad

SHA256
9b212aa616c7b8ccaf19e0a82181843e22ed9bb2263ffd10e01f9ac36c080128

SHA512
a3ce5e9f2915e19727e5c8ff65ae63b37daa7c2868d90e34f5525d537890f4d72c70326527be0c299d4c9e5e9eb7aa5f98dfafabbfa00821eaf3c3ed2a10a603

Download Submit
C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui

Filesize
11KB

MD5
71772fec66fa1569ae24c649aeff4a74

SHA1
d3eadf357bd357394030005f08c12cc7d4518ded

SHA256
b1fbb155526f3fd08566e1944c91836c721a053ac5be71644222317c31a02a19

SHA512
5bbe694e6fc8752baf5c52f23d00f669481240d77448e3abc7dfb27ca04e9784d9a98b69a697edb992e905b3cb13f0eca30cd1d96e6346838f744fb3d040d5b4

Download Submit
C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui

Filesize
102KB

MD5
232019f159ad0c6b947ee6446bc21b40

SHA1
55e843d5f0932c41a1f4fea3436966d8d5aa645a

SHA256
329618ff9261f7e16b43b037106b6bbd4a34cf6b94d825addd58ea395511dbc5

SHA512
cc3cfe547ca330608abe326e1768d602ab9a536e7abd21ecb8fd09b36b75e7ccc860cac2a97d9b05d217fa7a835d099e72d51bdebfb9c596bcf893b607fa9044

Download Submit
C:\Program Files\Common Files\System\en-US\wab32res.dll.mui

Filesize
92KB

MD5
6ef2d712cee2d46f9b9f6e7fac79ed29

SHA1
48e2e217e8044ea436ee1a02546ea980d5a22f73

SHA256
691b3a9a5bb9890b806cf382bf3ade080b3985338b3a29f082a79b3aa42c3503

SHA512
0533008a86a16f3714b7643c106364af91f52febf75694efeb620bddd1cc85d535d0b956d67ed4ba7473a546db312e355f10f50f75dd56a52974df3f049b40e2

Download Submit
C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui

Filesize
102KB

MD5
cce40c13834dd2a2fd6dba51347abe09

SHA1
9d31c51e1b1149482a92cf7f14e6deb9405d1b15

SHA256
99c9936c840e32233148f51f31ee821071abb71a4c38140ed02b87f03f5d72a5

SHA512
3fdb43287c6ecff464f7a25287d4abef05ba5b0776f3d7674ef2f503483f6ecae6e3685a7ee97b14563daf648ce6f14b347e3fb154e131e0626d8691547845fa

Download Submit
C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui

Filesize
104KB

MD5
6d5d7ecc88017fe276ecb850a0a4a202

SHA1
3dfa9e11464c7fb57886af261d0409dcca65b297

SHA256
963ebc237608ab11d22f22b6473238998f0b2e9b69b4a47b3c8fa5e20d1dfa6a

SHA512
427529595a954ce356a78d30a74e693412ed781405af9cb4fa30cfbf7de1f67982bb114d1f11bceacc7d1024b35ea16d54b922cbf92463dbf6efe02696d07c90

Download Submit
C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui

Filesize
97KB

MD5
841a380c89270438242df0b64f063906

SHA1
62149534c28aa6fd9896846aa7d60a0844fb5e2c

SHA256
17f0552736a28aa8318075d21fb3e279774b80f99530344e56b80550b5e20127

SHA512
e3b37f8b78c4591e71c18ea17fe9be988cb97ed18c810d6476c8ebbcac57f666454f4c39bde74b69287fc13e9261525ef06711ef4c4ccb093009823acf5ffbc0

Download Submit
C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui

Filesize
69KB

MD5
ff8207d1b1794409c5e308fc2ed255a0

SHA1
26768039410aabadabd31b7ca87f5bc14555644b

SHA256
02f5d716f6b1342151a0fb0a9555e85326971304892be0c2a2541f4a70529b89

SHA512
3577d471d902e6529697716491441efcaa2ba66d9fb36dda2ac94213b64cc3165d067beb65117814f780c0c9ddc62cea8c92a10680c1770e377f34acabe6adca

Download Submit
C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui

Filesize
12KB

MD5
3dedfd5b880768d09c7eb9cdcff28287

SHA1
045db3e3e23aef9b04d30eeb3fbf9acaab391c4b

SHA256
59461e906d16eea175f7813e717618050f871f08b0a4f5e859f91882fa2d3bd0

SHA512
16e2cc21b584cd9d925bc8374395da262235a9fe1ea50303ea5e09649a9c03444f4dfc369be0c10cacc093620124700a2f973506b99c7b11fa1ee50b0705e2c5

Download Submit
C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui

Filesize
9KB

MD5
31736f4a28fb0205e4645120a6acba74

SHA1
2a0a628895b6b100ce9c3c0454d2b1b4305a7828

SHA256
3864e793455b56a57605c305fbaf7d095e9033e9980e376fbbcc2850cc2eb334

SHA512
492a1bac45b28db5b53bbc16f3f58dd2d685020b2749611e01d19485bb4fdb5e64035a420aa66d08e47e5772d1f25ee16297e2a7d3116d3eb7169f3dd2b71a1c

Download Submit
C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui

Filesize
10KB

MD5
caa85d46c32bc2d160072ffbe90bdeb6

SHA1
a763546d76242ef0813e220fdcd7639ed3e7840d

SHA256
ecb0967732a8e5f604017153d5c9ccd1244cea44f0bcd6bd1a9a6f54f2d39f07

SHA512
b421290257210efa04c40b1a74eb8983fc59d5bd9596f9ccec2eacdd9cd0389930964f56b33ef1e672f1e37de4a44200126f5f094d73ff00b6a3645fe21afa2b

Download Submit
C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui

Filesize
7KB

MD5
566d464262792c6777a9857e49f3cf17

SHA1
b2148a603430718d5a132c2217227d1b5796dafe

SHA256
8b02629415b69813a607e5dec41576018e52218f5d46f4ba8db81c2c907ed186

SHA512
c62a148112ab0929879e4bc88028ccd5af41897c5bb4faa3f5661580e9afa8ded9e51eddfcdce6e5f1f3ec1c7ee51edeba37189ca56d942cbb255c475388a1e8

Download Submit
C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui

Filesize
11KB

MD5
838ca54715b5d356bac1637086b2921e

SHA1
3ecc71699ce88d09e772f656a59fe624fe6f60a9

SHA256
1b34fdb45fb5a0a0f497a9d14128a6a2d596523e64a7171b8c29c34e6dea0f26

SHA512
6869cf144ef23ea66ac58ebb4318c772f25e21ecd4d474912df8769a936cb303cb26ce65670271d089e3859ba8d6442b67e14c1573604e9990a07a813097f334

Download Submit
C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui

Filesize
8KB

MD5
b90f5a993402f1d8098ca66801c87270

SHA1
aaa1b08a5f17d46b53a1c0ebba49b85457b30af4

SHA256
bdf141569133611436a5cafbfb15cc46da477522603e6d0392acbab07ec3d63a

SHA512
b56166f7ce479387918f535895f68d27724935fbe74568a46e99eea60bee24f4405f2e939f4ea6ed84f1963b90e020fd5e15c173bced388ae666f2df81391e09

Download Submit
C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui

Filesize
12KB

MD5
4df15c2c92207986c8932edfd1456d55

SHA1
cde345e9df33b7aa521f5caecb6b2045de4c6355

SHA256
52b89a1e023fdedfce43b261a2d122fb6accefc01cf0a83593c9b10319965aba

SHA512
47c053e0c6378b40ad118dad34bb3862b1793896914f2f55e2a5f8a521e69ec8756b37289f74b1dd534e0c4dbfe2d8d28232adf4f3cded33485d865fe404022d

Download Submit
C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui

Filesize
9KB

MD5
bf38438c041fdb039c85c2200ec2f8da

SHA1
c9155c06a0115ac9004e05ec7794f794ad261eb1

SHA256
b5d48e5f14a8214285218c56cd95f5db91de3a7f688b0be6573af413a0f087da

SHA512
093f1b0acbc181911f49282e6307e08d5230f786498c244ca9a25099d7c4c05732dc0cb3e71cee06fb971623cbb7d9ed3e9c3b9aa648037b8c9171f8862e9864

Download Submit
C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui

Filesize
11KB

MD5
d81e4fdeee31770761572077411dc6e7

SHA1
12a2b888f3cf6b08807e58677e743ea17f6554cc

SHA256
0a3b49887907702e7e61301aa0cd6db8ad96c5df94e4dd46421ee47e5801363f

SHA512
cde50bace5e548752b7a18ae64922543dc20c7040897791627605477b4658c74a7f40edf65e7ecc03f6a1140ef2f66eca3b047c50c90d44e49fe8d125cb95d54

Download Submit
C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui

Filesize
9KB

MD5
154d39b91cec245cfd2848167d52aaa0

SHA1
7d055767c1ef6796927f8ad0a5182bc6731216d5

SHA256
cabd4b03408cdd37225055fd38b57d41c08bc1ef7eacf95690f6dbc9c92de704

SHA512
e3b12d5c67c4af37cce69cb49a7eede279d08cb504acc6831977ca653885ab0eefe679b0f784b5ad347195915bd2008b6acffe2d134cca96d14554b685572407

Download Submit
C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui

Filesize
6KB

MD5
1b68c41c4138079417e65d722ebce3a5

SHA1
cf39d678dcae5436444de682cf0cdce951064845

SHA256
ba398a9b4b56f1da1698167afa335997707766082ebb0b415eddaf1b884747a2

SHA512
04328365c9116419446cdf0a3aafc5defac05c7fb1ace7f643b9ad2e50598f60af1031d9ca44c259a68d1b1e6aa21690bc013a0f2b54118b13fac7df1cd129e7

Download Submit
C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui

Filesize
6KB

MD5
d2954ca7b344b754b98169ce783bcf94

SHA1
11d35f9fcb64389e0d0f7bcaa4bf2a29221df302

SHA256
8b1f27d0d859c7df16e4b207ac42ff4e14931fb24ec80e8d4b7213639b5622ba

SHA512
7285d1e649bf90b89bb8e5178bf7df126e24dda26529c34adf3169ce9336c12d348298a28cd915b4299cbe902efb16ffcd85ebdc22129d6123ed198b97af08da

Download Submit
C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui

Filesize
94KB

MD5
d4d58ee778772a7e0c91807118255add

SHA1
4796fa8dbd3d98dac4807ea780f558dfd35f26fe

SHA256
31bc9cd946bcbecf5834ffbed1a4e4de6355b7a987873adf5b9a94d43b8b886a

SHA512
43945d28e6e5a91d79a56ed71285e7383b4a65072e5f97d279ff22e887077adc5531b7d02ac950eb6e52e5247e132b0bf68c4d8b75fa85bada4bd40296ca8533

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui

Filesize
5KB

MD5
9fd7f48ee1e25bba4b12a593a160a513

SHA1
7f9a0caff22e546a076b043dbce69f2f039b78f4

SHA256
1ef0469835a8395aad2a574df314d33c571d76a44947112c50ee6d5e0a03ccc5

SHA512
63d4f0eb7bc332b7fb8993e66870c79493f38c1e200e7885ba4abc71ec6d7594282123d95b0a449a1d8a3032026424543ff472a89bc055d9e9b47c6457a01118

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui

Filesize
27KB

MD5
6d6f542c5628af16d29086a59467b7a8

SHA1
6641add11f240d66b3b233d7da0b015e7f3a678f

SHA256
7d6ea7684948c3eda4c321781ca38922cf6c1b2bd9541dfb8210a3ad61628234

SHA512
8b5940938f86aed18df0c666ee87c13e0468156d5d0febc6d486cd6c4bb6954e904a2f9b8999f76e75303123870789cd4c37af11dab0d3ce3d80623689b0942a

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui

Filesize
3KB

MD5
e15e4c7b38a903e1b7630515b0521a38

SHA1
285c753867fef1cb6114f2a71db95280ac58f4d6

SHA256
71b2c8713e36fb310a8c4393d35bb24d7b07b060c9f95d80825234bcbbce3c60

SHA512
0fd3b9ffa40ce0a9cea9e3a28485e2be08b45d1e87127a317e1f565635e71789c5b84b19bcef1684896bd9f7ffbbb6acb20321671f81ae3c31973b6a48f3cc8d

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui

Filesize
3KB

MD5
95a5b9a721497f5c2045adc78a48af3a

SHA1
bfe0d09840721bb565faf4bc37e772809dcaaeca

SHA256
2d954dfd4d6bd5700a4e8853b9f64fece55f1f3a3b81680e7e9218bb7a4b212c

SHA512
4d9802815c19c1d8592b2a405703b99e2287c829c913de2691d5764d9a67707e69c128e298916ade3d6f39cb037a000790a01ecccd479aa909014fe1da74a4c7

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui

Filesize
5KB

MD5
861b4461229607bf510e072f2d887c0a

SHA1
49407f4faad6d5ead2936dd4cbe73f6213ea472c

SHA256
9292670650e20feb66dea3b9781f33333c1fc2eb54f2e9cbda49f4dec826eee3

SHA512
ff64f59952b3c4ace9d1bffa8c87242bf706cfd5c7318fe4a6b67e04a7b796851702e211fa353dd27babd01275ffd4325579aff3b90cb3be52c2e505fd419e0f

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui

Filesize
24KB

MD5
802ff7c7291bb8cef5c7b34613549067

SHA1
84cc313e4d701431c06a955c63af446741ee1ed8

SHA256
017a4dd2cd186bfd2fb8d2b102bf0e16f7387662ac0e0145d94c4ee03712cb05

SHA512
a63942565459b303a04700910e918f73c9ebf82218912771314959115cdb86efbea09e34d1aaa708a6954c1e54549aea00ba6070d9e6c439cdf2631107c0222f

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui

Filesize
3KB

MD5
c013a2423ffb4c55b1177e9fafa65c54

SHA1
ef42ecc93beb97acfb9ac7765fb3fd854d7ef4c4

SHA256
4969b3e4305c92ff75b6e416461c1337a8195e3c0a60caa17d6ade3adc049cf3

SHA512
999f8fb390090b2dfafa2d239eaea5d670c0b9117de5cb6f1a31ea0bbc82406851a6d8cb700f6ebf3a422470d398a72ab71765339750043f6e41ad5ac32897b8

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui

Filesize
9KB

MD5
21de0301758564568e0718390d3ca1d6

SHA1
8115a170f4b2b7dc53353c43c1d95f6cd75153a8

SHA256
8ce8b2a209e7756b0bf7158286785652433122540683a24a88bc35e0a6acca3f

SHA512
31e022a0174e1b70637851df8a6d2727c3a96bf67c1b88b97bb8b5b38c5a58097b0c58b9c1d87fdd27ef1696a7825a1211a3f355e4c9fa2cbad1c2d64c00c75a

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui

Filesize
3KB

MD5
971b84ccaec5058e776155c6f317a7db

SHA1
9ab17bd47cc83d5e944f20ac1e4304a05a7a45e8

SHA256
138fdd7d2675ebda1f3870fc003cf18450285da663d4b0cd98c58d403b5192ba

SHA512
965a0dbe7b76bd5e691556b40bd99cc1cd501f05ca0dbf2fde85ec77370abc9a430e42d677cc0749ffc3b9e602f9523d5113b05b3f1aaed3ef7e662bc6434bb1

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui

Filesize
5KB

MD5
c9a618c52c358eed8bb2682b9427051a

SHA1
e283a9eb6724367d98d1ee6ab2a8e478faa8b156

SHA256
15eb2dfd892b14ec6d6d20a14ca0fb0c91d4b6c39171eabb18eb6ab9f9aba1bf

SHA512
084ef407d205bd9dc6ae512c21103ebb68898517dc06bed04fd4f01821274c4aea68b322e90f4c5fd7e396182d61ae2ab357fcf30bd874b14a40ab80370d59ee

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui

Filesize
27KB

MD5
4243ad7f89c6e56704e4057dbf56b194

SHA1
1cf730685d83c12aa67065aab63e60bfb9d074f9

SHA256
65f6e0105834af10eb1cc8b800d9bf8330543d9815105258c1f0213fee95e271

SHA512
34feb5c19061883f12bdf193ad68ff7339dbbda4fb4a8cc9be598dc54309590296e36d532e46a931a94e001d34b1f9f4200f407124b288e7b3feeffba01620c4

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui

Filesize
3KB

MD5
82daaa93d66bd320877512ed792e139c

SHA1
e9a619435e49e861e6093136ef56abd3c0c7799d

SHA256
fbd093bc6c43c3c5215bc3d94055d0bd8a61815d1808654b04f8f6e17e46e6a3

SHA512
af10ae5684d4835e27e20ee36677416c01cec99ca3bd48019f497613188f32b0b07fbeafdd4ffd9bcb8e9e4e1098fa9936d8569f59e3355438bc7af25755c875

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui

Filesize
3KB

MD5
66ceff520b5a49d96b5c24e2f5c3ee93

SHA1
7253bc9bde0999e186782469b6cbc98b83833e39

SHA256
8ae30ba80edef71d1b2b88bb168fb1e5409b414f9dfee2525add09d1cca53cd6

SHA512
1d8e3de55eae60a709f29a3a1de2b6aa4e7edb89e07b42fcac76b02ac8c2cd1070d541cdf88942ef724cfb93d5fc04c40afeda2fed9a125b7c988d7a85c628c4

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui

Filesize
5KB

MD5
1983ab201ed2338e03266d6e0c27c28c

SHA1
d9e54d4478707fef9a17a5c7a39eefe6c196e68c

SHA256
15e32ede23f7c850eda1c81604ff8abfd09f63c6367b891f66f6410ea9a5636e

SHA512
320e184fbb16cbe8d0bdc95c49d0767d21edc606f8189d4c9e65bdf8ef160fffc7bc6c4246e52b992addc47b7e325282f1d3c62760a45f418ed1690356099b67

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui

Filesize
27KB

MD5
68c0ad0dade289cecbefaebdbe5e5b95

SHA1
6f960e18d8cd4f02684a47d38ab5aad8386e736e

SHA256
10a6e903df3dcbf47a6a37a502dce7753e0e936bec2bfedeed22baa68637713e

SHA512
c3006e30e520ce6424315494a67e903aefd16483d7bbea650685c58db1e56f9d30abada0eeb8a8cd11f26420c16c2da6e5267ff812b2587f8eb5f31993a36f61

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui

Filesize
3KB

MD5
2180f140d40c950eb856c91e69ba5c5f

SHA1
449088efdda8c2f1172a602c2095c5bbc3fc39df

SHA256
10208f2a948daf7e88c13934c0a97a518c8cc38c51692473ba8b865bebb46817

SHA512
39885ac899fa1ca231338b9f23ef4c798147805a4517e02102b75106c4fa6e17e61eecaa53c326845508bb87bf86f83284c8b54c938b6ed3f341cdf10f39d3cb

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui

Filesize
3KB

MD5
d327fa38eab3fdd56c7f5c2ae7188afa

SHA1
f16a4632a6cff99d93d0d4e7a2f7affbd53bb152

SHA256
e6da541dacb7d6cf25bdf7a76b24699fa225e71322e88f3d8e14e8d3a409d63b

SHA512
704e482881b39d945f1c03bc8fa1cf56b9cbdc0a227fba450b35694fa8f55f7d0e706d820a48d78d1af9a111ef888d7aecbeaf02cc5d32a081e48d7d81a0dd94

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui

Filesize
5KB

MD5
fc0c2865af4ea9e51a73212476c6d67e

SHA1
3b0d52a9b6ff592a16d861c6c857cf1bb6ee7892

SHA256
93302e6ee46170781ed8cb61e4545f2753390defb6d6acbb9ee95d74f6e99dcb

SHA512
d79fe679415e1e6aaff068242629222a9205e6925afc9d50aef646bbda344ddec7e99ec8b23dd5a68c90ba0b8e092d460fb100b11d641d1e1b43fe8a668be440

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui

Filesize
27KB

MD5
47e43d2ad42e48c8b193cb62d26929d1

SHA1
6b9bd2e2f56680199110fe31a0c8a9876b94e62e

SHA256
d3b7ac4391c0ccc6f604a88b89e505aa2d8278d2d892ab289b762aae5bc33e3b

SHA512
e4754f727faffb3da10b8441a76e34f5c3d36ce7a447ffcb551c98aa300a04b736cda5e7b951b28fb53454a2b300353e9e56eb1db3ea09e5051f97b3b642e4f7

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui

Filesize
3KB

MD5
5302ddc4734351460731866fbd158c9f

SHA1
d2d3734d5913b88f0e00b61d4f85c4cabcd8313d

SHA256
3810b92e2f896985f0fee60ac680c9631d86e6fa589cb4b7f7d4c19342e22f9b

SHA512
7fbded3a7c30a00be41dc3a7df973047c20894d332f0988de7c29fd585fe7e094c4e673ea2de8ee1c8b0b61ca4135966a3b04459ede80c4faf30814f749efd8d

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui

Filesize
3KB

MD5
ec2155c41b2ea950603937cf44994185

SHA1
fde498331ec7f30648d1aaa4b6e83ec574b849a5

SHA256
5a641b1bc931c1f62fc5aa2dd7a782be6aeba16eb943bbc04d2f34066fba01f8

SHA512
9878f41db25f7d1528d521be1dc4d51278892a49d9f7b493b125a92f10072041ccf568da49dc814eef009f0eb6e9b5a4d859e2f7de041a283436ecba703163e3

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui

Filesize
4KB

MD5
34152cf9703454b129b07bfc54b37f45

SHA1
a7d6f68fbbfcc806deb41def71bfa184174b3945

SHA256
5f98e5bb1f0bb0225326b0a61f6473899e6d198ffa1aefe6df60b8d873455875

SHA512
9106b89a43c15d5e0959f29c61fa86690958683b7f4c663806e58928d179dc715427d9fc8922c748dbbdecb8510c2792402ff9b13211f36459820e7ff01817df

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui

Filesize
16KB

MD5
093df1afd4da255ff35e081397049456

SHA1
26f844a9dc4995b8fd7ccd0a187136774d045eaa

SHA256
9e508203e27a0e0f02e2c43e4e6692ced493f955450395d85e721c6bb3655f7d

SHA512
6628c5a4bb0a7fa88964888c031cb1accf1a41a419a7ac32733ed530d51b865653edce195b00e4f499000bba34ceb0f6e37e7162eb3b48c12481c512ba406652

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui

Filesize
3KB

MD5
83499157834f2dd2f3379083cdcb5a24

SHA1
ea5641c9340a6e2c4c2a2583202c3bb0e93c0ced

SHA256
44b8276e71c67781a912d0f042c9537a906dd86617df0319c34d978db34eeb77

SHA512
c7d8cf893074753b6607f81591e8aaec577698371fb8253dbc160ca70aaee0cef0baf732b620383c1bff4e44f0646405e4cafb427e565184dc99ba75d5bc1e10

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui

Filesize
3KB

MD5
909ebd06e151cba867b88325dbde23eb

SHA1
803eca4e021d8e2788b8a8b028c5804ec7a80218

SHA256
533f43c90776552bb7d30e4fc4f891ebde87e8c31476a34a032e054028e03190

SHA512
966cd29c8378a5105a78a19e857d3638b35bcf7ee27489ba187cd0f9af7e2b4eb769b732dda171e145792854ba060719b8e974d58341fc4cee732c2ffcc319e5

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui

Filesize
26KB

MD5
d1be033b20ce8f34da1ae0a4c0bbd502

SHA1
6f5c7e2752fbeaa87f2d47beb64e169f0113a957

SHA256
4e75996b8345affe7f56fcc1711834d25ffb1a7ae86bd64b72e095614d27e722

SHA512
73029e266b07b120fa69006e8b997e83138febeffba56ca33f89ed6b5817661ea27cf15a266e6a5b3454b4bc10384b8c7710eab4f750f522cfc6afe633bed04a

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui

Filesize
3KB

MD5
a58c7278ed17600cfd0d6070e3f99166

SHA1
84bc72036c20cceb1c225b9f3189b28c70c103a3

SHA256
d41846646ba711d8d86538c4283cc7a482809b346ee958d95be9857728b85623

SHA512
2692b2b2803f436aa64a8fd4208facc0a1c20ee45702b1485fbc0a250fb510d15e93aa583e950ee0b182e2d98130cc9652d54a8ea00582bac59a82ff36ecac2e

Download Submit
C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui

Filesize
6KB

MD5
ea6b57b8c73156ed7a96f11ca5e80a78

SHA1
59307993d4f922f73db62e4bb9d4f7f477401b4b

SHA256
661276f4c21d19def3d148c025ea7b3a527741a8bc21d486725f21f3586e901b

SHA512
6be83f4e6811de67e3805b0ed627f94d49ce8775b6eb403bb81780af939b0045a0b50911c20434e6e3b78fa3d19ce31e9c536fb78789d6ff9a91bfbf1afcb2c1

Download Submit
C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui

Filesize
5KB

MD5
c2ba049a698b93283976826d7571f01b

SHA1
63933932abc7641612823229130dd9f73bac2ad7

SHA256
20463e47e664d12164f00c92cb40e78702a3fdc5d5ef06ba483fe393c0f47872

SHA512
d2de11b24f3da124a0a4e6e711c8ff2ed574a14f2792aa69a550c417663cef0c18cb35a773bd6f3a5ef5667b087ec33da87b52b1a99be9f0f5348222c40007ea

Download Submit
C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui

Filesize
6KB

MD5
2a2f4f220fc79bdc3c0b6c5b3a2b9b68

SHA1
9ddae60ee560f84f4f198d2088295aa8d6c7d33a

SHA256
19a0e6d9e593e6c3d4f9b3568e7275f446f9933e861e5a547577c7cf1e440f35

SHA512
eab8efef6159b9b30b5dc66c89ff103e5dfc2a7d2145bcab6295bea9f2d68f2cf99d668c94bfd140e1b606caf4865ad67b0304a7790a1dc7606deb0c05f56cdd

Download Submit
C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui

Filesize
6KB

MD5
5511b6f61fb21b69da1ed4ae803b0bde

SHA1
f66324ad3e82a0434e731e83c09cb6b8a08838cf

SHA256
c928d27d39384ec1a6af6d262655200787c33dff818bbfc2a60b6b9e6e84f684

SHA512
c2e1045007199f5761ca59bb7954bbd5b8e4e347a87c3585e35cfd605e6bc4aff9731a45cef151ecf9107a7bb69c40794e0efc5ee984a9d0f4cd2c2b363ba467

Download Submit
C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui

Filesize
6KB

MD5
8491a72eb0ebd879002792d4ea5d3b26

SHA1
0a71908204404120632a656743525e0a7ed15c5e

SHA256
10c9a5bb86e3f6a346798b8c709143ffd126dbeafe83ec2aab258c119cf1b2c3

SHA512
3e7e0d82907c735ee46aee585eaca0d8d5c5fe06e814ead3209a2597a18f559ddbc5dca7c3742f535b70dd093d7091fd1cae6d4ae8686d965c350f1fa849ef11

Download Submit
C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui

Filesize
5KB

MD5
1a6b382459d2889594a4b27011887bd4

SHA1
ce21198f2942fe68a04d414d122f9c6f0faa2303

SHA256
3dd19884edfe5aa5d19aaa7dfcd04a4505bda9821b22b0f427694cd14df1046a

SHA512
1d953dbcff0c43717ac8836b94c7b601d822ded3512251981594c7cc44ca7c10295dde0146fd37c4ffbed2b859f0857dc67161a5a25de8fc4ca04f9ccb4dbca7

Download Submit
C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui

Filesize
6KB

MD5
aea57b4135105aa5dd7bba9833ee1a56

SHA1
27343ffca224737b251e9061adfab48a904840dc

SHA256
7d9a6a3860ffec1631f0a80eb852f24d3f1387777d94dbfabd25d0606ac2ba28

SHA512
b1a0e0ceb3ed3fae3850e58a844fc2724f4e3dea2fdd970d969a92fb06683009fd6f1dd2661426370f650ae76a6ce383090f8f0f9c296260728cdc60955ad1bf

Download Submit
C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui

Filesize
2KB

MD5
3ceb19fca9d316a0b577dff0e09fb83d

SHA1
bdd2daea90653a2e3f7e63f0d7b086e9968337b6

SHA256
37ef70217d0c0586ad71b84b244d0d094533219f022494c448734e1e5a30b89f

SHA512
47bd19635f6d3ac307142814da3b86f565ff4c99dd00310019cd1967c8034fe3fd2614afe44a91c1c75c2d0d74bbb1775b5a73fdd1969458fe56804df248d897

Download Submit
C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui

Filesize
60KB

MD5
edba18f94522a44e14bb72300f0d1cd7

SHA1
c98008e54fdd7e845e745253a1aa2e3b2a738b98

SHA256
e1a308866bc122ab1ede0001688558c838339abfa991c37a6d70eb56d6d21ef5

SHA512
c56cfba6c9467957bff8ac6fb82b7655161457ff5c4c65a948ad814233a555012e1bcd37001292b3a290e1ec6c2e1f74e9c9603d1ee8eaa84e035f7030ab2b5d

Download Submit
C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui

Filesize
3KB

MD5
fc7c71528244f6795d419bc0e5f5d652

SHA1
a80b9e7d9c1bd118b216ef3a7de72df0c9a38484

SHA256
c021b62385df38062fb755752f2b048588b3309195b16b8902b4e6217973b343

SHA512
4668bf65e35c88129c75cd23897ee99e8fb3148f566d0e6156cd6c0fabc3434babb06eb694fbb593a4d969fd158a75e6ae2b4649fcf8a8e0ac48843b038c3e5b

Download Submit
C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui

Filesize
58KB

MD5
c5004377b3943c584ebd061c31ce3a37

SHA1
4a05c83d1cc62911384b206a80a29536c0824160

SHA256
924e34c0a38006a1d46882fc91db79d5f0114003552c99331ea19090bc6201bf

SHA512
812c837428e9658e74be0e95b97778ca2b66dd7c10a69259c704068d61ebc291702ed7e6fec1fffcade689854b1f465e6c1b6c3cda4e3ba4e7ead147cbbb129d

Download Submit
C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui

Filesize
3KB

MD5
9c9fead3b236ad763fa32ff77d7b1417

SHA1
6bb78e616850456df902096468b7925460490ee1

SHA256
d9a2794c619ec2ae034bb882ab38e9c62e41ab1aa0881ce4dfe4c98060431ace

SHA512
248b2590582f6222a190dad4916eea7efeb319b8e1ce803e975ce960d4161b2b9dec88a93e8c7276e61daf0c88069377e7a11e7f76072496c994bff56c6d6668

Download Submit
C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui

Filesize
61KB

MD5
6fa17b9fb08b716a68a917d2d245e5ca

SHA1
05510f804fc2d5e4b9b0141bd4354144f65021f6

SHA256
79bd4ad82f2baef89f3b9a7254db07d50d82cced2f7ea27f54dae12b2039baed

SHA512
0b0090e276db6d17c5586e1ac4aa26eee74bda8369c81586c92acff4399c3acc462b088a2f16583a0dc562dd3f42b9e25b873a7b2f9d0109bfeff18a8a0fba88

Download Submit
C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui

Filesize
2KB

MD5
c2a58e3bd8d18b9287e69afb1c7b8ed9

SHA1
f649b26e21a41d94e617505b0ecfeb93eb8392bf

SHA256
8237c13027e85772d823461f84ec502c4ba7e075bfd55b771de9be992cb70787

SHA512
d26fc9f8dde3f09b276013dadef4e5c67b6bf85b0100de4654a96e87f8bac63f0f6aa426ad7c0a56485169a206fa806a006c22e377d29303b2e28e3be8bf2737

Download Submit
C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui

Filesize
57KB

MD5
7bd2e8bee545a7e44872ff2a48b78f3d

SHA1
99201d675b702aa075559e4a6def39d5d109b6fd

SHA256
73cf1fda8829b4a87d2bd0aaf170bb24ecace90f92a37926b9f25e2cddbccc27

SHA512
ff6963e7a68f20cfc50cfc778261211915d77fff940ff0483c9bb7fab43c06396840d86b58eefd1f48a2daa6503eca79204a9e9c89b18a7d228c72334879d060

Download Submit
C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui

Filesize
2KB

MD5
0d555626c0253fbc6102ec2a72befde3

SHA1
e30b5b5c91abaa411fe95bddfa7a67dea7772894

SHA256
edc66f5b21dd38aed967e3219b748171218f36b26778a53494117debb4d7b2b9

SHA512
9735cd48bd0514885e7453ef7e33ff20c0ad13857323d90af689d873b4790eb8fe75501748e4358978387767799ec9ef7e86560eca5c656fd43eeb870bfd1466

Download Submit
C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui

Filesize
31KB

MD5
362bffb69dc77b78e158da829aa132c7

SHA1
295e910bd2e928a24e03d12d440d5e48f1025e6c

SHA256
8cbf44a28519e6ee046b551e0de7f4495091ae1c82d6a45b30f96bb74be2c481

SHA512
4256ffeb5dd0860243c5f5b906bb68fabc31e921ca95999b8f2ec15c380be3accdffb1aba2cb205c10dc46d2dd3597d211a287bb243f708f94fc5dbfde2302e1

Download Submit
C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui

Filesize
3KB

MD5
dc0670b3362ebfa819e3b110cb83ced5

SHA1
9c2eeb77a7b401d00195f63552472d0a51bf43be

SHA256
078c96c35d6fc60df2f1d2a08039a31810114af026f05c880b383cf1ed13c6d9

SHA512
9cc5ddd8091ede53ffb33d909af0c735cb672ed67fbdd9b0cf45b269ddcd2a121f97bfbf162c21bd1ac4d7e61564294dbb1be84edf00b24232a0024759eb8f55

Download Submit
C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui

Filesize
56KB

MD5
28cf33e171e1d62dd87092a1a306bc78

SHA1
728eace67bcd61a5de187c8f0c37683ff13fcd69

SHA256
6117c9cd8888c255691ac7805a3caf0a97543760b211bce078a2c2cb0b529b93

SHA512
24997d71139312bde2712400104e06600df6acedba034e10126d3dd404b0fb0b24910ab3c8f3b953422161e4fe11d4a83e734a8f2c5fc384ec3ff1170f9740e0

Download Submit
C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
b6178c5f942e1fb028ed0edc88493be1

SHA1
a4efaf73ec6ff930daeee907da52374e0ee1e3eb

SHA256
5f7d9541e17a26921ecbbe15a6d5105b5ddff96fa884200badf2d8786849f3a8

SHA512
656b37be4144821c880c5bbc7a15add17fd89b4c6450310c29b32a56e84c39ae2bd5cd94da01b89fd4d679a6cd974202efa566a058cdba2d03bf43d5fc1fca6d

Download Submit
C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui

Filesize
3KB

MD5
1a0c6e5cfc9db6411639039833f669ae

SHA1
a2515f037fc6c189260403006b66c0d38c7357ef

SHA256
a9695d09076d72bd9eacd0f094adda8ed2710c62ecffb6f63680a6a2b9989a05

SHA512
53031998818ddfcf29dff0b81c0b36ff1d280ad355518558955160469c924a5c1173accc00fb89d9afdcfaa43184456577dd0098f66764f74735bd961afafadd

Download Submit
C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui

Filesize
61KB

MD5
3d6b9c464a7e1f0a27d32d141e1d7f26

SHA1
0db720f56f8bd60f2d1386dd88875693b2a8ce46

SHA256
f5b9a3e0fc07754f77e5fbcc03c0c585707a9c185c6f33ae0f5b45ba45799ba2

SHA512
46bf316bd635d7922ecb04b6cbfbccbeea85eeb14c5ec65a132df2423bc8b7b4273aa62addc2cd9ad7394e387e6c06a2d3220d6574aa67dcb3d56cbe43b7bb5e

Download Submit
C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui

Filesize
2KB

MD5
308df3b380ca76d5731b7964c7338fd4

SHA1
1a00eda754b3113169722c254a011595f246ba3a

SHA256
0c975d9343e175c4448a18e6c067f11ec2519ee82e765102463301d16d2e5249

SHA512
47f04db387ec5d84ec6d71eabf233936a679b4e47b1970985e1ecf5a1dac9f1cebb7ed5a27970d26f963c45d23e14ec8f01a763855c28580bcd5a8318f6c3f17

Download Submit
C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui

Filesize
3KB

MD5
fe2f78d4f6801a6a9f970fefbab05e27

SHA1
a1fef15835f50b88cbb94079fba2eaf32e928f7a

SHA256
805d736ea6df98d949c7821ade1ded703dff29686a4d1f782326cac2c9a10f16

SHA512
be7aa8f67348c76ed406bc727024a96f38a118c81111c501e1216a12f3f1c32b3d01933239c73b46f7a8ec99e09662df90b52220a55b0efdab8a737c22e1a036

Download Submit
C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui

Filesize
4KB

MD5
c5196eec68777bc2e3984cbffdd7991e

SHA1
2c491a49525f3164f057252afa2ddc98314eb40e

SHA256
2c23beffeeb9293086fda7bad35a817db623b143a14e6529cc45f70dd814db67

SHA512
8f297263b76ee0e2d43ff845e830e4202e5dc9cb2c8f69902a4e5fa41ea6089ebc83fd74a407918f483d6c4be9d212f9ae17f0db48ffe8009f28577cec0ba991

Download Submit
C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui

Filesize
3KB

MD5
8486d6800ea7e2559d6cd38d92b0efa2

SHA1
ac5e8bb68e1b3961833357d808e5f7f6f0e4c3a5

SHA256
a8ffcbcf129f4945334bf36c1d2105997cb02fc70eba874c4006c98973ca9a7f

SHA512
cad542dafe0f32b9837f0d7af1ee8c23218fecfadcdd6ce03ef1a09592efb985ce23c7eb1326b93a7828c8695deab07db9d711ebcd4d4a3fb9016e81700d9494

Download Submit
C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
d93ba714c9b1d011b5b0359b1e3fbca9

SHA1
b2ddc6fd27d76c4e01f52cd0ad472a4a7c482fee

SHA256
e44ebf998ac123b21db11cb51082097c21760463acf6fb246ab4fe61625e5072

SHA512
292a55386f91fb336d001bc798e529341f577ad23088a4677ad2466e072895581d0a125cf46c34e1a49bc88b9dbbfb8b8ec6bc4815772bf79f087ae915a97d17

Download Submit
C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui

Filesize
3KB

MD5
97110768a32af63cb90bf9f3be1ab284

SHA1
cd2a937df94f6b0b4cae899913082d96be314a26

SHA256
98c55f8234fab5959346c28df5f873c5826a35f575da92c477f14b0e285aa34b

SHA512
3137c96f16c655a10e3a5269d8e18d5d738ae461caea28e417bf941b9a90c3c84f4bf1ec57d45be0813a7903a12e513919c04175fb89ffcad084d1b37e18bc7c

Download Submit
C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui

Filesize
53KB

MD5
35dc4cfd44bfe3e6ece7f36f8e326834

SHA1
61c603660baf7abc9e34d5718e026743c6174614

SHA256
786530a33dca0472abeb6508da68232184571421d1008b29459614ccdcc76e30

SHA512
f2879bb64b68e69a28c7e1f1c8e5221b1dacc904cb5412da87e3e3770878fa886b6a081c6d7da11c1c7b240eb4bf916336434ec0fcc15d8495592822e510beda

Download Submit
C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui

Filesize
3KB

MD5
d6a9ffe89d353d466aeeaec1e25e7342

SHA1
a89f18639d4bdfbb90a45adcd39404e9d18a3597

SHA256
428d42de2768fcde63b6f895e5c086b6b00bfbf00036106c664d140508730fa7

SHA512
7bfe1152467e95cfbfda505fc9232874bcf21baba7633817a5a8a1ddfb7cd36cccd70bfb31441852c6f74a6d07e6c44966565f150391b9c79c64d0415ceaa9aa

Download Submit
C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui

Filesize
4KB

MD5
05ef962182543eb134d6dab8b5b8de97

SHA1
f22843b6374423ed1da65c7f6e50b7cd3ac3fa5d

SHA256
c599919175921524f7aadaa3243d1f5b34ebbad288169eca10bc2248e7a6705e

SHA512
2d8c4b4f49f72f1d2b47c2872a506dd772c82077111e5af557974b7d439de919c24cd3a797a28c55d4231379e79f8d02e66772bd7e0d9714d6ac070c4f86d529

Download Submit
C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui

Filesize
3KB

MD5
6401034704a42e09f0c1c63929bacefe

SHA1
cf56d726ac1ba8f19e1a1df7190c3c0462227c6c

SHA256
6c37f25272617005df777e235185f17c196e6e5c4d2f806015fd4c30197b59d4

SHA512
5e9c4eaae51c1bb278c72fe8f171b590c8f1f0e112fe069677923a8adb9add688166c9990960c86157483638e19b6341770c9b9b43af198c2e1a98ff49d1bcd4

Download Submit
C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
d8a38abce6d26d5d447b1c217c065d52

SHA1
b15c0a5acea4cdb620b62e7fe7d80c823e60e90a

SHA256
050c22919625eec2280d21536dd24c495a943a745c2401160093fc1532c4c6cf

SHA512
7ab7b90aac03c010240a57877fd3c445e5048d7db5866501c48f2bcd61c6f56ee4a774b630946f5a62933c3f28a802d347cf9b1e106b4d3ffd8c6769e47d8873

Download Submit
C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui

Filesize
3KB

MD5
09edbe40517bf8690bef3385cfe360f2

SHA1
a6a3fa05d577f57943a3d4f867f382cf07b063da

SHA256
6e2424f191a0e305d1f76965246dd089902fb19b087ed77d845d4e6c177b2293

SHA512
44214417c6da6458111b5abb647b247aecab2d238b2f7f4deb9ef96778024c2e36c583c54115d3ad2c92b940988285f770227af5410904958f2dbc296e10ae7a

Download Submit
C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui

Filesize
62KB

MD5
de25cb1790eb38112dda23bdd7360659

SHA1
89d8d1c83c85d5eaa5bd2b4677227c1fddf363f7

SHA256
f606f3594c3f712af7c71a94fa2566f415567ccb6973a5ca1321893165ffebf9

SHA512
8bcfd400658eda2379ecd9b56966af0d897dfb49e2573ed5f44b6d63cccb49529074d12895bc55c678f8c3ceabbb3ca18882da6cd718673729637a9a48c0d3a8

Download Submit
C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui

Filesize
2KB

MD5
5ad322fb5b432f5fc8ca9196b7d43e9a

SHA1
59de34abc49f1d931a6c6f79930372ee6597579b

SHA256
4aff80bc0f79808a79e26c5a023bcea65dc0f5f4fee63e167e25899db4ce72ae

SHA512
663e4f135f9988f3d92dd703234ff84711df74d1c154e9e1e48dcd65226d3fade8fd4074dc6c9dd7ec97a7db01fa888fcc33c957cf3147a4614a4e81839d9103

Download Submit
C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui

Filesize
3KB

MD5
03c927ef65ba088fca2bd1ae1be5d97f

SHA1
2b2a917eb120f41107038fe4af96e253e1db13fa

SHA256
adab0dc2e5675180deeb6071f0a061e65e97032514016aa423fe4b30acddc5ef

SHA512
670c1fb3c9ff096cddb895cefd98766bd823e7ac80a11aa642bf7cdbc8a7d720fd174548ee58da8e7c0092abc2dbe7f7b771abadc9a404c6a75b3e6cf415757e

Download Submit
C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui

Filesize
4KB

MD5
63f162d38b785f2f2ed4d0dfea1323b4

SHA1
18dc8085a20661e1075a3f019723651ef0f7601b

SHA256
d226d10ee6cda9029ff8b8223ecbee9d98db6d0757a8b0331a174875078eb751

SHA512
bed13b55900f1d2a0f34fd8d5722db2a0b403db97f9335de5ff1ecadfca6d0504a2f89ce17f1645b595f21e5f48f54f2f724d64eab8a6309045ff59a97549815

Download Submit
C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui

Filesize
3KB

MD5
ddac80328a63b456040a06655a983053

SHA1
6f092eae297ca30f5656ec7ff680d51c4187a888

SHA256
d1a322b286dd11dc4de246354d809159546185178474869d8c0e43f754c64770

SHA512
64fa4c7f2692b314308309756710ceea53ac22e791dd7092f0fe0437ca82a2e3795f38c367f42f945db6becfa70efaa6517fd9e438f0f448dac3af1616e6f856

Download Submit
C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
376ce0910b1ae0c2e02ffac18a485b17

SHA1
5e9d00b6419a4e5a7b81eb1426295b62b7b2960f

SHA256
ec7878f9bd2d936f8087d59b7143d80408f1b9bd723c3852f592e39cda3bf3ab

SHA512
a6ba79b87778583b8c38ae3d8eebfc63cfedabd6bdb6e1f32a3cc7e74d7667b344625b659babce7edf71cb6b5ef8c2803e7d1bff39dcf5e1b0c255291f3ae2e8

Download Submit
C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui

Filesize
3KB

MD5
d28acc440c514095df1cf314121af228

SHA1
646b139ad55c475b9537fba539116402481d3246

SHA256
3741a9f7116d4994ac20c8344ccb45ccd9052799ce8070c2c9896405e03c715d

SHA512
804dd48b3f023a21d5ffb315423ec3beba04a2b586d3b0e2fd690abde0f9b7b4d895fe47bbb64edfc8bb551511b3dae1a1eb7adb4f6edd3ebe35438aa216e9f7

Download Submit
C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui

Filesize
63KB

MD5
25e95371f0cc08ad920f32c936d76d10

SHA1
5e342c5ab66d2dfecdf27e1eb8f4c4d57a68329e

SHA256
21286cdfe7ba87d92156a3b3b3e7ab2f0128002130b8f046b62a1d90ccb32fc6

SHA512
97658810f2786af92eadc924d07ed38fa6cad24f9bae99abca1f7dd7fb02419b7ec61f09c82cb0fab6c6253962e476f2db1e9ca2e2a5010943943c1a2cfde81c

Download Submit
C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui

Filesize
2KB

MD5
06587051e689bff8be87a4a41ad3d59b

SHA1
b3408a15cde86995bea22efe149d032e9f8a21be

SHA256
c4d274a6c5b2e72839f88f2c19be9d9b36f4caf0b1b41fea75079fa1678b5265

SHA512
eef0c627c48ce5794b41d7daacc12ab0b8a1d1de99e7a81b72a2e55a01c724ca35c0f161bca6c36e505639b65f4195b77c7625e2a67494ad7891b8a93d7dca27

Download Submit
C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui

Filesize
3KB

MD5
772b0c0b971847a6f8925b394d37c9c3

SHA1
2d647dbf314d7d8859717d6dbf4aa7dd187f136b

SHA256
25f602d280b298757b035f3d7669fe7e23d0e3d06f02ea71bdd1bb47fc6a43db

SHA512
e92983369faddeed654a3b5844244c80937ef8bab2b93e3b40f1fb9d8f5769fdb19fc6fbc7dde53165ba7b4e697b9647ce1fc6692048b4f1a05c838a60fc7f72

Download Submit
C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui

Filesize
4KB

MD5
f161335986c40173e5722e05a4fdb9ae

SHA1
69592bbd71cabca85dc686646362a0e1a952a701

SHA256
3857eee4bc1f1dd8176608b77c03652db3022088ae5f1310e4c7ebbee7945b0d

SHA512
11a591fee768f988c4502ebadfbae0955d212bc019b6a6698385325207a8338e20ea650bcbce69341638955e9d6996a59eb3766ca886f83e372a36358a6e6f3e

Download Submit
C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui

Filesize
3KB

MD5
0d2bb512bd7eca34ca72831383c50e18

SHA1
7ade48beba1c23b3175036e5aa7043813c1ea03f

SHA256
ce274d1c78d49b1eca631007b12c48b62f2625ecdd9c2dd2aa7766e52bd41312

SHA512
9327793c91b9d8de56e073c4c1ca7e2af17bc67338fabe252593745e0933d0672d5430727fbb618a76270095df33fcd89ecef8236053da052420a769daf0a0b7

Download Submit
C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
f1cb3ce661c3b74b20d435a13c4ef19b

SHA1
955106d52ac667028b980574abf7e5d347164451

SHA256
3ef2b1414f7c7916f3a99372de0d4bf4a5c442086d58288a6307a52f85c2ff65

SHA512
93db902e60c0b266e14b8cdfb723a8fe60d7755b22e983a35ce9ece0ffbc474cccda37fcb56b7504994ffb55cef8c5b2554a947e03dad64cd16674346c0baa5f

Download Submit
C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui

Filesize
3KB

MD5
6bd855603ee348d112c4616f3d88a709

SHA1
4e1d96d9f9063fbb138236ca327e39d61bc04d3e

SHA256
34b77510b3066c551417a563cf469d0cf38a0302198b9a430259ab7c59f654b3

SHA512
14d0bfe351030353206223321ed26a065700303dccabc10e3ef2235f6853cf102e62728536db1a862b5f11f3b9a39550ff3362f665f417c0d52c878ef6470942

Download Submit
C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui

Filesize
61KB

MD5
c52dfed997274e79c9db2db193a4fdb1

SHA1
cdae62c253c5bf1396956fbdc28451d559ed037c

SHA256
9dd4a94d3d291005bddbd9844b0a0016268db02c782b3d1f0df96ca8f7739033

SHA512
8e4bb5b723f0c3fef2f3e385b98508ed0a1002244dc877507ab9a5afbb6890543f8b7d11099722f3a6b35ca110232f793b93aa50983813ae7e6f3b3d56e32885

Download Submit
C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui

Filesize
2KB

MD5
bf51d062d54cedaf6b5329256f044961

SHA1
c997bd62fd0968a4c25f8e29326e070df079c19d

SHA256
fa8d605f539b17c95773af552ddd0a243e2c8ec509119754d5cc8f9d40e39c11

SHA512
2c7be24f9c9bbe20eca225392981ff3c22b270932f6bd4691643b2544c23c8c9dfd8d25f4fb1b4fd5283191710759ae422ae936fce6d5568c6d2edc471073e29

Download Submit
C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui

Filesize
3KB

MD5
37341d920dfb285d5c196c8fbcc3f17f

SHA1
acbdd4d2291329d93a9ac9cea0fb562f1b0edb52

SHA256
e46b19a57078967cd05f83af166d79eeda893c4d5b0a650e3bf1cf689008801d

SHA512
01874cb21bbb57cb4f458bc37339f986f2919161370c8faba925d80939b332aa86472b1a766b9836e7c3cc302cd156b1361e8126fa5c3a89e08c0e1503a41939

Download Submit
C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui

Filesize
4KB

MD5
71a9a47e10afa9e97c7c278c9cb0bb9e

SHA1
db1fd3198475857637d035a38a1b8e4a02c4ea43

SHA256
eeb85268a6d0b8bc9c4e5e15f7fa750574bd14f354aa68e8fb658dad7d7b45d4

SHA512
1892cef768ece87fe67333838b4302cb0d7a1ceb546b2e4de76ec69d0fe4faec66f47ba78d98d5f2bc3f39d49a73204026fca59fa26a3d8c5fc019b9faa30aaa

Download Submit
C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui

Filesize
3KB

MD5
2442d7540eddc27c6c3c95a34a91249d

SHA1
02c6c4cf228d9c4143f42869fc9d3c315e48b728

SHA256
287bbbde44682682b963ca3f89088dc5ea7b69219381c8289f2da8dba1bdc11c

SHA512
4602fef63e61ba538b16bdc0a35adbbb43fa3d60d0bde7c8779cb3e658ca4b22bf6ab6e73399535285817acec5b1dd23b34b08eedc87d6b4621923bb4290ad17

Download Submit
C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
519f231b2ba9b760072df69883fd3944

SHA1
c0506e80c8c9725315b0eae3f406158f303a94c1

SHA256
7e59e782e0a8c6dece29f28a3cd508b3513787f57a2005b096f42363f261e501

SHA512
aaf8b77159cb5292707662e7c4788cd7000ad7474b38293b02a0eec2b8f1518ba8ce5b6385a1f4a18bc85b1cc28f44d7aa4b4fe3a20bc3bf6cb03e9b9d34900f

Download Submit
C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui

Filesize
3KB

MD5
da0b4e003669a4fa00c0994cda1001d1

SHA1
601ad07b37bef3dee2b5d80d298df41e5532de3c

SHA256
7ca91d83b47f85844fc5bc9e5e521016d6628bb2a218b6f48df7daf3a86a88a1

SHA512
b25726efd013fb29f5f04fc47d4e6b7489c8e08f53a77cd32ea03d28e4cbfb8a51658acc935bf473737fbcf4469a7db2c6cfb8e011561fcf0c1365fa6149c1e7

Download Submit
C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui

Filesize
40KB

MD5
8f50fbb880332d1469544961e64190aa

SHA1
c19a3e58425b100528730cb610a80573db38645b

SHA256
23683a7ad01253976b513e79ab97a9ce8d3fac1eb3ae9efa020c13b2af558f71

SHA512
1092f40e5d91f9b6cb273bbcd29d2f0640aaf0f44ccaaebf69f51717f70a75ccb5d28642ad00a82c6f128c5509dad2dfb80aea98dcd12a61fc7eac3e3694564f

Download Submit
C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui

Filesize
2KB

MD5
3faaeb947fdc50b39b715302dba0c51f

SHA1
7aa99e4c314cb7ffce7a88f5c05d3ee284d8b5e1

SHA256
fa216ac4bb8d3f107213c987a0a84a622ad8bfe73649749f3ce3101d621069d8

SHA512
80fda53d33a2f4e17db92d344dd066124c7e3eb63f62d47783f47f9c8ea3b05e4a91cfa2fe810667d3a8f489e4141ff2abadbf24ba5a6744dddffcbe01143d15

Download Submit
C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui

Filesize
3KB

MD5
1a5498f54ccda585b9a32ec0adf4595e

SHA1
a1e962fe969c9935b88c42eb1302ccbddc5624a2

SHA256
4f42c65575d739824fafb97a78b583d671515dc8b2bd3e4169a8ada441100353

SHA512
1126c828e27755a7ea6ee8fa50c98af2bcafdcf0bf2e964b86bbb5ef592c33a9936022e700bc688ac122491af42f8025bbd0fe03121fdda2d2ac467eda926f02

Download Submit
C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui

Filesize
4KB

MD5
ba48de7c4fbd4caf3b67f11ceb03b88c

SHA1
ef1b35fd37a03908b54d175736a0febc25aae673

SHA256
567a13dac78c81bca9961a8fb423580fba0f63d7672ccabae2589a7730b87846

SHA512
fa995f1eaa635faefed36df3388dab7a42bfd85cc1552601639eb99c251eb53980a3a6f2af2c362a9ed2b878f883a167a86166d80993661c3be8ec8bd82cb110

Download Submit
C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui

Filesize
3KB

MD5
2f5fd58ddf80a644de6e3f8f7fd82a90

SHA1
059ffbb70ccb81e4521684d60c986b8878eee7aa

SHA256
3906aab6d334c097075849e1e80a6b57433fcfa8550038a1f3b311bef8d331e5

SHA512
da64fdeed59ef7c19219d46d2ef87e71febc36c1b38bc35d1a9edee3db6a633ec092691609dd04a6709a45649a0ebc857dbb551a367e8ad13ea5beda43338969

Download Submit
C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui

Filesize
3KB

MD5
23e099e1cfd753616b61fbeaa400b7dd

SHA1
54b04ef2b578e164c0ccdb7136636c25b1dd1bb1

SHA256
fe88f56dc525773c8ac8466680971b7b8a9267430a9eeec049720773fcd8f924

SHA512
9b09dd96af2b7df6d92512186ab92900fc6e6636cde07eae9e8a58bc3cf21f01ae806f849774b24c5e0a0f1f9c44d613fb7717b4b32e2a663d4591facd3e78f9

Download Submit
C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui

Filesize
56KB

MD5
b2fcd7dbcb5d9475ae64775c51923f1c

SHA1
2ccc051a6fee7dc0dff20e3890d9403eb954f5a3

SHA256
9949bcd9f5e71566dc5bdb628efca5f7a09b3063220a1341fd934cc5390af7e5

SHA512
b8525327b2240ed0df9924ddc4ef13dde0012153acc69252e144e8603c6e281f1416e3fef12007117ca17443238287732170d914a15c8983a0d16e03b4eea185

Download Submit
C:\Program Files\Windows Media Player\uk-UA\wmlaunch.exe.mui

Filesize
2KB

MD5
fb6cbebed030ec6d3a6d2d88be8611d1

SHA1
9cc8eb3d5ac9655e6c6d824b59b0ae99d8e6fc6e

SHA256
3b4ed2aef035c057af897f2d459c822a666d1427e2caf8a77a765475a3093d18

SHA512
d5743d54155ac8b0035d6f3cabe2bd0af90ab1b1889551fca3711cd8c6b12fff7d18bd33d8f6a53148944c94e5ec1bab47eeb21cd64e384bce18ec065226a228

Download Submit
C:\Program Files\Windows Media Player\uk-UA\wmplayer.exe.mui

Filesize
3KB

MD5
a86180085d004dbe2965bd46e436ffc7

SHA1
ebfc59370f5fa87747822980e2248d4f49162a63

SHA256
7c43d5066863866cc28ef417b8e9e07ebdd626337923875edf6fe9d296d3f2ea

SHA512
6a81aac39b293d018f4f6815450c953fdec2f82cf4b919c9cf57373c10049b38272f930ffd1f725e7cfc9070a490544c86fd4bf461db60860c3c850ff0ce7cbf

Download Submit
C:\Program Files\Windows Media Player\uk-UA\wmpnssci.dll.mui

Filesize
4KB

MD5
6d9541504d52fdc877b749456c81b232

SHA1
c89aa99e0de999f2b14f332ab4e0e41200341a31

SHA256
7af29ade4138dfd2105aeb90d3e9d5ef4e843a4531ba8215da51817a7e320d25

SHA512
58aa40e5d3f0d4d227511071332f37d1ff0100775b3df8776b49b330c91fbf33ba64d1ac5f33a62ecc1618832607672774383f61351b5199d4447e4b5b28a505

Download Submit
C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui

Filesize
3KB

MD5
257612d00eed0d5819ce103b0468b7a6

SHA1
d8342a66a8cc10eac561df8c80d1f890c20551ab

SHA256
42a87fce3f2b5f23d3fff7829a779ccab03728b850143f2de6fe33cf7545a272

SHA512
007186975fd5bd9f69c04a2349563bcdef447ac9cb7e1cb19b1ab0648265c65bd4e4b3cb6b1930ea18bbc3150f8c37e68be68e2b53b27de44b45d1b074eb66f2

Download Submit
C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui

Filesize
49KB

MD5
6dd8d7999e5f046da63f83a71da39b2b

SHA1
50e2b2e30aa09bbe7414dbbb0ec925a52d15b54e

SHA256
282ecda55053670134935468f89eeb4fc025fb30ecc34e15928b10a1d23e752d

SHA512
0c348f8f51714ffa7b6df584b695e4cef675671f38c616ccee5e29c383cf818eff5be90430bc4db976777bf4bcf81f6490d53694282862a9e139670e3ddde73a

Download Submit
C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui

Filesize
8KB

MD5
f75c0031737a94065ceef3ba66559254

SHA1
b92ea1645363d21caad7f3092882057e78c92c40

SHA256
a1632b8381750a4d68ba70d6862fbb5024958b1275aaf1ea375a540402f1d12b

SHA512
2b9a1e5780f5615edb24b0033f820f5203616da8a35895d3cc6cd796d5f4df00ca2590bfb9a27ff3372a68620d45f8b96df3966188da5c197876b69e4c98cc81

Download Submit
C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui

Filesize
18KB

MD5
bf799fb20da08427f3de8b0c13558613

SHA1
1798bf0944f81595b5c509d4c6bf9fb15c2e6325

SHA256
d761f8c8bb7371167ea2999d0b2def9badb4264fcb34e94776fdd7324341f6ef

SHA512
5dd3db8c6d3a77343134377435d9925b1ce09cc2a6dc68b91cabae3b450c877f787633c2bf9ff6b675546b7c3d5107348031e8b960183253f9264386235c4094

Download Submit
C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui

Filesize
16KB

MD5
20ed34ad0ea669285aa774f379dd7a6a

SHA1
5a2dd2e08dc0e257cdc40b3ed5b991b9ae9cfd51

SHA256
60601618e748c61304920f0ab97707a78f19752e0b16559c5a05febb85b32658

SHA512
1c100c67cdde9b7ecd632bfb203bf5120b3c63926f4f2469b41228a4ed86aa81bc518d316a142bc307434848062abca4b2fce265846e1124d69798c83be1ea38

Download Submit
C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui

Filesize
18KB

MD5
a775989eb4b3c8d8b20ee6ef6097f067

SHA1
bdb73cfc83d6425f741328e433cc240a80dd2fe5

SHA256
d5e8355cc688237cc1edd9f7916be878e9dce44c1814de5f6f33080ac4af068c

SHA512
544fa97fa92921f762aec2cb0b5e23715e133cacf0a36589b0592d192948c55a7c70da2b50ea495955f023c6e9f8050d0b099586f5170250f670340a28fd4407

Download Submit
C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui

Filesize
19KB

MD5
f64ee4ea3c550dc92d0347ead835056e

SHA1
609cc66224a45813735177e04ea03387af26a3c1

SHA256
b2936bfc94a02da9256da07557ec981a24d78f4eeb65f0aac01f17b781e8bd3c

SHA512
578d0830db17f244610f25655b9cacc560d117672f7f4c006db140d3643d74a85205301a311d33bbd8be15b501697fc544aacc5974174e7224448c0597e3b991

Download Submit
C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui

Filesize
18KB

MD5
e2b0500bd7ed6169daa807ec8d3a6fed

SHA1
abc02a30459c34215f9c95243da80dd90b55041a

SHA256
f126f1a6a3eb7aa13398fc3c3dcebf6ee79fc910f8eefc74fc508c9c91d989aa

SHA512
772a6f58f2c4b2e9525ab55b61e6b6fd600f14dd50d0e2003928715812ba5945e3008632ca2f6d496fe734bf7d0f1d425f039f082ade5b3c3ee33acd33f32b47

Download Submit
C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui

Filesize
11KB

MD5
240aa4a672c446b407c6a027b61bf7ce

SHA1
c5836febee4d7677e80845d03d850fc41ba8a5a7

SHA256
476e5877f907f2ee9eb11edd75c94e163127caa4afc3126a38ef1bb15a5d425c

SHA512
d15e9072450fb35e60febd074440cf7aa4e4e062b04e96ac11d4bd70f6a0f23f7501241e1f3f1eef96a3846bffaaec22334d6fda9ef77148545b80844a9af291

Download Submit
C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui

Filesize
17KB

MD5
921f14937b6d67e7f50dad61f0738dc4

SHA1
94aa803f0a4256f3e17ec9fb3b66e46650d8b667

SHA256
1ae3007baa0e796bcc75b5463f57feb2a1e8c972eff99ba91a0441789d7c3ef8

SHA512
3cdb76dee02feeb94c20f553d8ab3b186bfe8df63ee2c20dab590f8c699d8506cb4b49b8e338ae0864247850e01fdd44aa115058a6b827ca3c36fa37e80012dd

Download Submit
C:\ProgramData\2E11.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat

Filesize
13KB

MD5
2a255bef042bc2f6032acddd17527828

SHA1
cc41ef22b632382e54d3a5fbdf3d7f61a0ac28ec

SHA256
3b85af6737ab56229912a5d7703816a3fed0c726f9f5010fb0faa4a2ea0c3d0e

SHA512
8705d366dfffc3adac7b1560ee6eff52b08ef1faacb6d056161c2096b7b7a573864b4cebdc9a18f116757346f5f18afef9cf5661154d77e373a960167689b49d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat

Filesize
13KB

MD5
f14b27e6a02016eced7ca49ee7401e9f

SHA1
27d38364eb45f39c3c0daf4b998fd56587be2841

SHA256
618e49543ac6eab7b0d034de1a85fd8be2f72feef568fad1876b2f95861899dd

SHA512
56c957357ba7c1fce09bc4c0b3e4c7131fc961307a553cfc66dcf6f651d9f6298c890531854c64d2d82429843ad59fe63f7e26e59a3f3996eb41ba1a2a7d9a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

Filesize
146KB

MD5
f21631338352907552a5775cba20f051

SHA1
690a70cf5bb8e612290ff1ffaf93e65087f17033

SHA256
4adc8433faca71020b2221490a9975e2548f6593e259d0bda8f079f4cbcdf57b

SHA512
7488eea46dfdca399e5c550be3bb75b275d755a3aee3cd0ae0112d734fc951677604a2fb40c18d803b4ea556d890bf73d7fae81a7b6a821209c2a81bc5ef2db3

Download Submit
C:\mqmQaLLxg.README.txt

Filesize
1KB

MD5
e660a65fcf9340820aff87745a4b9074

SHA1
161bfd683350ad551ce3a6652ba43bc4f447811b

SHA256
1a0ff740dcfbd23a131c794c9b43a8cf3578b361814e89987a8ca752c936cd93

SHA512
74f332c787ae1af6369c78c072c0dfc6b5148bd5f5b95ebb0c8d5f593925d083b0a28f2e54623d12599980473fb6d541ddd8b786d0f18fd9833ff71f2790a44e

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2392887640-1187051047-2909758433-1000\DDDDDDDDDDD

Filesize
129B

MD5
294b887d656285ab112c617c301beac9

SHA1
f03ff7178d810367437b77bd472385fd58c1deaa

SHA256
f7b79a0d7b72431522d098790ffc8345534d78a4406b1ea30930a9d257ad8a38

SHA512
71f7b3e74df3e05906b2d7211e7df46ee1a2673eb66227748f2388a44bb03476b4c63015c17715ddb8ed0692be181f64cd18c59a0f8d04ac168cebc999513db6

Download Submit
memory/4596-7213-0x0000000003370000-0x0000000003380000-memory.dmp

Filesize
64KB

Download
memory/4596-6447-0x0000000003370000-0x0000000003380000-memory.dmp

Filesize
64KB

Download
memory/4596-1-0x0000000003370000-0x0000000003380000-memory.dmp

Filesize
64KB

Download
memory/4596-2-0x0000000003370000-0x0000000003380000-memory.dmp

Filesize
64KB

Download
memory/4596-0-0x0000000003370000-0x0000000003380000-memory.dmp

Filesize
64KB

Download
memory/4596-7870-0x0000000003370000-0x0000000003380000-memory.dmp

Filesize
64KB

Download