f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053

Analysis

max time kernel
111s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2024 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Size

146KB
MD5

06f96cb31a2b655835130a09387fb401
SHA1

bb27f7e6cb3102c017c44a5bf8d86c16641e593b
SHA256

f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053
SHA512

2caeba7d1404019e2d378abed794b97dd4d14c646c51d6a9950cd6b677afdcf10f7263469f725d23251e11fa0913f5126743c6255d0c32f1583dcbf1c7c13744
SSDEEP

1536:jzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xD11h0i9TJmr7kZd9V78ny3OxTIT:8qJogYkcSNm9V7D1pTJmr7ksy4IT

Score

10^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\xEJOHNVZF.README.txt

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation. More than a year ago, world experts recognized the impossibility of deciphering by any means except the original decoder. No decryption software is available in the public. Antiviruse companies, researchers, IT specialists, and no other persons cant help you decrypt the data. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions.Send 2 different random files and you will get it decrypted. It can be from different computers on your network to be sure that one key decrypts everything. 2 files we unlock for free To get info (decrypt your files) contact us at telegram first . if you don't get answer in 24 hours then write us a email Contact information : Mail 1 : [email protected] Telegram: https://t.me/AzureShard You will receive btc address for payment in the reply letter No system is safe!

Emails

[email protected]

URLs

https://t.me/AzureShard

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE is not expected to spawn this process	4944	3792	OfficeC2RClient.exe	100

Renames multiple (7635) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	5967.tmp

Deletes itself 1 IoCs

pid	Process
2332	5967.tmp

Executes dropped EXE 1 IoCs

pid	Process
2332	5967.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\spool\PRINTERS\00002.SPL	splwow64.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\xEJOHNVZF.bmp"	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\xEJOHNVZF.bmp"	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2332	5967.tmp

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fr-fr\xEJOHNVZF.README.txt	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_listview_selected.svg	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\AppxMetadata\xEJOHNVZF.README.txt	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-200.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\186.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalLetter.dotx	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\xEJOHNVZF.README.txt	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main.css.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\xEJOHNVZF.README.txt	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\WinMetadata\Microsoft.UI.Xaml.winmd	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-125_contrast-black.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner.gif.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-60.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\star_full.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\assets_picker-account-addPerson-48.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\nub.png.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_fr.dub.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\it-it\ui-strings.js	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\xEJOHNVZF.README.txt	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GameBar_LargeTile.scale-100.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-US\en-US_female_TTS\ruleset_en-US_TTS.lua	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-36_altform-lightunplated.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.GRAPH.16.1033.hxn.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\xEJOHNVZF.README.txt	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\ui-strings.js.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSGet.Format.ps1xml	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubWideTile.scale-100_contrast-white.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\xEJOHNVZF.README.txt	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldContain.snippets.ps1xml	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\CompleteCheckmark2x.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\xEJOHNVZF.README.txt	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-20.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.js.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\move.svg	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.LEX	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\iexplore.exe.mui.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\ui-strings.js	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_pt_135x40.svg	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-60.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File created	C:\Program Files\Windows Defender\xEJOHNVZF.README.txt	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ContemporaryPhotoAlbum.potx	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\ui-strings.js	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-24_altform-unplated.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\adobe_sign_tag_retina.png.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\ui-strings.js.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\ui-strings.js.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\bg_pattern_RHP.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\SmallTile.scale-200.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxMediumTile.scale-150.png	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\xEJOHNVZF.README.txt	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxSignature.p7x	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5967.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\WallpaperStyle = "10"	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xEJOHNVZF\DefaultIcon\ = "C:\\ProgramData\\xEJOHNVZF.ico"	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xEJOHNVZF	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xEJOHNVZF\ = "xEJOHNVZF"	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xEJOHNVZF\DefaultIcon	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe

Suspicious behavior: RenamesItself 26 IoCs

pid	Process
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp
2332	5967.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeDebugPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: 36	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeImpersonatePrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeIncBasePriorityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeIncreaseQuotaPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: 33	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeManageVolumePrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeProfSingleProcessPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeRestorePrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSystemProfilePrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeTakeOwnershipPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeShutdownPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeDebugPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeBackupPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
Token: SeSecurityPrivilege	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4944	OfficeC2RClient.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 5688	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe	97
PID 3264 wrote to memory of 5688	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe	97
PID 3264 wrote to memory of 2332	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe	102
PID 3264 wrote to memory of 2332	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe	102
PID 3264 wrote to memory of 2332	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe	102
PID 3264 wrote to memory of 2332	3264	f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe	102
PID 3792 wrote to memory of 4944	3792	ONENOTE.EXE	101
PID 3792 wrote to memory of 4944	3792	ONENOTE.EXE	101
PID 2332 wrote to memory of 5140	2332	5967.tmp	103
PID 2332 wrote to memory of 5140	2332	5967.tmp	103
PID 2332 wrote to memory of 5140	2332	5967.tmp	103

C:\Users\Admin\AppData\Local\Temp\f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe
"C:\Users\Admin\AppData\Local\Temp\f4fb0f2ae098850f2a8ffb771ae4c6c8aaa81144fe53228a2c01df2d34307053.exe"
1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  - Drops file in System32 directory
  PID:5688
- C:\ProgramData\5967.tmp
  "C:\ProgramData\5967.tmp"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\5967.tmp >> NUL
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4444

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
PID:2892
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{585E64A4-A96F-4801-A720-30B47FE02BFB}.xps" 133758545587930000
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
    OfficeC2RClient.exe /error PID=3792 ProcessName="Microsoft OneNote" UIType=3 ErrorSource=0x8b10082a ErrorCode=0x80004005 ShowUI=1
    3⤵
    - Process spawned unexpected child process
    - Suspicious use of SetWindowsHookEx
    PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\FFFFFFFFFFF

Filesize
129B

MD5
c14393966b5fb4edcbb5d62fc0d56423

SHA1
52734e0474730384c6368f763595d4fb5c491bd7

SHA256
335567bb9b3a4b6429e475d4fb6a16e9b6ad9d6dead218387ce0ee834987c095

SHA512
d87ada45f2f3569092779aad480aa1d63c462371634744868b8a2f355f683344b3e21ad9ecb38f82a8186fca0676b3863d35a4ae74abadebbbcc27bf201378a0

Download Submit
C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui

Filesize
56KB

MD5
99e610a86702c203a9981ae13610d706

SHA1
6cdf6a2a81b65ba418a018e492f250b8a593a365

SHA256
95d601ce89d74ef2d667b8c525ab68b647221592dc7dd0a37779545d5f330be8

SHA512
4befb50e78240c1970f684d9ac3742214b1760c2731673fe300565051c61900d026cdd42812b8c34340c7d981edc34d61070167d2a41014748a0ae9fd6b3b910

Download Submit
C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui

Filesize
47KB

MD5
55a8cdb320931991291467a425de42d3

SHA1
a4a66fba6ef06dfbfdafef7fb2a509abf405ae25

SHA256
8e37152d82962c865a16571d94fd38869658cd240a67aab30f8f0e153ffbcd39

SHA512
e00734f65d5056aa5f478f0fdfcadd9c350a12d97e9e7a6a347282f8381708be02b6318e15b9acb0486418b15326c7c65d2f862df4aedd7a4f7592807d0f9b2e

Download Submit
C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui

Filesize
47KB

MD5
3c4a95337bd19cdcf4ad6640a99c78a9

SHA1
993e54fd77a224735b9b26708fd33ee8c75514e5

SHA256
6fe8e1e4d883426210b69a8fbfbaafbf79f2c90d721511530e9e67eb9ecaaec3

SHA512
50795d8c2741e26496c65b9bb687b29e202471baf021379b5729b3afb9e5b9cb98f0fce86234d8af64a89edcada3b820bd662cce4106a9dff1e2044ec3ee3fff

Download Submit
C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui

Filesize
43KB

MD5
4b47a3ed5af629e812b9a87bbd50420e

SHA1
0ce4a136920b9e802139428f54ceda9b8df40243

SHA256
152cf18885ba0c1faaf16acd00466c0727babe636412e57d84d452d04f7eade0

SHA512
b29d3643a67e63ae247f29aa66c527ebe0bb6c0f29c67ba78f13d44cb32a849f158167993a6520356d5fe663e947f72891b6a6e97cb7d8fb807f7522bb769c2c

Download Submit
C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui

Filesize
53KB

MD5
a2bc333a3b5b2b44e0bb40b4c28e7591

SHA1
a8e4bc8326609c64f397159e9e2944f0ca96ce07

SHA256
b72fd534cf6e631d0de0f193b448b39a1d0fa91693504236da2b50d999cca689

SHA512
d34fb6bfa87b7299ebc55399d99e30ff08672507aa23774f6abcef26edb07c3877bd442411c2de0c74558c77a30af2aea4f40ceea9f1d45523cc17f7d9dee2af

Download Submit
C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui

Filesize
47KB

MD5
dbd87b81ba1de73befbc98a1e7ee5680

SHA1
a4c26937264f9068b7a3b45d4fc0385898fcb7bd

SHA256
91a8c2b2f10f32599ff341016b8061e25ca19b3fcf8050166f3e8cda193af6a6

SHA512
1ff1711f744fbc558eb190e03352eff279a5c67e25a47b52afb1108ae45dedafcfd5fa247fde898d096e32061834d3fbb645850c7532e565bfccf8273594a946

Download Submit
C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui

Filesize
57KB

MD5
2756218ee186c6bf6ec25227eb298c55

SHA1
394927289f60c0ee627974b530ac53d34d422bf4

SHA256
0fc397349dc80b8bf53b1de15bc1356ff69e9ccc5ed3bcfee96bb50c11a52007

SHA512
15dce1dc8265f725a2aba186095e564b34c268c897a243284aa58470ee383f0074486c9b72065ee951f11d914f52aec49be856dd7ecb4be68da1989b2bfb15a9

Download Submit
C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui

Filesize
47KB

MD5
4b9d45df4261a102e5253955c4f39a4b

SHA1
8f5344ae7ad87e4f063bf0669d24e003b43f372c

SHA256
6c8ac1816e65048d6cc947cdc863d5f01d1ca1f0c78082a539d5cbea0330d8e4

SHA512
ed311463b050ab1307b105b15a11b2d21602daf00fbe66bf06ff8160253ef7eae6ef41d85096b9c544f412a2dd697edde751169428602f3d550bb05ecd0df1b7

Download Submit
C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui

Filesize
54KB

MD5
c32daa15242fa0b65a0aad35e3b3c76e

SHA1
99e970d365384bd68b7687149db336da8ebbf5fb

SHA256
2355efc82f3e55b27e81f28a49ed7a25aa629234c89fa1fafb59e20158834e00

SHA512
1905070cfc1cfba2869c2eade3da1144f62b5f14e9e36411c3f88ef0af89287f5929be89152b31fc0086ac1a067badf1e1428ede3743e50acf8b7d6a3340d270

Download Submit
C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui

Filesize
47KB

MD5
78dc6637f57b3ca3885109283639d62b

SHA1
7148a1f4fcd322c337b9bb91721ae47882c1420e

SHA256
aa211ff960deb0859ab92d58a457ce7712971d0d5bff580afcd1b1ffacc33d34

SHA512
ef0c752d6603e77f7fec4cbb12c3977572b4a5de1ff1312817e46a436485a36908f6f63ffbf3611be76256576316ff1420e0535c7203a3651137bfa7e877f76a

Download Submit
C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui

Filesize
32KB

MD5
917c62589e14fcafbb4053ea1113ae08

SHA1
5bbb3e2b0be1d12e8ef8fcd2228b68c77fe01f2c

SHA256
eb252610efb8fe11ef19f7151182a8923b3956a0a846571e16c0a49943ec6c45

SHA512
68280a67c4c7ba28c727efe859bcf23ec6a2849f631f1a8fcc76f2aea9aef908bcafed0a30501124d9b459b99f19aa0ba6b8842537668dcd7854adfb67d6e7c1

Download Submit
C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui

Filesize
37KB

MD5
754e4ff95314cf2a08379aff19780c08

SHA1
be6068bce315c1723dbe6cb32a4fa4d42c72e1dc

SHA256
43060e7398279685cf364c895b1739618e91e297f574907a22d7c5156fab56d3

SHA512
a0929b2863f9408d205d59084f278ac937a217668307d93d965109aabb43fc09c3b5b7cc1df478f526fbaef205b99d597a11e3ea1ce10828482f5860d3646034

Download Submit
C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui

Filesize
20KB

MD5
2feec51cec5f2935aec683c0a64f01fb

SHA1
681559d834f2e4b3d83e101162a3708657bff265

SHA256
3b1bad91c9584d9013d07272026936701a7d5d88c1285511b18e43e26b08c73b

SHA512
a22a18d6158f72975ed29d5d25e7963360faf14c647b7f77813c90580a56065ea3d940a716a4be9032ae3a129a4cceb61e4182e9c3bf09615cf1ec6ec2830fca

Download Submit
C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui

Filesize
17KB

MD5
7166921fe989dd7b1894a7cb9ca935ad

SHA1
1e834715e7398484432b4e4ae1436cd40ffae6f8

SHA256
ecb4794b305b1fc80ba0ed97999abfe20a2402217c4f607e0ce67ebcbdbcea97

SHA512
77cc1f8794c3fca7bee7b7443b8d1ee1b4fc1a6f095577a895156354612a17e0f87ce28ec2787651b004da3ce31e6ceba539b6435ea2ec5119a643266d94ee1d

Download Submit
C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui

Filesize
19KB

MD5
82e2e45e2eaf81545b86fd248aadfde6

SHA1
eaa613045c1252f8a932ac2bebf8d8d899bf20de

SHA256
ad9698bef7f307af6749c5fbe86f6cf4c0fbc62e9412dc41ee25c2ca1a11f788

SHA512
78e7dac12e55eb8d708d68980d9135a0ac3650202ab83f7bcaa6764452e22eaf092922170a877f5b973a8ea67158e44efc8d09d606df022c31874025542cf2dc

Download Submit
C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui

Filesize
20KB

MD5
d9557c993204d3d3731cfc1bcb1e7f5c

SHA1
ed8e5cc56f5ba9f4b47996254bfdd499c40a9fd0

SHA256
fe055978c9ccb86d3e2b8dcff7b2c3454a3e69e05c9ba187ff681ff387337d68

SHA512
2dc6706eb1367e33c2a20eccbbdd27dc21c98bb5cb3a95ca5171668ae18a7ed14e0739b1e1e1f39188ce55b7f09bfbca6aaf97531fcef9c4b0acb0c3dc19f442

Download Submit
C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui

Filesize
19KB

MD5
ed868d4350f8c5f1fbf14bbe350a2f61

SHA1
9b60642036c11d6b34d4f4df5b505529e8143000

SHA256
a15045a5c308eeb3c7f0655457d4c357bae1c22b0e72273b1b66c6e2d66250a9

SHA512
4deb6bfa745bde155459e094295f3fcdb7eabeda4a3852c04d7787954a3869663adf6fae6c6b842178abf6a59a29cc87e8a05d2b6b9936ecaf5749ca0b317f29

Download Submit
C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui

Filesize
11KB

MD5
2de77a752a30a23eb90d77430fa3670e

SHA1
f7ebb677f3003b1c9d04313c397c76c3bcae095d

SHA256
a5f1c6470fdb4a6091409d44de44ad740a8aa2b0f9f7b87a279cb2ea7b969ebc

SHA512
ad64ad7cba29f91071ac8e81803c45605d33da1f469ff4487cd17df1bd0cdf81425e75bdf9c41fa38815d59827a71d61777839f08d2e13061fc6b5b03fdc68ca

Download Submit
C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui

Filesize
102KB

MD5
a2e74d31fbc0e97368664d019a897452

SHA1
f546b00e4d9bbde48925dd050799c2ddd7f1102d

SHA256
cdccd36a9f90ab7d42d50730a835ab8396e5cacabd54fb363a31013d90b9d060

SHA512
7974817a6942627ce43b6f935e3d4b10aa13a6ee76c47708bf7b55d6f54a1a2c837a2d279677ec1c62059e232b69333eda6539ad48d9f409a4f2e2ea02ed6bbf

Download Submit
C:\Program Files\Common Files\System\en-US\wab32res.dll.mui

Filesize
92KB

MD5
dda6b34ffca0f214a765dbd098520f03

SHA1
f18650fcf5292736d665fb89154f0ed3f895e00f

SHA256
eaa3e2c7ee808ab34846dc3a868ef8408b10f2145343aa3b49c3aa66cd258048

SHA512
4667eb1a15bc8661036d41856ca4f9e8312f7e62e5ec934ad8924499a321a8c783e92b181d0d7ae0d97804c3d614de2d918bb9bc9244fb59abf50bedacd03f22

Download Submit
C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui

Filesize
102KB

MD5
409ccead1c5819d6ac4a474db21ef7ed

SHA1
3ecfea557edc1bd042dd236b5d780a975b22b5ef

SHA256
36690ccec806c77e998d33b3928f1ade9a40cab4bda414baed065e6c25a6e107

SHA512
122f910dcd5baf99d5c401896f56557bac1d9a3f5fa598c46004dba3a47724719434183969c31fb7909fa3f7dbd361a2099bdfc61d0f89392c712c13a9b037a0

Download Submit
C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui

Filesize
104KB

MD5
c1dee3ade0e590511800acc036adb6f6

SHA1
773f82a0dfdde66b0fd9969f3e6fe01c555deaad

SHA256
b5c4ff19c3a0407f6a06b5a1f83829ba91dd11e991e2e5ba66eeccd74f32c8c6

SHA512
ba66266cfd551f0270029c322091cafa4550f116d57b80560e7a88cd45914f0e8a31bfd15c1c7fb7afbee95bc5b492262a734491697229c7d6d2d1710384e7d3

Download Submit
C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui

Filesize
97KB

MD5
59328c01ca12bb4863a5fd78392260eb

SHA1
d5ae413e79ec60c9c85af9e49b141c053a64b2e6

SHA256
596349e49b79c29a5b0332c7d692fec05f53848c21f7fe18fe12fbef577b6adf

SHA512
e2f9949eff7e6bfa3e2f93de2c46c8ad299d1c6d862c574bd5c83bdc0c43b456679034eee0fa068bdbfcb200ed6b097c2ccca0ec05abfb2155009f935860179d

Download Submit
C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui

Filesize
69KB

MD5
1a6acdea24d886ef69c1e026462e525f

SHA1
9894c66e19b774346dd35a92bd21a7ab1a541718

SHA256
ef95d839320537fa96b371d683221ec7eb60f26f76a5d209c25604793aebcde3

SHA512
90d8beb6a7dab7962e776bbf4977e9db3d629d881be44db80e4d518dd727e5feda92e7dfa80573571a23bc7c6769a86108d76923b63f6828bb0b2eb39cb6d5bf

Download Submit
C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui

Filesize
12KB

MD5
0cf44181d30a914e1bf34ad27ffbd915

SHA1
7a8b528d391bff6d4dade766359da4103d83e88d

SHA256
792e662f08ceffc7e05fb5912254b35e60b70a515e05c5ec18f772b0094ee116

SHA512
2431cc77b29ee5d28fb34cb684edf55e2cc1abd8efef695028cec389d1475877affbe145789cfeca0c421825dacc655a09855771949cfe6a812350c97d497a28

Download Submit
C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui

Filesize
9KB

MD5
ce230ca1498de65fb35246a4af68088d

SHA1
57f7c9381fc0e51d0a5ee500394e93f76372e885

SHA256
1d9dd9d244a294de7a9988d194a14d8080d291a589da185454d231eb745ca9e9

SHA512
ebea728fd9ba539aa57912d53da1dc543dc6c6c5ac9d36a28455d83a3e41f0c790672251627e9cc0ed4d58b0b601005dda25b07a890768b38214c86248ed1dc2

Download Submit
C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui

Filesize
10KB

MD5
55df59e1e135e095995d00e7b6e6ad60

SHA1
00fc1c46240ebea9fa74d5c90e7df10570d04ffd

SHA256
ed94df9cb68e22775fb97b488c728a45dba9820f503bb96e42d5e9ecee87ec1c

SHA512
93f313a8ad37a8adbe8da6d9c114a3c3e05c04d10b57be6d47f9cb90f2ca039c49c73eb1bb0cc1625d39eaffa2dc8205263b6f3c3772ebd2b106904dba9aee27

Download Submit
C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui

Filesize
7KB

MD5
aec746b1a557e379270a8689b65b9aee

SHA1
8af9e54d322f19fa83e320ae12eb381f718a1601

SHA256
74ac73ef0116b361da57dd29ccab285e3b419fdad6df7b77e018b6fe9c40a7cd

SHA512
0051edc47e3e2f762e8ec6f43b2fa208614760df24359d8f6e424d13683dddd8590ac8476ebdf9c7848a3713349fcd44d964600c34a60508aae252de16d35a58

Download Submit
C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui

Filesize
11KB

MD5
8cd90f907b73ddfc6980c258e96b0ecb

SHA1
f0b0b63faa4e8e3d93316a95315ab4949cecd326

SHA256
811fd4687bcea64417c578a5b0d23f3ada0af36606da5ce514bd93f8ad72fc36

SHA512
e3bd60a3b93ebc838564f90ce3b266239206de75a21e8bb575f64cb1746c302de346532824453fd1bb45acb99108587715334ef20981084995f8ddcf3bebfa62

Download Submit
C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui

Filesize
8KB

MD5
2a2f978afacbfcf65536de0ef7038093

SHA1
082fe3f06d3dfa891adfc0301bf7cbeb9d7bcec8

SHA256
0133a5c10c1ac59073530e0a54fb85a8431fe82428cc0c78a57c4afbb31ea6f6

SHA512
8300c35af47c74168242ff77aa08d3e151b1faa00f5b69f536f215cb83bad632a344b347122f7c7e527fe04fcf8d1a0fa6c055beccf2c47f154dc292b8a38d67

Download Submit
C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui

Filesize
12KB

MD5
da77dc6d34460910f134ff9958519900

SHA1
0de280bba0c434d2e1cf5a7c9c78b77434d9b798

SHA256
84bf76b5c3850a297d4b40c6d90126f568f70b02b75836dfd8bf6ed1db564dad

SHA512
e1e78e0dcab29207e95aa245ad0f275b1f96aa10d63f9d309358371a77af5783202d92884ba94d9a2b599a47de82e9b2e69de46e03c4e1433f9f9f303ca51b9c

Download Submit
C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui

Filesize
9KB

MD5
88b7cc3f5e832abbfa493430ebc7a4ef

SHA1
41e841a7fe0ec6e687fddc877f5b2e5265555209

SHA256
251d750e4e2a677476defdcbf6723ebcd80ad4ff403e7f82a4551149683d7db3

SHA512
40b1c77b265a8140f3c094da949a02e5786800b600bbbb5471196c680ec6e6b26de4e44ab0fae2ad860a107163d3849760f920859185e8c77ab3cc688bbd0d75

Download Submit
C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui

Filesize
11KB

MD5
92c80d3a79851ca224d9105c1f175f19

SHA1
51870032c51c4523b233555891db7e18d239fa93

SHA256
aa43a4c036b493ba8ada9ad07b6f0809fdd118b6d707c601682315a874481b92

SHA512
66cc87aa6db479712d8532076a56702eb16b195233312b47e4456d308a361404ad90cbdd08fc281c6983284a4001a92cdcb1d47a0b3f4651c98a3bb3cd2b6ec2

Download Submit
C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui

Filesize
9KB

MD5
3bee3ee71d01cf883b9c5a69cbaf6ad5

SHA1
528da9dc7db09172634eaac1aea3f702154a1117

SHA256
54cc205a72d921a9694f1463644e5cb7052043c021b9f708cf9b5b5d779b3fa0

SHA512
58287634ea9b742e88bff96631d392eca95dbb88635388114d316c3c46a4e471d88a0e77d7cc63b4ef697d8561140875a28deda0c0d58ba9032b5f4c5cc5b8e2

Download Submit
C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui

Filesize
6KB

MD5
74ff59348441b2c9b48b5377f0288bf9

SHA1
ccd5938038cd09c6fc4cd14ab87b2cd962b09dde

SHA256
b5c4bcf9d6a8b554c6fedc26e3cd84ebb1b76f703645342334de0a3fc8b223d6

SHA512
5e8b073975ca9de13846820206426a8a4f6f7de7a443824b2a58c10518264a7b784adc4590a9b14272a995bbbb1ff4eb5ad95c8bff982bb6606c9fb777c707a1

Download Submit
C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui

Filesize
6KB

MD5
96bf7d33620c4108f698c918f29bbd71

SHA1
d9f2ecdb7652048c63d643f24c14f532d25e0aee

SHA256
b7f7a3684e2b16ace989dd49da9682ec63f144358829ced5d63d31c179dc8bdf

SHA512
ac39d420114fd39d25855b4996758846b96e48405310f87752ecb197e1ab7156abb3fd337b605821b767b94a364bee29732ae715c5884243226aeb918199377d

Download Submit
C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui

Filesize
94KB

MD5
628ec5d8aa8e147b7981e153d917067e

SHA1
e3d73380a8e575925ba6dd760f8f61b1c6b1b85f

SHA256
6194411cdc4fd4c682d4f2879145812d015628429cf2903534b679e138949719

SHA512
d36f5402cf42e4d658a64e4f383594c90974ad4d9f3e204969a645d7849ad8ca4204d28a577d01ffe4f668da216f84de694b076be1d313b1bed80524b433a259

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui

Filesize
5KB

MD5
ea5102899f0fc2016f91730b026182c8

SHA1
e8ca939b9dde4da8e03dccb95e820cfc863523ad

SHA256
01e084c2fe38dfabfec7430983eaa6a33ff726492f7e7698a7fd306498477a53

SHA512
b0e90cedb6d3088ba8ad06905c83b9df5b4160bd0e4bb44c90c2c9668e76eb40d3dc87cb32b0d7eca7d4f898b2ebed9d12ebc592ad3b6e87e0010f6fe0989722

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui

Filesize
27KB

MD5
efd209a80b86ace7d3e4b15585ff81c9

SHA1
bc48ecb33db7f4c290a862a4f3d2a6571bb2fc04

SHA256
0806709195d4f74b443ae8db60548fead162e0c068befa88ad0ce1446fe8ae3c

SHA512
f0d1d3bc83152a9f0adefa9bb983e4887d2260ed0766a808bd6afe673d21d0c763ae03b66fc7487b8992755929f0b5361cd337c98317b4a690b967f9d67f47fd

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui

Filesize
3KB

MD5
f72f06b203907f610a82897733451035

SHA1
598c1ec93d834eee9f3be4d84503464c8b2ca6ec

SHA256
e0228646b0345c927849cb4e151a608436832edd10a38a4d58c5269ba0fb3314

SHA512
6755b66efdf699e1f04e48b7784c50623bf88b7ee56f5fe8da5d4516208d88d544f8ee879d0286c9ddbd4e6a88387c5ac84ea2b2f9d87eacfa2f2df03020ea2e

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui

Filesize
3KB

MD5
b1bca1da7b3eed1acd48773a64e0bce0

SHA1
7bb9f2cf796efeddfea1e75482831fd6491b1cb8

SHA256
f62316231239c61dd3d2c4b9f6be97c08969b9599f2cf572922d15c502360bb1

SHA512
fc9a2e67a2da71fe5bf0e505fe4110dfee1ecb3405e79b1ecbd4327a9f667faa4d571b813a9770fe432364b27aa90e8db42bd4df235fd8cab977b95b2e7cad50

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui

Filesize
5KB

MD5
529a522a2c300ad057b6a1b93a13d3b4

SHA1
d646bf99769259f7b00f5dc32e91754afd844f42

SHA256
401222704db0827249c889617cbf9059105ada2dbc75bb96e28b05b4fd29aba2

SHA512
dcaaa251412d30c3e8f550c471be12dfa90dea633728eb81a5ab0ca69dba34cb80c86aabb2932d10d48f827e2e408c8768fb1b036aac9658625a99c09293eb46

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui

Filesize
24KB

MD5
86a7344d372e3a998d895084443010de

SHA1
a156819a80b9e1a7c59355cbbb74e1408558aa23

SHA256
ff375114cc27369c4e7b389199125144f7a53bec2a5d3f87bcbc691d460ce234

SHA512
b3375a8488434c4e33b31dd165be17f9fd2b466ffce249ca07ed2685e7bbf9a31be66611214a085013da18b9623bcb1aabc830be0aeb27cd73ed1a4b9e6f710f

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui

Filesize
3KB

MD5
028af166626aab964d6c2739c6add118

SHA1
81b76aa3d9261c54be47d4f2e3dfe96276737609

SHA256
7a54ed29626df432e4561b6b8e0f3d49931de1575163a9e2f60f83f3a6a766d3

SHA512
a4ce5effaa45ec9472e01f6c0658d68624dd678daf62f325d055127c8f27401f2aae6fb3852fb52e78546530e16502db7b8c5d33221c6d1e9b6e93bed9e9123c

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui

Filesize
9KB

MD5
3cf9107b75be144f9a8a5fd691710aaa

SHA1
a4cebba4b8101ca4fe9e3902dccb06f3043c78b2

SHA256
35f913b91c32ae8c109761622fd0842f5cd85cf10682ff7c30adea4d73557c79

SHA512
90ce9e9cb5b5389b102ef8b31a130abf400ba2b9c23945a395241ab249edd0c994b1f98e52ed08b065cb0d044c94f4a4a1c913cb78286ad571b337015eab5e22

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui

Filesize
3KB

MD5
0e368698fc3fb9dd33b300bc0bb578e9

SHA1
f44e8a122e003a54385a71141b01588ff50eaa0c

SHA256
0727951232d82e30a83c2c451a9ef7aaa499c4196dd1604304c93db84906e30f

SHA512
d2d58a8f87970afdd3e5832b5704088ade6c3a9d9b8385b66af251ddf7ba788d0c6964805163ccc4b6ce2b0cbe04f7b46170185d9f9055cf949625a805cf8101

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui

Filesize
5KB

MD5
774485926228c78463b303e65de473dd

SHA1
0aa3410958a855e8ebdcd830ec0cab10c886b07f

SHA256
3c262572e8a7b8f1f7e67b28ec617a366df56ae11bad8f9dfadd6aa3c5ae9bf3

SHA512
91c58263cf7b063dec6464cb6c48621c1ad5b6bc1db3b89f34465d7a08f47f77db4698e93fa39f447e7aafd8af2d6f69024a36219f99db869e5b2ac9b07496ae

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui

Filesize
27KB

MD5
b255fa9cd7c77e94e5adc63c6b49ee18

SHA1
b625ab1df458f04c9e94e30479107bfbc2335c82

SHA256
6cabf3b59ec764b87bc77f4d62a0deaf0f8e41f11fbb42f8a59a4d19503cb244

SHA512
4917acefabe673adf7e1d5ddc17749ea27079dd95f88e2a44f4126d74dc1f2ce5f3d677b607672fdadc97f072085e90ed189dac24972a45106428aca5a548fbf

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui

Filesize
3KB

MD5
9541842ba21f15f90b9c67805cee80e4

SHA1
6e720e1e336347c148a53442dab307253929cf64

SHA256
e8721797501536b188989782012d144ee2409cac76ee1b0416a85e73305f1699

SHA512
a5d8424e7c448cf9b3627816fae7bc3c552e2302c4d34e6b8c177fb04423798c702aa8eb0a6060a771bac3eba9521188c842e456f95005d766f8a2e4bf29a57c

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui

Filesize
3KB

MD5
66ceaef950e05b9357079d51d1b74174

SHA1
9889915194209230def935ee549c077be70ca00a

SHA256
864d5ab894fc995cdec90c23e8ec480d3cafb09cd16701bc00de48aea3ee1349

SHA512
68fa384eb71ad58aa3344de9e4d5dd0bad88521fcbf14b05c0cdc1f7676bc95d5ebe3c1cd8d867114d5a7688b79fe255d3aa5b2cbb85306f7a0428ae886394b7

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui

Filesize
5KB

MD5
a338f9f53f48dcbe4f85809b036882d1

SHA1
22b8e483d1050a9d773d9aac9efb2e946ccfa15c

SHA256
b274a66c5bdf129a3ed51d8e44235a0769bc0715e27b5205149c09cb990cbefb

SHA512
0fcb5de64eca1ddbb9ff9cdda7b73bc50bd2cd1e895dafa1d6b6c5bee2e5ff6abfc69027fa4ad30868b63b632a897d8f841f373e3b5bcc129d137928828f52a5

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui

Filesize
27KB

MD5
8c0cf4a27a88905e3a684aa0cb5a3a9c

SHA1
695d636d3d2dd03cecbe2df09332245b361efea2

SHA256
d2f38dcdf77080a50508e15990bfdb08956076a32e9e3c9d895b9590227741de

SHA512
aacb58e68ef26c370ca8be1f1571884d69e7a5f4e0127efe807a8572f94a236287286f901b09d1162261ee750625971860925a55c8b5aa879099b1b6502e53ab

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui

Filesize
3KB

MD5
4119e699720695a7bf57e778a2e0ba40

SHA1
2d86aa81aeff62f8772cedf02218e6e4de1a1c0b

SHA256
355830853bc83939782dbd9ca0762efc24a11d312c2a4a48f342d613ed152719

SHA512
1364e01c30d370bca6d2fb0c66881d2ffa5a13206e8de0a8278b999a15dbfaa2a5c5d8a4ca68d2506db201537250a324e9613da3922b7af7d54ddba0bead0859

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui

Filesize
3KB

MD5
11570063ea7c091719b8e0665d8c4929

SHA1
fa3905c77ca9894dcd41427db3792aa3180985fe

SHA256
541deae7030f3069bca73cfa770bcf183677e3f43aa7b02b990e3a22c8d40f8a

SHA512
3cb63d562535fba5a63fc3f2ffe4d73b04ba102cffa4bca86104103d3414df9a33708dd250e0fac75e56560dcc2a72113be7e074766580337cb125cbadf1a797

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui

Filesize
5KB

MD5
89d9d637f422aa6d34336f1d11f384de

SHA1
5e6ff074b4b1872a3f19adfb3f51a477aedb3665

SHA256
bcaa6c520a8737544427ee8a147c21a702281f029da5074fab160d1574e8b00b

SHA512
3ecca02e1043fbc377d7817e5cc3a34d02966fc4a0b53ac24367cc5a4e2d0e731c67e2d3c44bde0381debb5aa1936c5a579a8b8725fb33fd3efeaec7472e7be2

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui

Filesize
27KB

MD5
6b9423c5355d2fdb8862b0231acc5d13

SHA1
b79f31505a726ee2ed6be3fade34ad48ca88e9ee

SHA256
57333960f87e1631b728d0d0b05f723c1bf8697f80ab45adee4aa4df1ebb0ec4

SHA512
8eb13785e00c54ae2ef4e67e5cb1f927a4e562ab0c549859b9bb159e65db1d4934a6be0c9dd6203c0dfd11574958300307ac99a986ec6baa0cda67f13723b527

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui

Filesize
3KB

MD5
390c106f7be9b4ca9233707c34b38f71

SHA1
9d2fd0e20d475b298f934eecf69db90390a7e4d1

SHA256
6f02caafd3270da777e57e29600eb4b0792d4d8e8cde7384d7a6df836ec2c766

SHA512
3198a574e02d05346c87bc691be5345ef2f05c1b099f23022dd15d9a5b924908288aacb8cc0759e23ad28aa5dbd2a87820eeb8a3c61e88784ea33d48463a2025

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui

Filesize
3KB

MD5
4f8bd330dfb81e2da10cca3cc71fd2d3

SHA1
f1047b66c254fdf6236dc47191675cc5060d773e

SHA256
a206d1e0f0df5ba4d51e1b7043fe97c54211adec097a2c1a142d42f081dfd9fe

SHA512
14e77c7b4327641581e1efc425d27cfe3f427f0bc0529a39bffc2e004206f46d68863c569f7864c33048f8856a79f0401d05c329cbdd116a64ebe95ed944b39d

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui

Filesize
4KB

MD5
c901b4e1bfd2757be3bbae49eadda565

SHA1
1680ddaaecc4cceb1c73eab9504f73ac79a67e60

SHA256
dd1b519457a0b14d5bef55bd806c777b4826c5a90fcc0a06811c79999e5a5b6d

SHA512
732e7fdcc2b1b842b8ae7c5e0c49890900e8beb89bf0bf1a8a412141425c95dff2d3d81e42f6daad8330072c57900bc7589dee98cced32de34e3d65135c1312d

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui

Filesize
16KB

MD5
f230ec246871f440748fd0d163d9ef08

SHA1
fa81da6eab03d56cfcb2ddd4c1019788d3543fb7

SHA256
32142ddc6c0ff9ba4997792ede1fb7a363ce6808e7f9b82c72efe9854f696616

SHA512
244c4d9015ffe052ace580f01135f6ea9702e08ef346d2b75a32440dbf2fe34f2eea45402059f9dab6b03291f74570d0f20d57339ea4f12e51e3b732f90c2b0b

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui

Filesize
3KB

MD5
92b24a8fc93bccb3884a667adc4f314a

SHA1
e6a25b434023185887383606682d1fc5a3c312c6

SHA256
74e2e2133ef3e80ef1bad4378ee6eb6c7f2354a1727a9f3f0e5340bb30509f72

SHA512
1a8f3f511520645b5b647635c6faa4630df9c35526799976104ccd2812877ab4a74c40c02ed0e304700a233d042cbf47350a78b6047dda2cee59692d73d62f37

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui

Filesize
3KB

MD5
196f576efb9dbb334e91f1b013caf0d1

SHA1
44f414abf68c85a307d7d5acd9d2977ceba79f5c

SHA256
075320a588bb839f24d13c00bbc1243e7a9826d9284383c0ea2c823469504a98

SHA512
86b29de048d2f444a2d6577ee2404777f536a19ebfabff8035525a36ec379a7a23901bdb57620387784c83d0fd4ad4e3f48aa552a53a14725854e5bc94312e67

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui

Filesize
26KB

MD5
9dd5dee01078966e28cfd81cbe848a00

SHA1
97ac25f40e6be826912e7afafade28df26083237

SHA256
1c99fc5a31a1751b9397ff215ac3cc26e93772626bd381ba637983cd671ce82e

SHA512
dd50aedb120d15b180cf1ee02b84f6c3eef0474d25684c8a86f0572b6261dda6626d08cd798214d7003dd18dccc7c3eb67ea12af88e38f376c43e208dc175042

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui

Filesize
3KB

MD5
9aa3697f48fbf87e5744ad152d9ac4cf

SHA1
d677ed6d292fcec7f0e19acf5d1c25aa162ba0d4

SHA256
b79caed25256b4933253775557bb184cb917b97fb08162dcb57f9a32189dcad0

SHA512
f0ef3ecf791a6035d828c4fa33dc9de8bc7e91cfd76cb96d81af285d467b398d9e1a862cfb6aca3a43f1512ff30cf4b0daf531d7efcf3b4cb8410a522211568b

Download Submit
C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui

Filesize
6KB

MD5
f1c20425e780517762e214aadd3c1967

SHA1
21925725df2ea323e7f28514be67d1d4da8ca845

SHA256
258f9af248b247165cfb4f5ff60ef22737fbec9d3ad443039d6e393cf53aff88

SHA512
9e9a0f4e558aaff2670ac0aa74be7929cc56c7970bcffd5844a0b8908bb0a660e5a36392d71e5957827b3412770b78e1101e7b3fb3d08297f7ff8e3ec936ff80

Download Submit
C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui

Filesize
5KB

MD5
b38503754284524df1161222c8f7a65b

SHA1
95d7fb90a61c4e701637fc8ea9fed0b592871fe1

SHA256
c8a94665ac26f4c175d66c3b376791b22d115562e0ccbce1c99f7bf313ab279f

SHA512
64372b61c4e8d1829641805f9d48168488d9a1c59742b8e7775315024da3a520c576c4193c69afd23484b40e5712a1878060e55e9a59b2fea68c4709c89b8563

Download Submit
C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui

Filesize
6KB

MD5
eab3f0bb75ef620727c55fe39a07e299

SHA1
cbe7782cfa7abfe6e6fe537f4dece78b3cd4a7d9

SHA256
6b2e309fcae2c45583d7e2e99c0463e95c191339c17bc8a3c4d7070a2b353a87

SHA512
c439fc7a7e933816244586c2b2593530bf4ad2348a450612d514e6dd1929f9eba85b063501f800ec6ddaef9f4c31ad8f4b97c202da0a495f6fa03827479d82a8

Download Submit
C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui

Filesize
6KB

MD5
0affc9c1289390688f624f4e3f5e2658

SHA1
4e20f31932677cf91b70d3fdcae966f4a2b0a0cd

SHA256
c4013b607713b4d190c0e2034a33312a0002e4115062b17c7ff7d89520d5b877

SHA512
ecc5a1ff2ddfc9679e8a4d2bc2d8e04907af334f22ff3ade22dd6105b7d0a9f32d85d701362c9413eaa80fd77188163c636613d27f47aa32233bc80d889e5f15

Download Submit
C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui

Filesize
6KB

MD5
70e1e5da3fba28ed85dd8c5a04c1af27

SHA1
f410aaaf14afd6836276f8cecafe2db13d865e48

SHA256
6558facfbeb4844d132faa83b035365fdcf49a32d294a26a6600e0e01faeaa1c

SHA512
fe261b372b266fa0894ea75302e3edf501b3cd11f5a007fd7bcd2267b9e5ee9825e3fb9be40d593afe1c8cb37b4a2f7e35af2f3e86c4f651bf2b64714b971639

Download Submit
C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui

Filesize
5KB

MD5
72ee69274388c46c3b0001a5876f65ba

SHA1
bdc4cedaf5ef2d483b1f0349e15cb4f2a3274fc4

SHA256
ec4d9e9eb6004cee951df35aab68080c478871718d9276c050adcfbecd67a60f

SHA512
4a10ed4dd636df7716e8e55bfbf8004b6bfc10c8942bd9cf7f40dd4cce86264350f2a96e170c1e5f62aba4591cefe84d31e61b047e02fb17b7e0dc24d6ad954c

Download Submit
C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui

Filesize
6KB

MD5
1da52c3bb8cd98569ba78e450d8cc416

SHA1
8cd4e72f7a278ad9930870cd97a3423e9b139374

SHA256
eb28545f498d97e7e78a30d0c9ef8bd931449178b48d63ee85caefa5dd493093

SHA512
72c75a379d443b060a7c328dc3e57a9c94fea4a8dd90675132a1240700d49ae59c68d6af184436ccae65c2dcd2b10deaacd45c3dfe1501df60e6e0a81bd75901

Download Submit
C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui

Filesize
2KB

MD5
78d328b3c10da59008d306489f628319

SHA1
525b5bb311aa3cdd6d9373715d310483d420e88c

SHA256
9fe27b2375fe8886ed6835e1eff5204333442cd03b435614c477c12569455d25

SHA512
a7f9f713f17437d972abb9171321fa52e50d2c2246216abc6a9b71696a043ba6d74a25e7d0e3d5c86480a52a622edf45cafe6d2557983504713c0f932528421c

Download Submit
C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui

Filesize
60KB

MD5
ecd7df3dc25eda86b9c8fbb8eaec6c31

SHA1
046985d820088109923092ff17273a8d4b084593

SHA256
ebf077716ffe785442ce6b5faa1420dd554bb1f0e6a145299718f8f438964871

SHA512
b7d638bdc7fa0eb674a2c7cb15e53f19ca0e344cdab0b25bb4f87cd5ff86e87be00d0a76e2fa706157540e516b190bfbb74d15588c3b2f6d6cd79160354af361

Download Submit
C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui

Filesize
3KB

MD5
156e8ea6ecba7a0ae75627b4a0182d2a

SHA1
e7a0a6a50c81df1d0272cd8a52217e6e9b185697

SHA256
1cd64a2c662c258a69e72aee6d8f4725dcc43fd4f6cf720a3683b34915fbe29b

SHA512
687b079f7d1aca2659361423a2fbee9289bdbf2f550ad8b42b8d7903c57f8c49ed396eca459a6c5690b572f7d95a63140c287068759ec95cb2316ec4eddec338

Download Submit
C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui

Filesize
58KB

MD5
f3aef34c788e0756347d8dd1f72d56b4

SHA1
0e19983a66ff6828ecd23541bf2582a5f2416a1f

SHA256
0763d7ac11d9b243b9c1eb2036e47664ff49a70d38827291cb802b37555d8374

SHA512
539871658174ac89349d930d76763207d93ebcd4f9f45d6f23a025121e22a20734da6c778b8e0d5484cf570703f79a9be70272faaf1ee8bef3fa806c113d770d

Download Submit
C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui

Filesize
3KB

MD5
ecb0a4084b5d318f3151ba00294d9579

SHA1
5736de3c8f62d0981a893b685a39635a2a5c6a60

SHA256
c3294ebee9364ba83254d21b8db631af211285fddc24b653deede4584f927e7f

SHA512
f6279407983874427a9525648b962eb7057c2a28deecabd0f98de886567cea1724c8acb3bbe68eeb7f52e032a6a19020b9aac95cf43ea0de5d013ac4b66f2996

Download Submit
C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui

Filesize
61KB

MD5
73d6f4f0234574727364248cdfcbdf61

SHA1
0fe2ccd3a0ebe177b909879463eec71d6610b59c

SHA256
e665c301ed8439299f5e0b16dfc9f189f049c4c6eb34019d133087334b2433e6

SHA512
e12840e8ac72b4a6c2905aabe099c0d84b147d7b047d04d28b0c0e9cc4f05c7eabf8c81cd4532490b2668b8c911b32d2e8ec107f6ea2cc24b3ffa0a0b75e023a

Download Submit
C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui

Filesize
2KB

MD5
51bea6b2a0581cd8408005fb7c54eb3b

SHA1
8a192de6da667990572c86f2b49cd6129a567ec2

SHA256
06e2eb708a4aefdc9367796622e0d207b0f9ef5dcc745a882e469718eebc7162

SHA512
45d7a1592c385fdf289408b5326eea6fd25d060161aae7f35fa5eab25c34c2ded3071d6fcfff367f113b70da88fa5a9d8aaa8cb97356c8ee46ca76545043ec27

Download Submit
C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui

Filesize
57KB

MD5
53d6194b05d2511f2f0ffb24769bcd87

SHA1
c39f34e4a536a8b4fb2364ff0355c0a67b347f87

SHA256
16e046a7ee2d91b287bea233481899e499d41f1ca9df57e70258ed4124e3ec10

SHA512
813122c6d924a89493d88893233a6bbc6931241f1a6ffcc7e5e5960d256e355c9b34939f80d010c951ed1c57eb77b8336cb778a2b350af9b22243541a6cff6b2

Download Submit
C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui

Filesize
2KB

MD5
a5aac53dac0c368f58f849d35332b7cb

SHA1
791cdb71bb8338574ce5d977966500ced1650d12

SHA256
dee35b192096034930e83495bc0e8038c9771841386dc8ec3236306cfe5da26b

SHA512
aaaa2b34839119443dcc60317887cb5093923a8344497ab9ebc72ecde2762a0b363adb62d07b0fbe0900c4346532d6ff2a7b9399fafbbd62535df338740bcebf

Download Submit
C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui

Filesize
31KB

MD5
20b9480b6002541469ee82de23af1ec8

SHA1
fdbe373f14dc3839c1e7e733def8a0aa47cd1fcf

SHA256
6d7d65e8fbe2a17813b56be1bba9672453bd275d6a20036c633869b7f70d2135

SHA512
72c5fe107027016432ddd1875b0534713042f2795b4d2f6e47163651916030d86412c5577c9eded92650d040dcdf13fc878bbabdf900f5843bbea90ef0c2a677

Download Submit
C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui

Filesize
3KB

MD5
229770db8da2be5cd06755cbbecfce29

SHA1
9acb62c33687c4eb469283b47611e3b85bbcca8b

SHA256
c9bb9fa9d7ce1df01d75249a8de2a83894ad40ca9c9b22f103fee6b8721ed780

SHA512
d245217c6a69e293dea71ba76a7de6e51e8fb9a3a138c7e02daaef4382232cac877a1020fe24366ad7bcec638d0956b87fa05dcdf3d0fefc93cb9e8e2742cfc2

Download Submit
C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui

Filesize
56KB

MD5
fa0fb5692dcc51514e00eb3645bb2675

SHA1
252eb910b091743abf0d0c4420f8028716b978a5

SHA256
97724b669c000112f85af5fc43137b0641e38b0e939789b71b0d2f6af71e3c19

SHA512
d41e0514cdc799cdad05dedcf40fbb74812f800d4c63c6cd3f1fc39d10c3ca9d2f9063ab4191a1d8353088ef1c8fa92389fe8b7c04c9bcb15718781541c0572f

Download Submit
C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
c4e18c9683e64c29aee51a5fc04698ec

SHA1
c63857c75920da92b0755735231003779bf5929a

SHA256
26be84bc8e229bd51420ff3c41e401fcba8c9868dcaed4d3a380fc55a15c04d7

SHA512
e240356678e74e5b1814c5d9cfaa52252fa47438a9d545e2d85c01666a2745792ebfa505328271388e9acaafd609071738cec0e718d17b0a6b4addd1739806cd

Download Submit
C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui

Filesize
3KB

MD5
0f615c16e71ccaa5e8d891c7a08b17d7

SHA1
8d2f309f24e0a34a2d8ae768c048c2a33b37b0a3

SHA256
aab521fa602dd64e936968a339e66562b03646f551a5ec8d2f5c773946b7185f

SHA512
c526e11aa4f62e48be621e112b4d3f062e595365c025598444a560b6dfe441e885bb8ac2beb73127862e3eeca43a5d1963060f6f839aaa7c35aa974f1f8c6488

Download Submit
C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui

Filesize
61KB

MD5
014d7ff2dd9ca58a1488583e08968947

SHA1
074ba4874bb1d8b963a0e18c6c940a0e7dca89e4

SHA256
31db580f0025400c2f7a07b9612dbf4fbb31946a70401ce502edc40d0bb57942

SHA512
238df6fca58aeb6dc941cdd9baa516812b4d4ea72210358fc0355def7d1e1a118f777c52d5638b11b55fda78ef106273e25247cb925105d18df895c0bfe43c8e

Download Submit
C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui

Filesize
2KB

MD5
619018c4a3fca107fbbccfe213f2f253

SHA1
a8163131d2d0346246b84820e7f33ae11314c8c7

SHA256
5055890dd7b93deb5c2d1c3a72a26f4c504e34d356c9460648c7f03b11b2047d

SHA512
58e89b04cea93a7a722fcfce9e72e3580cb9938d2c67eadb578ec65ffbb4de88c18949e95fee9ae50ec4293677776ecab6acc9198d0787a4eb42c76c8ab02bd0

Download Submit
C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui

Filesize
3KB

MD5
ca587bd9400093860eb2803ba023f004

SHA1
fd775e987294d857af7d41b584c1c2bef48f50ce

SHA256
145f8ff1370fc795d67738282016eab1c5c1c78f45edfeced62fad185fb5d086

SHA512
2467109b0fe06b931e48f41e86d2d3a191c6e509387b82ad210b0be46054d42e925cad6eb14e0454bff4a4333aca338a228246032a10faa63953fe2f1c8ea8fc

Download Submit
C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui

Filesize
4KB

MD5
2aede787ee4cdc46a1669a06ab7c79d8

SHA1
a8a29f231b515f6d649a38d5bd01ef30ff342606

SHA256
d114e2357f8292a371e19894fc8fd61370464a08ff0c5f2fb4f4bafafc8e12ae

SHA512
96a0c297734a65c70f125ff7a21951fb006865b9904899fcbf46f74cae4a326ac0c39cd2dd4aefb27bd6e21b79ba77819a6bf127f56d1471acac8a713d8e9111

Download Submit
C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui

Filesize
3KB

MD5
b5ca3a24fca5fc94f46e77a450086d30

SHA1
bf0de52ddd01a125b757e2778c1ad0e5dbc5be67

SHA256
1a637ca9dde166fb5dda124769f01ea72c3d15227fa0b509cc634bfad26cb94b

SHA512
c05f105142b18e5eb64384ed69a522329c481e2e988464e6cea3f68d87f59dc5f5232cffd0f0547c9ee0b51e3083afee8bd6b086af052454e90908bbb148ae72

Download Submit
C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
2a6b639080df24c48d373b881db2c212

SHA1
d41d18f7b28955ce09c944a34851845fe4b09c90

SHA256
d9ca49fa2536a1745df43579772bbdb29958e6cdc9c219eb55341d0970c5de5e

SHA512
16256097625b9733eb31ddc9b1716383d004c7ac9e049c50a5334b62de7b3f1961c91df4a06628a570c470117fc9f32f12129994d9ae86b767485f62311ad43e

Download Submit
C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui

Filesize
3KB

MD5
986526f3371b774f5cbebad204e19c67

SHA1
826076eb9e710e8e4ed5a44911efbd857e940fc6

SHA256
c4012a9f8ff759a32e7c0f9ae8862e4d65ba6bcce8c5c48b85ae29db853e41e5

SHA512
930586868220fb1cba627241815d38cc4f61b803779765cfae335e922dc37a14a04c928aefcd82808fe266368e0582814a950c6eb6819e4d93b098e5537bbe23

Download Submit
C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui

Filesize
53KB

MD5
86881bf04327b3c1465e9506f6752fe4

SHA1
6bc5c9d4309f757a8a1f2d1e53b03bbbe94eca1d

SHA256
df379942c1c0c531d1d32b1caf8d5679b712f10f4ae32506d2a7cbbf0ff9172f

SHA512
92ff9b1f3e0b728c003f559a5c0bea4b54405493ebd1d562b18dc51cad3709c30839a609e3a5a6eb1b5d0afbc1125f11605220081ddca98339566bb1a90edc7e

Download Submit
C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui

Filesize
3KB

MD5
5a52888ff37f87ae96ac2bf0c115fa23

SHA1
22724b352163dbea338288527af39d36713e813d

SHA256
394502b69dd1a03611cd219eaa0e5dcd0c1ab8e548259c8bf6e3d9b83bbbaa5f

SHA512
3225108eed9699a8797dcb9e5a99a01e2701478fddb75953140b404e9a73a4409e004375eef5e19bc6aaa571d3b872fc7888e3f28b3fa5bf91ed555feea51489

Download Submit
C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui

Filesize
4KB

MD5
805a0af62312c1abdafa785f3e9de59d

SHA1
734a9041d93f05186500c904f068d503a9d0a61a

SHA256
e1d04d5345b263836321f25cfd448ec7849862a93b0a0a6f683b0fbd95135207

SHA512
29c87f5ed2050afc086fb3d05dbcfd50e46e695442ec77be6da23de5deeda90baa3b1f74e44d36225d6d9fd73b7ac8fce942f113b421e17cc0d90279113877e2

Download Submit
C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui

Filesize
3KB

MD5
fc68f701d2fc97f325fdf24d89e96d1f

SHA1
1a08814b5850a014e339176924eac0aeaae0fe58

SHA256
cd8c416e03c821cc52846521fe5d905e581d77f3d5ed873c5ab01bdb31a342ac

SHA512
5a52e65a5d675ee7dd267f9cfffcb4b11d03c12b64ad470cfb28fa36cc9e52bdce61476aa24a0d5b912efd631fdc1060817787c085124f04e9a11ccc58692929

Download Submit
C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
ae853805eaf075016579d67317b5ef8b

SHA1
ce2f519903cdc07a18ed48deb081f62fe9808113

SHA256
46a9da52c299e9fe927faf4bd4782b6656c86fb99f99163164cc8db68a8af216

SHA512
9d9f976b4e94718f6ca6ac8a9115d4897b240dccad89319cc0fcc57818dcec392de3009e25c618e43e4284359fe599f0eb33b18854825913aaeeb57d9945bc5d

Download Submit
C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui

Filesize
3KB

MD5
0de4cd978af10bef373ac6d38878529d

SHA1
cbf5d4e38da508fe6fec17208d8f431814ea413d

SHA256
072b1a2b357fbba10e6a4d79afc623649eec855da6c785dde7c0a4a391c48e65

SHA512
0ccf21a782c1340f22b5e9d3f321409e2594379c383f29d017f66eb37d2f17fa9d46f946ef97592ecbb0d68b25d57b02c2452923a3d5c5f2c40a52f952ef521e

Download Submit
C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui

Filesize
62KB

MD5
3575d9bc591ffab4b5e616ce60d2d4fb

SHA1
4e897830de900fa292cdc1fb7c2944fb426bc87b

SHA256
1ef2ee52e0030f5021d818fac27694fc2d5d55368a78b97df98fb593e42664bb

SHA512
cbfff24e3432f9e3eab1e7a73e602c1f5faa18a88372836d4faa897ff56efd4ddea5f30d8c95b16a6bff07a152ddf9eed95b05cf8a32edb64d707a97691462c2

Download Submit
C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui

Filesize
2KB

MD5
6eec5ca1051964ac42a96f80ae323d43

SHA1
e6d804cb12229d21d30fd7ad58da259ec1547396

SHA256
7a0d808c059906d0501ffcca4d40f87a94562801133fe8518186c579c3de924c

SHA512
4c7f60a3eac95ca9737081dab4258d34775bdc3919d8373f4e57ed440e7e0286a5b4e69aeded91c7859dc7f90e20a0825156836563a5ef33ac0551c5a1a3d1c6

Download Submit
C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui

Filesize
3KB

MD5
b6c6b51c88fe68a85349283636dd40ef

SHA1
0ab9560129007c66bd894d291f2691f50aa3fa62

SHA256
5339e9c49badd8d5593f928c0438a9ac39b7b8efb4c418c7980dadb2e05c68a3

SHA512
561ef8df1a9b12ef2d62749d980b7782cb1ca1845af71e5753623cda6c46640b5949d2bc9ae9765da13aeb941a064d0005b4805e682172dd50502f1cccdaaa60

Download Submit
C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui

Filesize
4KB

MD5
9277d351c1f220f0000fc1cfbdba0aa6

SHA1
0fbea2b44fc2fbd7e21f12d9698cf48cd1729415

SHA256
1d6f60d80bbe026e6dfb63bb2d1d4c73ac6cf1a7a65f3e04d092183ae6c1f03b

SHA512
d921bdafc4bef8dd42b90feea666999c175921c13add9d8f18946a61fce707bac99be0fedb4b4c0169f574dc22664d693d30d3a711becc2161808ea82bec5d4f

Download Submit
C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui

Filesize
3KB

MD5
7e42b7b3933465207ea3b8725b14f6f1

SHA1
c876de65d0218bfd80008592b4764e34fdcd5372

SHA256
4930800f77a81df5b345d72e8525b8c93883c69b6ed0545d6af75570f51aa277

SHA512
73e2881611b9dc684c287fc35e023b33daba4ec0d8baa49deaa4a20d0f30e91f0643ae1865de5b10893d80c22c7e9e504177478242a8dc6ff555c8a83ccfb337

Download Submit
C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
3dc10b8d7c69894dd23a8a479f99d7de

SHA1
d98b18a47d7747fc013bd5f2c5611d6f65e461e7

SHA256
4eaf3ebb08919913ac957ab6ea2a11343f4a9b82d672460002d69b78eb51beae

SHA512
8ff1fa01c6d7e4a72f9b9df5bd4e6c0252631fba9bac601575d7ed07acd6946ead714a92dd03bfecc83414a7794f3cf2e54770780f93a749473c06cc8c6221fa

Download Submit
C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui

Filesize
3KB

MD5
54bae5c13149aa415b0694fb506a1734

SHA1
9a5145f1620ca6a935d3a3b0bfe9a3cf3ac19932

SHA256
76e53bc474c2b8377d2a06b9ce03f105fdc89f05fc8fc856f6197d628df83853

SHA512
c9783f939b5d31744128f6edd4f44fd3fde4e4e88a19eb1fc967629c26b4b7623a86b0088d9a8eec123c781958ce0c545b2645ec7e8259366ab9d8ab258f5317

Download Submit
C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui

Filesize
63KB

MD5
d7cb599e75ad857222efa68c6066907c

SHA1
38099f308ea155b731ade2faef7d57b5345d53cb

SHA256
8a5e252c1139301bbe7b0d4ef2e4518662d73e584313b892b1bea079bd5bcadc

SHA512
fa6b3c5d216dcbb81714db5ec2110296666377d54b46a4e656ca06fcaecd4dfa0e1407190ce9c8624ae6399d3996b95781a050780acf9d3a0691677f33045d12

Download Submit
C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui

Filesize
2KB

MD5
da83031d48767efbfb0f60dd95ffd0ce

SHA1
fe9b34c27796c8c5f9b1f637fa2abfd441a8087e

SHA256
1d2a26deec5225e920f0f6da68cab1ae4a4ec6dac5f95fcdbbcf0bc623dbba1b

SHA512
9de3e3c4e2b318a14dc08bae6d8c29798a92433f02c22c5c9b020d27109fab3043b22ef7b6d10d373912f6ca244563f9ed40f76449567128a5d623024d7f6bd4

Download Submit
C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui

Filesize
3KB

MD5
c0e25b966fef2d83b6cc4cd678711938

SHA1
73658efd0f69087ec42a3bba9ec17bcdf0d23ef1

SHA256
c7edee421cd984e6b29d5c0017c1ebf27551cf0adc98343fb3f303806c38a186

SHA512
e035b6c60824f7ca9b69bd99058161a03e937563cfc132bae9f416378777b07bbd061b59a5d11109bc6ba9617b58e72f4a71a88fd9ffdf6073b49f90145bab51

Download Submit
C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui

Filesize
4KB

MD5
472b4c4b8695adb13f6da2a79f35bce4

SHA1
20ae5b2fb9e62a21ea4cb536c1e5564b834bade8

SHA256
9c64b31c9c4ecd39c65400835f9804215fe000be82f67d1a635db48595a367bc

SHA512
b8844c0cf1e86fde7a9f3fac5f439824517fec545c83d4700624c1ccb26beea0951db39f45df472457f89a59fd121605f05c9d1c1a3991dfd5a19ebcbdda26da

Download Submit
C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui

Filesize
3KB

MD5
c4f5647ffc77ffce9d75df347970e83e

SHA1
95b827d412a8c74821c792b2193c915fa5414318

SHA256
94a83f17891b606150d02f26426cae32238e2b69262edb6f4f007d52a86e425f

SHA512
8d95bcd52e2dd2089109daa43131ebc3ff0e6461d90978807ea61d863bbd5d775ed5fcad4d011a8e6d9ac8d44803058cb4ce89ef55218b78cf438c149970b793

Download Submit
C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
4af86361d5ac3094e8858b1af451dbec

SHA1
debcab27e6873e122bc62347c8adb4ee20430214

SHA256
d0802c3a7ceeb9f23b70fd62411332a64bd50676db2eccac046014df7b5e9856

SHA512
8e0e74d2215e4f350b9c1fb361faae90e95ef0df3533ef91bc97c5bf58b88bd110e0220f2f3fc151c9cafd83229fd43e82032796e63ea44f52802ea7964a305b

Download Submit
C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui

Filesize
3KB

MD5
fbd208fc9b6f22d2c47474e7cc86309b

SHA1
ffed49b451012cc9659e07bb8e4f93fc4bed79c3

SHA256
a95d6d011482208d037c118e48167ba4599d6e40b0a97cff8e4ceea0c08d6030

SHA512
2395c03036498fd5872d238599abb6772c62687c1ffd7c26912d223fc46d463fb6f62d3e14882f8e985d19f4b8239fe47b9b8f01b632306a59157cc3198656d8

Download Submit
C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui

Filesize
61KB

MD5
f0bef17ad4179fe555d0f5f1d1f63eee

SHA1
8bde96ca3bb3b13149cc48ea3f3655cfc71a295d

SHA256
42f02b0956f9af0276e7077e01508715d9973993effff1bd53152118a123c058

SHA512
7c75aea3ff82525aaadf0f991ba3caa7ec305a4caed91e21afb78e41c91e9a0f1c22b9a95d76fbd3fd97c34affbe5100770aaeec0fbb0038cb2fd2ccb463fd8d

Download Submit
C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui

Filesize
2KB

MD5
06639ea6b51868609f427b59048b0a61

SHA1
f9b91894a25a6b0bd7b554bd4b46aac06c59bae5

SHA256
40d7a76a2080aebf3e15f1040fa5a3b509f8d716fee08540c4d58a7ea58b5878

SHA512
5de9d27ec23bab73b45133561e47f1a6e529dad0134b7f2e70560a8d7085b4013d82e0cbd88077b03bc2e259eb245c6267caaaefdbb43794e4e96ad4398907be

Download Submit
C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui

Filesize
3KB

MD5
7f3927cb613f4a95711eb42ec7bb4c6b

SHA1
ec875ba2cd186c949a58b748f383eeeb931f329c

SHA256
a519de56e90f3bdd8d1b7412f5e2645e2434415e8f2ffbea8e9a84016e1a929c

SHA512
2b516851e2f0678366ec6965ad9b79a4fcfd025f8923f1f82d03b732d27572ee69eceaf6d1ac009b2668cc354b4cf238c1287c90f2ff02cb1116b90f61c5876a

Download Submit
C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui

Filesize
4KB

MD5
c741ece2009fab1340c705ae6d176df1

SHA1
e1835ee6cadbdc1c4c39ad43f3cd4693072ef100

SHA256
06ecbbc6f7420041ab6dd520d90b94c33d270a280a4362f1a6e5f91e23944a6b

SHA512
956a49dc5e5711475614a4b6ea937dfbb4ccae21ab958bdba5788380109e4925018ccdbb686d828ad396868721961f5ec2ee22216fe33273b6c51d4ffc8aa41a

Download Submit
C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui

Filesize
3KB

MD5
c767a0af95e14419a29d7778451b91f6

SHA1
2415448bdceed8ea5cdcca87e838b00c47c87ce8

SHA256
d953af2625ba5119723db7c26443328830e99ad969d3f5fdffb82612a0dec232

SHA512
3b45c751c45135fac60931967ee962e4381f264b2026f45979a0d1d57b861889eb8898bc18bcfad54e5b968fa7af62e6584e0643a5811f5fb52bf7f7b364ae0b

Download Submit
C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui

Filesize
3KB

MD5
f40208bfa58c05ece0c8c45f7d83ec95

SHA1
ab2fefda416946f70bc3cd6ee2dc0025c259e762

SHA256
f36a869ffb463679edc9137fcd6509355b8054fd94e0709ec53c4277449bfb47

SHA512
6c21db31bde513a20e09f47429d1dd54bb55c5c914dc7b3ae3778bbcf5a488b8a9b06186e26c46cc164337b70c6d93d9538c4f83969c853007102cace8b8c408

Download Submit
C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui

Filesize
3KB

MD5
e6b2ad87905b8745695e6b89ec829480

SHA1
70681c4e43c703c01611aa6cc685bc1b4829ed07

SHA256
0799744034f49a21a4724832748b1cd6354df97763b56970ba4f9fb010d15b0b

SHA512
06a0abbba8ed2a8fc46628bc24c21f5f8f10e914861c570b7b75695027f0f7b610f0670a744d3e9f8147d7b66fe95e136d67722f81f2ed74252cdf9080b5d005

Download Submit
C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui

Filesize
40KB

MD5
2ba4abeb6bde0dc3a0f00f5fbc72c6d6

SHA1
8365f57f0e1c321d19ac9e105cfce7916ef2739f

SHA256
2b7d7a6d316367a0d0e14c192d46025950ac5211c97c45070fec4d74662fb3f6

SHA512
2e9687e78b5d92879f58a1e70fb9f1dfce70dc8e31cc31690991691c9a0bfa51118d8fa89b1298002e764026f756589b621ab1bab241df2d7ee9dbb4ac3ce6f8

Download Submit
C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui

Filesize
2KB

MD5
4a6c7c70a3ecad12a034476771c439ca

SHA1
1d32456a6a145bd2ce9b4c8df6b5505fe5ff6143

SHA256
b5bacc385853fef03e6187cad2dc603838e8fe30d049243d4d6bbe101f0ebce5

SHA512
44549f7ddcec369735a0aa72e963232814c1e1e8096e9e4bc0e82a76ef221e6402d4950772db66398b4b369878b09f0912cf1f20c7fe02a08517217e8b639781

Download Submit
C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui

Filesize
3KB

MD5
5b33aa50850266c30c6ef81c15dbdfe9

SHA1
4bfa27d9799681b53040441665ce8e6b91426e25

SHA256
1dfaa631f71ea23d6233de547babb8a1472f75e83b9f2e53829c44f93ea22a27

SHA512
51733ad5902a5c916ba0cf56a36e45b31adf87cf64424ac6caa34f8452c499276c8f32f3cc65e0078bb8ed485ef5bcbb8562d3bf4d99624784c2bdcd1854e715

Download Submit
C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui

Filesize
4KB

MD5
c12b4968eaa1df2569f5a7ba7458ae1a

SHA1
4b19fcc6729a4d3061f738e6ffaafcca00edf98b

SHA256
26bffd75e5cda10163d4046bb708575f4ad24bf1de9ab2c311bc67ca4dc99234

SHA512
d2a052aa362d23264bc9a56aefd19810b54868f3ed0160fa305615e5011f4339cdea79defc03777b5bd8cd6ea382d5ded11867bcceb0ccce00181ee753ce349b

Download Submit
C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui

Filesize
3KB

MD5
1b2490c13a5ba4f44f9872d45c9774f6

SHA1
b9cdcbd75a6a39e8a67ada23c95702d7608d155f

SHA256
575142d8ae0a98b57b491622a02a353ae643f8a9c505e4ed8e9354026a1109a4

SHA512
a85a990d9044d41f36d08f2d52952569756bda925b77bffa456fa4441ff884f8f32fbe3df0735277315d7621fdc94d34296b01b89c2c17af7292be51646711ed

Download Submit
C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui

Filesize
3KB

MD5
bc37a1b0972dd3bc15703fb8f0d7681c

SHA1
6514b153a7455829c14d13511995bff72f41ef34

SHA256
87749299708fed2ac89d203c6b11bd2fc212bb8aecaac0de54e5c4aa15e090ed

SHA512
638cf15996fa4d4d2db98424231d1505d9e6db6251b22513b404fbe8236ae2f65ac18751dfef274353feceb54018b08d5026d54e3434776074ddc707b31b1066

Download Submit
C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui

Filesize
56KB

MD5
34e01f68312d359907aa588b61ba5012

SHA1
fbbffb22dc56d3d78898ee8b59e9f9f311220ba8

SHA256
7d974cedf4805dffbb03825b8b1777f8c9d1015bf8e130e45a8a13da2c8cb3be

SHA512
eafa8c132ca2f3903bb28e3c95b8c8e74f06a625160d88e083bad9b90f4e212d3e75eecaba5e94d569bf50d0851e5971fa4fbafc0eb2758f8ef9d4be99c68b4d

Download Submit
C:\Program Files\Windows Media Player\uk-UA\wmlaunch.exe.mui

Filesize
2KB

MD5
74c6af42acea395fb8c05f91f3798906

SHA1
0e9a602743b50641d6267ca3447f5e90515f50ab

SHA256
61d4d24be35c09238c53c8cb5d81de82478508c608fa125e1758070ad30e6238

SHA512
339d28c3fc27f45bd41c92a4674a99140817fc868d51e62ae5c08d60cfb19800f31f581ef9a39a6f0016f8f2db8fc1ae1b45558fd3929d082698f77146025141

Download Submit
C:\Program Files\Windows Media Player\uk-UA\wmplayer.exe.mui

Filesize
3KB

MD5
5fbba8ed3bc6d20013147c43755c2b9d

SHA1
903e9d68b9f5283545d14b0532592581f2eaf63e

SHA256
f227191d5943f0071babda39bc42dde5534b3d31ae6489e8fc912eac08d38763

SHA512
46dc77936b6f4ea5cea779ff43297a689eb28df896fe70ffdc351f864936c9214fe8697a9c9cdc9f09e60ee587fe2c4b2464ee8617e2d76b2fc7c8f3e4f77b0c

Download Submit
C:\Program Files\Windows Media Player\uk-UA\wmpnssci.dll.mui

Filesize
4KB

MD5
3751817ec690a004b93e584da7dc8d35

SHA1
49f912e069e9bd1142e0ef54c4f452b70d5793b9

SHA256
1e4218fac6d232c670047c44336f035f59217f5ec86eb42b9aa783da9ca8f825

SHA512
136214348e9f6be20dab49b00054fa6856643acc11be80e6b89dab8df4dea057b64c3341a09ba319a771d6729749747b1a4fd957172c9ab86629f5c7399c9ebf

Download Submit
C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui

Filesize
3KB

MD5
b921333838c505cb20ce306bc79d5b0c

SHA1
a5b2fc877c1252ba65b4ed60e5ae394f73c2fccb

SHA256
9d7e4a5f4efdb72288d8c9550a410f15923f8385c026719f4555b688b18fcc5e

SHA512
eeae4ffa0f4e7795cd26572db287b1dfcde01638196cc6aa173a2bb80dec9ce72a0bb122bca35dc261e66085e711f4205f9a5f127c6715a5db16b286c5845986

Download Submit
C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui

Filesize
49KB

MD5
785bd29bab352aad1b34cb8ceb7d5301

SHA1
104c34e0c534b26d5cdb94f5371f34d40a27dd9f

SHA256
c58c3ed6992f1aad21ed6b95e2b39cb5ac9ef81fd687b49f763287f331e9dd8d

SHA512
c571cc24fbf12f26f415a5cff810f87c632fac5e252379760fb50887b6b1f875fdd7a35515f1807762978a570622f25745a71f4505e33b4af79fa9055fad1972

Download Submit
C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui

Filesize
8KB

MD5
a34ae58a1260ae0bd66ecbf701771850

SHA1
ac5ebda060ad9a62a962eec9fa10bb501eb0763e

SHA256
ac6fa31e86f677d08462769f370d1db9ede836c7ac1fe9c8565240a064129746

SHA512
9c012cd444bfd83d327f42ac098e5152ae1b254da74e89fa22d19b18e192e3920fafd439460a7934f61ba067bb6a570b4b2d91a15d2ea9bfcfa4e0f3b8b99772

Download Submit
C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui

Filesize
18KB

MD5
4963c7a14a4bbb6a46c15df75a9e0d4b

SHA1
b11e26788ce37978045b25b6c4ec1218910dc03a

SHA256
e5a78ac549233be0311ba4833466efeadde01ef5078cb2b1e187052c66b70668

SHA512
031314f69465332e8a3a06c14252370e0ebdbf283cf20496a706a0d6424c39c4ffe7a32a81e5c651b0e8c53cd19d456ed62202aa6f6d29a8bf10c8ca06265886

Download Submit
C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui

Filesize
16KB

MD5
6d5910d22e24f8c50dac6a8b84ea3105

SHA1
1b693711bc5c8b3d30b28f52b3d71219df94851a

SHA256
73b7fd8f805f2fc795f862c16341612c6e9cfc0e819eac54ef09823ce33bf2ef

SHA512
5b52257f95decdeee0631691e4725828c81fae8b722c826a086a6946ce01d57818434585383d8e91b790c0c3f2705259b6424035724541da2973d95c6b8e84b4

Download Submit
C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui

Filesize
18KB

MD5
f54a7c2a94379eb4db696ed1daae6547

SHA1
fdae5d95462ef2433b20e731e189b32b216535ad

SHA256
3b78f4a5249264f56e00b5a2c38c04f5b266c2da3634e7757d92d0cdc987107a

SHA512
1cb6fda564ab7d6924620074cbedfd6f88b86719b3312be263e50356b94573e9ba50527d7ddabe662ff7705d4a7bdda4af40b72a4f8959cc08f0a507384665ea

Download Submit
C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui

Filesize
19KB

MD5
18a842812aba6b9bc9887a076ee12832

SHA1
cc74778f59ca84b19630361808e9e6a78602d912

SHA256
dfbd2c21cbd902945bb817dc16148c5a87f0027602808b87da556a0e5cd1742a

SHA512
bce6ff41577ebb48191c141d658b0b43e8bd41a15e05158557a6c3a1f347a17bfac0c98e3668b0bd0e23531dfbc4818c5132e6651a5a1b95c870b82cd768692d

Download Submit
C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui

Filesize
18KB

MD5
ae3d8cab7ff9f902914c54b0b949aa52

SHA1
e375eca715e11a998fe84fd3becd01fd48f5e515

SHA256
c7cb5d0a70058baed8fb212e20b91387f9846e4925142b01b1c0cfa29f3e0e55

SHA512
f8dc3be378b30fe98a10cacb8683cc6de78f8f6ec8074363c09bb920913e254497b269318bd7c05153e5f7b789cfb7f581b3fe49cf99ab6f7d69673ddba49623

Download Submit
C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui

Filesize
11KB

MD5
a31d66cd5322842087e50ff9469607b2

SHA1
7028d4629589be7b32bfddcb8e17517de9151d5f

SHA256
f559a38246ae0df17eae197d9841b65c01b2b6aa4e7e26890e4d2d99e8184f32

SHA512
165f4fdba3119f3cd27c7b0d98eb885aade9166a47a737f0152b32099d670a8029319a1fe0ddafe4b2c49fe947516ba1202b540c64ce203894f2db184b0b4bbb

Download Submit
C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui

Filesize
17KB

MD5
f0a2d7fb2d531cfbca27cba9bc30a6d6

SHA1
9c46209258d5c8c6eac2540eae2bb9a350ac8e2b

SHA256
b1855d217fafff77e801adcadb9c2790bee4f3945633059423f3735e42196a36

SHA512
40be7a34f454391d0e145219371e6f26c1cf21d7fe453289b45415c9f18664c6900f7706ea7422cb3b5671952a64e85c28170966eafeacc03e0bc1b7664ee72c

Download Submit
C:\ProgramData\5967.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

Filesize
146KB

MD5
b099fff9b2dd310dd2eabdb9a96c6a03

SHA1
64a6aeafbd95cad622dc3ad9379aec51ff366f94

SHA256
8b24f5800b41e7d1b890f86e3a58625f6b1497216ce0515dd3bc7cb57ccda0cd

SHA512
9fa1484512140e58974d641cf0d5c10b30a82513c875c338480d10450f74c8b040e0b705af513535233d7439b47d6275e5e09af4014d6e677dafacf97f22904d

Download Submit
C:\xEJOHNVZF.README.txt

Filesize
1KB

MD5
7ddc8e8e786ba6fa3451c47157954689

SHA1
5009bf60c3086a2b0548e6d153e96c999831179c

SHA256
898cd90eebd58203c0c73c0494376c81ff8a67805dd20b8a8ca9c55b488c70e1

SHA512
e463de35276cadad44e73b5bf947637e139dfa5c0805dce741ace629cb2c51644d0918be8662d48ee30f04e1aaf3eea7f8992b04379cb7a9aeef6ca82dfe70e8

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3756129449-3121373848-4276368241-1000\DDDDDDDDDDD

Filesize
129B

MD5
f85ecd4168fa5ef2e2fc5611b0735d06

SHA1
08d7ae16da1a4b1efdc10ed4fa1be576cadb2d22

SHA256
850c779ff0a446415e4f5007a7b16014749aea4f5a61d272d753c1b2eef5fb87

SHA512
fed9e7f5f17857440c555169ad1820eacf0f9d5deb33aefeda6905b6e62d5bb1b6b1436261db0555f7ce326d661cda7a3e92cda0bb7f2fb647edafb8d55710fa

Download Submit
memory/3264-0-0x0000000002B80000-0x0000000002B90000-memory.dmp

Filesize
64KB

Download
memory/3264-6629-0x0000000002B80000-0x0000000002B90000-memory.dmp

Filesize
64KB

Download
memory/3264-6630-0x0000000002B80000-0x0000000002B90000-memory.dmp

Filesize
64KB

Download
memory/3264-6631-0x0000000002B80000-0x0000000002B90000-memory.dmp

Filesize
64KB

Download
memory/3264-2-0x0000000002B80000-0x0000000002B90000-memory.dmp

Filesize
64KB

Download
memory/3264-1-0x0000000002B80000-0x0000000002B90000-memory.dmp

Filesize
64KB

Download