Resubmissions

31/03/2025, 00:22

250331-apdw1ssjs8 10

28/03/2025, 22:52

250328-2tfd7avl15 10

25/03/2025, 14:57

250325-sb3mbsxxht 10

Analysis

  • max time kernel
    494s
  • max time network
    515s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    31/03/2025, 00:22

General

  • Target

    RansomwareSamples/LockBit_14_02_2021_146KB.exe

  • Size

    146KB

  • MD5

    69bec32d50744293e85606a5e8f80425

  • SHA1

    101b90ac7e0c2a8b570686c13dfa0e161ddd00e0

  • SHA256

    95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf

  • SHA512

    e01f976fcbfa67cfd6e97855d07350a27b67fcc825d4e813ac9d2f4e8f464bb4f8bbbbe58a26bc27e78fa15db0ee5271e8f041dd72f036c11964eb1c591b438f

  • SSDEEP

    3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVMMqqD/h2LuTeONA5tIHVcH:IS9rLPPUpa3VVEtLXcCqqD/hOQnaMcH

Malware Config

Extracted

Path

C:\Program Files\Restore-My-Files.txt

Family

lockbit

Ransom Note
All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?BC76D224712A7481EADA412145DE215D | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?BC76D224712A7481EADA412145DE215D This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

http://lockbit-decryptor.top/?BC76D224712A7481EADA412145DE215D

http://lockbitks2tvnmwk.onion/?BC76D224712A7481EADA412145DE215D

Signatures

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

  • Lockbit family
  • Clears Windows event logs 1 TTPs 6 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 8 IoCs
  • Renames multiple (6003) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Deletes System State backups 3 TTPs 4 IoCs

    Uses wbadmin.exe to inhibit system recovery.

  • Deletes backup catalog 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 4 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe
    "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3312
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1152
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:4336
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4700
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1984
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2336
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:868
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4924
    • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe
      C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe
      2⤵
      • Checks computer location settings
      • Enumerates connected drives
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:780
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:968
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:1764
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4796
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1652
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1976
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:4856
      • C:\Windows\system32\cmd.exe
        /c vssadmin Delete Shadows /All /Quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2892
        • C:\Windows\system32\vssadmin.exe
          vssadmin Delete Shadows /All /Quiet
          4⤵
          • Interacts with shadow copies
          PID:5272
      • C:\Windows\system32\cmd.exe
        /c bcdedit /set {default} recoveryenabled No
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3040
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled No
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:4460
      • C:\Windows\system32\cmd.exe
        /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4940
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:2624
      • C:\Windows\system32\cmd.exe
        /c wbadmin DELETE SYSTEMSTATEBACKUP
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:472
        • C:\Windows\system32\wbadmin.exe
          wbadmin DELETE SYSTEMSTATEBACKUP
          4⤵
          • Deletes System State backups
          PID:3000
      • C:\Windows\system32\cmd.exe
        /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3056
        • C:\Windows\system32\wbadmin.exe
          wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
          4⤵
          • Deletes System State backups
          PID:5392
      • C:\Windows\system32\cmd.exe
        /c wmic SHADOWCOPY /nointeractive
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5340
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic SHADOWCOPY /nointeractive
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1252
      • C:\Windows\system32\cmd.exe
        /c wevtutil cl security
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3020
        • C:\Windows\system32\wevtutil.exe
          wevtutil cl security
          4⤵
          • Clears Windows event logs
          PID:3636
      • C:\Windows\system32\cmd.exe
        /c wevtutil cl system
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4792
        • C:\Windows\system32\wevtutil.exe
          wevtutil cl system
          4⤵
          • Clears Windows event logs
          PID:1560
      • C:\Windows\system32\cmd.exe
        /c wevtutil cl application
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2512
        • C:\Windows\system32\wevtutil.exe
          wevtutil cl application
          4⤵
          • Clears Windows event logs
          PID:4968
      • C:\Windows\system32\cmd.exe
        /c vssadmin Delete Shadows /All /Quiet
        3⤵
          PID:1852
          • C:\Windows\system32\vssadmin.exe
            vssadmin Delete Shadows /All /Quiet
            4⤵
            • Interacts with shadow copies
            PID:3904
        • C:\Windows\system32\cmd.exe
          /c bcdedit /set {default} recoveryenabled No
          3⤵
            PID:5976
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} recoveryenabled No
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:5080
          • C:\Windows\system32\cmd.exe
            /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
            3⤵
              PID:4060
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} bootstatuspolicy ignoreallfailures
                4⤵
                • Modifies boot configuration data using bcdedit
                PID:3000
            • C:\Windows\system32\cmd.exe
              /c wbadmin DELETE SYSTEMSTATEBACKUP
              3⤵
                PID:1660
                • C:\Windows\system32\wbadmin.exe
                  wbadmin DELETE SYSTEMSTATEBACKUP
                  4⤵
                  • Deletes System State backups
                  • Drops file in Windows directory
                  PID:5796
              • C:\Windows\system32\cmd.exe
                /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
                3⤵
                  PID:4700
                  • C:\Windows\system32\wbadmin.exe
                    wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
                    4⤵
                    • Deletes System State backups
                    PID:4260
                • C:\Windows\system32\cmd.exe
                  /c wmic SHADOWCOPY /nointeractive
                  3⤵
                    PID:3020
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic SHADOWCOPY /nointeractive
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3204
                  • C:\Windows\system32\cmd.exe
                    /c wevtutil cl security
                    3⤵
                      PID:4992
                      • C:\Windows\system32\wevtutil.exe
                        wevtutil cl security
                        4⤵
                        • Clears Windows event logs
                        PID:5164
                    • C:\Windows\system32\cmd.exe
                      /c wevtutil cl system
                      3⤵
                        PID:1100
                        • C:\Windows\system32\wevtutil.exe
                          wevtutil cl system
                          4⤵
                          • Clears Windows event logs
                          PID:4272
                      • C:\Windows\system32\cmd.exe
                        /c wevtutil cl application
                        3⤵
                          PID:2040
                          • C:\Windows\system32\wevtutil.exe
                            wevtutil cl application
                            4⤵
                            • Clears Windows event logs
                            PID:4904
                    • C:\Windows\system32\vssvc.exe
                      C:\Windows\system32\vssvc.exe
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2684
                    • C:\Windows\system32\wbengine.exe
                      "C:\Windows\system32\wbengine.exe"
                      1⤵
                        PID:2312
                      • C:\Windows\System32\vdsldr.exe
                        C:\Windows\System32\vdsldr.exe -Embedding
                        1⤵
                          PID:4428
                        • C:\Windows\System32\vds.exe
                          C:\Windows\System32\vds.exe
                          1⤵
                          • Checks SCSI registry key(s)
                          PID:5472

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H

                          Filesize

                          9KB

                          MD5

                          b7b0efadff656f142c8e41c85374c653

                          SHA1

                          cf02ac7c65e2e2d4aec0f72f21acd7a41684285f

                          SHA256

                          27105b20c5aece064bf51b4559a52f68ca273a680adb01dcee2318e9a902d058

                          SHA512

                          bc0c4fbca76adcc537590d6a86c78744ad85f2ca8cbc924cf18cf1b398c0b989a584220e5114c3000ae006844565bf5a5939851a1d7c4b9e01735ba5efa98d97

                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V

                          Filesize

                          4KB

                          MD5

                          f3f2580f54266959b6fe2d1fbc60cc34

                          SHA1

                          f628bceee1257cad785f31924a8de2a26e4b9235

                          SHA256

                          c27d066f45ca16ee8f46a0b3acf637f56efc56cab5959c5ce4afd5bea8aa8ea3

                          SHA512

                          c83b7712dbf1c2082065b72181f9d4d421252dd786afa126c12b301db9ec82fc3a7ec412a442150c6529cca997d4d7cd6d6c7d6acf6f7180a8ec4801346d7fa6

                        • C:\Program Files (x86)\Windows Defender\de-DE\EppManifest.dll.mui

                          Filesize

                          4KB

                          MD5

                          b98665be9a8375ee5c577865ca5bc953

                          SHA1

                          9cd6c27cd47c3189f7e93dd6da63894d0a365a99

                          SHA256

                          5a78dd5cf876e0a2c4d28153c2969bd48974dec097f1cece677d8743c776e08e

                          SHA512

                          94a06d738724a1eeb3093ea9f69c24f618d4bd3a561c4a9dd5d10e7aafe56974685aa10a74d3aa1f61bceff5d91f663ff5b7faf90812865fce7d4e3cdd35e8be

                        • C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui

                          Filesize

                          62KB

                          MD5

                          e0983e28a095c19f117c1f6fe10404f8

                          SHA1

                          ae1aa6a8773b745d66203c138b89a9c063eb56dc

                          SHA256

                          acac984295ec52267007d98521c908356ce1e713cf9beabaea5cd0b5cab490c8

                          SHA512

                          6b09ad99864d0f8a46760e8dbff2613ceb1f0eb4f4e20a1e73cfeff3cc49ebd3243b85b2c6a6ea4656f27316c62005169c376eeee26a75aaa6ea5832ac12a3ae

                        • C:\Program Files (x86)\Windows Defender\en-US\EppManifest.dll.mui

                          Filesize

                          4KB

                          MD5

                          3cddf3e08aba4dbff1ac53ad54928f89

                          SHA1

                          2974f65c9819f63411075e41e7d2f24b70c8a536

                          SHA256

                          83680fc622ae3afad7565a1ea15d35798da68ae03b8630d36b5fee2c1c057466

                          SHA512

                          076ad459a8b4c24e5446bb50f4baf5bcc5851e4d519c19a956b9309971b8312c6b15fb3fdf95a5f14c414b26d69c233aa521396297fb229cc084cb054876a331

                        • C:\Program Files (x86)\Windows Defender\en-US\MpAsDesc.dll.mui

                          Filesize

                          51KB

                          MD5

                          edd7660e1d7af5852df225847135740d

                          SHA1

                          c688795b80beaacc2d043d10f4b5e530a4b439a5

                          SHA256

                          1715740667446dc64dafe907cff7606a1f098cac36cdb137669155e6ea17af5f

                          SHA512

                          74e53aefe0705bb3f1827df23685f303ea908d3672d21580053aa0607d4fd371f663f453791745edf7e2400993e7257ad47a86c59a23673edbcc652736b637cb

                        • C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui

                          Filesize

                          4KB

                          MD5

                          f9d0b3cfe851dfb81656078ff7678b16

                          SHA1

                          d5b5c20107df2cfbcf5d4f46523e63316f1f2e4a

                          SHA256

                          81b3e43b330663563cf519e819789cbb3bcdd830098b165557b5ab7557d09bb5

                          SHA512

                          2e676d85a1ebdfb60ff3a2b106bd36f5a003c76511b8873fe7803c31189565f93d9a6d68470899ef4059431aa89d32254a52f9121db7fae271d65aa4cfe9cd60

                        • C:\Program Files (x86)\Windows Defender\es-ES\MpAsDesc.dll.mui

                          Filesize

                          59KB

                          MD5

                          c22b80a64d771d0aa7cad590b1a0e526

                          SHA1

                          06185470608b8d36cf923fd31596ae855b8e9fbd

                          SHA256

                          261f6f22745512a9e7fcb612a71dba0c400a748cc755f0dab076770286df9653

                          SHA512

                          0a5bdc2e6ddfc4b289aeb6e998424e242b8de5b17ca76af7cf19fb9098e1f6a14b9bd5d998edf3d4e7a53268d05942658afc342b2addfc83d26e06f2e4aa8d1f

                        • C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui

                          Filesize

                          4KB

                          MD5

                          47222433c66d4a205d354b7f5e9f2c28

                          SHA1

                          d030c967011bf607b4b244c2e04cf164b021d617

                          SHA256

                          2766fbc8e7ebcf4509822ec86a2bc6327de5c4d2d54dc0b5ee4a003001e59957

                          SHA512

                          67e189fc845c04d2ef7fecb38c41367a53375923ce4bbd7838b19748e10597d2eb12bb7e1581b8fdcfd72ca0e51b98e20ec1be9e35d11d3c0f07810cfd960838

                        • C:\Program Files (x86)\Windows Defender\fr-FR\MpAsDesc.dll.mui

                          Filesize

                          62KB

                          MD5

                          535e5663352bdb36b7babae594f38d93

                          SHA1

                          81cf8a0086d539fd2b3571e1da1e301d7747a652

                          SHA256

                          715ac2d1960fd6be01149709f3397bba58cdef5fde3086dda8ad44924778ec3a

                          SHA512

                          f752335591cf11d8a1f20b95b63b6230ed363e31a7f19c937be51367b604ec42064b7626a1a67f46074cb287db0c8ac27e7b06dc0d8ce1a502f92ebe8726be51

                        • C:\Program Files (x86)\Windows Defender\it-IT\EppManifest.dll.mui

                          Filesize

                          4KB

                          MD5

                          0997fdac23455a2c33c1517ba9fe9927

                          SHA1

                          e05055a8391d7b8412636523aa3f60c9a8c5c923

                          SHA256

                          9aebed244e6a25c10ff948545dc69d7a1f38097e3c45557b6c4ab3651d7da737

                          SHA512

                          a7e1cbfe804a3c4452af1bcc5e7f45899a91a05f4942ab37c77f31da79f89b296df91b92a9f6151066b684db7d4fc8b85fa06d543ed7e5a5d5e388748d4a40b0

                        • C:\Program Files (x86)\Windows Defender\it-IT\MpAsDesc.dll.mui

                          Filesize

                          59KB

                          MD5

                          3490713ec850a16c4a16014d43c35e3e

                          SHA1

                          9b394802bc2c1cb97105ca09671d2d817ed34cbf

                          SHA256

                          eb4e821d05279e9616818b8cfeae012ccab60ff97ae33114f8a2225f1408e766

                          SHA512

                          187b251f74ea907a7ba52a71d7f5eb7b298e9a09e4e12ed447ac43a4ae36c43824077e57f70bea1fe035f4c68d12e6767508b6178eb848bef2386f2721602683

                        • C:\Program Files (x86)\Windows Defender\ja-JP\EppManifest.dll.mui

                          Filesize

                          4KB

                          MD5

                          ab111e878c3c19cbfaee1c8eef0dd736

                          SHA1

                          5752b32c1b964d6c01869f5835340d821e265853

                          SHA256

                          3caf6c0eb9068e40b31badc01f613aabf6c6e92ae1e9b9bf155e9e49a2cafda8

                          SHA512

                          f68ac057ead63653b1d03f5d194fbf0800ee1665f97c506cc489ef8c881f2232d53a2638917166ba7f8753c713a1e7c3117a004d180e4115bbf299411b2886a5

                        • C:\Program Files (x86)\Windows Defender\ja-JP\MpAsDesc.dll.mui

                          Filesize

                          33KB

                          MD5

                          ff8524c9b4642c991924d5aa9bc28db7

                          SHA1

                          497a021d84a055508bf53409dc36098037412de7

                          SHA256

                          7970b82933588ed7c541584d7c56a4de1dab64f77f86595ef0e257bb03763c25

                          SHA512

                          a9d5c9cac8b24cb38ab7f63e6a591d0f767f286e13354c05280483d0b23e36ccc5c232f405a08592446d23d247ccaa1742618e8acae98fde8002e629efbb2326

                        • C:\Program Files (x86)\Windows Defender\uk-UA\EppManifest.dll.mui

                          Filesize

                          4KB

                          MD5

                          9175be6ac502e77706a5c9b52e814224

                          SHA1

                          7ffb4d00fa1a72d1579e49d3e189c0edf1f4ef68

                          SHA256

                          4ddf38e7da8accabcf5d77b0598387f55ccc64d8bd0413d67161484c32b96f25

                          SHA512

                          762a80886670eb2565c798dcf7e0af63275601d76dd64ad9dab96cb6501d020929f6aef6552840c87353510a4266063c41567a981cc20ed87f11168c2304b044

                        • C:\Program Files (x86)\Windows Defender\uk-UA\MpAsDesc.dll.mui

                          Filesize

                          57KB

                          MD5

                          629c0bb7fa9bdc16f6b337d1f246d0d6

                          SHA1

                          712dadb1e5fb7749efe157576c1090f349f025b4

                          SHA256

                          78c52bc750946bc1ed7b4a86ae2ffc3f86416a784ca34291c52913f17c694cd8

                          SHA512

                          1b44319c95d4ffe9ff454c65a0af059afb985bfbcece85b948af898ddc0e7ca80599d7ae5a06fc93d197f9141cb45c99ad78aa315f4f45ce27bb06b94bd6af38

                        • C:\Program Files (x86)\Windows Media Player\de-DE\WMPMediaSharing.dll.mui

                          Filesize

                          4KB

                          MD5

                          e92354a97635b0298ddfe8180d10f25e

                          SHA1

                          bd0013c2269cc9e5d24b2909939c467606cce88c

                          SHA256

                          c83eb82d787240e7f09e8d59afe84f60c438d8cfb46072ea32437a5c3b6bdf71

                          SHA512

                          6eb5bd18248b1e8892bd0b0cc1093bed3c1a59d0772136f3f04a72bc54b1103055fe67f02cadb1d746899e2850cee260d64e79783335bbba898791175be59ab0

                        • C:\Program Files (x86)\Windows Media Player\de-DE\mpvis.dll.mui

                          Filesize

                          4KB

                          MD5

                          881261664681479de488df7fda45bbd9

                          SHA1

                          6824fd930a53b5e036a4273caf2ed282e10a56fc

                          SHA256

                          5c9efb4119bb244e5f3267fa60167d8295a9a3f9e3d8b25b1773cd2300c1400e

                          SHA512

                          53d52535f1b5934ca18f46b1c9ffbb948052277789d343c24b2b4b7f226ba231de10480acb677d633b8777327981ab0de1f480f6e6412f02a37f3dedc34661b2

                        • C:\Program Files (x86)\Windows Media Player\de-DE\setup_wm.exe.mui

                          Filesize

                          63KB

                          MD5

                          d32100e0d22888cf5f1c04c5aebd72b9

                          SHA1

                          3603ea60d127d551d7d2df711fe7603967249fe6

                          SHA256

                          d637bd343e04c6ed49e9164fc65280c41cf9958c80f1b5b78ed7c83d83503bd3

                          SHA512

                          29b7ac1a246a20441edb6926a4151a65c5d591a467d9f1f5e04911804e46bf0c13d94f8db78bc8ac2133f8d9431ff105a5e6cf569bc407f4cdf0e1637b8bcee7

                        • C:\Program Files (x86)\Windows Media Player\de-DE\wmlaunch.exe.mui

                          Filesize

                          4KB

                          MD5

                          c22d773ffcc19b8d7d7acf0f33ce267a

                          SHA1

                          9a2bb6a1173e9491f85a58b3f5f14e9f5e5d7686

                          SHA256

                          5c2e0c9eba38fbfd57ee4223759d1b37cd29fbe418f373e9799f4db03ff8aeae

                          SHA512

                          462106b2308c9089a035c8fb5ba64212ed8333921a16a3f8f469af8c5e1d2be4b41d90959f5a5e3104ff46b11f510a0456d350f656c7c16d543f3a18e321a5cf

                        • C:\Program Files (x86)\Windows Media Player\de-DE\wmplayer.exe.mui

                          Filesize

                          4KB

                          MD5

                          7f35d92e7dd561cb7bbe4afe219cbb04

                          SHA1

                          cb8793148d7d00ea75fa691924c2c17feee7e1fa

                          SHA256

                          ac55abe62ae4e036763c9ab8a31e68e762d979b1a1acea6854cbde868f307730

                          SHA512

                          1471d1bd33d97713ddeff74e05dcd22dfb30feab667dfbde025fadf161d15947634de92d28aa49bc19395a560ef291e1de1d12abe8220a8accaa7dadbc008d69

                        • C:\Program Files (x86)\Windows Media Player\de-DE\wmpnssci.dll.mui

                          Filesize

                          6KB

                          MD5

                          bf573738fb1d7355c9c9b561182e7052

                          SHA1

                          68bc74a7382bb927035a712638e0ffad31d202d7

                          SHA256

                          29789bdcd94e3ae45534ae75d14775d50cd069af7b56f168f55320a596ece51b

                          SHA512

                          78526e0de9773c1434c64caa4091bf7586326c0974a34d79508a8e45f71f78f30a475d927d8322d3745d362a95b1326f994156691149a4a9f5bd770a1a34e5aa

                        • C:\Program Files (x86)\Windows Media Player\de-DE\wmpnssui.dll.mui

                          Filesize

                          4KB

                          MD5

                          7c39f0567b261bb0b86082edd6126f07

                          SHA1

                          56933b64a31db9afcd959e86d9b049d67ff04c3a

                          SHA256

                          13b0d21c7f151f961aaebe8c426e90f69a49fc620ca7f1eb7d37e70947ddb826

                          SHA512

                          a9a681716898bff79a0b1211ed3971e63bc56c92c09dd75fb7320d9cd64853443d594a1fc3b3bb37584d79612704f31f5d703cdd70d2f68b72c28560552e4bdc

                        • C:\Program Files (x86)\Windows Media Player\en-US\WMPMediaSharing.dll.mui

                          Filesize

                          4KB

                          MD5

                          b2e9145f069ab3079d27a8b3e0b7b64f

                          SHA1

                          8cd33daca5a3139dd6200e2ae0e88036c6b92c17

                          SHA256

                          d7b18377fb33e84d64da28af8b875a8c60f7ad5a7a9bedecb105ba35ffe931d9

                          SHA512

                          d4f7562d22d8789cf2d610c897eb1de5c12b5d88b716146207a3a36e7626baad1728519204b621cb3ea7e32109081b8d2731ee74fe456ce17b06d119ea0d4495

                        • C:\Program Files (x86)\Windows Media Player\en-US\mpvis.dll.mui

                          Filesize

                          4KB

                          MD5

                          be86ac0a364d7b6ca52eb34d2a86cd82

                          SHA1

                          3108368c4f41063db2e7125fab789a72764fad83

                          SHA256

                          40e6f64f16ce213b8ffde46b90330069a1b40f53bc78002b1308cae37666f81b

                          SHA512

                          d3cd23f16ed20c32f2342f6e9781421988df783276b3ad8a3375bb8f6477855e829b389fdff840fb202b8f816e5af6058f6fdb26421069e889002713185553e0

                        • C:\Program Files (x86)\Windows Media Player\en-US\setup_wm.exe.mui

                          Filesize

                          55KB

                          MD5

                          ed41cdaef117ff4eee8f1a49867fed3b

                          SHA1

                          5826653ce78d33eb079475352b3aabc9b4e0d919

                          SHA256

                          aa967408f116c47609581ecaa8b37e67d7bb975f8ee86b6b0fb9823e625bce35

                          SHA512

                          85ab7ff40d255601307db0f77674d9be59a1686399506df00ca8f3ba4b2df87cc85b7d5990a2aecdfe805121fae8a8d8fa09b2d5be1a134c93fbd82c652b380f

                        • C:\Program Files (x86)\Windows Media Player\en-US\wmplayer.exe.mui

                          Filesize

                          4KB

                          MD5

                          3239930e72d6f7665c2069eb00e11072

                          SHA1

                          f2e36a74ad61a4abfcc825bd3f4b015187e4c7e6

                          SHA256

                          ef16f5ea9ac4bcd23528946e4b272be693a0186608328e09f3fb5a2670941c79

                          SHA512

                          29a8877bddc58d13b71f26a89575de3e31227e8c6fa75796d1a98dc870a13e509386893b9393787bc28512fe042648ed2017fc07057bf6b5fbc0724c11e07ad0

                        • C:\Program Files (x86)\Windows Media Player\en-US\wmpnssci.dll.mui

                          Filesize

                          6KB

                          MD5

                          f304134861b0fa2c072084fee10392d1

                          SHA1

                          20fd6fdd97538067df6dab6d44fb9a78e02385f1

                          SHA256

                          f96b5bf1cde99c5170b74fc50032739459cef2f91cfd86e51299a5a83c4e4942

                          SHA512

                          dfb957e927c6edb1dc798de48f5ee59d0948719f602a739d3a3043ac60a6e53968856a403f34674fbc8c55581957fc1833a3e14d81c3b98983ec3785673b8307

                        • C:\Program Files (x86)\Windows Media Player\en-US\wmpnssui.dll.mui

                          Filesize

                          4KB

                          MD5

                          cdea2fadd61653301d11db2bc7333997

                          SHA1

                          674593baa700626726bcfc2300587b5e6eaa3ede

                          SHA256

                          a7a0d00475e185fc4a5aed49dcbf79429813a127da5db7d147642b7496a98641

                          SHA512

                          2bfc6914a1f3c7bf6c7d7d404821848f58e28c83dacfa6bbf3f4f54852bfed3d9c3521013b79752cc575147a4729d10e349c14eb789d076ded374d9aeac6ccea

                        • C:\Program Files (x86)\Windows Media Player\es-ES\WMPMediaSharing.dll.mui

                          Filesize

                          4KB

                          MD5

                          db2ca78f6a5fb92f6c63c6117b73590d

                          SHA1

                          928df76a5022be7c9daf1dddd40895c690cee4a6

                          SHA256

                          cb9830bc46335b666a14f22659436c8dd25136500e6dd7a3a5fb8ea5b949a22d

                          SHA512

                          50d9b7f373066605e05c47e4b62f6c2592724b9bc42ef2b7bf606f4af1892e8dcedc90a47f2e97dbc8150b4c29d7a192853a48e386cc8ec2c614f2d08ca5a1a2

                        • C:\Program Files (x86)\Windows Media Player\es-ES\mpvis.dll.mui

                          Filesize

                          4KB

                          MD5

                          a9daac284b676b2c32658bfe8450e682

                          SHA1

                          acb7f30574269d693dbee5e1b7ba42ea3a880fe6

                          SHA256

                          97dfa78536223cd4eeb34042d863fb24cbb43d8e9653e8a484f8c4ec99bb9db5

                          SHA512

                          092f7956fc899e46305812c83eb7b8ac1e33849336591425ce15ff9c40950f2154fb6092b290f2d286e2528548ad3f88c67808004c3ab429c2d292b4b9b5e018

                        • C:\Program Files (x86)\Windows Media Player\es-ES\setup_wm.exe.mui

                          Filesize

                          63KB

                          MD5

                          353591f440db1055b6e2c043e8fb2977

                          SHA1

                          2666bb0b623cb55a46d166d748834b3948e35280

                          SHA256

                          0e65d5fe1d0e82d5464d3cb15dfd75503594c51161017985d16ee7e9ce615ffb

                          SHA512

                          68a21c570cf0d718666085607d3ee96d009832ba1d97099ac186b690a07dca1792ca5ae7eb70121f2bce8d43ce3ebbbca97f2bebd68d4cc4cb6d111a9a3f9db3

                        • C:\Program Files (x86)\Windows Media Player\es-ES\wmlaunch.exe.mui

                          Filesize

                          4KB

                          MD5

                          058bbc5c308f7e0be49de59dbd8ce09e

                          SHA1

                          030a7964dda57fecdbe21263f66b81d72c059d94

                          SHA256

                          aaa95a7810e3e957f4642ed58207051bca8532652c9415163b82f7c1adc45dbe

                          SHA512

                          63a249622d067669915a0eea26da56e18de5f68972b27ba6deec24dfb42a61ace41dd9b28c139fb1eafa291977af44d73471252744ad5d68af7c853cc7ee4a53

                        • C:\Program Files (x86)\Windows Media Player\es-ES\wmplayer.exe.mui

                          Filesize

                          5KB

                          MD5

                          94d71012cc3d725ae694012e9dd44d96

                          SHA1

                          0c4067cae5d304ef639ad3d150495abf1786936a

                          SHA256

                          12ed7e963dc2c92133c5c882ac042663943534e08130a5b6fa7c493a141b7232

                          SHA512

                          c125bfcf73b955c0043b1d80081b390ecf4b7332c2d25800e006b5ad4e5b4884dd8e613e7c5fa0250545e0f1f3d4bca29c6bbd47c058ced0ea18755edd157c31

                        • C:\Program Files (x86)\Windows Media Player\es-ES\wmpnssci.dll.mui

                          Filesize

                          6KB

                          MD5

                          52d40feb167a44da9fc23ec6aa8d09ef

                          SHA1

                          165e9e774d8c3b915994964566a1f952e0f957c2

                          SHA256

                          496b279334979f2960ecd90dcc2eef0a524f3a1ef4edfb574593fd559f332ba0

                          SHA512

                          80ac6f633eaa6922ed2df7994469468ded34c1437943b6759cc8259a890576f2b01e1e071f87bdb0f068093ddb315d3d9cd4c207f0bf08f1d57202c37b5f909b

                        • C:\Program Files (x86)\Windows Media Player\es-ES\wmpnssui.dll.mui

                          Filesize

                          5KB

                          MD5

                          79891adad63feded837c07e912632f5f

                          SHA1

                          4990c6cc75df578fd692a3cbe51a632ad5127911

                          SHA256

                          ff30309e7314f9d719accbdd4d20b625fee1c031ffea4d23309ded0bf4e3c2bc

                          SHA512

                          ae20185f356638b604179b4432aa118cf5d49c5172d589eabb77602bf89d0cc724cdc2ec6b8db50ae96bdde535ba4b246199ca8a6ed4e032a2032b2c9cf7c87e

                        • C:\Program Files (x86)\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui

                          Filesize

                          4KB

                          MD5

                          fcb493440e5a0a97d5fd1c30f2c35624

                          SHA1

                          509d638153f77d7ac2b5ffad8d095cb7b37b8d38

                          SHA256

                          77d65dac8fcb6543cea025667f0ea43680026bc185335f5f54068f1effc31220

                          SHA512

                          11bf9759660d1f1e6be57bd39663e7fa22293e929e8b21918a4ab129de03de8a56563383cc8e9e951ec0339e3fa3ba73ed2fb53dd5f3137b435874a810031a24

                        • C:\Program Files (x86)\Windows Media Player\fr-FR\mpvis.dll.mui

                          Filesize

                          4KB

                          MD5

                          8e9804e5776e80c9a0fdc90a6241e39b

                          SHA1

                          744baa37376fb7346f1e4abc81c548646f556849

                          SHA256

                          61040d4665e3599bcd9c6d3212178eb2afd9b52d67f11b7a808c17f3da704da8

                          SHA512

                          ffa605ab5f7dfb485071f3d8da64f72f46d191826380fe846dad0777459a4d0f73405886856154cc5c06d93ab36c4094dd48ea355451bb107168f68ad80336d9

                        • C:\Program Files (x86)\Windows Media Player\fr-FR\setup_wm.exe.mui

                          Filesize

                          65KB

                          MD5

                          fbfbbac46b4036166810356fde364259

                          SHA1

                          a3eb9091275e9ec61a86189638dfa37bdd21c017

                          SHA256

                          769bb3f25112d39422d08b8067628534a626e91bdcf7fad8d611fd438eca5319

                          SHA512

                          dbf2745f6657cb7e104e7ce22b8315f1c754f1c60f579741561799c1643c141684a51deae3ab73b354c5b54ffe430393082be78ea9e635658165e4672dc5df0c

                        • C:\Program Files (x86)\Windows Media Player\fr-FR\wmlaunch.exe.mui

                          Filesize

                          4KB

                          MD5

                          9ea7af1d5f2a4a462632d98f7d20cf2e

                          SHA1

                          697e02064075fab4da6ef7f18840d400d7234c23

                          SHA256

                          f038da91abb3cb5e8d2c879f264dde45d452ee492d6f9f195b91654873449d0b

                          SHA512

                          45104822078bfae7651285817796c37db2c4241df3c301992f88f34ec78f764b1abbd80f4a69dc23cbac9634594f8e05851f4910166f1a954640762b7eddfdf2

                        • C:\Program Files (x86)\Windows Media Player\fr-FR\wmplayer.exe.mui

                          Filesize

                          4KB

                          MD5

                          895b02fc3602407cb568a0aac571a7c9

                          SHA1

                          0ab5277cc10b331f0a82e9644468afcd34a2a3d3

                          SHA256

                          6d15500fcb409547539648b719ce418f337756c1fa6800d54ece03b179568dc5

                          SHA512

                          9e52ff9e69a351820c2f3c4a007ab622bae41d815d3d246407e7f8d8ac0e6299c8de6b43e8d98a529e14fc1361f0d0da08f1eba322007dd0662c52e0a6a27e8f

                        • C:\Program Files (x86)\Windows Media Player\fr-FR\wmpnssci.dll.mui

                          Filesize

                          6KB

                          MD5

                          e2ef54c483f8a7540fec444ac22c6d75

                          SHA1

                          b99b3314b1b37554e0a07ce1dd189731af6e73e5

                          SHA256

                          64983037af68d376b9b58ba8ae08afd62efc61a6bcb0c0925545b2d7517b10d9

                          SHA512

                          698f50fe7bfc42150dc6c0289f2fe49d36b192b0e2469476be6b770c823c639cdbfa387ccd3236f2f85e12b57f43079aded67a1c84dfd4d18e419a32b2570f73

                        • C:\Program Files (x86)\Windows Media Player\fr-FR\wmpnssui.dll.mui

                          Filesize

                          5KB

                          MD5

                          2d2908dc6a9fc5d94b69ebec7448fbdc

                          SHA1

                          2e17f36c00b9be0050aa8c94d91665dc26c95f37

                          SHA256

                          76b435a30eeebee6f40ecb937e41d8bebf97d7c1afafa36ee91d9870679586d6

                          SHA512

                          3d827a5e275686d0d79fc382e0a8d4645612fb8d00fad1666989dc6633b404cc59623c6e5dba34292d23eca08c28433dca588a5fb51fc3063b80e8edf3cfc91b

                        • C:\Program Files (x86)\Windows Media Player\it-IT\WMPMediaSharing.dll.mui

                          Filesize

                          4KB

                          MD5

                          8aa4866627fb87d0687e5186cf8d0fbd

                          SHA1

                          c485dab3744bd6cb60d0c3c772ff2e44bcaee5e9

                          SHA256

                          7f6aad2d0da993612e00456b4f56414708a21a69765d46d382bf2075de802fdd

                          SHA512

                          967a8e7a06fd73748384cdee7ce1d3b63522965e6d804036b1fd5979c11f29f38bdbee50b2f0d5ebc6fbf1aa28262d48fb939455836cf94552391d30b0d4c1eb

                        • C:\Program Files (x86)\Windows Media Player\it-IT\mpvis.dll.mui

                          Filesize

                          4KB

                          MD5

                          acb6f90c15b9f37258b2f2dc57a23bc3

                          SHA1

                          89c7c04866303cb4a6664e1566ccf544ef0c5c79

                          SHA256

                          701dfcfe36a2eff3f76affb0da2dc8ea2ec2f6cf42a201345da05c3b6f127068

                          SHA512

                          e60631605918e3a3ddaf1c6c9e6cce345a5b502b3e901ce7ff81675c734d72f7e8689040f9953460ac16fe238b83ad6ad0ea4ee6989967d8534ce428c94e3827

                        • C:\Program Files (x86)\Windows Media Player\it-IT\setup_wm.exe.mui

                          Filesize

                          63KB

                          MD5

                          be7909289e27cf652df83b9e61657b4c

                          SHA1

                          f850574e79216740535d5c8316195d377e4eadb0

                          SHA256

                          a1493cdddf601faa8d117f2e3c09f11df5294f499a838377bb737ecdd55ad360

                          SHA512

                          132923fcb18b70190a145b57539fcd25128319c6b5b9b52e3c313962c125e95479212b747f776c6bad734f67dc67d5957319fa788c0c75bbde32ba949f632a4e

                        • C:\Program Files (x86)\Windows Media Player\it-IT\wmlaunch.exe.mui

                          Filesize

                          4KB

                          MD5

                          3121592a712325a76568045d64b31b70

                          SHA1

                          45005cc33303e6f2e58e66de0d0ebbbdb31234df

                          SHA256

                          3dfd3f8b7b98c819b06e7477e2ac0fe0233425da6754f3eff71b1a362f21dbf8

                          SHA512

                          ec757db0e33a9ae1f81a51967a240dfc9a0a940f116f3b3f6a55f5b29ba31681066d7cdd6b107299c4ec52ab21ea8d6cdb440609f85b184856c2dfbe808cc8f2

                        • C:\Program Files (x86)\Windows Media Player\it-IT\wmplayer.exe.mui

                          Filesize

                          4KB

                          MD5

                          f02c0fe8a061c7aa378f5f2c7b7c3e43

                          SHA1

                          816d313358490fd35edcb666f2722579c9aff41d

                          SHA256

                          aa70bcd26b9e837523f10b1a3d3499a00c26a479a547c30f8f9b4d85fb6d2997

                          SHA512

                          b0c2eb0e6fa22e7ade335d583d0cf282bbf78bd9ed05d00efb5e114598fc476bd8d7dcf5f8ec8eb9cb50e197a4f91305eb4cb2084d7038a71225262ab810b607

                        • C:\Program Files (x86)\Windows Media Player\it-IT\wmpnssci.dll.mui

                          Filesize

                          6KB

                          MD5

                          5f3641fdfcab5f8f35824af5c8f0b566

                          SHA1

                          f8a8816b97a3905661936091170cc716d0fbdee7

                          SHA256

                          d789793e0e3d5830df05c11280d54539a7bff65f4c5cba9d2ececaf16fcc679a

                          SHA512

                          3d0926ffe3b4614aef03c4b0264623010738577d3b4d922b7017779d7604fc7359a6fe9bbef9efc5d571ae9cba991484a39144ddb05b0bf2f4520ab6a201020c

                        • C:\Program Files (x86)\Windows Media Player\it-IT\wmpnssui.dll.mui

                          Filesize

                          4KB

                          MD5

                          ded39800fa79e962c4154a05f6119c64

                          SHA1

                          b91eee3a49443b2aa8004e549c4b07a1670b6069

                          SHA256

                          82be96464387cb9dd1d8f59563d46085e4158a0933aeba2b2138902f641d0bbd

                          SHA512

                          79cff2ee0b607b36fa0d7d11044d3f2d8fbc7130531ff28ca552a0846e9c6e0f341a14d7caa45c15f1048192ce1d12503ee7a3bbd4a8aa64f8ac2b68701858b6

                        • C:\Program Files (x86)\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui

                          Filesize

                          4KB

                          MD5

                          9b7f5f9a472b8690668f2033e7bc3a33

                          SHA1

                          e9b5fd71d71a54398863c5b12f151c07e3f7fb15

                          SHA256

                          9de331702464b51a9dae5e715fec2dd2ae3fb53e35f17b8e5d5141bf4db6f7d6

                          SHA512

                          8d7a5176d5c47af2ba7b57f7781badd3c95d041ea2a6227fd110f78fd0a3add6e77ab8c5fe84969de4314ba323a9f79cddc5b3b89594e993e3a3de28fc23c4b7

                        • C:\Program Files (x86)\Windows Media Player\ja-JP\mpvis.dll.mui

                          Filesize

                          4KB

                          MD5

                          3253e46b703fed233043ecbc63ff2ddf

                          SHA1

                          8550955509dcc7c002d9a7a75daf35a6d469cdd9

                          SHA256

                          4697555ea3d5ade18a573d7cd69e21370b8da1841b02aa5998171ff124bc033a

                          SHA512

                          b52e4b3215373ed6d28921758c836d88679cb0597a7e44ef1a4c86abdc77b2e71ad706ed38df229c1c0aaae503dbacddcf9e3052419f002614489624a8439ef5

                        • C:\Program Files (x86)\Windows Media Player\ja-JP\setup_wm.exe.mui

                          Filesize

                          41KB

                          MD5

                          aa60b7aafb422f8e4efb397ee1c8c830

                          SHA1

                          66845284670ca85ef1bdc8ccde4e3d6516978a15

                          SHA256

                          be3c76aa353c40c0df9218cdd1c90c93df42f27bae2bc2789bf34aef520ca699

                          SHA512

                          b245fa648658d39595a87a5c24392d38a0ba8d168113f0a3cca3fc13a29887f0955629f562a6fc10352e1ca4e5e959b2ae507382d543a0ca5a8629222ed0963a

                        • C:\Program Files (x86)\Windows Media Player\ja-JP\wmlaunch.exe.mui

                          Filesize

                          4KB

                          MD5

                          cd403f0db181f1078be4c6804a3b6ebf

                          SHA1

                          8f639d9986fb90515a8458b12680fa54ac0275f5

                          SHA256

                          c5c631371cc580a7ee1ff5092a56e5ad1961ca63b6c462d9476a219000134176

                          SHA512

                          516e1c638845298b3aa11fb1363a2a14c5d523ecf5ae004e29e954d053de4f5708b8a594dac99d2fce8fde7df02453c0b1e97b59b502ae3e74560fb057ea415a

                        • C:\Program Files (x86)\Windows Media Player\ja-JP\wmplayer.exe.mui

                          Filesize

                          4KB

                          MD5

                          81b9661c5395710e3b57a9c51c07a38a

                          SHA1

                          187477e09afdcba7195d1d768f1c5b7727aaa76f

                          SHA256

                          cd40c0faa2f0c9b80be2148b3a223c80377bb16df0987f972c47b943f20fe2eb

                          SHA512

                          d67f16ca6bcd68a958146d8d9e2746c16c9f768d9d9b4d44f951e5dfcdbe590f9fffe27bc4e1a4316386b6ce720eb96f348e3b78d41bbe903d923f04cda929f9

                        • C:\Program Files (x86)\Windows Media Player\ja-JP\wmpnssci.dll.mui

                          Filesize

                          5KB

                          MD5

                          6d13cf4609353386ff626c824cf49da0

                          SHA1

                          d0e3197470b54baab945fa30d645db02714a9579

                          SHA256

                          abb3f72513531756a60b111f557a5fdcc7a8594ae0d5aabae26152289bf1f307

                          SHA512

                          6fa7ad9afab099b855110f13cd1ef7bd52ca41481fe4fbdf247625e8ada7e9dc1c3979e6432a1ccfd748bb6fc618c4e6f3ff45b5502d5cc9ea222fd69a266826

                        • C:\Program Files (x86)\Windows Media Player\ja-JP\wmpnssui.dll.mui

                          Filesize

                          4KB

                          MD5

                          237241d3d8fb2a493966346a605ee839

                          SHA1

                          28d9f751b8ef29474e5d0157b2e1ed9f46d42fec

                          SHA256

                          ce1ddca2c7babdaed64cad5e994570fd7a996c89c4e63e7d09d34e01a0965fbf

                          SHA512

                          8436fd9077d7f0a50d3112bf1f79ce95d5e3300970da99ceeb71fdaf7ff915541d8b6dd90b4ee61b91471874cd1b7635deaf50e1787a28694f6a149c2f09a26c

                        • C:\Program Files (x86)\Windows Media Player\uk-UA\mpvis.dll.mui

                          Filesize

                          4KB

                          MD5

                          831d460e6267f09f67d02cf04fdf7485

                          SHA1

                          624d7be5aa35208d973cce4a61f229740cc3900e

                          SHA256

                          7d54f66ea0c132e644f3e72c7ebcd396ca83e005e522d083858ba569c1df92bf

                          SHA512

                          ada4017d10d1cce95d5873da4735bc308358edc4ba1fdbe73ddc84d7f192fb7e2107e7bd897f6838dd48dbe48c7c2ac1d8a7391b4f0b61e16af7a48703028be2

                        • C:\Program Files (x86)\Windows Media Player\uk-UA\setup_wm.exe.mui

                          Filesize

                          58KB

                          MD5

                          c7a5fecbf4a7464a33aa15ed862ca047

                          SHA1

                          ff440994f3a39dbd8fbf260e6440bc15bf061f6b

                          SHA256

                          e7a33f2a8f86fe974d4fb935489c0fd25850457a578fbf7985ca7dd4d9e02ab1

                          SHA512

                          b15f2e7f131d220bc7eac18b08c9b38442624f9534b36f4f1f0010fb8dc4c9c6b0ef0ebea4d0879ac42458778f7ce003a7c81942e06b07274489e2470949bb55

                        • C:\Program Files\Restore-My-Files.txt

                          Filesize

                          1KB

                          MD5

                          ad49c9e7e6cfbfd8af68c07916dec3fb

                          SHA1

                          1b9423c204ca97aa17a222748f1ce4a4ab976522

                          SHA256

                          2062c18fb5dd37d2d258f0a17ea7e3a8397bcc2bb8e03b00a5dc19c57af606b6

                          SHA512

                          f71188c14fa42253a1e003b25056f7c8bce01d5afe96322fae8b9e1d915ad818c6be9c633f90bc345307681a2bc087c3b76218661e313a409bf11f56bcb68f43

                        • C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_133.0.3065.69_neutral__8wekyb3d8bbwe\AppxBlockMap.xml

                          Filesize

                          2KB

                          MD5

                          22623df239bccad9996902a90c7eda16

                          SHA1

                          8332c40ab7dfc222da29c59ec344e7da4d0fae2f

                          SHA256

                          66ca8b6ca3f405f555001934e9ecb330005105ab5993056d5692d37880d296d0

                          SHA512

                          e5bcd6b5bbc5237d42f9636807ded468dd14003fac23cf7c787243512c91e36f03a19277c2511ee316857a4469e93d7a0e8e36a4bd28e53312add89b457460e6

                        • C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_133.0.3065.69_neutral__8wekyb3d8bbwe\AppxManifest.xml

                          Filesize

                          4KB

                          MD5

                          92f0eaccd0682a34044a737dcc690b09

                          SHA1

                          03f98df9bfe98404d2034da47af81753f253bdb1

                          SHA256

                          c39550bb781ef84b830eed4ee7bf9e320946dbd8878cb93139d0f68769fbd100

                          SHA512

                          1b86ad22e781c7f9283ebb6d1d2573dd358c15d667a8ccf26475a201fc0c9d13c59088c7b2e2d368b970221d4e1c74d3dc3e30310b566e3acff6fb0aac805821

                        • C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_133.0.3065.69_neutral__8wekyb3d8bbwe\AppxSignature.p7x

                          Filesize

                          11KB

                          MD5

                          dba03c90486bc75e7f7c7c2d74b166cd

                          SHA1

                          38ad19e0e8dadce50d95339ea2ed132eec6aeb7b

                          SHA256

                          557e77f7a97cab1dce3d786c1494d399d05be35f5559ceadba97072e5884eae0

                          SHA512

                          7d050fddd9629f1a304c827f23747fd3adaff171437e63b68a050797997932c939d19a2d0f0fe44280044ca78f39d7734cabab6b9af290aba8cbe516fdc6ed99

                        • C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_133.0.3065.69_neutral__8wekyb3d8bbwe\Logo.png

                          Filesize

                          33KB

                          MD5

                          0661e74cf9283be5c989e264dcb652b4

                          SHA1

                          768ee9180b17887d66607bab27b9eeab13eb2032

                          SHA256

                          e42521c371177f81d9892f662fe5e387cbf899268f86de38d1bee07a9c357579

                          SHA512

                          2eca6b1285152e0ceda0309ee4d36b2345d35c85942a26d7e80df460e15ac2dca1fda4c75365b86e2bb48f23ca82e309565ad162a64b31f668858c0378f0e2c2

                        • C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_133.0.3065.69_neutral__8wekyb3d8bbwe\SmallLogo.png

                          Filesize

                          17KB

                          MD5

                          3eac3e788d07a9d38a9e777939ec024f

                          SHA1

                          698c4c9919264c28594f76b6938680db27d4e4c5

                          SHA256

                          7816b6851a51924de3976c69d584e63c8e4da3beda01822b46e6d9a149677d55

                          SHA512

                          7586aaa6ec8152d1362bca8c2a1c6cfc88110088133bbf7356043455e1ff3951e070eb865cdd39939b7b116ade4cc93501dc080f534f85c57e8993d44c233574