Overview

overview

10

Static

static

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

7

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

9

Ransomware...KB.exe

windows10-ltsc_2021-x64

9

Ransomware...KB.ps1

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.msi

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Resubmissions

30/11/2025, 12:12

251130-pc6htsvpft10

30/11/2025, 12:00

251130-n6lvvahl7110

09/11/2025, 19:58

251109-ypxk5asqhm10

06/11/2025, 21:43

251106-1kxrfatrhp10

03/11/2025, 21:39

251103-1hxzesak9z10

04/10/2025, 20:19

251004-y355es1qy910

09/04/2025, 13:37

250409-qwzeas1rx9

31/03/2025, 05:19

250331-fz687stwdz

31/03/2025, 05:18

250331-fzse2swn13

31/03/2025, 05:18

250331-fzmvkawnz8

Analysis

  • max time kernel
    494s
  • max time network
    515s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    31/03/2025, 00:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RansomwareSamples/LockBit_14_02_2021_146KB.exe
  • Size 146KB
  • Sample250331-apdw1ssjs8
  • SHA256 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lockbitdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomware

Malware Config

Extracted

Path

  • C:\Program Files\Restore-My-Files.txt

  • lockbit

Ransom Note
  • All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?BC76D224712A7481EADA412145DE215D | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481EADA412145DE215D This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

  • http://lockbit-decryptor.top/?BC76D224712A7481EADA412145DE215D

  • http://lockbitks2tvnmwk.onion/?BC76D224712A7481EADA412145DE215D

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Lockbit family
    lockbit
  • Clears Windows event logs 1 TTPs 6 IoCs
    defense_evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 8 IoCs
    ransomwareevasion
  • Renames multiple (6003) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes System State backups 3 TTPs 4 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 4 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe
    "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3312
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1152
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:4336
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4700
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1984
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2336
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:868
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4924
    • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe
      C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe
      2⤵
      • Checks computer location settings
      • Enumerates connected drives
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:780
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:968
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:1764
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4796
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1652
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1976
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:4856
      • C:\Windows\system32\cmd.exe
        /c vssadmin Delete Shadows /All /Quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2892
        • C:\Windows\system32\vssadmin.exe
          vssadmin Delete Shadows /All /Quiet
          4⤵
          • Interacts with shadow copies
          PID:5272
      • C:\Windows\system32\cmd.exe
        /c bcdedit /set {default} recoveryenabled No
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3040
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled No
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:4460
      • C:\Windows\system32\cmd.exe
        /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4940
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:2624
      • C:\Windows\system32\cmd.exe
        /c wbadmin DELETE SYSTEMSTATEBACKUP
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:472
        • C:\Windows\system32\wbadmin.exe
          wbadmin DELETE SYSTEMSTATEBACKUP
          4⤵
          • Deletes System State backups
          PID:3000
      • C:\Windows\system32\cmd.exe
        /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3056
        • C:\Windows\system32\wbadmin.exe
          wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
          4⤵
          • Deletes System State backups
          PID:5392
      • C:\Windows\system32\cmd.exe
        /c wmic SHADOWCOPY /nointeractive
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5340
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic SHADOWCOPY /nointeractive
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1252
      • C:\Windows\system32\cmd.exe
        /c wevtutil cl security
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3020
        • C:\Windows\system32\wevtutil.exe
          wevtutil cl security
          4⤵
          • Clears Windows event logs
          PID:3636
      • C:\Windows\system32\cmd.exe
        /c wevtutil cl system
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4792
        • C:\Windows\system32\wevtutil.exe
          wevtutil cl system
          4⤵
          • Clears Windows event logs
          PID:1560
      • C:\Windows\system32\cmd.exe
        /c wevtutil cl application
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2512
        • C:\Windows\system32\wevtutil.exe
          wevtutil cl application
          4⤵
          • Clears Windows event logs
          PID:4968
      • C:\Windows\system32\cmd.exe
        /c vssadmin Delete Shadows /All /Quiet
        3⤵
          PID:1852
          • C:\Windows\system32\vssadmin.exe
            vssadmin Delete Shadows /All /Quiet
            4⤵
            • Interacts with shadow copies
            PID:3904
        • C:\Windows\system32\cmd.exe
          /c bcdedit /set {default} recoveryenabled No
          3⤵
            PID:5976
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} recoveryenabled No
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:5080
          • C:\Windows\system32\cmd.exe
            /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
            3⤵
              PID:4060
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} bootstatuspolicy ignoreallfailures
                4⤵
                • Modifies boot configuration data using bcdedit
                PID:3000
            • C:\Windows\system32\cmd.exe
              /c wbadmin DELETE SYSTEMSTATEBACKUP
              3⤵
                PID:1660
                • C:\Windows\system32\wbadmin.exe
                  wbadmin DELETE SYSTEMSTATEBACKUP
                  4⤵
                  • Deletes System State backups
                  • Drops file in Windows directory
                  PID:5796
              • C:\Windows\system32\cmd.exe
                /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
                3⤵
                  PID:4700
                  • C:\Windows\system32\wbadmin.exe
                    wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
                    4⤵
                    • Deletes System State backups
                    PID:4260
                • C:\Windows\system32\cmd.exe
                  /c wmic SHADOWCOPY /nointeractive
                  3⤵
                    PID:3020
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic SHADOWCOPY /nointeractive
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3204
                  • C:\Windows\system32\cmd.exe
                    /c wevtutil cl security
                    3⤵
                      PID:4992
                      • C:\Windows\system32\wevtutil.exe
                        wevtutil cl security
                        4⤵
                        • Clears Windows event logs
                        PID:5164
                    • C:\Windows\system32\cmd.exe
                      /c wevtutil cl system
                      3⤵
                        PID:1100
                        • C:\Windows\system32\wevtutil.exe
                          wevtutil cl system
                          4⤵
                          • Clears Windows event logs
                          PID:4272
                      • C:\Windows\system32\cmd.exe
                        /c wevtutil cl application
                        3⤵
                          PID:2040
                          • C:\Windows\system32\wevtutil.exe
                            wevtutil cl application
                            4⤵
                            • Clears Windows event logs
                            PID:4904
                    • C:\Windows\system32\vssvc.exe
                      C:\Windows\system32\vssvc.exe
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2684
                    • C:\Windows\system32\wbengine.exe
                      "C:\Windows\system32\wbengine.exe"
                      1⤵
                        PID:2312
                      • C:\Windows\System32\vdsldr.exe
                        C:\Windows\System32\vdsldr.exe -Embedding
                        1⤵
                          PID:4428
                        • C:\Windows\System32\vds.exe
                          C:\Windows\System32\vds.exe
                          1⤵
                          • Checks SCSI registry key(s)
                          PID:5472

                        Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              Identity-H
                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H
                              • Size 9KB
                              • SHA256 27105b20c5aece064bf51b4559a52f68ca273a680adb01dcee2318e9a902d058
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Identity-V
                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V
                              • Size 4KB
                              • SHA256 c27d066f45ca16ee8f46a0b3acf637f56efc56cab5959c5ce4afd5bea8aa8ea3
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              EppManifest.dll.mui
                              • Path C:\Program Files (x86)\Windows Defender\de-DE\EppManifest.dll.mui
                              • Size 4KB
                              • SHA256 5a78dd5cf876e0a2c4d28153c2969bd48974dec097f1cece677d8743c776e08e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              MpAsDesc.dll.mui
                              • Path C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui
                              • Size 62KB
                              • SHA256 acac984295ec52267007d98521c908356ce1e713cf9beabaea5cd0b5cab490c8
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              EppManifest.dll.mui
                              • Path C:\Program Files (x86)\Windows Defender\en-US\EppManifest.dll.mui
                              • Size 4KB
                              • SHA256 83680fc622ae3afad7565a1ea15d35798da68ae03b8630d36b5fee2c1c057466
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              MpAsDesc.dll.mui
                              • Path C:\Program Files (x86)\Windows Defender\en-US\MpAsDesc.dll.mui
                              • Size 51KB
                              • SHA256 1715740667446dc64dafe907cff7606a1f098cac36cdb137669155e6ea17af5f
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              EppManifest.dll.mui
                              • Path C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui
                              • Size 4KB
                              • SHA256 81b3e43b330663563cf519e819789cbb3bcdd830098b165557b5ab7557d09bb5
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              MpAsDesc.dll.mui
                              • Path C:\Program Files (x86)\Windows Defender\es-ES\MpAsDesc.dll.mui
                              • Size 59KB
                              • SHA256 261f6f22745512a9e7fcb612a71dba0c400a748cc755f0dab076770286df9653
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              EppManifest.dll.mui
                              • Path C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui
                              • Size 4KB
                              • SHA256 2766fbc8e7ebcf4509822ec86a2bc6327de5c4d2d54dc0b5ee4a003001e59957
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              MpAsDesc.dll.mui
                              • Path C:\Program Files (x86)\Windows Defender\fr-FR\MpAsDesc.dll.mui
                              • Size 62KB
                              • SHA256 715ac2d1960fd6be01149709f3397bba58cdef5fde3086dda8ad44924778ec3a
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              EppManifest.dll.mui
                              • Path C:\Program Files (x86)\Windows Defender\it-IT\EppManifest.dll.mui
                              • Size 4KB
                              • SHA256 9aebed244e6a25c10ff948545dc69d7a1f38097e3c45557b6c4ab3651d7da737
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              MpAsDesc.dll.mui
                              • Path C:\Program Files (x86)\Windows Defender\it-IT\MpAsDesc.dll.mui
                              • Size 59KB
                              • SHA256 eb4e821d05279e9616818b8cfeae012ccab60ff97ae33114f8a2225f1408e766
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              EppManifest.dll.mui
                              • Path C:\Program Files (x86)\Windows Defender\ja-JP\EppManifest.dll.mui
                              • Size 4KB
                              • SHA256 3caf6c0eb9068e40b31badc01f613aabf6c6e92ae1e9b9bf155e9e49a2cafda8
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              MpAsDesc.dll.mui
                              • Path C:\Program Files (x86)\Windows Defender\ja-JP\MpAsDesc.dll.mui
                              • Size 33KB
                              • SHA256 7970b82933588ed7c541584d7c56a4de1dab64f77f86595ef0e257bb03763c25
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              EppManifest.dll.mui
                              • Path C:\Program Files (x86)\Windows Defender\uk-UA\EppManifest.dll.mui
                              • Size 4KB
                              • SHA256 4ddf38e7da8accabcf5d77b0598387f55ccc64d8bd0413d67161484c32b96f25
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              MpAsDesc.dll.mui
                              • Path C:\Program Files (x86)\Windows Defender\uk-UA\MpAsDesc.dll.mui
                              • Size 57KB
                              • SHA256 78c52bc750946bc1ed7b4a86ae2ffc3f86416a784ca34291c52913f17c694cd8
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              WMPMediaSharing.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\de-DE\WMPMediaSharing.dll.mui
                              • Size 4KB
                              • SHA256 c83eb82d787240e7f09e8d59afe84f60c438d8cfb46072ea32437a5c3b6bdf71
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              mpvis.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\de-DE\mpvis.dll.mui
                              • Size 4KB
                              • SHA256 5c9efb4119bb244e5f3267fa60167d8295a9a3f9e3d8b25b1773cd2300c1400e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              setup_wm.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\de-DE\setup_wm.exe.mui
                              • Size 63KB
                              • SHA256 d637bd343e04c6ed49e9164fc65280c41cf9958c80f1b5b78ed7c83d83503bd3
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmlaunch.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\de-DE\wmlaunch.exe.mui
                              • Size 4KB
                              • SHA256 5c2e0c9eba38fbfd57ee4223759d1b37cd29fbe418f373e9799f4db03ff8aeae
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmplayer.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\de-DE\wmplayer.exe.mui
                              • Size 4KB
                              • SHA256 ac55abe62ae4e036763c9ab8a31e68e762d979b1a1acea6854cbde868f307730
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmpnssci.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\de-DE\wmpnssci.dll.mui
                              • Size 6KB
                              • SHA256 29789bdcd94e3ae45534ae75d14775d50cd069af7b56f168f55320a596ece51b
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmpnssui.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\de-DE\wmpnssui.dll.mui
                              • Size 4KB
                              • SHA256 13b0d21c7f151f961aaebe8c426e90f69a49fc620ca7f1eb7d37e70947ddb826
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              WMPMediaSharing.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\en-US\WMPMediaSharing.dll.mui
                              • Size 4KB
                              • SHA256 d7b18377fb33e84d64da28af8b875a8c60f7ad5a7a9bedecb105ba35ffe931d9
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              mpvis.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\en-US\mpvis.dll.mui
                              • Size 4KB
                              • SHA256 40e6f64f16ce213b8ffde46b90330069a1b40f53bc78002b1308cae37666f81b
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              setup_wm.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\en-US\setup_wm.exe.mui
                              • Size 55KB
                              • SHA256 aa967408f116c47609581ecaa8b37e67d7bb975f8ee86b6b0fb9823e625bce35
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmplayer.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\en-US\wmplayer.exe.mui
                              • Size 4KB
                              • SHA256 ef16f5ea9ac4bcd23528946e4b272be693a0186608328e09f3fb5a2670941c79
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmpnssci.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\en-US\wmpnssci.dll.mui
                              • Size 6KB
                              • SHA256 f96b5bf1cde99c5170b74fc50032739459cef2f91cfd86e51299a5a83c4e4942
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmpnssui.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\en-US\wmpnssui.dll.mui
                              • Size 4KB
                              • SHA256 a7a0d00475e185fc4a5aed49dcbf79429813a127da5db7d147642b7496a98641
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              WMPMediaSharing.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\es-ES\WMPMediaSharing.dll.mui
                              • Size 4KB
                              • SHA256 cb9830bc46335b666a14f22659436c8dd25136500e6dd7a3a5fb8ea5b949a22d
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              mpvis.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\es-ES\mpvis.dll.mui
                              • Size 4KB
                              • SHA256 97dfa78536223cd4eeb34042d863fb24cbb43d8e9653e8a484f8c4ec99bb9db5
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              setup_wm.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\es-ES\setup_wm.exe.mui
                              • Size 63KB
                              • SHA256 0e65d5fe1d0e82d5464d3cb15dfd75503594c51161017985d16ee7e9ce615ffb
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmlaunch.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\es-ES\wmlaunch.exe.mui
                              • Size 4KB
                              • SHA256 aaa95a7810e3e957f4642ed58207051bca8532652c9415163b82f7c1adc45dbe
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmplayer.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\es-ES\wmplayer.exe.mui
                              • Size 5KB
                              • SHA256 12ed7e963dc2c92133c5c882ac042663943534e08130a5b6fa7c493a141b7232
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmpnssci.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\es-ES\wmpnssci.dll.mui
                              • Size 6KB
                              • SHA256 496b279334979f2960ecd90dcc2eef0a524f3a1ef4edfb574593fd559f332ba0
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmpnssui.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\es-ES\wmpnssui.dll.mui
                              • Size 5KB
                              • SHA256 ff30309e7314f9d719accbdd4d20b625fee1c031ffea4d23309ded0bf4e3c2bc
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              WMPMediaSharing.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui
                              • Size 4KB
                              • SHA256 77d65dac8fcb6543cea025667f0ea43680026bc185335f5f54068f1effc31220
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              mpvis.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\fr-FR\mpvis.dll.mui
                              • Size 4KB
                              • SHA256 61040d4665e3599bcd9c6d3212178eb2afd9b52d67f11b7a808c17f3da704da8
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              setup_wm.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\fr-FR\setup_wm.exe.mui
                              • Size 65KB
                              • SHA256 769bb3f25112d39422d08b8067628534a626e91bdcf7fad8d611fd438eca5319
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmlaunch.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\fr-FR\wmlaunch.exe.mui
                              • Size 4KB
                              • SHA256 f038da91abb3cb5e8d2c879f264dde45d452ee492d6f9f195b91654873449d0b
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmplayer.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\fr-FR\wmplayer.exe.mui
                              • Size 4KB
                              • SHA256 6d15500fcb409547539648b719ce418f337756c1fa6800d54ece03b179568dc5
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmpnssci.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\fr-FR\wmpnssci.dll.mui
                              • Size 6KB
                              • SHA256 64983037af68d376b9b58ba8ae08afd62efc61a6bcb0c0925545b2d7517b10d9
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmpnssui.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\fr-FR\wmpnssui.dll.mui
                              • Size 5KB
                              • SHA256 76b435a30eeebee6f40ecb937e41d8bebf97d7c1afafa36ee91d9870679586d6
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              WMPMediaSharing.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\it-IT\WMPMediaSharing.dll.mui
                              • Size 4KB
                              • SHA256 7f6aad2d0da993612e00456b4f56414708a21a69765d46d382bf2075de802fdd
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              mpvis.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\it-IT\mpvis.dll.mui
                              • Size 4KB
                              • SHA256 701dfcfe36a2eff3f76affb0da2dc8ea2ec2f6cf42a201345da05c3b6f127068
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              setup_wm.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\it-IT\setup_wm.exe.mui
                              • Size 63KB
                              • SHA256 a1493cdddf601faa8d117f2e3c09f11df5294f499a838377bb737ecdd55ad360
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmlaunch.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\it-IT\wmlaunch.exe.mui
                              • Size 4KB
                              • SHA256 3dfd3f8b7b98c819b06e7477e2ac0fe0233425da6754f3eff71b1a362f21dbf8
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmplayer.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\it-IT\wmplayer.exe.mui
                              • Size 4KB
                              • SHA256 aa70bcd26b9e837523f10b1a3d3499a00c26a479a547c30f8f9b4d85fb6d2997
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmpnssci.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\it-IT\wmpnssci.dll.mui
                              • Size 6KB
                              • SHA256 d789793e0e3d5830df05c11280d54539a7bff65f4c5cba9d2ececaf16fcc679a
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmpnssui.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\it-IT\wmpnssui.dll.mui
                              • Size 4KB
                              • SHA256 82be96464387cb9dd1d8f59563d46085e4158a0933aeba2b2138902f641d0bbd
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              WMPMediaSharing.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui
                              • Size 4KB
                              • SHA256 9de331702464b51a9dae5e715fec2dd2ae3fb53e35f17b8e5d5141bf4db6f7d6
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              mpvis.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\ja-JP\mpvis.dll.mui
                              • Size 4KB
                              • SHA256 4697555ea3d5ade18a573d7cd69e21370b8da1841b02aa5998171ff124bc033a
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              setup_wm.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\ja-JP\setup_wm.exe.mui
                              • Size 41KB
                              • SHA256 be3c76aa353c40c0df9218cdd1c90c93df42f27bae2bc2789bf34aef520ca699
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmlaunch.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\ja-JP\wmlaunch.exe.mui
                              • Size 4KB
                              • SHA256 c5c631371cc580a7ee1ff5092a56e5ad1961ca63b6c462d9476a219000134176
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmplayer.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\ja-JP\wmplayer.exe.mui
                              • Size 4KB
                              • SHA256 cd40c0faa2f0c9b80be2148b3a223c80377bb16df0987f972c47b943f20fe2eb
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmpnssci.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\ja-JP\wmpnssci.dll.mui
                              • Size 5KB
                              • SHA256 abb3f72513531756a60b111f557a5fdcc7a8594ae0d5aabae26152289bf1f307
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              wmpnssui.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\ja-JP\wmpnssui.dll.mui
                              • Size 4KB
                              • SHA256 ce1ddca2c7babdaed64cad5e994570fd7a996c89c4e63e7d09d34e01a0965fbf
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              mpvis.dll.mui
                              • Path C:\Program Files (x86)\Windows Media Player\uk-UA\mpvis.dll.mui
                              • Size 4KB
                              • SHA256 7d54f66ea0c132e644f3e72c7ebcd396ca83e005e522d083858ba569c1df92bf
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              setup_wm.exe.mui
                              • Path C:\Program Files (x86)\Windows Media Player\uk-UA\setup_wm.exe.mui
                              • Size 58KB
                              • SHA256 e7a33f2a8f86fe974d4fb935489c0fd25850457a578fbf7985ca7dd4d9e02ab1
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Restore-My-Files.txt
                              • Path C:\Program Files\Restore-My-Files.txt
                              • Size 1KB
                              • SHA256 2062c18fb5dd37d2d258f0a17ea7e3a8397bcc2bb8e03b00a5dc19c57af606b6
                              • MD5 SHA1 SHA512
                              Submit Download

                              AppxBlockMap.xml
                              • Path C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_133.0.3065.69_neutral__8wekyb3d8bbwe\AppxBlockMap.xml
                              • Size 2KB
                              • SHA256 66ca8b6ca3f405f555001934e9ecb330005105ab5993056d5692d37880d296d0
                              • MD5 SHA1 SHA512
                              Submit Download

                              AppxManifest.xml
                              • Path C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_133.0.3065.69_neutral__8wekyb3d8bbwe\AppxManifest.xml
                              • Size 4KB
                              • SHA256 c39550bb781ef84b830eed4ee7bf9e320946dbd8878cb93139d0f68769fbd100
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              AppxSignature.p7x
                              • Path C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_133.0.3065.69_neutral__8wekyb3d8bbwe\AppxSignature.p7x
                              • Size 11KB
                              • SHA256 557e77f7a97cab1dce3d786c1494d399d05be35f5559ceadba97072e5884eae0
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Logo.png
                              • Path C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_133.0.3065.69_neutral__8wekyb3d8bbwe\Logo.png
                              • Size 33KB
                              • SHA256 e42521c371177f81d9892f662fe5e387cbf899268f86de38d1bee07a9c357579
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              SmallLogo.png
                              • Path C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_133.0.3065.69_neutral__8wekyb3d8bbwe\SmallLogo.png
                              • Size 17KB
                              • SHA256 7816b6851a51924de3976c69d584e63c8e4da3beda01822b46e6d9a149677d55
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download