Malware Analysis Report

2025-05-05 20:48

Sample ID 250418-lmqctazvdv
Target 2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit
SHA256 2c9bb93dc2c9f841e58db43ba7dedd490cf7e0fd9e66c4b56a888e25e93a510c
Tags
lockbit defense_evasion discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2c9bb93dc2c9f841e58db43ba7dedd490cf7e0fd9e66c4b56a888e25e93a510c

Threat Level: Known bad

The file 2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit was found to be: Known bad.

Malicious Activity Summary

lockbit defense_evasion discovery ransomware spyware stealer

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit family

Renames multiple (7596) files with added filename extension

Renames multiple (7506) files with added filename extension

Reads user/profile data of web browsers

Checks computer location settings

Deletes itself

Executes dropped EXE

Indicator Removal: File Deletion

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: RenamesItself

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-04-18 09:39

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-04-18 09:39

Reported

2025-04-18 09:41

Platform

win10v2004-20250313-en

Max time kernel

104s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe"

Signatures

Renames multiple (7596) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation C:\ProgramData\B75.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\B75.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\B75.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1279544337-3716153908-718418795-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1279544337-3716153908-718418795-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close_h2x.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\HoloAssets\HoloLens_HeadTracking.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\RICEPAPR.INF C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\ui-strings.js.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_bow.png.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Dark.scale-300.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-20_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tl.gif.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlCone.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailMediumTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-Regular.otf.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-sl\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-64_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\sr-cyrl-cs\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\MicrosoftAccount.scale-140.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOSBI.TTF.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\is.txt.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\improved-office-to-pdf.png.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-30_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\it-it\ui-strings.js.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\tr.pak C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AGMGPUOptIn.ini.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluEmptyStateCCFiles_280x192.svg.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\FlightedFeatures.json C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-36.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\B75.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe

"C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe"

C:\ProgramData\B75.tmp

"C:\ProgramData\B75.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B75.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 c.pki.goog udp
NL 173.194.69.94:80 c.pki.goog tcp

Files

memory/4484-1-0x0000000002790000-0x00000000027A0000-memory.dmp

memory/4484-2-0x0000000002790000-0x00000000027A0000-memory.dmp

memory/4484-0-0x0000000002790000-0x00000000027A0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1279544337-3716153908-718418795-1000\EEEEEEEEEEE

MD5 eb124b5c772abb630b3c1339480328ed
SHA1 b73d860f5e24eb7da4d7c375c00c5c823de942e8
SHA256 d6e5042df7829c4ae6826ad05df4584a76de0dda49f5312b2ad24098219c1157
SHA512 35d3a0ffa3cc602066d14f40c5fd8bd8273712334a8de1435d74c96368a13549be4a3e29c8fa7546485f45302a9a2228096eb672fac041ee27fc9cfccf97b28c

F:\$RECYCLE.BIN\S-1-5-21-1279544337-3716153908-718418795-1000\DDDDDDDDDDD

MD5 40e1a98fbad299b29dc394de9dbea7f0
SHA1 bbd25c259748548f12617edcfa08274b777d9207
SHA256 c9ae58f40dc9f813ee6e0622b7a535a5b90bfc96ee787522be35505ad39fda5c
SHA512 b7340833327b6f11ce566d22319a41d9198231a84a4c4478e7fed22a865b4be75f60643e8a48c47120bc03b83a672c619789b814234e8d4a74c81c7867ef6a36

C:\3T2S47O5t.README.txt

MD5 a614ebc98430a25bc689615a8d71a613
SHA1 f940c2db3c21f1264b05191dabf6dc41d6fb3561
SHA256 7c3de04e7a1d7a44f84994244470f05faca7fd22fd80376414c0c0a596b696f4
SHA512 d7b6192a5d9f3e9535ef14a183aeea85f9a0bb1e624d4a6420b407510102dcd018c83559d4cf6718e6455fbb03ec0256c13ccbaf2336786e94c7ee8b6408e151

memory/4484-8566-0x0000000002790000-0x00000000027A0000-memory.dmp

memory/4484-8565-0x0000000002790000-0x00000000027A0000-memory.dmp

memory/4484-8564-0x0000000002790000-0x00000000027A0000-memory.dmp

C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui

MD5 d62c9ab3f13bd85250a1b2b6a3f66211
SHA1 ca7429d28c92870cf44e4cf981b6e4b236f54cf4
SHA256 e99272ebdbd6da619fb02579956b7fe5c70e9fc5798dc3514817bb9d32f794b8
SHA512 3fd6fa8b2eb825d3cd5b0be9a71a9cbad587836db0847ef4c3f9670c4bbfd8a7ac478873935e66730d470407cb82d9ca1ef5de28bf12cbc9f9ff187a3ec48d29

C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui

MD5 f68bb46896d48629b15a2d422ad59140
SHA1 02252327755a43bc87205445dc6d5cdd41d5bc85
SHA256 e6d44a8af1cafc550476b01b84b0b8b94a6578f5356602db8405aea7373404ec
SHA512 2105b693ddd634c53201f1497a837d4cb2791ccc900679350d5c340946ca3d8ba864caab7d9e742d6271307d4991104a1f03358e67aa17ed3f19a809d22a23c6

C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui

MD5 3394f6ed7097bda2cd48e66c066cccfa
SHA1 c43dc29b112c4b2a5d28269228eea2c4d1760c93
SHA256 cec198c3b7c5eebeb0bf6787c9ab338882c183c6d88171f3a3ba0475e7e2ad73
SHA512 55555e87bd18dfa4bac94794a243c94b6547941d903cb148de896e880e907ec0c71b76dd56896d7cbccf726f2bb97c7c523d34a339ed0cd04be864a67d9fdbb2

C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui

MD5 be3e537b79ad27e0850182b4dda3794b
SHA1 9e8c0464deea183d5fb7b3f78f55b19054f3b396
SHA256 3737a828d44c90184ccdc1e4418722082f3af01812f89a03740eeeab42acba9b
SHA512 51d4cdce7776f52e27c06ebe4fb4200cd9b8cef008b4f0e3370b2a309f39ea5a00d3f5a1bc6fe8b7dc3cc7200402301d77c3ecc081e7fba99dc5e8e5d7cc8728

C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui

MD5 a210e0c33f6c005ec3d816798618c189
SHA1 37636e28928cda65e8e4313cebb9589708a34af6
SHA256 2fe7624e6b13221825345a716ba995e2c2fd18d68567594309812eb6436e280f
SHA512 b2752a1193331efa404dc84fa8e885f6852c4f181ad2f78966995b83ace743fb5d2ed4c41555c172f0d5480e1b19567be33c072242028df48d704ed18e634399

C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui

MD5 173ca4dc1844e8603fb6cbc50613222a
SHA1 8d5a13cb61bac575032695ccf040c49e8f0bc337
SHA256 52db11e58c9fb9f9eb3f33f427230eff2cb93a76d4a74c1972cda9a2499d72b8
SHA512 22f9325fabce292b5822db1ac25a0a2dc0eeb72083e7692ba138e45e4a6b4343c565486e062f4cf28abe3cfb329a390c04bf7bdf313a639132b46140c468e051

C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui

MD5 9cda469464d4b0cc9ca59f78b9822b43
SHA1 7e224f7b6696a43ee2ebc084aab09180336f0523
SHA256 5aacf00d1ac24e2bf3ea14575b889f8835486102aaaa0f1bee0868f2088aa010
SHA512 125b71ae882c941f8488e3a7e8d01b438900d7ffa1a69ac3cb91f5358c89e5e9975090562eb76132f12b4c73ca030a0f51bc8e4c8a638dfbeb257c3f4c2a2397

C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui

MD5 4ed0fe201fad0fa7a71acfea0f00d4ca
SHA1 77ff4dd043619c4be60e5a35b796f43bf410804b
SHA256 d2ae5b70baf3837199ce805706fc4798c23319f9bf3947a418b08cd51fd12d96
SHA512 818090d17ac3d2283a9ef917338f8e0d3920031b28ac2c3f6bfd41ff5341749c83d6dcd78026451738861cc72e9236e0feee3c8371b026115f6650b070c53bf4

C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui

MD5 b1b331da944b0f4b07612db2c1f9fda2
SHA1 393366e76d7ef7b3205a81a3b7287101b4a7d17b
SHA256 e825cd9ffa466557ca6fc0ac82c5688da892b83cb12259c0f22ed0908fe935cd
SHA512 4ab81d4bd9418ab8e0e1df4169407a8ff40b9c819dd3dc986025d32ac69efdb6adc866fe4ee79370a7d190bf940cb27b6a50038659e6048e183071e73ffbcfe7

C:\Program Files\Windows Media Player\uk-UA\wmplayer.exe.mui

MD5 369332700fbf9a4123f69f04eac803e4
SHA1 709582d1546b0875e1b2514b87dfc93dd8798c59
SHA256 4baeafbf8aa03c634c131a84aac18f9d3f7ae1ae1a516313e5dc550b46e11074
SHA512 72c33718d223a343fcca7aa705ed08fe03d742da4687bade8d4f2ea39e729f7c14629160e19fac227601b8893fe9486d44d6f862223b69579125a3053524eff5

C:\Program Files\Windows Media Player\uk-UA\wmlaunch.exe.mui

MD5 ac85da38ab5f7f8b0a3331ccaa3589f5
SHA1 ed3e41e44f86a1f411b651755e00fc25e6e01984
SHA256 d2c1e4a391ae52e7cbbc2144e62808e7ef49b5ce1893900776855497beb2d2a9
SHA512 22c1dbf7ebee23be2a7f7816e1582a138614354fbe46d1f360ba5f33028b948c6f560dfd81ec2857dd78929df1bd7c90f26fc6bd7ba86a08d2e15745c336d7ee

C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui

MD5 c9e5536e71a79e6c0b08318a730b16d8
SHA1 56d584d6df00fd34b9ba58cb887e3d61237e701a
SHA256 42bb52fa4ff27dfbbcf3adcbd818387322d2fd3a837cf4ac08e273172781da88
SHA512 98b2593dadcf0f1a44ce3e9f3f60767bd72ed5f0ba5b5910ba0b4cef9b3a47ee6e48ab95a6ac842c5d6fd3729abdd078bce6fe1148c1053e2c256804cfb17640

C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui

MD5 53dc2a50db0748a9a408689ea60716c0
SHA1 722b35dae752e4b46ddbe2540bcbaf3ea7c9fa44
SHA256 b18e4b0920207d0fee089b68f22a2c145103729dd47cc1a6d246d5539e1286a8
SHA512 14f9cf92f5aa15b2386b23161358a00acdd1deb1a97ea46f370c3a1d248aa0f2190d1aefc8383c253d21de2c9d9eaf26d4dfbb99210d6accae878ab08aa63068

C:\Program Files\Windows Media Player\uk-UA\wmpnssci.dll.mui

MD5 53eea728654a606c72a6caeed427b41b
SHA1 5aaf10a175ad0ea50a70dfaa9ad1a1fba884a06c
SHA256 2ab87acd92d38d94e615f4e96e840ffe5e3bd24ca4784006c72e9e43dd3141c6
SHA512 a8ab95a8d7cfb604740578d63ee99849adf98bf7f7db660a3f237a106b83c1022f9037c1197cdbd7a071aaabd8d9cc5616a9b2e762b20842cfde42880746e3fa

C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui

MD5 bee0653533e10af1b2c2857f06e4277b
SHA1 01c4014041f0dd2eba80b9542a8e8d924cd1401a
SHA256 1ed1c46e709df4b89852b4b07d2e75ac1d47fe5826657b573472bb76b4a5406f
SHA512 327d4213c1af8af5db45141f36c16537bceeb07bd737e9a28e1f8f0c918feb74d5c273efd570109dbb6b19b0893e6d4e0c681e44ef001aa5cbcaa01ca4f416fb

C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui

MD5 0eb58954eb9ed84caa4259fe93acf7f2
SHA1 c411769e0931b4af66b346b0163e50570e3fccf7
SHA256 c334e14b861aaec594982a9b478510c9b7be16c19070436a7b54c9dc0ba908bc
SHA512 cc0503054aef34f405b4871a4a6c9b7d4514c32f23cd82362205666fdc6a1698828631c2775cbe0d7019454052096e31551dcb4d2730f80b1051ee30d00b908e

C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui

MD5 03c033ad56b0bfd83f55db422f184cf5
SHA1 a23085709e371a5ac9c30e449535313105392f3d
SHA256 2418fc192162a3a28add990fca4ba8981aa242a2575edc261e799831d061d52f
SHA512 9ff2169d75253e8047928fbbfe30c42b56246c8ddb0d910615ba02fe63503811d5bdcc816531441bd31b602d547113b61f17daab46f582491467bba84fc71d57

C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui

MD5 f46202b67f2362d528687f8087e397b6
SHA1 3f458eb75c2d070351f457d3b9ab8aad9255f291
SHA256 66937b3bd20cb6ea18a1485b51f95f217d6174ddb3a0ac6ddf4f25d10972573d
SHA512 20b1c3caeb3a47ef89b8fb1b6676b7b738592eabd005218cdae46f0b2cef4f5a1b8417dafadf1d7ba0e6a65358b126a29fa0f99929ba879a8208add143f58b52

C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui

MD5 ee4f3c8263817e0874948e2df26d8c1e
SHA1 e5275f4c52013f0522c8fbfe38be1114f9fe8128
SHA256 ec09dd832f89a024a271d7f547f44fb308ef81431a4f6c217e6fdf44b60bb5b1
SHA512 1c175776b16410afa53c15bc0ff4ee15613cc6bc3aee0a82308935d324b1b28aee5fdc428e3e99acbbc2bf2b8f41e1a05b4329d6e282197dbbd893579217e2b2

C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui

MD5 237907a7596689a34389d0766119ac08
SHA1 3a96b15fe7ec90c1a1ad70f92eae678c0b425b86
SHA256 90ddb5a3f56a61821b7a6c796eba780b18512c317f53a3dc3b13571e52f2c71f
SHA512 7bf438606e89658d68e2e7e52361ac608dce0a357f9f0d4495b11c686fdb367d93f00dd92080664aae099367415610e6091bf9ad3199ec1a70aeb959dafe210c

C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui

MD5 fe2317f5255f996650e91b2ffba947db
SHA1 2e40f6823ada4b2075cc776d990314346a87815f
SHA256 ed68ac9a4ea8c35e91960848b30b0e8d31ae6fe46e7d0a7923acfb04fe7f31c9
SHA512 8ce5eead72660807d7806697fba04543b146271173d2c334e71fe0436b5dd9bf3edbb25318ad608a91c7f07d279aa775300340340281b47065a7663b9137045c

C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui

MD5 1763fff6fbd5333086630a2b22311bcc
SHA1 56c9a3148f8d1c77bf7e0076c166a2a847b747ef
SHA256 6ba30d26555b18b4f22d817b948814d1ad93eb54792f5b582b8ec9d8e5910f7b
SHA512 7bfaaca679172b5f73027eb2df8dbe9303701ccb5dc59311e39f8a54d8ce5d59997cf9d7ff780dd70e2ec58bae499e8db91713b7c6d9eba9681155f4ab478e51

C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui

MD5 0f7fbbec555eee29d48f2166b264dec7
SHA1 8602296d28174745197851f174809e65b9966c88
SHA256 89815608db74e6d1c50e69f0bf3a76f7e30f803fb37e956a1699c2237b0fe5e6
SHA512 acc85df514b5f3b755f3575b9e4c6f78c305edc79da4894e4bf0723782e6ee39f797cd4f6b0cc1f1f3e49660e94ea685f25ef0c5a7d3607aef1f61fb83e456f8

C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui

MD5 3f423e9a8c4f771cdf48938b642dfd54
SHA1 1ff6d630c978428f7bc1473d704e48d04ebda0d7
SHA256 2bfbf9e2b19df5f1ad8068b7bf603265e8aca957c262177c6d63ab4760910a63
SHA512 35a1d9d4ffac0ab4d70b3e30ce467e42bbe235294ab37b24d440e466dd6e6125d1fd02dd59cb183a4dfe5c9fbd6b8157e4cdc1b33c4868e650d5310b98524c55

C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui

MD5 10b22d6b02ae2d895262aac35e0b309b
SHA1 e9a3b7d49fb0b2db699363518c6733c94d0ef5e5
SHA256 37a3de9cfffa3939b0b858744689c37fce4dfa16d256bf560504b0fbbb327d73
SHA512 06e5e33f7112134630039bf178a4f749d577181d7a0f8199694ad2ee2d79ca1fe11e80c0efd26c021e4bdf8fab5c928c4ed5f660c3c11b3028b03d8b69c0cd29

C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui

MD5 bdee54c0130f20dd418696b8beaf45da
SHA1 0bbafdd452f0cc3e0b7572698498e45beaaf6a40
SHA256 188e7144fd3ad443b84dcd3079ad339cde2334bc238bad42974a5f953fafbe49
SHA512 9d7617f5764678b83d2d48d4513fc93e0227746c630216a6a6c6481842d46e4d9c56f816053f6faff63d71a4440daa279335e2f63b4f3b55d8d8283fd89deb27

C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui

MD5 4079939176f2fa2241f61d3326ad0ec8
SHA1 3ecff7714fa479e72adefd3a52fcf378e07618e5
SHA256 58e668a53bdb5d890e31a069385b7e90fbfda47f43e41713e89c0dc156da43bc
SHA512 a9d783bd6c6dfcf0ef48fa71efb1c8be96f19e92abb3c7fbb487138b19dc4f2b60fca9da203a974b266298d64b6021cf2b2026b88d402ab8f32bf6ab2c45b3a7

C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui

MD5 9cc05f5549d6357aaefd1a4da204c9a4
SHA1 87a7fbd16f9ee258b783be098a0f3f3dfe321e70
SHA256 0188817e4ab42aab8416f83212044cc7b153fcd54906937ba881db535c2e9b1b
SHA512 0cc7a9d24a87879dfcb9bd1346b2162fc0a00411b76de28ee3ed79e8ecde276cbdfddb9a1a099a7644c5989b17650c6f4d50c822d0c53efcd4380b688aa7d2cc

C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui

MD5 0fefd7b695f4b2a3fb095e46b3ccd142
SHA1 48b609e3ea19f7b16ae42bcff6409035069f35b2
SHA256 d0d0d3c0dd93dc386ea0e45bb3258543a2220ce3f40c095d1f0606d4e800471e
SHA512 2a11181d13e57e6ae4c8f9ef85acc0590b0ee5f0ba8faffa3bd36f15b81e8d3de7f781514ea041987f7be21cf9002c3417f6c168643e79671276d49015bd2d1d

C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui

MD5 0b767cc37b54e20dc079cb282406a316
SHA1 d683473fdf36c6f3ecb530d7cb71bb707e268547
SHA256 0c30106b302961d5ffdde2776e8d020423e77d02a6353b146e8e93cccba7dda0
SHA512 63ddb7f23a37dfdba238e907e495d0a61d5365178f29537c7b8ad26f830be00643ac9f93f4d0892964c7eb3c7fb5355eda9180e720babf098303282dbef8b2a7

C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui

MD5 f8d48125a3f77e10d1b492071dc21640
SHA1 e2970d97ed1b92bc93619a6c41ebefeef6f40f53
SHA256 1293aaaf16648945753ab7487055a69e1a86fde8581ee3129ba3faef9ea88a54
SHA512 35005c96d2a07e27ca1106f455db7d7cf3e8eaecb3a38cbc92834b2c51887e78ec7e80170137ceced370b69933d4b7aee3dfdebfa670bef70b6b6573ec3ec338

C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui

MD5 649d33b3e65cfd7f412cc78f8333f3f3
SHA1 fc975b44430c1a42be8686414ab0f1bf3694db48
SHA256 5f0b6a246fab71bc48764630c4db8030a4fc9c878d67240c54bb49c5eebad900
SHA512 8c8f0567ebab49a5441e6ab43df10e370280bb272ff5d94020291f8a1302e0643458dfd99bb5310de288bea21337389b05078f32cd22960f8a5019d888571236

C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui

MD5 ad3c39ebf67ce38d0f95b048bea684f7
SHA1 2d8bdc7babac887b38fab575735fec47ec72117f
SHA256 c592e82e8e9c2364e65228e7c03c7e6c9921ae7c509ed77e71115f66a639f91d
SHA512 0fa711b7e5367127e0f7c66d6ff0fcbba7ca2ca50ee934e7e7f3854a087fbfeca44edd2b78931f553bd4ef6f212a5c0af84802ba30b6c4a7280707a69fd8abb4

C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui

MD5 6aa3b9e89de082fb3adf03087d87d0f1
SHA1 fd495c06fe8e23a111c54da90fdb25117b433156
SHA256 55b9dea7c78db5f83debdf62a2fbe8ea5fe1f665408839be10234340c4f8c32c
SHA512 ae2f797bd49551683ae1c96a8967eb8649a3335bc017e858bffd162180e7fa65c19bc5c94a04ab77d9cbfb916c78553e3fa498445891d40c684e91ccfe6543bd

C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui

MD5 faf58b18dd737d5983e4fb40cadd1eeb
SHA1 441605ae00cc319cf956f24af8c37c0c4b7a1267
SHA256 c13443650775f460d207ab61da2b4cb5171ae39236ef3963d3dfd2324f5c47ec
SHA512 a240e68b266f3bb164a5c7c1dcf07856d8a90a76b5ff0bcec5b8e8ad52892b04b21c429cc4f01fa508b64a7063b425d90f9f959aeab2e2117017ee00f2fe32c3

C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui

MD5 a810f30b8554454bacda55f951ba5d75
SHA1 cfc14aa5a1c3475fdffdafc4d916ce640db0908f
SHA256 484f5035f12b305c8296adca14d249b9d0937607cf389195a77614dd0196fa2d
SHA512 c3f32fe85542395fedac5c3c9d14845e6121775b388ad6c6081e9387e84106c8f15840029a04fb4d28b46193aec3f0d0c085ea99b5d0e420a20aa52e9330d2a8

C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui

MD5 17d42c7121ac8f19ed52b282a7cf3149
SHA1 bbc98f7a2df2cdd7a875664055461a61782fe5d7
SHA256 25abdfcc582671e74c79969d1535be15e2428f24c5fbe84fd507c9ac6ffb723d
SHA512 c71fd8cc44315310bed2bbedb77f5c7a3fd9d28768cf7340e59b05c990885bb3ec3f60d42b87e0dda729a30f9cf3fdbaee75df64167bb77c9c2ecee93cbd05a5

C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui

MD5 95c99436115ffd5ab67ed40c8468adc1
SHA1 351ab4d24c5c96943106ee30119b0d1fd158dd5f
SHA256 643b71ae045dabb600ae51826a7e1525383606332fd54acc28ae5d53a0a9dbed
SHA512 5cc40d57dcb736f8e72a0b31db84560b04bb184a6fbec1ed5e77618beebb01cb4f5003afada0cc18d970cd2d5540d682ffe13b57b3e0bb1bab35c5600572a493

C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui

MD5 84149b54ae67411048210885a46a9543
SHA1 987a1f541a0d69bda9b7d930ebfc64df400307e0
SHA256 501fd8693d1d82f945c59d86f839f0b526d4aeadb7b73e9fe6a1b12c0214cc14
SHA512 f13caa872a64b898a0d8be894881e9d7ad18ed86f3b7286eb7c214d4f57b1584f86cec1d6abd999356b87f0e897deb193deae1a1df553a7436363b6e7989dc83

C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui

MD5 1b4895975da2c97f8f151beea4a3ab17
SHA1 2387aaf5da4c89b407ea7c8a3069b24ac3a3857e
SHA256 01a3c1ac7cf4d5f30ce8b682abb82511c5f3606aa792ffbb06a61e0fd7ec3974
SHA512 585d77e0df674a7ee068dbe56d2f59702df86aeb43c4a2df5a925749c08f87820870b58f5c23ae6b7bf0db770f8f95baef29db9edfcd3753ee4de567d54dd215

C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui

MD5 52994809f22704ca61bd26286ee9b5f2
SHA1 8254a6742b83ab068b49cf955245acd476daa7c1
SHA256 0d1a1eeacbb7b7ff62afcdbe65cdbf58391ed3f59bf991a6fb3d71f177c9154b
SHA512 a46b076c78bb6d5a0414200c676812f71d864aef88faf3742ba181e88472a7a65f7aa15c483f2c7449d4f923ed56f7f5700d6c59e1db712c7c178aec439c3226

C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui

MD5 0033aa3735809e24f6128a0c05555a9b
SHA1 6a227c1195162e861fe873d24c437410f92f8248
SHA256 322e37484e34bf899b081d7331c5480215f08706731d1be0188504bb053d0ef3
SHA512 155047e73a778dddafc80c6a4827b68644de8e42f37bec418db2241524cfaf72d99c56c7151b395418670c038e107de6f5d08a1e64ec5d2023ffb262461ad9aa

C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui

MD5 a9fdd89cf1f5a8a8b6557b6cc90349de
SHA1 357df5dbc275ff41c93ec839952fa93b723eed0c
SHA256 f20aa859e16ed01baaf99d65c001804686e41a97a387438712c63de7d42ffd3a
SHA512 c125ea8bcb848804594534939bc4a7a6ff0c3d6385b866e026eb0587c9e05bdcddeb5a9c3021de720f635b63497633c315f5229e78d2351ea2ae3141fa4535ca

C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui

MD5 abccf98d3db511eef652843b9932c730
SHA1 3cc0e2322ce739bcd54db18f06976fc6b74983e5
SHA256 78eeeee8a86f7e807bd954262e18942f87d3aea19bc897ff50f43973fbd1a7fe
SHA512 8086a5c08ab704b05152759db184746c0799fd2a7d9cd28b17615154769ccee40397b5168b67552d99a71209401007e56e782a61b0fa8fe4f3cf6b975350e81b

C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui

MD5 8a9ac5cc71561287b6c74aa9fb4de923
SHA1 7935db4bb31fe4e305a6ecf7c0f6742e9fdae332
SHA256 80ffe323e435e2e7c018b6ead5385b51a56a9e2fb23e24ea627e906f94722ef7
SHA512 0b5d8435303d37898d0692b376014bd863c047237d873f4c855d620f99b6ff83329fb69ddcc13f8d756116689b7655cb703d416453bbe43148ce534005a98422

C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui

MD5 d02d47072dda7d15e254a6b2aa4d5461
SHA1 ff0e93e8a74f5c07a6f2636cc6087126e6dfef80
SHA256 b2357f6d88b8445f38889fb26643269ee320faa6d50cad8f95f2c2552c9a37c8
SHA512 7e4d9018f66815ac712d1d4fd70f5cba0a4905bbd04b4dba628fff960c1593babfecd94fd4b49d1673bedae4a25ccaf919198d09a1885f8c1a87a08b7b0facf9

C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui

MD5 eb6cbb06ec78ff60d79686f5e9696d67
SHA1 5455ba53a2c8ba56cc8c8dd8fca190dd35c45185
SHA256 721e9b6c6a888846ff3622107890e13553e78483952c5293498332eb63feb294
SHA512 97fdc6886576f8da16d3d449a6383390ba27247c2430016d63f52a41fec7cd21470ea1e64220ecb66cc8398bf89976e6afc7f30d79d38e6a391024bb2f221fcb

C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui

MD5 88f088d3343f1069de578e9ad0bac335
SHA1 bec2525aadaea96d2f339c4ba1e8e603c67cd848
SHA256 aa3b64d8508cb67abafe7419ac7cc9c73b267ccf4fe6651aa6c1e2eefde8c057
SHA512 14127bd90859418db9a55061be3db0f169ef3d4bb61c42e0d1c3943b8e22da026135ca06233a607a6a9e97804c0b11cf31b000c5ed3d0e81756e5dc980ce0ada

C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui

MD5 f3e54b2ed468b166570ac7d1a046b42f
SHA1 c234aa081f62f011d53f00dbe98ad7c27f3138d4
SHA256 914350f099593ffe8f9998be3c88420977017f569585de6acbac2f8ad0aceee7
SHA512 1b5a7892fb84f1763fe3aab1e6435e84b12274694a03eef89b21c5e3ae07bcf928338fd553c6348748b7dc8a2ec16cdeb8f7062ba542a77ec92dfb0eee814821

C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui

MD5 1985d591c345f4a3f6de99c2bbf33f44
SHA1 662fe4649031a7025d18740d268c572915b92c6a
SHA256 d6a10e9dc9b0c0dabc4c43c3a129beb1a44d9eb5e2f911c95d33fb39bb1cf5a6
SHA512 a102203779bbc645f0481cdc5a0dc70eee17860094a5e30957426db21ef94e4dcd560a2a456b0e66206d99a89ed460b4eec382dbc71bdaabe383ecc0b20af102

C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui

MD5 96916c9eafcdca26d080b768b963b2d4
SHA1 d8a723dea8c53e516d8bea82d992b3bafddc0f04
SHA256 5c4974ed65934f68e1007bf3bf67f236db8e6ad908a0c5c8c88184d28bb9398e
SHA512 da68e209a1500f3687d2890c43739a385f3b3066326c3ee9560ec5dc098e2f57a3d5e88338e3cf8582b58678dbe9b7ce18146ca1ddd82d04ca3e709b69865a64

C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui

MD5 7414658bec226b6f9492d36d6c245bc7
SHA1 579818e5d064b8fda8dcf82f257aa8ca3b6b9e61
SHA256 f9e4340d3b82651aba20a7f8f5cc241a7306a5e1f742aa001bb9170164ac06e0
SHA512 d8170e4584fc6b2d9e632ee5ed156b0f5872bffe2871aef1c8dbea8b91b8ffa4f5a3d0e32d0a5a6002267e397027d0fd479b51a6ec251d0e8f5deda47515b3fa

C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui

MD5 6875286bd5ff01d3eb8430dd42215012
SHA1 2150bf30a2533df0c9e0e89786f42b355a02f730
SHA256 4b00953be4ea8eb9d4f392dcfe2198dee8561fc59825303de211d96b45652ba6
SHA512 9f7140ccbdc52ed4ada2b79b94e087c24d36c11057dca2fd0282060208e154f28dca1a2f2ee74151a934d2a34f369c7741f6364836802e83f60998679be10cf9

C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui

MD5 c914616ad535d552ee00157d59c96f45
SHA1 1e8830eceecb24c4586c9bb7143fc32a569ed418
SHA256 ff6b9e034e921102cc16b016eda383cb21935f84854a1435aac8f35ebea97a66
SHA512 ba66021cad1c89400904940494b490b6e1db308465b8f21a613b5e484f51afadb489587cf3255847c3469ea84d6497a873b81b57251b4dc87bcf673d31f57175

C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui

MD5 3d363a4247ccbf97c83e7320d4d5fe78
SHA1 5b2cc306899009fefdafb3eb9a032d7fbf1e8f22
SHA256 efa34e942c80e8c8f93dd1553ee021043ae90799d753ffc70a80072a6b79c314
SHA512 9c39ae85562554c850c6587b71ae52976417a587660937d800e52f1136488694c84584dbf91f7a7cc306a4b7319ec85e8ee8d5ddd069257f434c395dc4a88aac

C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui

MD5 81047a7ecddef3c83946ef82c64c0c54
SHA1 203635d581a7b8e838a35a9c68b98ebf476be1b3
SHA256 1f82b8bbf6f619f5199f37af83db8883f82409f3beee8d8cc7eba39dca2c9f26
SHA512 66d22cf14594fa58638148e2c3beebf72d656611aedd697acc63f1960f842dcf5737e2caead7f480a7d12e1a4c00baa83484e724d6a98fa5d91200c7cd25a913

C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui

MD5 2a6b42d4190a1b8eab9ad54781ddf701
SHA1 ff0f8ec4255da13ce2b02b264bdb3482f749e32e
SHA256 7dfa329fa1d12fc3e7ec5ae3b2ab3e905b223668a95df4386d1f62610c68344e
SHA512 c55b94bc797d943e0d87a1cc8a3a1d1ca440f9fd67f53ea28d91c8ead2bc14a06062da4e3aa02e1bc5e2d3e916d4f231139e14deccb81e38071b88b685f04268

C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui

MD5 0639212073b1762a7dd709baf59e00e2
SHA1 f5abee95a59af11ac32ffbfbdf03e6d1af43d6ee
SHA256 3c406eaac4a31b2893e6c02269c2ca81634c977991699cf8f1bf0cc6f7de4188
SHA512 800f36e08c5640b9ef32623bee2e7362a8ed87ce0241c7a4e76b0976fd01da0936c8cccee57113d8f5b678a27340b6c16ee2706883feb91292db2a4c468325f9

C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui

MD5 14fe1b89f872c20ec201c7a0c73d96ed
SHA1 6ccdc96bfa809846fd2ef2bd4d49fc5b81fdad64
SHA256 11d906023bac8ecf9a24bbaa5e3fd60f203b6d46a0c19c27c7dfffa71fe95303
SHA512 46d2b503feabb05a440220785025a3f6c524f5d893dd98e35cdeb3d280648c0c180f0c839195e98eab809ef06cd4748d39c6b37e5eaa4b4ed87a90090c206f6b

C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui

MD5 6dd077185f8335d2e46662b2e1349897
SHA1 8c9973f43918935a0b650463047fce375c39c201
SHA256 60d27a964050079a0cd6f991391d314d3bd29479a81b80e338d5b60b69ef2960
SHA512 546f441b35b95346eb4dfc584567a46d79f4983bfed81cb5df01faf8bbb56e095046a899aeee50429735abe12bb79b10532b990b993a3138ca09542f96820bdf

C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui

MD5 34b96ac18af2eac3fd74f60d12a7caa8
SHA1 aa2514c4de1ae9dba0421542311d018d99066932
SHA256 53761717bee4967e1e69438a0b6352011c538875b2f4c7293b029632369f09c5
SHA512 1f6803117049c76beb210b13f4098128628d0b72b3b510823e59c05ad3843b10bc651ef13518bd254ef38dd10676b0aefe678e214c61574159606c1a7859fbfb

C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui

MD5 56ec890829d5058ef6d00dd877b27bc1
SHA1 1a8a7d025af2180ff5f0b6e37f86e453a91abf7e
SHA256 7075f1b871b3e4b71a02738df4bf7cee5199d9b02262593cc8b6526e6e520f09
SHA512 11abef4ed0ba3c1e8c10ba9f8f96c24084f68f35a7c47692ff86c932748b0d0de2b721c8cbc9c529f9f9ba77b99d7b2ad1e9d6ef83fdffa6db6c1832421f8137

C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui

MD5 ca5655ffe0585355808e9b945befcb20
SHA1 8374c80e74df74023576195437666eaafd90b178
SHA256 b48fa929d17d74abb9ef69eb716e5b8a4969944372b54a71a8c4ba209bf32ea8
SHA512 ee7c7e6ecf236ab714c5d0e78468b505988d4a2d02ebf09b65e41f0829124f2602fd95dd2d5620db73619e3dfc3d1dbae0026f05b771368adacee71f30496a94

C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui

MD5 542b28c1e33ac0453a4a4fee1ee38a2e
SHA1 7659ea39fa85fcfeebae6e351743aff8cefabe4e
SHA256 4baaca9c82b92575d3ad9b510a25e7489f9f4f1ddce897b3fc19aeb57c3388f7
SHA512 384e84d2229257dc9efb693ce43447f75f913282a6c2cfdba32e7837632897b638db1964b0779292da40f4af83c4daa1a4817ecccdef2071ef054086de3fcc5d

C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui

MD5 7ce6c12de1357f2f453efa6b7284cfec
SHA1 a719c2ccd0b2d51e93986e4719ce5d6acf7ebaa7
SHA256 4b43b6c96048c9107820acbd337355b363f13c65c352561330cf4b2758087d4c
SHA512 4f324a5edc6f340654eca7649b03a69dae70cfa40ca159af13e35fff215eabe27cbcad3e5969177aa72db13add5381630a0ad199c149695745e8b30aa5f77881

C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui

MD5 b301df27aae0498109bf472f0bc8009b
SHA1 67f76a199668b7265ada4845b592b4bd0535917b
SHA256 9a9665e8ddd11f1c2add12340212a9f5b00f9a74dc47df15361763598fb290cb
SHA512 22099a9aff90e7935c1ddd618ab3f78178575e94d823183f42ac283937985afea07dd390f1a7a4634152dd4e035fec9fd72bff05bd2c886a6295b86322972027

C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui

MD5 b30c8c055483ef76f5f60489c2d75f6f
SHA1 ba66036d8f38ccfe22053437038b6e7c6c37ee3d
SHA256 d046eaea3e5e8870f91a7f31ffd1ccee54fd76547bd211c749a0cfa7d10bce7f
SHA512 0c169e61205e51be98394505dc77c1211dd279d10848e775ab393d7abfc9e4a17479a163f298e4323d9c639d933c58eb24787f1e4794359931e7c2ded2d20871

C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui

MD5 3e912ab948fda2ba3c527cd3065e61a8
SHA1 c97d70586f1d11b7ea6d7f6ac78a383c61ce670b
SHA256 7873d33cc9a1c7a0dedc5f122f1961be09a3ed1e1fb19341dc8012b0e1dee9fc
SHA512 6e534b7474952b8b08f7101368d8d11a424a7fd7848f7ce1bf8284e1fc072187031d4f8e42473a5653665fcc46ca5a8aaf9189d94123f6d20887e05955b01ad7

C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui

MD5 c6cc5a3bac9704c107f514232a7474a6
SHA1 cd7591ef9e09925105ce918a2bb353762707cb7e
SHA256 2e0de329e5c2594981538fbd5337da25c84869ccf89793d910d11ff91f8d64af
SHA512 c77ab89d378f72801c082146f411c050ea517010241593ff07a88fb4deebbe93664c8a6fbb4f737b1732702d67948359d5be669c54a52780974cf2cc1308c110

C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui

MD5 789d5f60a9ffdb2a36d65d3bcf15eb0f
SHA1 0cf750eba41c1cedf30cf32815bb9973f9e00f6e
SHA256 ca167d7d601911cede181b1e020ec823e8ade48acbce0f6633c2ffdd68b47557
SHA512 571cb1848bc84fbc873cbbc046b35bf2cb37fba560284d387a0db495d31ec619c373b62a0ed248f907c46a9c55cf05a079d3379f389b8eb34d4b8e3be1e67043

C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui

MD5 5aed66941ff6bc0f6298c362df1d21aa
SHA1 c36707eef6ee16c875dab959ed33e3645a97c9ea
SHA256 64784dad83d557b623664e5d6bc333720ed38e9f3bac3c17976c759fbc88cb42
SHA512 8349e7aed3f744d5125855a16160cfed8b728b362950c1a58460e60a92a139cfe0610f97f5bb428033b1262465f8c1d9a67abeeb30be6fb0e0f95cd51743770f

C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui

MD5 ca5e3d86c49603d3cbfe82b99bcf6fbf
SHA1 5cde5dad842063b4a2d98f9b32f448661ce28f25
SHA256 31e5884859c02c9bb4b9cfc5b23b29ab2c5e0fa04539e1ae2250f0ba977964c1
SHA512 7e4ef6a3f178b1305b717f7224cdde003661e6668b8fa09d95e353499c4354e5b417665105434c1dd4625fb552bfe4bf31c5e56018c51af2c2fbe746b4e8db12

C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui

MD5 3108b2f763ce4b1b90525a512dcef1f2
SHA1 b7abd2b111fe1745ca30cbb12bb45f26c88918ce
SHA256 a7dd7521de723783bb77ba1c73bf591a783549ff2f692ecfcced9165091d8376
SHA512 c231b3dea942183862fb05f0fd2d7a48e5edd32af41d6d2a6184f905582130c918084643dc307cb8c3631723d9c72ae5aa8f8c7ac3c9210fa3c713b41f0c02f4

C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui

MD5 d4f3e6dce35eb1ab824d94c2039dcb54
SHA1 b60d6155e2691770c8df4453109f6e96147b62f3
SHA256 8c8d83b666b64a4fb4f43ad519a64612aefda3b72c5b25b75788c8ade5e76891
SHA512 f1a4476df1d10a7d739dab6d76444d3fff36b3dbb38c82d102e80f5933fa3b9999d65a623da6f1163827fa279447e025f4cc0c7b964113542651ce6de8eb4135

C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui

MD5 53dd64a8b652d1a1a3855f9434925170
SHA1 81e730ae35a6fb09f832d2b3605a92eb11fcf6bc
SHA256 b928bd70605d53ec6a9936112dc3548690e0005355ecf6c581472bba10411978
SHA512 de1ee0dab567e198d208d31f4a44e94051935f5b357a93ef4edbecd749607516f07ac7e78460c7b0315e9d10ff0ec9021cfa8b1d40102a409fd9c48048f90107

C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui

MD5 aa9e6ffbc580033bece4b8ab5d43cbda
SHA1 8fd411126ed5baf28d563f4c7b875a50acff3444
SHA256 afa20fc48117eb491f25e471f3b0694f2222db6b71f9cc5c10c219942f42c4ce
SHA512 1069895d3b440a6f28ca40be1d4ca1ae248a25c3734f556155ba2617816767794d0dc408bebf7433cbe5e0cc3a76af0142e16ea679bac39c37465c07d3183659

C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui

MD5 9e285e25c213b97b88ce70b2be9185c7
SHA1 893322c3aa917f6a31b3694cb77a4ce94574691b
SHA256 11b0ddaaaedf4316c1fc3b07a87960dae38e0405765403e5343157a43bf185ff
SHA512 4db7ab009b2bd4f3a064fdcd7cc8db4c49600c65c04a1162b0a6e1318fd0060d78689b9eb07b1eb6d87b7befae023d2c2cd5b9da194897aee9c7f8b8357b44c5

C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui

MD5 fe2e4bcd0e4202c9701614394f517fa2
SHA1 fd8ccbbe6165f681d8707210f3243d0bc7b9a913
SHA256 30947851308e8c861bed6e5f68fe4ed7038eacf360d1a98a8f492d1bcc364feb
SHA512 dc3068a338d49a0ae70bbd5ec713645f681d6fea5ff2d07802b708bbf113eadec91ac2a17d6bb5be5341ef954fac4c359cee2a39d0380415f648fead30578e01

C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui

MD5 0f5fb163823bf357858983fae255a5f6
SHA1 02afa8da637183215fc2da21a77c3edd4bc5d318
SHA256 425f93aee560a31b88e3ad9aaca526430db82f7738e09ee4401261f3ea4c8ff2
SHA512 18f80752dc1ca9c0697b0feb270d928566b0339acae8dda95be9a3bb59d7024b3938f3f4161e5241e60802aff32668272114f7e945bdaba93acc1c23415bbc0c

C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui

MD5 ff723577574677dfb65ad3a900dbf0cd
SHA1 065b37e05db1641b59d31e251561086f3428a06b
SHA256 7fe039600d80bd3eb7708abe69cf0f3d4c57a22828c39bfaa402ca04640adde1
SHA512 06b78d64b0dbdd1b152595a03e6e4d6cb99ce3237f19757ca53dd503cd96a2dc0c3b068aa2597517ca63405d578389384a35e8e738b993376ee407f680e2c9e6

C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui

MD5 db2a8f90912cdd149eb6ee765392cc5f
SHA1 5a86b03675901eeca93d90743eb7e6c2042386bf
SHA256 2e63961900eb5427a062d7c8e80dc803b23bc09b7cc20d04cc38af0a2986c61f
SHA512 644d543c7532007dc023e7b1563bd2608ac398748da3d411b4eeeb5a01bb9b4b30757dc490459a2ffe98eca475ca17d150f3fd2e0cb46cb8439e1d66a587d895

C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui

MD5 5c25f95485b2abc4ee197b668d625a65
SHA1 cce9d997c74a216103ed8147111bcd17fd636536
SHA256 21608e118953742fd46652b852850aa939533733ac9fd8571b07963cc998e512
SHA512 a9832eaa1638cd417b73a4a645df3b344add6aec8adb2a639b72412c988aa1558bbedb889c4ecfb91d499f4701fc85b07d12d1865d2cfd3ce084090fe9b82bea

C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui

MD5 756aaae6fc6d3446af93580e7bf344b1
SHA1 15ea29bcd2a42170dccd8681d7eb24acf9aa04e9
SHA256 1f08ef34f7bc78f1d43ae7d6fc96d39b365bee7f8234176e943ffcb8755dde8d
SHA512 0493126457348fb36dcdeaa71b9cc414ee64a252cb18d4460e0eb49d7052c299ef7480d8d2554522b10c66e7981e25f6d04f33e41705d42b676b0890b56d5379

C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui

MD5 1da24083512b507462a7038e21cb9a67
SHA1 758241fc60647545133935f907e6f84b02941146
SHA256 ed11f18d78f36087f03805451bf65bc52676daded59c533289d442137d2c32e9
SHA512 aa87e7658bf52409699701732937257e9baf8257356cce0426366d7cf255e542447841b84e6e10aa8718fd3c2ffccba0f73675a8d3e05d2bcd93e6840b74bfb1

C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui

MD5 d65ec07ba1cd8093f048f44a3c657ab3
SHA1 21ef1af86f08820e3d36b4dff065eb734cc56457
SHA256 1d66e04c805643fb1d0da3e0a82f7707248dbda75291f862b037652eb186f879
SHA512 59183b804ee7cac533974fdfa67f33e2414713b6673256d5a9f346c29fddb8230238dc336528e3917bfa60eabe4a859c1d0a543ecb5e4d76de3a96512784f69b

C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui

MD5 06fe36a2eead81037a0ec7e55489ee34
SHA1 b221a64902a11e0addf2eb807e125f6b05836be4
SHA256 32c78ddab770e3068421532650fa36bb16b86d98cf1e13a36412fbebc6009c07
SHA512 1711004752d165580d9e51ecfdd01f4804dadbc12df8e93d0d72ac3df7058f6b68c37a4a7f2ab9b1250abb5f7df16ff02b03f316a224dde66919f4688615d360

C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui

MD5 6d5ad7b8961396c9d8dc2aff8091e9e0
SHA1 746f7e7fcdaa63f121c0a9d93fe3cac67d04b6f8
SHA256 26aeb971493604d5a9b3c4dcf078c372d4018ccf4bcddc798728af86146ed239
SHA512 91474bdc18d20fb6d9ac2e25ba8f5054d7ee3de3e63231adb76a44c77f13da8f4d80eefecfd6c030245324cb0c1f5e329ccb62ee06c9cc9bfcea4539d5444d6c

C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui

MD5 401eaf9afcc7e60e7e4ee44b003907fa
SHA1 5a4a7c3a7a1cb7cbd92cf7f149dcbf4d1973ba79
SHA256 75ba9d82349a2b445f3b1506fcdab4143195261622f49b1300c1c7b08fb2e78b
SHA512 2a53db72aacb69d42ecd6a12829535714da8e843eb99dff4a0953c66da813a54c09953f13a59fa701312ef5e79751fdeb598b1f4f8030442e6450dc3f0b3c557

C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui

MD5 8b1b637a8e79c8d2a37db9843f7dd2be
SHA1 dc9c7d9951e362beaac582544231c7ec9eaeb9d4
SHA256 8d6b46fedcc3d5ab55ce5703bd4b59867d78cd43b3b15a0f277f540a261eae09
SHA512 dfc769505e9c826f5c447814bc7c1e3ba79561567e34c5cfc374c4adb4b36d2851439cf232524cee165de1b4284e0c7a82e9f8f75648035ada04a6686f9ae34b

C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui

MD5 470c46794009891b3864adfb68285db2
SHA1 cddbb4cff95cd609b7231e4954cc95bed08b5347
SHA256 1724283c3b0a7ad6b8e9ad41390170bf6ad403166e602de15d44e70edb72e36c
SHA512 886dcca388c64e014ce6bd028cec189c3f88445b31e92284f6062031f2c5a1f5817d83568fb764fb39b8180dc070561899934f0611b50472f23b7a630d4499e6

C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui

MD5 ad7e3af8828a5b87cc73885eaea9767d
SHA1 7b90d8f7bc1aa1b0d6b0a7865e868479cc650252
SHA256 e101830d1d5709d34bb96a252057a8ccd57444e4b05eb88e100a83453314613a
SHA512 f3809ffc504a6dd1fb945f9c93fadc8760c5039014e929a98720e41b14e3305fde1c2b78a73bd515699a92629fc3bc09dfa3a02026e3a123522217dc002ce20d

C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui

MD5 f70cb0c83ca32cc8b885e1be51fdcfcc
SHA1 53a934fc6f820ccb5c387939f263fd063def257c
SHA256 3b7fffe94a54b2fb7cf084360c753edb9376381a30f22982c0d117a429cf0062
SHA512 d103aafcc2cca42cb10348b45bffa527eb5249acef4b9bb80d8177db5a7dff73fb1de585f93acb22e47d09534a16ec571a7910da162775f232e587c0753d201e

C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui

MD5 9814fca534407954ad53d1eb7729b58e
SHA1 067ea48a93fa8ed6ca875d48a9210e4ce09138cc
SHA256 cc4a2d8da3ca799e93a3e2abf9b267eec2dc1cf9165081286258d23f7363880f
SHA512 d9287b05957ddccb1bec0c58df27eb1fba69bcc6e1310a22de593150113e5dd338398285afce672cbc990f3ab992f8679b67849b6a5f143adfdde4ce28baf9a8

C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui

MD5 86eee008da92e27336c9b4b2c780bac8
SHA1 2af0083aaff73a297f44b8f37e8232d09fa3a03f
SHA256 286415a0cadda871e62a30b90b47cb6da0bc6ba960fa883a08589c3b6661cda2
SHA512 774bda5fcd6aa536be84db553fed34433792035b11eb4ae64c64a293b21dcb15eb4122ad539c6c62d2ba5c34dfdfe59e8b44146d1ba2433c6b020a10763279b0

C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui

MD5 8aede079116b67f65f49ccf3ebdd3404
SHA1 2b7846f38626471ae8ab2b092ff3af7df5fa3d73
SHA256 3cd72fae4fb6d1d2aa477f24347c6ac0542d4aa4e5bfd90bd7dee66bf89bbf35
SHA512 228013fe606fe86112dd24e3e317b92ceace0de77003a0939c76b204530b073c8048941c6a45cda1832bffd64ef75b006e0bd9efa6e211c999b064444810b319

C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui

MD5 7468122298d34c0077aedca4e3ba732f
SHA1 7c72372f486aa06fc8b3320613338f835ecec5b3
SHA256 76a49273abf3d36bda21d2339e45587ce0d4b7215a3973aab78183589681d3f5
SHA512 da7298a32dfc52d6772ff1bcb2ba53e0ea360a6cd361033492cd2034d0bbb021946d8c995649dca397ff8b8bdbbc74836251352aadb037dd4f560bf75ef74a34

C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui

MD5 e58de21cfaca151da988ef602e321ccf
SHA1 c499d05e7be5b581b6f11d3965aa3864950eca09
SHA256 91af4dfa645702f8739115d23ca475f9d71f1611725d09d5a68e130f2765df01
SHA512 1e015ae2f6dc0e3ef07a70074b16d90d75f9f5e96dcb01f232cd826744fcf5cd9bc213aafeb9ff3d05fd32e2b6ac5c0d69042fb9393dad3882e3a19d508b04f1

C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui

MD5 1bd44fe989d45fc02c041dbe2f96e994
SHA1 7394aa03bd0205794dcc257cf6984e2da312531d
SHA256 f1d5196c87b3b6351b424e58a5c85b9dc3d1f4ca308ed562f06a8f28f6ebd8c2
SHA512 b7c3e6b6cf26343be68f600be880ba05fea0c8aefc193a75c7f4a1178cd1b1438ffb6598a11d3e8532095704df36b8ed478401abfa603adce85e8ffddeb9b51e

C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui

MD5 b9dbe1676c0a140c4e5928355c886089
SHA1 5e21fe7382a550c9408f01096cba416a4d3c6e78
SHA256 db5f977b8793796b49fd9421ad2930718827e0e7321b92f22467be9ab93446de
SHA512 6ed3cac228511e3373c4f9f4b0190b56616900f58c6f73e4227d5824c88fdad2e8dae21b9d48cdab7fc1f9029d6032c546269adbcdef96e62494fce3658a7ad9

C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui

MD5 7bb1f33d672edfb729cd1287f6403b55
SHA1 8cfd4e72b4cf8a0cee6097651c733208e9ad090e
SHA256 1813826f660baa27887a5aa22e9f849847e9fa9111f374cf7216819594b16fbf
SHA512 68eda6ef07c044b70e041b22645730a57b7bb98cead65f36dee376bdb8ac79640103e83c47bf825058a7e57f4468daee53459889c8c0abd54d4395122a7ddb89

C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui

MD5 f52844c65954add56956f34b36d6b4b7
SHA1 a81a4e586f20e37615d0afbcbcac941fb99d3ac9
SHA256 a3956727cfd553a77a8a32c4bb35e75a48e1244b804fa1c60217a8e21b917919
SHA512 eb220e228e0f9690f2bd5966d5bb75c77f2aa87dc0d57352b897abe138c825dd1d1eac8ac49765eaa1074c224c26ef4671b900a6365f115cfbf513b1ca9fea1e

C:\Program Files\Common Files\System\en-US\wab32res.dll.mui

MD5 571d72896fc91775dd3b1777f8f34c59
SHA1 070385c847271d4b63bccc4ccdd52d8a961d1297
SHA256 43aa3c48f0f46a6db0c59cde05392fbf16b1775d24d447c83df30394442fa433
SHA512 308f90959f467245e407c7ecb69bf4654d0cd1784b3cca2f9d6465d0900520ed9549b2d01937f52b27eea54cee94c5a722be61593438757c7dc28cf4ed9db16d

C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui

MD5 a8140679528d1f73b76f8059dc97cec3
SHA1 7bb0dd0f83600a263bffe5d9a883ebc3d126c3f0
SHA256 f71a49068c63dad733cd0775ccb65a358fe7a1651c0efd1da4cb65f3d80909b2
SHA512 a6b3b556846003f965b824392f59b11928023c8c696b61a7c3e61d38895efb8c1467f54ec89014c91e35155d9df56a6495cd7e331df0b59e1920a73007358ca2

C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui

MD5 a4dd965ad7f0bcc2c512ddfd6588d80d
SHA1 ac04a677b2baeb32acf12203c971b84ebf570849
SHA256 b6185a8a956d1352af2d1ee68d3ec67d515fc6d12c06855cb54e4a180e75ff76
SHA512 99a680e72123635ae490d6df61029fc29a7f1a167d141a8bf9353e1b7aeb9393ebf08f8481623384923a8947d88b025816a3eeeb389ed47456987a726ed19aa3

C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui

MD5 85a31bc0d83297bac4dcec4714c94e38
SHA1 ac81835fa56030ec6c264942cd3c412d1553dbbe
SHA256 b8fb13ec471a762dee0d2428c7d0e098dcdfa5bfb1b3ce99849c94a5a925a2e7
SHA512 b9c4a48ab1c6fc81d94344f2d4a9a19f98f56c58c28f1d0c17fdcdf848221f6cc8ffb825861497a7647431340aa6a3c2e165d50449b7de640d22430a69658fb2

C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui

MD5 5b9f4055a8b4cceea105383978b4dedc
SHA1 32034f79dda5817a0e24434fb9a676eaa49712a0
SHA256 2ec13893358384f6fe65ea6f903a072114c4834002b50b222a415a60b642b600
SHA512 43be263e0056f4378ff52cc7db161fb5d69e1b8198e065e8c53633b86c2dc2c5671b88e51e5ed1c6f807a2959de78d676be1b013802272ce7d23b981b4089e4b

C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui

MD5 1063f0594e173dfa524ea1c4a838dfc8
SHA1 3b066cceca2bd02d79ff59ad200fce9c859c8bec
SHA256 e96fd910af9c87b77a58facefc92b274367ce00447409f4ca33b69af4b86f3c0
SHA512 b52790ce172401a36e10ce1dad86964c6d60ff1d3527ae600e24498213e87b01d1d815eb5b54721e6b60b76bbb0c6c1ca6e2bbefdf1851e852cae924d534443b

C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui

MD5 9405481d46dfc32c4d416dad5934bf8b
SHA1 c4364c153bb1268f3e00c7044cb8425aa6a99aed
SHA256 c29277217c3fc5ed0fa878343c3dfc3a73e40886f2991f3a1e035ad697eb8647
SHA512 dbea39d7acd2364c2670d80441cae54ba97ee59077b90a0dd7cd05b21d297d8ca328ad4c746871bf6188ebe04f6863261b7eb64b72f0bca4c0bd55bbac739c11

C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui

MD5 5c8fcead892c693ac9bcb2056b05d857
SHA1 a4b33ec874309c1efa4e4f83e36011251b13bddc
SHA256 f233855dab2918a49bb6c7d8515f56fa04dce47ac950a289f4fe6ac90bc86ab8
SHA512 ccd28b33c01a0e5c1df93ebb5fccf1555a35ba22016d263d40d4b2d5960ffad5881ad9563f1693a9a885cb66eb880d7ba0b3886e08313743204ee5bf15e517be

C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui

MD5 4d3a5014775527489b21669ee4c92d3d
SHA1 a056eaddd2a43320e2606925c1543e1acf488d40
SHA256 aee42134d38a9866a03a4181328deb4e061af9e4ed528c31f5d1ff48b3bba51e
SHA512 c7e4870ce0289ec4d63080fd5b1bf57c8ac5c9d9bb175b198f55554218256cde6f0e6691ceb92cfcffc29467cf1e4b0398c49b50eb9b10bc508702638e5c7c93

C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui

MD5 cd53ae998a5b3fac987a9698aa9a7589
SHA1 96f239ae848ad3d37ffd5e8d0ffed738be6e2661
SHA256 7271cae4583e347f41a42d23d5a54258b7cca8ffdeb61ba1dcc1eea5dc383ef8
SHA512 292e7dafc213de6d353a9194d9ed1c9abe73a0e009d5f4a4c9ff1d1ef387c22d3d36ad2b1cc4f891603bd59b2006861d5c166b6a86c7ba2383f605c7656c0180

C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui

MD5 8b2c398e1b0d895888ff0dee23522be5
SHA1 4d4e45fe52afdc0c4505c05ff48bb0aa8e97f123
SHA256 a5f71f877784f9ff675c65e3fbf1b98aaae64e7992fafe8f42cc0668530f5aaf
SHA512 e3f7771cd7020fff07f7ce56bdd5bfd9052d7ea38d1f78c03893a317ca602afac3d6596b75193e285c5093862799f8d58ce22e4bd5de2840c0c066bd874951e0

C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui

MD5 ed05045da1cdb32e2030580d8a217e1f
SHA1 0b178fa2cc2819f4e28545ea73f4a37ae7ecfac2
SHA256 b0061364749f1c035df301c714e00b0ff973ae139c8b0f8eda6a8c9c84f2774c
SHA512 e36e64dd6db88405a8d4bfbf6e7f932b12a8b4d51fc830dc075b20860b38e5fa3932e0f6f2041d4f07f7adcdbaef46ff3324d2586cc8306af64852727916e549

C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui

MD5 60e87251d5258c1a17abfab1d505ceec
SHA1 a648f647e41ec239212d8588fcc945f7c1fe6808
SHA256 4fc3ed3bd95b6738fbc9bff4084b62f039295d1c42d39867ebbe7b6f731064db
SHA512 b94ac9c0b1bbb6994e2612648ccbbdd352d47a4dbaa40bc9da19fb1d031fb67890542b197103064b65171e9b191207ed7c6a23234091566c9d956623a604eee1

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui

MD5 8985829e5074d456180cfefcc9e55c14
SHA1 af92ec3d64bce566a6a33431a75ad1e1e2fc4ade
SHA256 a1fbcb0c64207a65dbd1d8bb28345fdbe8df5faf8c5a19dd388538cb89ab7d7e
SHA512 9a63816efef4e8fbb7b0e8ead6d6ff0e22808df31ff106536507299dc18311f94f77b1ff75c9ef3f0b0e966d30155338d13c2dcf3c41880bb7b4494cdaca577a

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui

MD5 2066b26870d927d5ab9acd7564535484
SHA1 1516dca38ae5bb0507464a7ec628ad2377680241
SHA256 58086e36ee914b7fff3e2ccc6bbb4a12e6608d2f1b81fde57e12a8960d685be0
SHA512 b11d62efcec5230eeaaafda183db4f21c7440a4829d17ddc58e9d9740f5d59f780049fe7f4bddae0fc037be823cfa1e0021a611912822b61d9e18b5b202748d0

C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui

MD5 f22c6cd89c8774ca34fe763cb9c2f16b
SHA1 eb37f33395ba42d414168aebd1f8f0849e8e73c2
SHA256 1e2eb12ce40b67e3daa827065501e28ac40f37ce9f4d3e0ccc3371ddea67af7e
SHA512 5b77e2d29b64a39b79df0c3b4235d936071c264b5951af4b269a59b46dedd55a042c2802845e7b0335652b7c985b040602a5a3f40416ee050c489d34c4cd37a2

C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui

MD5 dfea21b54d41345a40273d4ab0712c46
SHA1 51ed3dc1d942b9656f048651c8726d029d5c24ef
SHA256 af04d54368bcffbceca2807eba7b82f435bbbf7441f86796d0dd73b07070e47f
SHA512 3a1536e5d983299dc7f961e60c26b465113fc2d539276b1c6a511b6615cb56ff364b5708174b8ab73bfbdab42734c1427c8fd824d4cdd2c4fdc859ad5ff00330

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui

MD5 403ea71cc0316ef554e655d0fe8a9cf9
SHA1 73eab5d12e1964f1e4f06b6235a334a259a58dce
SHA256 8a2d6f51bbad1f054ed33bde80dc439d8e348e30a08acc558055c7d2706dea33
SHA512 b4a06a246f6b60e6ae2955071161319b152d7f1a1ebdd0d9095d020a499a7b1439c3494e01a3aa68b34cec428d44e58e08982afeed2a6c275dcdb8a411943a59

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui

MD5 82e3f2bc2f28a32738e8bf08cfc6aae8
SHA1 16484d111eed7513c58cd26fa9070e4f931facff
SHA256 da0d62b93c802a28d6b55ac697aa0e560e1068889e8da5d6c0ce6a450829b719
SHA512 bae689c28c28bec77feddfeb10cd929d61a45d3ec38d7a96d836b582b01c6de9940234a0e5ef53e9af71dc80f5cb850a7a3002d59d365d6e6ae703c8153f30fa

C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui

MD5 7705ee5ae02b730e1a8edca2acabc02d
SHA1 85c810b54c48bc7444bd0bd3e35b58d8582f86cc
SHA256 94462c069c6395f3248802142831aec2cd355c06551b14ba48863123d0c8cc8b
SHA512 1fde09955d9506386827a9eefb0000ecf53a74980e0ea52de1de069a5354d56d325df587c5b0bbea0cc0e9fe8cac30a9b6f67b70b1d0f64c1db890006800299e

C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui

MD5 3501986b1c44000f79c00422aced0085
SHA1 138b576996f1d5d5185ae29a59e942b69d01d279
SHA256 a39b0f71e5d86315f3b4d9b22c1857da3daa112bd143d8eab948f9479d848665
SHA512 fd7a37f44680111c3f9a7c87c330644e8b0bd08fff10e56c4399eb43c40e10254d3a4b66a5c386302616e61a75c733478f70df4224a8cb717da82fb9f34fcd78

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui

MD5 4e3db6bd72a36e795d1f91b8df21c82b
SHA1 942d5ba7b46aa85d24588a5665919e95f8413ff5
SHA256 4dc51241f76defe3a960ec9270edf0308cf7feeb3c60e32e72af79c3c1ae40c1
SHA512 438b71e85c0bd86ad906e30006afacd0291b5cfe9afce62ccbb24552c346cbf80ca4e755f7dcf28c356c050eb91758a75fbc944d60b799e4e08837862d528294

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui

MD5 2a1e311ba35d75c44e7b74018b811b20
SHA1 252f571ae7e556a3f926624c575840be54ed2ce1
SHA256 4c189f756a540888dd9dd7c991ac19dd7578633f6364f9c56205bf7a4b731a75
SHA512 a8e63694b21e91817a83b0cc706b4e9aadf7706a8778da19c2071ee01ffb282f9bae09c1e793f4a12c7022a2dd46bb5f968bf0f7943ce02de2876d77c147188e

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui

MD5 18701ea617ba3ea502283cbbcb179121
SHA1 108a9441f3e236f776ff067360b628d5a5de6526
SHA256 e9f355b349548db696cfbf9f620c27d776fee67a2263b4732602614bc3024df2
SHA512 d5d371ca909278e44fad331e1952788d7463b0779e19cc9b0caf83753c71f7765f0ebc0ac5010435269b1dc952c0b402384c615bd762d337b08f0282537fca3d

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui

MD5 9971507a2a2b611159f6073b781c67b1
SHA1 9f8ea9e30960aad6048a982521df757e5ad54c35
SHA256 f12348f76fc92a559e4e8aa716c9e910f318efa7337b3213d14b22f1c2279cae
SHA512 01e266ff07ac5fc35fb0e3ad4a5d58166111e2fd3feb792da5ce19ea61f3d383d095c8c5a28b9663d2ce062682d97a9d5a512b286be138abd2fe1aa859bfe6d6

C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui

MD5 fb9efdcd0c7fa1549545d8bf3c65e0e2
SHA1 d0772153581706f691cfedf2f4dd89cb6ee5fed1
SHA256 ccbefe5a8095d7972c664172675731ef38429db8868e965c640e1c4e3e5e67c7
SHA512 48be9defe26d2c2f7a4b454a6b29e47bae3dbbe099c92374e6d9e2f1c6e207c7a290ea69c23e2802b69346345190bc6b4ef39f465693ced864a0668011bc3a53

C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui

MD5 5d57bde3b3414347e3473681b0cc77b3
SHA1 4dcb31b382f12c7437290821810c19d01967c806
SHA256 9b04bd29f5bb5ee6dd37f6a683b6e2bf01235994fec506864e7bf9d114ec94f2
SHA512 87922bf646fcb0b19e87dfe0e57b5413c498c9b08c2c30b772c8b1c6ee7aafe17a8da34d876624af9dec25ef8001a1043c39d5acc9a7833ff8bcdd368611b088

C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui

MD5 a64fd97b82216bdcb5b7a3f35564df6a
SHA1 614ca8f341292ed3fe824db3179e84ba4eed9224
SHA256 0ddc76ed26b7b748832c5d06b1000aeb537d5c1310b7ba8b3bcb931546d38dc4
SHA512 7516fa06155e74b25cbde5a594706c0485c0adc010b01b33b21ebe988e4824bfaf9a1914ca449eddfdd3c949849daf3f353ad61f0564ea2408440e838eb2dcba

C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui

MD5 7edb6eb71ad0aa0f986560c2013866ff
SHA1 de6bb42fadd7c7dd8f2a272848a487508bca67b6
SHA256 e48187a038089fa5d1e0ad99407507b7f813b27ba2c742edd167f17597ca2a2b
SHA512 ceb71ca38c5b6f53c0571e6bcf22f05921fa2d25ed6f2e8c91aaea0bf93032966242ccfaae724fa1746dc48a3184d79eca9d95084cdd75dbe3ebf1fe62903472

C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui

MD5 94f634b2a5f11df13c8500540b234a4c
SHA1 74d0a4a4ea76550a112c29d35ceef6173805bd28
SHA256 93913eefa8777c4652afa0247f84cdce3b737cd5821fc22c6652310df40a12e2
SHA512 4149eb7f421effb93ec6631444395b3a6eb1faa8d2598f72f86ce6585592aa3ba5a9b23ee520a2621a0eb36f2c10d5c6e17fef2cd9e31c53bb16b83fa7b828e6

C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui

MD5 98d49302eadd02f7dd34f27d65492a8c
SHA1 f727b81927e12d58d21a4e59a87cc46aa5c7707e
SHA256 28c911fb32e49ecc4a6e38200c1ed77e3ded73d2411f6385983b8839ec1a4b69
SHA512 67ee67e90243ecb0f12e8265397906d6b67a18cb15084d2a1ff1caebc4f0f81fc3a6d304a080a6fcd0716c0143f4b3701c34c758c6071122139a74a5d1d2ab12

C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui

MD5 eb0c7ff0e58813c1181cda12473dc727
SHA1 7d509624c6aa51d838d4abfd2d934a269db210db
SHA256 0763846decc036fd8a8d1198e84cb0832de43d0fb73dd4f052bbb3e95e35d806
SHA512 3d5032419b854f442b547cb5f4459c80761b9bd2108edc7c7a0a6d42eb2a62ca62713e57052fa55c43c5a99b7f100bd89766c54210e2dad9385af312939c7929

C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui

MD5 280607cbaa9d830b317f7260f974c1ac
SHA1 39f863d87e54dd44ddd1890066348ebe964694f3
SHA256 7c9bba9d67a243785cc994d479b4b4cb56613c445dfe85bdf6ac59b5cb4fbee4
SHA512 2453b798808d498b19d30cfea8fe4c73e9314d712bb147547c9841d2687143677f509722d5bfd1d974a978741487cf1ea1de61e143d7419018c30f120b91b46b

C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui

MD5 649c42d5aeaff7ee8c27bd4f97ba15e2
SHA1 cbc39bf0eb4e291abf016fa2688386807a6b9c0f
SHA256 c574fc0d3cbf0517144ae98dd960914d45b23afcc9edb6eed30a2478440c32f1
SHA512 901f07707a44076d686612efa65cea0dce2e9f2ed3e9017ba4fb5560acfd53e46d6068951d9cfef524895a5680d95c403b58f09eb2f10f0997b3348717b3360f

C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui

MD5 06b16959f9f7bf69a265e01f5d1464c4
SHA1 d18ae37b94259d56ee391e678572653a330a1824
SHA256 62fd89432f41d8e6bb1535e8f1395b18675a09d59c5a724496ab8ac7e715e0e7
SHA512 c3ae862a1bf3f9c437f866c0da0b4832342935ee4696b4aa79b2e2bdeef7c5798bfd36b4ca260b0053e24b15d532d32f57aec5795c6c8534abe1e65fa5eaadca

C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui

MD5 8fb0d2e89e08f50bb1a248f0da1ed3fd
SHA1 1e81ea86483917bb417a28aae39b5b087704f414
SHA256 5d1897cbb8ea5e2fb3fa40853809c0dfc9b1ef36688872bdad6cb55ac3e7b772
SHA512 bd380519a20d045100113878493130a0a4f23d5641d291d2bde4c216e34a72d63ad0e0f5b632130fc615480c715d4a360ff15511f2237abe5002bd38d24f4483

C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui

MD5 30939c48120940d98849e72172254853
SHA1 7ade871a49dbfef437e1c22ec45deb66878b31b6
SHA256 534220d96638e6a87db479b969a221c1c73d557febf4b82c3f6997c2ad6c0efe
SHA512 abea1f0ec42d77d0e63e25517da9ddaf135f8fc9172dc2d1c0207ed48056c68991a362b84df0d254bdcabd0f432233b8405992c15ae819a2f0b151157d275e46

C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui

MD5 a5507de22b6ef300738a143ee36cd39b
SHA1 d931a1008cdbef19ec25266d0f2a9886ec9acc8b
SHA256 96503f148ea4b69c53041e9ff16d03d7f06e1d9df0d138a3c9aea78471fe1965
SHA512 18b629d732bd4ab24396aa0bcd9de846737762102230975a7f39991b75842fe336b72777ef08297869db9b77b084ea51c9c633a82417a90755f3697a014f14ef

C:\ProgramData\B75.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/5500-19983-0x0000000000401000-0x0000000000404000-memory.dmp

memory/5500-19984-0x0000000000400000-0x0000000000407000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 04f9f1a9998c756d187e0cb2d7aa9a02
SHA1 3528d13cf44ad0a49bdc249a2e8ec6ec47b0e3b8
SHA256 7d6bb6be8fefc9012dab81bca8c3df8f14bc696e1922122d439758774d9a4bb6
SHA512 7e13e7e9b5fc5d56dbb2a6497149e7efc255ac1346971a408751390cfc6cad36b509468f7e84be0d3447f01d628381f6b7a5e837bee306eb6fc4897beedcdf3f

Analysis: behavioral2

Detonation Overview

Submitted

2025-04-18 09:39

Reported

2025-04-18 09:41

Platform

win11-20250410-en

Max time kernel

102s

Max time network

103s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe"

Signatures

Renames multiple (7506) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\F126.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\F126.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3437575798-4173230203-4015467660-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3437575798-4173230203-4015467660-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadStoreLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorMedTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ui-strings.js.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner.gif C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\warn\warnDeprecations.js C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\NoiseAsset_256X256_PNG.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\offlineStrings.js C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailBadge.scale-150.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Common Files\System\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.targetsize-36_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-64.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ru-ru\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-dark-focus_32.svg.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\PowerAutomateWide310x150Logo.scale-400.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.tree.dat C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_ie8.gif.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT632.CNV.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.sfx C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\dist\css\fabric-11.0.0.scoped.min.css C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\or_IN\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Microsoft.NET\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-30.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\NotepadAppList.targetsize-24.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-black\PowerAutomateAppIcon.altform-unplated_targetsize-24.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsBadgeLogo.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\BuildInfo.xml C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib-commonjs\styleToClassName.js C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\MoviesAnywhereLogo.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-20_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-32.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubAppList.targetsize-60_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-40_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateSquare310x310Logo.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\msadc\adcvbs.inc C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_same_reviewers.gif C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\EmptyView-Dark.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-24_altform-lightunplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-black\PowerAutomateAppIcon.targetsize-256.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\CortanaApp.ViewElements\Assets\Settings-Black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\ui-strings.js.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-72_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.targetsize-60.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\F126.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe

"C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe"

C:\ProgramData\F126.tmp

"C:\ProgramData\F126.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F126.tmp >> NUL

Network

Files

memory/2020-0-0x0000000003640000-0x0000000003650000-memory.dmp

memory/2020-1-0x0000000003640000-0x0000000003650000-memory.dmp

memory/2020-2-0x0000000003640000-0x0000000003650000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3437575798-4173230203-4015467660-1000\EEEEEEEEEEE

MD5 26128a3c37c932b4933e69ecb5f5435d
SHA1 f34fc1c3fc3413aa4b6aef82b85827d682986aa4
SHA256 5301b876544d30928df590e831343642e827da150e363714e52a33c7f429e8d8
SHA512 532c55ab75b58b99b1913137a717d589bc0b2c012570c95d81c60df34cbfe2a4efa10cf0fa0d32cd12e0c16320db87faaa063d89c802d29d90d0aa2e4bbf3d93

C:\3T2S47O5t.README.txt

MD5 a614ebc98430a25bc689615a8d71a613
SHA1 f940c2db3c21f1264b05191dabf6dc41d6fb3561
SHA256 7c3de04e7a1d7a44f84994244470f05faca7fd22fd80376414c0c0a596b696f4
SHA512 d7b6192a5d9f3e9535ef14a183aeea85f9a0bb1e624d4a6420b407510102dcd018c83559d4cf6718e6455fbb03ec0256c13ccbaf2336786e94c7ee8b6408e151

F:\$RECYCLE.BIN\S-1-5-21-3437575798-4173230203-4015467660-1000\DDDDDDDDDDD

MD5 5a9bb4128aa7b6402e1be1b736e89404
SHA1 9e5d8df66600c6cbdc333b405cc77e1c5e9b3ba1
SHA256 2283e43d455f74deee2d8ce69d93b9a58caf3b3785d1dd01d73d447bafb9e672
SHA512 3ec9de26daa069ead4bed055f6a2870ca43ae9d22398c8d2a5b907b4324d6eeed2a8396437aed834037bc8be62dfc645e2b7a9e33ae8dd8c99633161a23a9b79

memory/2020-9303-0x0000000003640000-0x0000000003650000-memory.dmp

memory/2020-9305-0x0000000003640000-0x0000000003650000-memory.dmp

memory/2020-9304-0x0000000003640000-0x0000000003650000-memory.dmp

C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui

MD5 5bc147f52c012d38a2724cea3872ce4f
SHA1 4b3aa43b9b754e08d0098c78b1d79f8fff276edd
SHA256 b3340540edab513e8216e8972fbff50b2bea32f161b86acbaa03c28b21af7c55
SHA512 ae582fb5d8ae76a4fa6d2c7128ffe8d2f69318a5ea61c44a5c09c887548bf077f74e8c63b0d58492dc72ddc1878c79edb99af21075fed1a196fb42c6604af2bc

C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui

MD5 b4e1b14524e880117122d23460b66473
SHA1 746038ed0a0b26982ce3776f68f91e1223ad9e32
SHA256 b582af5ce9083ec968b74001c19339439ad4605af94ac543fa0e789b7797a203
SHA512 b11c24ef1cd1bd93e72392f8b96e53ab1bf06e6470b62c53aeca022a3ec0d6f84d34ea39209858c570fd9b1f0d4ed7960cf8e0286310a7c40a61225ebe659a5a

C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui

MD5 c78637ae79e67b434e5dcd3cf86d735d
SHA1 446b370fa7593ca2ed95fa9cabb5e85ba4df2121
SHA256 0a131a8b72a255b0ad9a3ef788cb5870bc0c7a10eb8fa3089b93977f5c906119
SHA512 279c0af3365f66f5f1b695a2bacc99c70ca1ff000f91c8ae624c95790838e5a429fd8c3c608bdc5084592a526f04835900fae65accf4308793957d6f992589d3

C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui

MD5 f1f4f16167f65aa9dbe122d5145d106d
SHA1 4ce8f521f24101174a24e16961ea97b861e5298f
SHA256 355fff2302161ad55c39fa26b5a26cbe49787e529b9d56bf12561f3f00e32408
SHA512 796f0b83eccbf70da8ef052ba7be5cd25fd0307bce22526a42f33f062402cfab0a30a3a266edc6416c14b2d6c7e3def9d1fd3b945b6ac107213fb0960593c20d

C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui

MD5 91cf2fe3496faab4419f191624991ce4
SHA1 747d44c58caaeee409a9a575acdf9a137894c87c
SHA256 dc582bf5ec5a61efd59feeb5353035902fe46ff46a642ec3760c068574692964
SHA512 727f2109833e3a0694189809728ca83bbaf288d7830352491965abaffec0e841e7888937f5c36b5082935bd493581c2d3f59096e2152411ebbf1847fc089ad54

C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui

MD5 f216c369cb4cbe8faf3ce1e371da076b
SHA1 52b1752d78e82ff4cab705707631d06c28786f12
SHA256 bf4dae57e6cc04bac67136db2f613d291020900fbd27e12409eab2cbfc0315b1
SHA512 b496c46102194e99fbf5c0e08886f92298aff6b8c8240fc97b3d2e4dbd36b9b04d565c42b4a9e282290b79854f40ebcc7eb2134243fb63eca49a10aed17db839

C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui

MD5 c956d94a9f8523499329ae03224fdf44
SHA1 dc0108478c7e46b77a5eb4793aa28a9c99da6b51
SHA256 0c1ad0cb25b4fe97d7e54eb66bf815705f2b91495f9283253df05ba2400f4d7c
SHA512 d919ae987342336f158fd2382377709e5f307f8aef3179b54bc6c470d3e86ce73316c0cbeaf1526512a3742fa62f4333510f10492a478ab010217039a955693f

C:\Program Files\Windows NT\Accessories\uk-UA\wordpad.exe.mui

MD5 d7892ec77258291a7591ce29e7a20844
SHA1 a68d7a13a2d8c11f94a3740b9116d9ae26b9601f
SHA256 64b14433958d13eea60cd7c0111f663ce8d257652aaa6bd67ee8f0e0937991b4
SHA512 e057a370a1de0300429d5ac53646c594752be1aa8033bcf1578dce2baec901f9a004ab3aed35cc26d1c737940908c9e4ade7eaf7a177957ce82a7a969f1e982c

C:\Program Files\Windows NT\Accessories\ja-JP\wordpad.exe.mui

MD5 afc1cbe5fc3d6ed827a2d3f79ea6c3d9
SHA1 e85fdc54da8d5b2c699a26486f55c02dab100fb7
SHA256 4c5614cce5ae767e4c9df2e07ebccf0054ca0e9bf3a63499d12f0925e266e4fa
SHA512 441a730197c7ff57af8c78f373b68d2495ba2877e219d69e8a6e838b6d11df6a24ffb80f996bcc1494f6594852f1b9eb04b3d14b737c565dc30b841411cf388a

C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui

MD5 397bef03460b497acf43fe06f9761fdc
SHA1 303a56680ec5d9f63bfbd3b5e85ffaa340f3008e
SHA256 b33e0d355af1206fec2e41fce55e2ea0a6dde32a7df9c928137b277b1da34f48
SHA512 469788b1a7d19402c742d82976b2f064050c59476efb4d8906baa245be8257d809d27f2d508dc672253e1e4fbbd03eaf7b5695909421d758d163e504a146fc17

C:\Program Files\Windows NT\Accessories\it-IT\wordpad.exe.mui

MD5 ff20537fa23ae62746270f26bc3c6716
SHA1 fb48c8fedfa0b6bf8b0e57f1856d1936b6f6cd0f
SHA256 bfe9ee254f5eae81a7c6ccbc3101d1a5dcba87a760447620752f825f166dce20
SHA512 9fb76f3ff815c616fa581e2cb5080caadd1cdd2a187198eb39aba181df453ef75a138729649d69bc449e9f52cc00ffbade4d587b03d2e3bfbfaf74136d3b28b7

C:\Program Files\Windows NT\Accessories\fr-FR\wordpad.exe.mui

MD5 3b00a975d58212b89d0baae43e446883
SHA1 9e6dd09fb8c1cbc2148aac424fc052685fe35ba9
SHA256 2c1d2ddb87b3da60e0dd098d6353dd237c9c40c3377a46ebf54775bd88c120f0
SHA512 f3d6b3fcf081b05387a20f39ae7dd95be57b9adc5838ebab0ea639c23ccac9c4f4d631a7f320ebda1dcd1c79a73dc21c835dd8797612a8703cddcab1e68303b3

C:\Program Files\Windows NT\Accessories\es-ES\wordpad.exe.mui

MD5 1ce3a2d6f598e0b192757f63f805f8cb
SHA1 18c65108a0d5cd6c5a45081f4e5305dae7742aed
SHA256 89ef96c58d9584ec0439d22d9366423f495bd8f60b6b768416a8324436374a41
SHA512 07696049ed54b4fea774b753130c2a21b465db0d2c1ee0fb9a5a108264abd708cd38299c8c20f364974a907b140f6a395e5ae019d83f063d1bc5deec2ec890fc

C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui

MD5 10553c276b8bb080773352479f1e2545
SHA1 473d790839ccd43421dbcd70cc68c2533b5e3c2c
SHA256 81e9f499c4eebe9bd311f02c0af96b59535cceb4e22df3ed3ac7e109972a6481
SHA512 05134f2fd28cee7378b4647df0fabd719b0623bff0dacc433cf5a1162daa72822e296a7777a9754b2d360013e37c080fa1631cf3766a6e77d63fcf9e42f30365

C:\Program Files\Windows NT\Accessories\de-DE\wordpad.exe.mui

MD5 6e8b665c86da969f9cbf2d1a3dbe65ed
SHA1 cc76416d650c8e3953437f4afceef7fdbee580f3
SHA256 97aef093cd549c026af2862d85e5f58206bc69a48497930b6c9282f9f00642ac
SHA512 b2132e128f5d650b6be4faed7a954c77ed7da103702ee81fc562b1ab876820d0b3ceda26c19f890b255ca85438d6f96ebbc7e0d9c697c5a6772e197887a4a864

C:\Program Files\Windows Media Player\uk-UA\wmlaunch.exe.mui

MD5 25f5d862bf5d9b6ca422d6147f261804
SHA1 cdda9193c8ebf46a716f85b4b2e0b00cbd5a2458
SHA256 e99a064619a3d229758785882cd2081032523316bc74e20f934c19ebe31cb10d
SHA512 bd01266778884544f9f564f874dab4f5b469dd753f0d44fca9db708f07465fa018cf800cefbcf02d780ad5baeb6ac2863f1a598695107f6dcf815628391d1a0d

C:\Program Files\Windows Media Player\uk-UA\wmplayer.exe.mui

MD5 ddd6df32d3f0f4ebe6c997b93b82351b
SHA1 5f13d3a1d772a083190d9594f44f902cfe5c0786
SHA256 2949c01e5b6ea3ef467ef14d8bdeb77246e54503f8de6d2545678c62f8787733
SHA512 5fcea161004315ef37a380fa0839114f77a959f1c328e8b70eb4a27e2221dbed934e6a47aa95d412616d1eb29b964422de6fc4dc94fd2160d4a71516f139e410

C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui

MD5 ef6ffde1604f34bba7599e3c2bb8b65b
SHA1 db82f06e2949c193021e11ece91f87992751109e
SHA256 57e978dce41ea7c0506d72acbfa481b03a6e55a3f4367975fc5cfdaabaca71bb
SHA512 5c47d97817d7baab70444f3a8b686823b5f9654a70465c017b043ecdf0bf23131b4179f8c1eed171280f5167f45415e39969b61031e44a7830eca06374298f99

C:\Program Files\Windows Media Player\uk-UA\wmpnssci.dll.mui

MD5 dac473b1f9e4e3ccbc30077d17ab20af
SHA1 447ec669e8aa5c0fc9350635180e82bb7d480889
SHA256 ab8b5e26f3ce28e8bed097549322ea6da282a3c5e564940df2ccbbb855dec635
SHA512 9503abe9fc9255a112bfa43e067901e3c468a4e92d1af8f32b43a674040da4eee1d1cd7e5ebf7e85973ad142936d49efb6fb5d035ac3a7f7a9b895063878dbc3

C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui

MD5 0bdaaa895a48e07cbbb8631f662f4153
SHA1 277e1920289362f125d7c7b6f665f2f0c67da4af
SHA256 eb1ff5177df9868b592fccab2e475b67b5b7fc7763187d715cae8c5c0c50455f
SHA512 a05377a554ee5f0be989a2fc3ff528719647381a6f92a57a0133c8fe1f9d3d9d31d175ca98c7790448dcd1b840208c07aea584a1dcf0e97f9e5e56b17f6f91a3

C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui

MD5 5b4616f1bf4ceacb6db81b7732f3d40f
SHA1 7a604239378eb2b6b1f6b1d25b7f420333c975c6
SHA256 21ec7f4c99c3069350ac84ef84b995c575439636206a02650f8e2d62a29dc9bc
SHA512 9bc54c8e7b3c18b701f138ade88468e79f661fab671fb2ca67dd835f48cdb28a244a2ef043f82bea2b5e25a4ce691fc621e717c7eca54dbf571b5adce20f3358

C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui

MD5 7b06cddfc28fccd3bd9aab0cb926598d
SHA1 e24f9316904d4480c244813e0b52930155fb1a38
SHA256 646c9dd1a1b81ec8d679252a140084fae28d929765c63369d6b794db6cbcf7b3
SHA512 b326fb903144fffb42cb3428b4ce67aa902e5d4668672ac2c2b04d2737923b219df5f716433bed76ed335b83b3bfe87869de2cee34ce9e8873d2e29f1ea60ec4

C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui

MD5 b8c9958cef439c653d87365ebc795986
SHA1 6533e92454ac82aced70402fcb2fea6bfacf50e3
SHA256 d6cbea9390cb38c231a16549afb7961c26f7cbcf6c5761a394410b7ddcab6708
SHA512 91f30d3d5863a29d380cbbf60de84743c1a250e19e16a3e9384ec8e980fe7b8c22049ecad2492bd3441a42e214f139a599a9281e4cc68063e8fe22d7474d680f

C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui

MD5 b4884ed890137b82752e1747de16720c
SHA1 932bcb87ba5f2a322e5aad6350f5f71581b67efd
SHA256 2d847671731cea01e7220fa2f4ded5f77c397fffb4d3ecc1a382a312540f597d
SHA512 ab5bb4e32263546d11b9540d3e7907af28a1f53dda1c8f3e0acba31b6528e9f16c0f959a95086fe09fa70baa75e7391f96a978c79ac8cca4666b8ea0956d0482

C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui

MD5 2b2b9260822fa5111f36e9fa54987a18
SHA1 e38a6ad91dd739f1f099d40469cd1284c75c81c3
SHA256 0d774ceaccb4dc1cd58f3f83b9daef4c18f1d5c810968c17bdbe4a1406359456
SHA512 7e2bf343e1ac5961cd857ad6c885515d78824b12482c16de2eeddaba8cbdeacd28202e530f20030cd8ee23c758227d167897960070eb24a4638462447884b621

C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui

MD5 f4a2f287ee8288ce41626767651fa2fd
SHA1 8bfc49cd5e774fa213a7cc239631efdebf2720a1
SHA256 ff85c884666101110cb15f6b3fc28edb6b282b5946ce7549168ec9db66d460bf
SHA512 14afb9d1a4868fb83f787efcb18e48fcc3f19ccc2c57e74b140abf3c82e83ba6e3a8b03084bdef9a6006137303e1cc9bfc2602d670cb7ee6bc8bb99c8ea8c7c7

C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui

MD5 b0817c4990ef1a93dbf985632115c77c
SHA1 757356fde6f231824e000bd24446422090ce0040
SHA256 62db679f2338e6a2e21a1190e744bf3b3b8534b1c692228b1376bb0d2cb22762
SHA512 83a19cad358ee0dc645b97d303429a5648d6ea71d86d70fbf62e1aae9848e36f873913d68e3630b29e258205bb084d53c775836eb53f77266fc3bca1e4ae622a

C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui

MD5 9acf1f72b9f67743176383f60d0743f9
SHA1 66640bd55618e8c1ad534203cdc97a8bf8b3c5f7
SHA256 d0257d835fd9611f8b71d9ebf13e9aa1b7cbcb5531f7dc05a628551289d03104
SHA512 384dd908a3049d954a2fd7e43a70491bbb64959ae8756e04209d58abaea0a98c2e40bdff1898b338d8e5a83fa1a360006dfa9733063e4b7e655d1fdf9fdabba7

C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui

MD5 a17e643d5e1a783f8db2a2fbf0dc2388
SHA1 bcfbdf67eb26692ffc2af29997f2123b8ef591c1
SHA256 cc2f5c70bdb3382aa37f65c746f9177455ec86df701c42904478fa2a1b63e9bd
SHA512 29bfc024da13dca5c8f0add2837faa148b77c201f459e0b5fee97ebab4f402b1f54db3ea3826fda80597668331a8f635075b32dbe3334502d97eb51d876d25cb

C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui

MD5 ef93dde545601efa9ecec45b303239d0
SHA1 3fc9e7a276ed13632b6a99fc2251371e0be5b4bb
SHA256 f64562dc08ff19c0e00a8cf45fbef511c1329a13762e37188597935d1c780856
SHA512 11d00ee7e7646de9de55bce1dd40703f767888ce7bd91f812c77db657a79efd03f7efe47b7c2842ecb004f481a69974af0a5f9253196346aa74790e84582f793

C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui

MD5 ba08f46943ec26ab19a9c49bef7d23c4
SHA1 979c5365c816550c548503f0cb24d47481a4260e
SHA256 7da6d1aa50aa60a96e968bf8ebcfe684c3c5b304d81e68b8696357bf0aa5a5bd
SHA512 28f2d54ba13eff2c77ff84781656948b2794c837673d9da43a870ac65ba83552d1c62b3df4354e355aff36ae341eed9b80b009ed2600668cc1055a3a9a79e55a

C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui

MD5 f3723581aafb90326ed575afa2efda46
SHA1 a47d0566ea4c09f0b49bbf7a10c9f8080672a8fc
SHA256 7738719d71aa1e685022a1e2567eef8e16f533a23b504d194a56431ff0cb9510
SHA512 b840f5f99f7ed98a5b7a201d07f98af1d371caac1242123b3323da8e0469c7a8b2291f074458cb8222f9912a29e16634b2a63972b9acd9c576aacd9f1cbb23f7

C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui

MD5 35a56189387cfc4cfd8998f5ce5469e3
SHA1 35cb851f9b3fd8d2d973c71aaab826a1d8a37042
SHA256 1a5da5f2c1014a4886180a6eedc72988867da8f97b5d70bdffeaed7e3561b991
SHA512 65dd9b94e13273ec1e22c6ed36399a4884ed9c05bb2de6595af9e3056c373e34562ed86b3ab5daeaa6925da4c3d57d6588f6d903325b9b9fc26fc7d143e21056

C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui

MD5 c7a93ecf0697d93a809f1b001f80c199
SHA1 7ff336d73b1efad5757e44a58da1ee6d771adc4f
SHA256 6adf99c1c49aab7a060f67f3b1012bfa5fa7294510f89b52090dac3b2a155810
SHA512 4095a7f742185b497e92a21ae1e037ec06d3fb2708b3f37b05b69713ac1db6166978f04d84cf8c838fcafee3bddabbfe9f48eb953c47271ad55011181b584c18

C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui

MD5 0d2994fef1db0a6958f975cddf7bda6d
SHA1 625a4a5e6fba4d3908db5c56dff0538d53a1845a
SHA256 07705e86e658cde68521aad32a897b483ee5af2d1071c1264e8af7315599717f
SHA512 0d349af0c4091849d040e15ee7916cfa09857e1522cfd61873e112bdd3321b74c937628eea2da8d99eb837eb7f6ffb48fabb131082822e72faf32213d35d685a

C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui

MD5 26aee2734341d41d57f7379197abecf0
SHA1 d7a1be3f7c47e36fcb170257ea87fe043965bdc0
SHA256 0db1b0a2b0781036869358b7a14eaed70d9dabf9630d4c70e730b2e1d758f002
SHA512 3fef43e741405315822e51db435ce777341ab9e6044303ed918e73159e71f97be4e25b36c76a27c58b04071b112285fd275017a8ba584c14579900d006d6d0b4

C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui

MD5 e403ea22895f46c2dbcdefb3f20186ba
SHA1 b6de73e37e51896b5440305d7ed6baabbda608be
SHA256 0cdc04725fec998a0593ea64a8a21e49cd2df5bb6a92ca0772d9b323aed606c1
SHA512 54c5ca7bf9c19e62281a186558da70d19f656e9430dc0171438fdeef0d37a1ad7c52920c78d9dbab42e201bac50588f533a67f1b8124daa3328ae3d6dbb719a5

C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui

MD5 ca09d6c8e1d21b64e1f7fec6095e9af3
SHA1 06a5d623e58586db877047cf21aee19d08d4a591
SHA256 267396fffacaccdf67a2c4a9a3b6aba3bdcedd10e851e9a852589132a6923983
SHA512 2f7a6d33d68d9c25fa55df31c71d1bbca5c0f769d95df7863366fa0cf543b1e6da7c4811332dde44f9a2b261d741d7d2ed69084fdf30aeb5ada7ae923b8d27b5

C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui

MD5 d714bf01969bd280010caf6b65c1afa6
SHA1 4f9a0873ebda1faeb278e57dcd43d05d401475bf
SHA256 44a21e4521d62c47544207342d1f6b89fe638afceebd3cc15c2d1505d9f70d6f
SHA512 5d9a7ae13f6eb52bcc486df2d23b10a0eed7b3c86147c75cdd9756c59c4b99cf8fc627f3fec9419f81175994085eff84a30467fd38e8291cc95dc125dea3f151

C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui

MD5 4d4391ecb993a6e996be7757950b987e
SHA1 9c08fc16a5ec61f9cfef2903cadb68bce3a982c9
SHA256 016975ea607a39755c6e8dd7038d28ec902d53aafc2c5e0b9b8f3011c0c39552
SHA512 4b8801f8b40152d0fd71a208d2cbcfff038cb155f4ff3c16d5e49091217bdca8d360de99acd8bd3525e83a736100dd34237a82782213d7a8cc64510780c56671

C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui

MD5 24bd53959e29762ae4ca9f740fb976d0
SHA1 d3d192e2f9cc43f7c161f74d3b07625196f2c1bd
SHA256 3dd4304c3ec1cdac16ad25b2fd247ca60e2cd1958ed769dcfde35e837de355ea
SHA512 488a2d00193c9a3f205e23e5385dee3539ce6022bbca353bf4282c3d065716bd346e58bd2ce203de83e676fd37af5f11572e4d2c2c4f9985c7c07eb54cf8f842

C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui

MD5 b1510fa97d7c53a627f8f4b8f7c9d77a
SHA1 f40bf46394517829e4184884d00cdd49a1377021
SHA256 0c0c6796c31a04e5c1ad315d404dc50127a82494da4131901e3b61055c04aca7
SHA512 9e6ae8f9ed8f8ff36790a73d264baabada5634df75329ec6382cb9b57557ec460aee09b6b36bdb1fd19f89e3cbc6d05dc441c9d95602df02736fba490b0330ed

C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui

MD5 18aab5f40ab4c31806dfbdbbe1ed2e2e
SHA1 d65c1b30be2bee2f20f77bcda24c22a88c2d0409
SHA256 f127817857f03769cd557ca6cf18593ee1543c36ad483a54fe44ca768c810e27
SHA512 82fde98418a0a9f063647f37c055dbd58e709cae8026093d8413541c2eb49a317e3a6625d3e59c900f6d71eb42a447836d991180cda0c0d668f2d38c99d4c06b

C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui

MD5 ec0b41d4cdca7a351bc1960d77fa191f
SHA1 549312c0f77d2cb3325e2a54fae866e896ed926b
SHA256 580c53389e57aa03bd8e4835caf53443c47d68b67f0d39a1ce92533f7d492891
SHA512 9793f5cbb20d736d4cb25758a4765304b5e59f5f082c0417203300e919a7d9cdd9dec1f41ab82b0df457a1b47294300f6c8a22db3e7525a9e81f05dbe23ea51d

C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui

MD5 adf4ce7bd45f686ac557ee4d522f5c07
SHA1 cad26ac2fdee70a9f8df61420f21084c555235ca
SHA256 20e95381afcfd86dc4ce7fba10677d8260abeef9b971534b80c3b75ece57d4d4
SHA512 c849fab95c55020197d69b778ab95c4dd876318359c13eb27360da8b091d473500a75c329d909cacadd90e58cb6ce0c43b557c8525e43e2282d270231a33e0ef

C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui

MD5 99c3d3e36ab07f5348d54af7958eba2e
SHA1 ed93128c98c7de93cf87b13f65f939af4a25eb04
SHA256 ab867381ed490fd6b3c965e52bbe14c5e31c53e3b6ad3ebb4c45ec9c03c2c427
SHA512 001aa077dac9ab478b2fcc0a4bcbe3770b105964ff1e8fabdc2c66bdc6ee1ed97444a6ed87d56a72f4f3b2bb0a11f802fb650f65888f6416c5d369beb0c7bb35

C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui

MD5 e6d41c0a30c69d208bb564f5af73c899
SHA1 2cb8b48439463d46f53cc6a97810d359f727aef7
SHA256 418c612def7d4ec815e5bdef80b700b12c1778f565b65d56ccef39c8dbb48947
SHA512 76cc3b34f5b387b5bb6ecba921a26fc29250d03f354d3e54e7e3023d91a2d5567ccf5837eeeb96a9d668ece15eddfdb2c059134f5b6d3434e9359df38f4bb3e6

C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui

MD5 345d60179020bb3881bc476fe7c35c3b
SHA1 b81a8f37de1961f1d6b385d1806a3bf628e60e82
SHA256 e3a7cce11ecb1c3c83ac3ee4a09774505b38e9104bdbc5961cc962035b9a1400
SHA512 c217be704c17aff55faba4051135ab9a9d0e4e7ade48116ed6274662084fdd70b69435a5ff14889fa22a09e8b0c560ef813f8929955e98aae7c91cb7d729aee7

C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui

MD5 dc211f68be2fccd21d40f5fc3f32c7b3
SHA1 200d5d9caa23984a098d6c40d1819a4899635183
SHA256 90cb93bc37a4cbfb7281467b6d79d5b38c2019648a045a533e7fb20f58ef717e
SHA512 4464234d0fb9d78c6caca3a2ccb772ed0d1f508b1261fd19eb33ed0d2e4b59d181668060128113fafc6465b8b4ad72ac569697bb855c29fa283f7a6f15cc4b62

C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui

MD5 d3f2bd318958b2932a3731e87d202fac
SHA1 79c29e620ecc24653b108ce918cc9529630e38de
SHA256 46e775392e3b8e7abb549612e00e0935aca8f5d8f26a2f249588bd48baf77d4d
SHA512 72e4dfe7df4e08cf3f41abee2ec8779c771d13129538ee8be707777ac2520a8704b30a8015203d04c2b8de3430ab43cdc26e5b8394ba5f0255749759b309d4a2

C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui

MD5 d10498dd2eb2f2af062fc311507b5f5c
SHA1 304edaa3f360c1b5f51af3f19a9610ccc94bfe51
SHA256 2d58865005037e66d7e71dd74820f6d7c79b7a4eac6f78a1ded896d1ee1692ed
SHA512 dcbd9f521728fddbc3bf2b5a3943600743e817621eed397b028f813fa60c0ee48ac19ccea1c58e32c98e262d18102ae94bcf8b6873fe46af151e629acef87011

C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui

MD5 0868c71ba3c6d69fc7c0e4394b0ec527
SHA1 cfdfbaebd2f3a98e8cd8d6d7ce3d6739e9cd5675
SHA256 64976da11977e5dcfb0ab3f957100defb3c3848e6e94c589024648a7e59961ef
SHA512 c04a9c86c6e1fc124158f03c5a76e2c882d79c1c88476d13cff97a437d2259196ab0380b9b6a055f118857b33469ac718d9a08490758a3aec463abc5f29299e8

C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui

MD5 e0641cb3f6d2f13d80d66ca8248f686f
SHA1 5b7208c5cae00f7e4572a052cb030ba1a3d5cd7f
SHA256 e347826a914733cb9d405e61c1290d0acaf08a58e8add1c4bc2db0dd7b150803
SHA512 fc4ab4bafe3efc23f4edb2ffcc014fb68749710f265ac0100724bfffd777a6173cd7f70bce6675b53da57376556904211501072e23ac8288e7f8cdb2a31ef1dc

C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui

MD5 5ca6e01a2a6dd325943d3d95569253f7
SHA1 3d7c41458a3c71d40e0fa9a572e4cd7139cd6010
SHA256 995a242519284cff8d9a66ef4a98e312ac1e90bbf7eeb6708cf579193937deee
SHA512 9d167df0a877507d30ae7a571efb6a2a8ed7e01ae19d6d0898b7feee655beb94f2e055eb1db10dde96ec8a559946f14451495265dd6c98f8c37073b3a91bdf21

C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui

MD5 72849a766a9eecf8585bacf4f3be89f8
SHA1 48060dc1b68dd09c067eace9e714ccb9a672a0cb
SHA256 3825c9fe6ff19a94d5c364f2870282efed20c156caf806bc6231368630fb5dbb
SHA512 4ff931fbbcb526b01974cf56e55f812966ccf3d0a759dff77791b0b8ee28f347c325160c780a5ed2fd9b722ffd774724a1b63b93032d971920c2303bfd0ab85d

C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui

MD5 207fcdb117ace15451ea012622eeeeca
SHA1 1bfe6eff8b22934678b5ebd51edef3f817cdfda9
SHA256 02ab6aa5966d2c65b8a3193bc2b6c6a9afe1c3bfcbac9c71bff05b2eec02ad47
SHA512 b0a6d277e9a65533a1111aa4c68f9fd7751c36825c88bbedd13ce2f8bba4269e4a020de18d79639a6fbef76a98a025faebafb97bef72733c01d22ad785b5b3e7

C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui

MD5 4eedd8abca1ad2fc593ff9657717d63a
SHA1 339685cf3f61479f03f814f9309d3d27338852d0
SHA256 4557d740422b5f38516e850286c3c00bf048e31382401b39e5f1ff065d5d9ffd
SHA512 f1656d6fed55c2290575a279934d4d7b0d3ebbacc7196a16817113da0d35c9c54107974127706e28c192831be6a9f5dee6302821a50ca4ec3baa4df3f71e0bf8

C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui

MD5 7bfa920bd575754261dcf6b84e249491
SHA1 114e0db3eb8af7baeaf49045a4b6e7687a12d44c
SHA256 301dcee25b24c3ca5de4978e83fb8618012a1813b402a8f43f2c8712ec993c45
SHA512 10acc6367f42228560daf831f7ff98752014c7d083c7e33d85713539d35455afeedfaa01ccfe13ef11f75bc38084ad094b566c656a1a62be0be3b7c44e4de115

C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui

MD5 b5cd31ce2f94eed33f686097633f80c7
SHA1 141156e87fe49731451eb7e5f2756dff25bf623d
SHA256 63a5060e715164eeeca21efa14870d18c993a928d38527c69e58972bb6a99b1c
SHA512 fff3190f5a14599653d84e7211f16e95168081435365136f32625d3c0b6739fc049b7a6af137b037c09b40d8d98defe24f9ba5213a9ad7fd6d9f30994b67c4e6

C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui

MD5 aee272589d1577671fb7189840e3880d
SHA1 591af8cd486df7c51e8078b4d9cd2248fba9f047
SHA256 ab93f8844473ec324841cf31b7e8fcfb7ea1cf09d0333a7808af6869ff4b3a42
SHA512 d8a12adfe1cfdd30510aaf0b717ab5a4c719274b8fc3d3e78cda4e1049b7aa5772836bc88f1ab777ac0721aa87eeb4c0f02ed56f8f2b60d027c11bd6cccabd1f

C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui

MD5 7b36ed93de8a0f8b5882900820348c77
SHA1 000e6c0718b57636af9547ce5133d8a48c47d9ca
SHA256 c64bf746d6c15e5e4a0f03de7cf8ea0cf2810b1e008815e8f9e437c8eeef4682
SHA512 61a03248d47b895b09bab5c84de9e7218f264bbe83252095fe9866152d41b1a47f9a61d3390ee36355793d316bfef5f689ef0e85d0d74ca0fa4ff59ba80cdb6d

C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui

MD5 ec15fcd654b3d13d6459f4c6659ee701
SHA1 5d2722f75b6d8650c9d8547c084cb704323b74f5
SHA256 0e60624eb5adf1ee070f4d76bf966a02c30fd72b43bbf8653e43420f1ce3d9ee
SHA512 d6b898c38d6ef465e105ba1818eadd9a48a2b0e2e025d058a8998ec0bd3fdac6bdc4c6691b3770773e12348b713ebc45ece75d02be1558cfc15f405555f396b4

C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui

MD5 9efd06cbbf8f5dcdd87f62b09a7bfc32
SHA1 d340465e2b1d8b9cc41cf59244f4c54c20c9842b
SHA256 56c1c88df769773bf556b2ef3dde1c65bcb79e8def456dfcf704fa7bff7c7484
SHA512 0de4a4d5eb96da5e48ff7e827386ace26d0722165f28c20958bc5f8c16da41dbf07be8362f94de11821a13260e565640f81209bbb9eaf3200ea62d1015afb594

C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui

MD5 51293782631c35512b984c3024de2eee
SHA1 a7f0a50b9423436ede297ff7aacdde5546b50647
SHA256 71428280ad6fbbc6edd0bd6c90ea14e1adbe9cb0131bcf8a765291d2e2d1c2c1
SHA512 ddeeac7b8c4a3970a1333c794a4e7ce04d3012e1e13980dcfbed5712beaeba65550dd47d79c996ccb2b71157fd33210b5d40ea81ed657a7faa146a74e4feef27

C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui

MD5 32ac61fbce269fa0d862511961ba98b1
SHA1 58ed222f4fa12dc12c4913ab3f6b02c1bcb29542
SHA256 d3384121a1e4c470c34965e572bb14de392f47412dabbd7cf3ac9fc7c2262d0b
SHA512 a0e2cbf2d7419ceb14d41cfed1e1f883cc0eb752533b91ff2352f8d4485c4f772bf9dc033e2c8a0266ed5c97dfbfa2ef01a0cce6684643d43b1240383e33e1c4

C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui

MD5 014c2b1f3fd22e6ab11d51889cab6a69
SHA1 a0b65e8b3ce6813f79a98b77b0c3af825626ec8b
SHA256 fbd5bb95ef9b5f8842f030fa92cc58b5dfe1d5594d891920379f8b38bfe2e5b6
SHA512 808ae0e8ad31ddf3df5f84ff7534d50d639f4f5f0934fc567ac505c9fc6519f7a903b6cdaea0d5e474f69ee387e55e144504a51c742d2e9ce6dc53c32722d530

C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui

MD5 d190f43761f84f5de2a3515b82ec9cba
SHA1 c91e3d3644a9752bf489031faa2af0756cd91770
SHA256 c9dd539b963956580a132eefdd62f40971dd0b76b7f35c64c4daea18cc77cd9e
SHA512 324b0ad38f288eff389c8b538d5fc8a7b8a0eb76d648836e6b2c63386edaff60107355d6b6abb4b2311b99a5c805ad809008e8bb07046cf6767e11d0848c2058

C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui

MD5 16c63e7a887bf331d6dc1a74af7f22a8
SHA1 d655a68dbd3916f20cd92143364b0b849b613937
SHA256 841bf6252a622ea7983dbb2528d7bda5c943ab2d3c8ff82ea46ef872ff8e6871
SHA512 58b8e4afbc15b791dd0b17b44f921bd1677aa892f9c3e5859939020ba6945be9693ea4b0f3a4434be9479af4f50458f19d0b58852e88488e698c8c7a0d901cab

C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui

MD5 a21d087ce118d3aee16046db5054e913
SHA1 e9a9d61afeeafdfde0b667ec10c1d0fe38f88690
SHA256 4a300b1de99164e3975cf5a0cfd65a4472537dddea4bd25db4a0b3a5c5b1b954
SHA512 2be1e2df1db10f486781b524b8dc8b20deeb832384b834e71eccb3e589bc7570fb5f421d081b5f379540730c96f85b5301900576c38bf1b4f84d13d30aa10804

C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui

MD5 8b72e2e0067810a4015649a86dabd9ba
SHA1 3055315d802a0d596e532085b69788cf006f8de6
SHA256 29d97e0e874009854582388b90d741ced2690c462c49e2e5cb3573312f1fefc4
SHA512 9307604b460bdb85d646b23ba24b632e019e4b69437ec2e406ae10d2c071b0910eb65902dc7a52813dd849866603d0fcd063bf27c9ade09abc573eb166db390b

C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui

MD5 9268d906d83412e225eceeb637216b98
SHA1 dd5edf3607a6f896aa2190059115eda5df316fe9
SHA256 3a1df6decf026e16ab13385d5c016f09f0594b6f6a514d2119ade3cb8c70944c
SHA512 28726a597cf9f4acb688088eb5e6fdc40f1a98482f87c327f415113e7650607af2b996fbce4c95021564180feef8c3e5002f36489410044fdba61059e4cc4750

C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui

MD5 088222881d90ef94bb113cd26cff4cd1
SHA1 2f6461baa1ead4a4903878ed80e4c3eb10ee98eb
SHA256 ce63c502be4c40a9467b69ebdfe5fc1aa57fd75b4912606e283b5a8f04e596dd
SHA512 920d189e826b9ca8233bb88ad787f9851f5ccbd84f841d5a40e8f838cd8edab6ee6de935de167c28f52deb41f67332b2c4cc8ca808742fe38053e13ff815d682

C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui

MD5 f4aa49b8629fed2470795a6bd5edb224
SHA1 473228c0676c1adb7a92235743ee20137ffe4c73
SHA256 609cf8efc0e520a5f777470fe5fb56cad6c23cb812a54e81c9c0b63250480b0b
SHA512 b1363e78e4e9f66950997d683556a81fe24720120b7ba8bd090da16d2e338e708025fe5877359936cad17d64c164ce77e1ef52d401f39e83ed85ce6a26e7d5d7

C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui

MD5 bb3821cd4629b4f419dc53986c32e652
SHA1 3fb90666d8a94310f85389d19bed6c23ca980dbd
SHA256 0b7beb6686f832cb3f9bc69fa8e708e1c1860df2e502f6c61c8b10e12ff9ad60
SHA512 c5e42d1a99af6aecc4c025375d86e28ebc71fc21ecc21af019c0f46201b174f523735b0398a62291f8f7e10528ae25d935f4631a03d1464efd41f07534068219

C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui

MD5 f838fefa9e7863cdb93926c244cdc1ef
SHA1 0a8a79a8b63a2dcd093f3b76d84bf2fee1ec2492
SHA256 8d45583bc407324e6dd95bd2941a44335b587818c3c2514db021ff77848ffc12
SHA512 b55f79678df734ee49de47b2e11c25c6ed926ada88d1bf41c50d2044a512005b8fd5d6fc013867b0411848482e6ec00cb0df37c9d460ef67b0e3bf6c2c904c9a

C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui

MD5 ae3df1c1f43d8fe5c56a32f33d0bf404
SHA1 51732d232eeef0a7ab59e416bcaa1d2e03a421ef
SHA256 7c33edeb6f506b9b63d2b23933da64e4ffbe30488a86fb63c91d82aa5cf736ae
SHA512 5e362ae6d09dd00183396aca1960af323b86619dd32a026aed3930e19da1af56b0292395ac5c2cabde0a6481593ff1b33d486dcba229263486a4eeff953a4015

C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui

MD5 de25f1e2dd177355e5ca79c4f0ee96ec
SHA1 29f04915033a40a33a057c694fdde9128c74a71c
SHA256 afbc348b626d3edad575a7c31f0e1c8e514d7877ff40190b17e2ff93cd718d29
SHA512 909c300aa4e015bae4bc11ed2d2bda8f1a5bd546a2c1a50aa79f47c6932346a05536ee4e850bf315b8b2676ada6d0951f900b29d6ddba80cbffb91feb416cdad

C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui

MD5 35e24839062581245efb18e39b28b628
SHA1 226ca5ccea99576c820f729634a31c300e4cc371
SHA256 8a49f8b2b8a431da64c86f16199d84e86aa1f04833cac17646541d870e23897e
SHA512 ba9e1b4c789512ec91d2c62805ae0fb49be1011b517391c5b0e9d61040db848df6aaaac7c58a2ddaa30b795199f09ba18984ba95f4f51ecf67af642a66b8bdf7

C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui

MD5 126e200ad1827f9b5aca527f2957830f
SHA1 8372e2896b58a7b492be6ef22e457840982edd48
SHA256 51c0b0880c0dd91cd7a28a2462b50e2fcf033ce133a9fd54f3e7a94c09d4890e
SHA512 c4a1a85f28c67589dc50c9eb14b10b980fa64e787293fe64124b47eaae5f1b7bce3d6d5fe07f331742c03cb6e8de6476724522e42ce39adcdbc4ab2d26ad4e8c

C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui

MD5 6bd7c9d873ea9d4f7a03066688483859
SHA1 2d119b27801dca5244e70d20980911f861f73f00
SHA256 816af96be8126eff7172b458039dc46add977b48184ec08347d1d20d6233bd0d
SHA512 903f9b8b3d937ee4c1dc8f6e86594514b57e26fe9124dfdf308d340416106a5954397f3229bcfbea6694c117a68000f8b7c1bf134071e60dafc3d21201fa607d

C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui

MD5 44f2ab21f6a06d99165f69586becd0ff
SHA1 303368dc3f7e04568ef668a28fbea97e30a25756
SHA256 c4f738aa66c6648f77129b9bd853960e3b8180314370f8527f36205ca4f30b27
SHA512 30a669e68480511a727d88907843694d1da5d861196e620f28a84f60495a5003b28fe7e6cec54746301ed3a3482544e653ecbda3612cf26e9fbb206352f09f35

C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui

MD5 2dac9265cd57b5c72beccf63dc0c5197
SHA1 c5c90c8fb41733438e65f4caa8f7e75a54ed4588
SHA256 1aacb8efbd6e20d4269845c4f07987969864946575eafae8a1f123722d1b49ef
SHA512 4c91a9bdde554a4e55b74d10e7d2551e99983d5435112c279f633f5e0f5b86d89dfb575484cb264a068885d06e7f0312c0e227b806bf6b4673435ecbda85e6ff

C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui

MD5 93b035a34940f37a12d3bbf1ff9c4e0e
SHA1 6881f84941be4f046fb29fa9cfa06c22b8fff765
SHA256 754b8017b575b1d4104fc2b4933a6472240530cf86b7b647d13501a2febcf879
SHA512 23dafcfd30db73a93f2f3e3a3b291b1b225a89a5810965bb67b8aa659d8a4be1311a69dc78f5976294e7cb92016e21ebafb65f42edef3ea31ed2571e9871e12b

C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui

MD5 b488470fa79778e3637b180e8f43eb4f
SHA1 1b56bcc3424928e666fc300b2966415c3154e42d
SHA256 0471734e7d140ef858071d42201bd87451facc18da4c6084c84bdeffc98449ce
SHA512 08cb0f5732c8f2acc2241c7036ddb1ff3c764c9e8c7c658ac48cc4d1c027664ea7fb7f6a9c2f1804fa69917699c6226217090abb65113262631f6a2b292aeb5e

C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui

MD5 3a5b93958755207214b3983be4680c6c
SHA1 2aeb7aa0cf798ebb2d780affc59230aa64d77bf9
SHA256 cf3e3ab2ca5c2603ead77a7f8a7ce0e9903d51737b87c27aaf277f7a01af6b5a
SHA512 27969340ed5ce8bfe368aaa4c259f2f5d540b77e29848fd4d1884a7d561ef65f08854275b19545b21be578db094064d91bc0d3bed974536fef6204111f544ce0

C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui

MD5 d3f482ffdd7174d6092f5cc41f67f6c6
SHA1 9336994fb883ee70943ac51bbc89893847cf60e3
SHA256 2624bbde6705187a0197ac82f32cdab4de752513112d64ff1aa8beb66eb21c4d
SHA512 13114f775e4e39a68e963f286556d8e98fd8a6f4f669d1b1744b28a54718a75778ed714569df97538242efeeeb6eea75dfcc9c56a20748011607592e607877b4

C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui

MD5 bf2246537e3cd1c607b8fcbd022107c4
SHA1 962fd372f193d57bf9e688f1ab6e56cc48a8318f
SHA256 fefc6088450e0aed823325fc7b25a306bcf6e97a64e19813be6db915bb799a7f
SHA512 ff22a8fa14dd47b3b1180fe30f2eb2e7b25f4dae46bd0174e2acd8651a555e9208a7c9609422b76befafa2ad23e2dd411260bc3b0caf930d3225061826c7af51

C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui

MD5 cc16b3b5ea74128933fa903d105bd5e3
SHA1 929d7994deb4af866387ce2a0e1af26662bca0ac
SHA256 cc054153f105276ad6262c72b9f9981ff5b760de280da6c0b5278c17b3e199a9
SHA512 121f0f8404202b124fcb650fb36dcf1ab35f22be245580f229b6d348f4c0303f9902d75634864ef1dd945873ee551560356d55879868b25e5c0c91a440f71a4c

C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui

MD5 7df2ff519879d384d61cddacf8f0efa4
SHA1 2b3c298ff5feef55e914af1cc740ac937bc54672
SHA256 80144c5edc7a03ac3cee095c58696412406453a6363ecbe8e7b3a16fa8c0f131
SHA512 d5124f2800a6d45ec3cfa01de4662a4edaeb9d51af48d155d41342d290e34036bcaed3a12e980675a31da46ffb1c16c740f354649192cf5f48201029e9988a7f

C:\Program Files\Common Files\System\en-US\wab32res.dll.mui

MD5 640b5142bd83faed0859d8a94574f865
SHA1 2ce3b1550b387eb6d5f6c28e354db3c19cc8a0d4
SHA256 af03328c08ff2a4653e11cb1e437c3732544aeb83435e67a4c9b8b800e1410f6
SHA512 85d5a4393891dd12024b22c4a1a7e50c4c3ca55fd45636e751455c41b842e48815af29ef3bcadabb5c7c41bef2fe3674cb1a40edf6cd122c2946ca61ae2c0361

C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui

MD5 2206a953413018ab689a88b15cb7ea0c
SHA1 2ab9a6f099ccb6f831e5fc36821154262cfe0429
SHA256 e3655e722836c69d93e4f187e78af86a5edc34a16ec6485a581dd0ca3d97ab30
SHA512 79dac5e6b4c8ba68a306627b491fd3041599fb00ab69a6cb4966a03fd3d1ab8dd175cb840789e2e4642a2c747ae8e2822377dd116a3e28d1b18d3892800ad864

C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui

MD5 80f803bf907f677d7276d7b49af005a2
SHA1 54a67d3eaa068d93aae62f37c8f6304657100bef
SHA256 7c56e3b71f741defefcabea3e5075c338de6aac87cef9a754229cbd435605644
SHA512 34f019c171e2e070f239018ef9109db038c74556ed396940c6f4ea32d73ea4f5dd7972b18c0ef9618f8e8e2e5d40b7910664dabd98d7a8cd51e7d6abd9138c26

C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui

MD5 b9336112378b8e3b79de564f9bc437cd
SHA1 a8042c73cd0f407fea44644ac670c2599f71854c
SHA256 198eb4551a02d7341c728acdbe7851da4a283f90ea262740c20a2729bb955d4d
SHA512 c65fefb4b075b7335d66aba424394b9ffab1877deb14a88aedaf8e90bc0e56a31bfc31aa91616e71f97420db88924f21143557acaaf473ba337e93e498ddeafd

C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui

MD5 03d44cb60eb9bcafc392d8970e320cad
SHA1 7fe34d0d8b7db21e90a126ffd2c7125047aeebd0
SHA256 f633ca5eb063864a076917612495813bcb08578de6b2c28bae833ce1f2072dd1
SHA512 6cad36eca5c8e1f747d0f60d548270773318049ddec135194e18b2fcdd17218d89810affedf7761d8b20f53cb19a6bfbc5e65b63a437ef0a1d4c80464bd5808e

C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui

MD5 9772a992dcc7fc6c7aaca113ef77251e
SHA1 388887783c956dfaf128606f8b05dc2d6235160d
SHA256 9b7528e2894452e19ff2c51df4379fb40df634be78f57c534ca072a37c9e7f7d
SHA512 fdb4a21fecd3bfb6d446fa635c3848b5223dbe016069e7a268e93181c54f7b1250e13fbe8aad5874758e7493e3d8c68df612a18b5ad5c114d6409b98f0770ff3

C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui

MD5 80e01a09ce708db10f5e746097091581
SHA1 67a6092a7e836b8eaac0c8980dfb40233e7f42b9
SHA256 aa6b79d8acd719ffef252733bb93043669db9d66bb4598eee272039c3a09b8fe
SHA512 dc62f83ef311609cc46b3abfe64ae1ed209ee1e353afe0360f456a18302135e785230114277d4040368b540975d10af99ea950ec8e874efda96a1da8834d263e

C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui

MD5 f8e225302afc8156679f282f38d03fa4
SHA1 d49215b481f6a87df9ad4632c589d879b024cf67
SHA256 03632b02881cdf57a3e43737f8f8ca0a038060416995891c0862dab2a7a6a030
SHA512 f1470fed129d4fab13e38492f3ad0072fb65e54b80a676912d2539f7b219c2b3320bc1b26ea90fe1c9d44c074a8c95b1d6d96fb59ad63f927986881684b3188c

C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui

MD5 925df6650c2295a115154d04a731e261
SHA1 d70fefb1a7af586aff402731f75f3b1078e4fd63
SHA256 0b872ab86d8e2d263809804bc7070da9876016dc1708042075c1de7358bd9410
SHA512 99e7fdb82de3b0af9079ef79de56ea8b5b022b7db82f64031428b63a816800e665f253ac43c770dc9511148f048f0c25b302ac9870d0eb38797f12eff9ca699c

C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui

MD5 5d538850d6c663d4f580e9fd4f877650
SHA1 a6132946ca214440d92c29f46136cd79535e74f8
SHA256 29bcefd96a604625cd6ad0ccda561d3be9f9c9318efa6639c0a5a0de0e3777af
SHA512 74e83ce8777b97d6bae5942488d4ca521e1451d4adda8a1f6ec777f1091433dfe59226d6b36cc9bf936dfb40063ea563309c4a3e78e569df3524f1869c803a51

C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui

MD5 47e9f6694dcbf6248b4b7b470a08f9a4
SHA1 ae1d2f576d3be84ebae5017b6d5dcb068f29c1ee
SHA256 b0796211e98ab67c8f7de666a09dd0168135f41d2133f0177811ca5d4c07f625
SHA512 f2c9d1f584d875caf98e0a045b20715145152e1c6b794ee9cc11f14cb96969a5e31b34913e138970943261fa61920c5aba9243fda2e495977040aa617c839aeb

C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui

MD5 b576a45ffc0091e35d8ca674831518fc
SHA1 9dff06f3a94ff5382b8ba77de8bb65ec389b81e0
SHA256 efe5facb8e883dcd651eb10134fe6e1b8c339de46cdf9c7892b7897c341f7505
SHA512 bc2a8c2aabdee7179507e712c9ec3777ee536d7b52a9af7cd60cce583beaff414eb1fc57081e187ad436be20c682c0f0263532e72e865e439773105a99a552a6

C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui

MD5 04362b79ae0eb2d7fc5c51f2881c3d71
SHA1 2eb71a096d29695da2bdb93ab508860ff9b58534
SHA256 6a996a6e37311dfbf2411e30a27af9fd66f521972295c651ae978590004f0cb7
SHA512 90b93f35fe8ae444d7aab2d3cef481bd49e4069317f557152ead25756c40a4ec11c8f9202204eb7f8780d590f2ade067ef1fea20a8457e34486ee4bdaf7eac72

C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui

MD5 be08fa489fdb8cc5021aad36b9f9c5d4
SHA1 a69bb759559d91aac556aae9e1125b40614ec4af
SHA256 20765cc0a9f272d93d947649cd88f25b71999b8127af4c4d90f7a9ea68d65d7e
SHA512 8829c48a26ef941a9e7dec7c7a38d80ec013eaae93b14d97f742dfab19b3dae2d1cf284501dadbe3ba1885a5da8ac125cfad94c5a09c7c666eea661b98c44422

C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui

MD5 6993d85a226398371c44f149018e69a5
SHA1 1f2aa9e7f895381ed55756fc5105dcc501c05266
SHA256 1681a7bf1dfb6bcc782c4085139e4837002bee2225c0550fa061f68173eef04d
SHA512 057190def778e1d3c2b0c2641a5ce2f5bcb7ca5abcccf785a884d3de85c9ec4ebde0d158595d4e30270dccf9d0c3370f603299ee350f6800436372852489661a

C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui

MD5 5db191731f8c3fd06271af50317d4a96
SHA1 a7b7ef98781b5cd9523156df612e3f3c13b78f07
SHA256 6207596c83499a5201d9c3c641ed2f9f3a5ce9e7697f08dc7d5e74366f2f2a17
SHA512 288a010ba9295459f6e98f64ebf5fae91c9ddbb4643e44f35b771d435edf87dfe8beb8adb4e86a918d4d9f451a320085e4156fb0ebdc58db03d54c94ebd1cdfe

C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui

MD5 a4ede23540d1ed1409bbc0d40ce9cd35
SHA1 a0efdf01492e4904ab2dd59801ac1b2fee0ba421
SHA256 5e4c62d7d174defa63996ace85770c72473e3effb88bb289b0d05485f73b22c8
SHA512 cb18c44765d8db7457bbb2bdbce52e21fd9ae6e036813de3dcfcd644d02c7fa5a8418dab220a6cf6e4a2d0a0cf17c6685af9bb5c7cc074877aba536c3802036f

C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui

MD5 b522af7289b3efe430e2bd3d5c8dfec7
SHA1 9a281735d6985ad015ae5542fee74010d417fc17
SHA256 0f461f1b4dd908bd8f11a7d367f10ee9ce39836d8c3a67cb4f1cec0e43e9c35e
SHA512 5e51a41d844851f0b51eba558ef209a113c9c387c79237710eae91782e7c3d4e3379f36c5a9edd28d38b808bfbb051a38312a276e42187036b6b3b826bbba3b7

C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui

MD5 bc34512aa64b8db85150e8581136b2a8
SHA1 1de35ddf297f111a7e625fa0044289ac7844e595
SHA256 c6635fe557dbeb62930870ec0f7fc3880f1774d64f2dc630191ccc35d04e2e7a
SHA512 9d9b8ade74b469e06f1eae9858f06d8fe39ca35c30cb8399877a9608e21423ee8d73e468b42cd476113dff1ce2fbb7a7ee6c606864e73b558eeef8943143ea26

C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui

MD5 91d4ee34323780f8f5fd8cf9d629ff40
SHA1 0a59052dca6fc61656568a77664ba6821b433ab4
SHA256 1952bb735f16e970ec675012a61cc621e572da5fea0b5ddc3ea54a6d6e015402
SHA512 b42321485661151b85e356aef1f3a7234462436c2374d2e3ca05b5c21c6b3b2c927e728199f5a8c6efcc28aefa4c7f329331df6ca4ccf4e5832c48c81a811c13

C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui

MD5 802d4b2eee9732d5aee97ac65bc873d0
SHA1 aab443e4144278736edf02dd8d34d7047b1c7f15
SHA256 e6c8c1c0b895aa1de6543ad87ccdafea5eee2c936def9335279eea83ea892a07
SHA512 d80b4a30ff7c3e84a12b449cff1c5b0de210647c63e057dab046a56484016fd73c0537b0e0f472924fe3b667fd00ba507fec41c8a13dad9ba8238d15195983d4

C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui

MD5 590e03d65c042d366a0a17eb00c69144
SHA1 54f3e2c1ff61436a9966e1f05ecb130237a70dbc
SHA256 230037ee33c7f91b4a0abe3457213ae94a9a8415e6a60e2553a4f415817241af
SHA512 69973c181b1a08f2a7209a098bea19649da94e9cfa27d2d898a1689a52a12f4b4176947939ea46d396ba5665b454ae833dd2a336c45517148c1e44f0add3d469

C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui

MD5 bf2f11b35ea2d7da049b152cb0e1209a
SHA1 1a89b135e4728a8ee2cb7a63adb0d88c97fe8af4
SHA256 e33f90841e5e5778667c6716985ae44c05aeabfebcf40585b064b16557162a9b
SHA512 de4868c03a2dc341de74c4eb8f9b5e201f21238047b8567bcdc7d48ab6339703ea2f3396421b07243f0419333f5d4f043dd5f511a2d393aeeb6905d50e96c7f7

C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui

MD5 c2425935e617fb7fdf1d92996912eb6e
SHA1 a40f08c6b2639500f6bdd06dded6c3bd879809f5
SHA256 95f09591239862e37fcf40fd9e96592f27f9da1bf672d35b17e89b690fceded7
SHA512 2e73a5b14e248f4bf931dc1fa8da993cf28576cc42085b0ebcce114b410846bc18ff897fd21a8be764943db8bf2237c7181105d30fe27d376841e0fd61ed9530

C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui

MD5 f8d787d06617a98c87236e89f2cf0c17
SHA1 973a54cc9f5c88bf34f1cf21d16fb1b7fc2c98bd
SHA256 acf5bd39fbd4ea9110338d7ab82a6e454b9747a0bb708909db668109a02691d6
SHA512 c004d388b0176b96a4a57bdaa2aff0a8a071c51a02a2f14bdfd2dd1c3613c71764fa1aa8757dc297ad90c5d5f6c1993e0620326246d92f168d733e7e1571c23a

C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui

MD5 eaf50ba99472682542fab9d19e2aad85
SHA1 e4df8c664a73c2fc991d78b95dfa6ab461227d85
SHA256 6fdfadb757f7dec141976e6278026856f1ad01b147b36532147a32c4d8da9cb2
SHA512 f870bb7bd1070b3c4f5b33e7a62e99644ba8021660f7b746b130b984939f3bd1fb937df6b2c8ce6925042e3fcec4f47d5d117cacd7a5dbcfe133b45744815503

C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui

MD5 b7a047e2f7583b08e8435e5f45ed68a3
SHA1 2ba5390cb417a62f286d9026529f890c9e9a34bc
SHA256 7e253564a699743f8355125f31de01b195b2732f413a6f720336178e141c2fa1
SHA512 fc0fa4c5e490bf8a5ec16df667e8fc5e9b7e8eac4d72a3647d5444d890d49b964911a721941f59fae27667d0b5bd7b105228751899679d406c0ec981612163bf

C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui

MD5 0223b888fe0b947d174ea880d8d545d3
SHA1 deef283a97e672be85f4ad2ac15ae47140c0bbda
SHA256 d3f13be7285f528f4d2caec9ee22b40674d268542642424ed7c277b8f7857d4d
SHA512 49bcc058b49bd8ab8181f7b03211cca668e8a214e3b03541385d719334b22f49a029fa9997b8097e1b5a546b2c4604a89060e170ccccd12cc1571692a494248f

C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui

MD5 01948a2d8796cc1530845f294135816e
SHA1 fdefc5a6922347ab6c9ff018adf528967bd832b2
SHA256 a0882392c1bd2404367ded63d10c3a00f2f8ebbacb576090024244cecd72a83d
SHA512 f9fa50f35a39338947ed749f432d6e14b14e178525f248f6fcd18db732e8942244c634c746ae124200738e48852172cd3c6d1494ea0b43e626a442eb60dd3ef1

C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui

MD5 b899b8fb79876764a789140f7ff7ccca
SHA1 11fa7b728a026f5aca81e5098c523edbaf7eac91
SHA256 3dc2ff7d57e9264d86a5b17e62584b2bfd8b36bc93cf6ebda2b7213fb9334bca
SHA512 db523dbf9ba2a2afa20f8b8e75bf6650cc1e51b5d297bc3cc80f7df2ea39ddd13ee78a1f8f0c2d57f9ea6b3ab695ee5a5a70b8ec8d22ffe05a148c3746cef621

C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui

MD5 629161053ffcdc652120fc9f38e758f7
SHA1 060f85ce1488cdb3afb78e3aa64305fc6c23a43e
SHA256 c98755e6bba093847707a9893a9c63adb9de4ef670a5c4c6004b77e20f6398ee
SHA512 55202b395dcf9da55bc1c49c491b3e91176b3e0c7a92b004fa6cf37b216c0898045e1e80a8e3ba55a751b356940980dfd8c6f90193470864c17fc1680eb96436

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui

MD5 c350f7f86cbde1e28809f5f868f68a7b
SHA1 fb6b8692c3ca23661bdfaa203b117cb599585d6d
SHA256 9ed7c7fec560f6a1b16ed0da508079b36879742c00525c3cc0a1ea6c99bbfb71
SHA512 43006d10369657168969e88e5cf256bd415bc0a5e48c6e8ee36942e4a1d6c9933880fecd98d0b1c0f4f8508e451d1c6be7d12d7cabed23ee1e2fb1a9a1c4b597

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui

MD5 ce40d001effbdb14fa143d67dd8ba6d5
SHA1 60b4626edc88737a6ff0022165cb481e572680cb
SHA256 a1c7d48026186fee7f9918d5cf6f320f041f5626d677703541ecf89ecd33c65a
SHA512 44c3e1ec3c1c7f9cdd23055466aebe1ee7e13e9d230c839f68d9b97772e405e9dbed5cb28b83dbf74dae4a16253c764c075fe88a76bd0490a683f778a4efa2d6

C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui

MD5 31f0c69fcf29ff819a462697575622ed
SHA1 15e773aa8ca048485143c74b323e95430567e9c0
SHA256 6ae6ce9bf3df56e09e72dcc14ad2f4c9ee5a808ae066955d0bbb67c01b4ae4c2
SHA512 bb261bd4d6f6eddca4a79b7f1e765a7e27f13a6c0cbd11c6376548144c738d2411e6499014f3a610404ea44f031d3e7a4f7245ab4b36db10dd3e83b4ea5c9b8c

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui

MD5 cb072fbd5152d561d24fdf8c59948b07
SHA1 3b97db10120a2c24cc4ab7caab836b91126915c5
SHA256 6ee5f2a97fe50bed246cc7f85fb1a364d32444dab648489f98c293c0e45f5b12
SHA512 13dbd3fa3567b1d970bd4b7d8bfd66864782ade2540cabd231c455d104c76ac417892c7e35c1d5c003960783eae23f295d224c5cf15bb6da440a35cfd7ed797a

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui

MD5 d11a5bbec390b533fb09541269f23fdf
SHA1 68ff55befdb905e81e5b879624b21f8e85979203
SHA256 f2ab45ccbb350138ac2922452fc0c620fcd1ed3cf0bdb976d4ce572e4ab0a44b
SHA512 b7654715a6296c0707e0a2393ac9f2c7543a15ce96f8005d9a2bb54bb0034bc634b448cacfe2884b388539d8f6f5cc995e7a32df0789bc1a74b424faf1480d9a

C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui

MD5 50d0086872350c6161a04c2719b69fad
SHA1 29ca485ca9478ffd93a4832b2219890bc81aac72
SHA256 f991a03ce0b6ef29bfd801e9567bfbf039df18af1defbc47c1c931f0add8d5b1
SHA512 c5b0be1a1369f78764da933553cd451908ada8431bb3a0c3d133f0ad1a6da6f4c1a7ea28394d1e3d4093d977af97bfbdcb363e1f6d712386d543186c07304a9a

C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui

MD5 5f76f1b229e49a4eac359de50a5da88c
SHA1 52573a0608ce89525fcc11a6e950b443422db799
SHA256 b308d0b6cf7eb07675ca3521b2538c6233dbf3e4213b60c6b4f654e56287173c
SHA512 bc6ade24e357c6d8218be7e0b3d09d724ba5a72ca005b6a07cd93d3a714d6c020c91b8bd092693d821ccb523cb6662994770e64c67f5ca06e6b5d887de972a1f

C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui

MD5 360632193464198c16d987506dfff559
SHA1 c7344808dc6608aad5ab2988042ff32ce4c59518
SHA256 4bbb04085be202434805f215cb75820ba8b40f44570da6f061e757ac92f7808a
SHA512 f0abba89471e982c10ef20e41fd10363d7dab47bef4c4fd7bb68f8844364401dc687f8c42e23a3dbb56dc03addcf35b33c1e49955d53827506cf93089ad30996

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui

MD5 694afbd0c38bb2b9b204a746b287c158
SHA1 2b014f51577714050b4ebcae691d70236b85ff09
SHA256 670f6d07f4883c83c6f7cca2cf7d6e92076b38517af4bb8d964c99511b5febeb
SHA512 46898896ae58ba0a1169f94aa6548a0a4b16abeb2dd1bf7f75f0c990eb5f483fb996f680e298f4a2417a86008759003b84f799984a79a0e12e4ab2e597c0772b

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui

MD5 ded5ee93af7b4be71e6a5dc11eb8c3b7
SHA1 d7f4b93cf4bf17182ca434e56a09826f76df7b2d
SHA256 45fe566f02c6a92b76d3db9d5974821bea6bac49bd73b1988a1bb2cf412bca02
SHA512 404eb2cb2f386203af5b70c21d8c466b2b8b908ee9f1b314439c82010188211b23691fe64b822c3aa362e3b0096731ce872397299878e5119b449bbeeb68379a

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui

MD5 89558834ad86fa91aadce5a60a110202
SHA1 5dce7eed0a7320eebebd0b0d1e789e57eb88a29f
SHA256 59375252b8504e04850371fab3fc60931072f9496cef3253e473cd7c50cb5f43
SHA512 ed612cd6e7bcdb3fcf849b6c97490aec665eb5809a908578667f0f91ac6479099222c5ced80f21264ce5dec51217935982c073035f8eb78dec59aef6cd2e9b2b

C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui

MD5 7f3d59784dfe6a2fe2a9291636c9a3a2
SHA1 83def55df4d977779f499e23accbee4bf714d355
SHA256 97029603192be3d27dae8965ded11f29a4b342e46825be33ece1ecc14f999d4b
SHA512 3f4572b97d5af0a92d42ec271bf64ff9b9426b11e0d6a95ce6902a537db57b5d1af3b641826db0fe6ede09f5e700136999ae9ac18a35c599df05cc5595822167

C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui

MD5 bd093534b2ff2568c04c53891e9a1f02
SHA1 4eeb65724a32b5e0aec4f812a1cca1abb0839133
SHA256 287ea0727dd765981140742f58346f4b308ecceb4c429a4d5f474a76f1135b55
SHA512 e4bb3aa92cd3038872bc44955b4dfc00a31fd7e5fad745fcfb40df414d5fe2863dd6038aeff244265f46e24ca15b8ab0448b21651c626f9a5a1cadcec9985f0a

C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui

MD5 e7f70f531cf2257aae1517d3b18cafff
SHA1 cd646401ec948c73a15d60b22ff27b2a50c1c6e5
SHA256 2e3bcb8e827d3a537996ca81fd0dc26f444ae68c89eddbbc5fc9bd47a80dcd6c
SHA512 c4852a63212cfef2e4e867fe62652f358e3bf66e1d6c97b3843005f3ce9ac32eebe02df468c7a61698beed64d5456bc2120953e7b55e90fc6b9c81726ec70172

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui

MD5 9566839f705daf79de4629293a1740d5
SHA1 fcafd751cddc3e11cb21e4a3ed787d7132512264
SHA256 9304ed535c5a926939c4e2a0084ca29b4dc57518a7f25462c1bc107c0f85497b
SHA512 6b767c9139740638a084135cc96301c991ceeaa92865fce1a01f0fd5ca10ef51cd6547bbd93320e886c519192948a4bae28c8ef819ef4f704e1775d0d56ab144

C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui

MD5 7bb62d10d84a5d444dd41b53e08490ea
SHA1 abcf83937ccc7e31a62c1280a929cdf34a7bd526
SHA256 093f40aaf0dd480857b40fc82a881f8f951bbffd7ae475ec4f258c2bf34a447d
SHA512 ec7c880d6d0b564ce30e6451a227018fdaa2dedb827431d0b596f40c6ef9c92f8dd6e86420bc444c805c5b002ae8b3b722dde8c055933d90796de6d55c4a5f55

C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui

MD5 c180ae04d9dc84af517b72bf0b62236f
SHA1 a5a86e515199f4818e8119ed909839aab4bafce9
SHA256 c07fdb0411c3f27097ac2d4720de0311faf35b6b46dadc17844a110a00936e85
SHA512 309e28eb0c275652d8dd8d6426f67978f11eb8979c4040ba43f33a56bcbdb82908056a0a0ad38245cc679194fdafa7815e9e802160b63536245fd7f2e41d587f

C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui

MD5 8ce319e290cbad82e242069cc05011ca
SHA1 99e9606cc0ff6bd9f65bf82f033a1f910b66520b
SHA256 5a352b2e700d8149ac449482796c3086aa4accd5333466ddb1efc397294b2b9f
SHA512 53db0356625dd7e776d5fbc966870d6246266debb2392d34fefcab01320d09888b8973102b96550348c7d92bc914d746fb6b415873151590be298dab42f17e3b

C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui

MD5 09bde4ea9a7007b934d3e02c336d1190
SHA1 d9314df43b76d320b09cc6cd8b98ffc89799c3ce
SHA256 ff8485e1eed871936e05d978fbde0425d0bf4d97e4848f2e00e82b13921ac194
SHA512 f7cd84533cfb94d2076a9e184f7381061dec33e940867fc3784c9ad4ecbbaf336713b6554105346ad5cccd07a3f9d7b3a20f13eec98e9d495a97168162ec204c

C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui

MD5 aff682c7499ad018440905e65970fa17
SHA1 6371eb6e7e45bcc16894bb06a687693f1038b290
SHA256 d1bf05a3399ab37220ef2a24a4a234cb3dd14c4a5526c3784e7f93fa8bcece61
SHA512 5c37632e478a6584b148488d11e71e7df54c7b3b0c13b412569ea6f7169890aa9007b9af1b1c775f5ae1c371e69a4fe0006c817440c48c6497a813b685ea568e

C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui

MD5 00c040f43fcef9c188298239c6f3bad8
SHA1 b48ccd039a3758ad9114b637e59f4878f935d464
SHA256 e7037ec109fbee00b5535c703a38a4ccc11f2f03386c6afad345aec462054144
SHA512 c1d7b01871b816d1ee5c910389c74852022d0f4dcd4691d5dec4ddcfacf8d17a708703c4001c2b28aa4fa5edf568428e1ece2b0bbe1c7002ac8fb7216a2eb064

C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui

MD5 2cb16f8fa04e10b500e46849e97d4d28
SHA1 8bf63ace30138688f9e8661d3a9246e7d37614d6
SHA256 b999108337eba8910d6cf51c80380be01f521e1cc0405fc331904d5ba5fdae41
SHA512 16e2ae0e66e7bedce5c7e1019ca604d942fd57b2b49d7cfc407bef46ddcc9687ae74e0085c3b89461c6cc56040bcab620e1b7af7b5cc7c6334bc72324de5fdda

C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui

MD5 f7402f607f2f242f5fd079f5bccdb5b2
SHA1 145e59c65ca5b2119d6cb5495c702bc820824d43
SHA256 73a7e461ec0ea2ad11e2fc6fdfaca1277252526ebe926fc9381c914ab8d3275f
SHA512 02c5d1ceca96fb41838858bdf45df559e69200b30d53e1217987fd06fbb7d38499da0078d8dbbbfdd9b8f046a0e75bb886099fc33c187c342c40c5261155103b

C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui

MD5 d12173bf9d8d40f312677d3851740cf3
SHA1 09bb4ee0197c930a16434ac8b9e05fdd45743f65
SHA256 4c9dfc8c6fed348370cea215ed1c0bd07bde4e90e3df1660fc377ba8e0fde1e9
SHA512 295c0f6360e4e29d73b37ef7ff3d6f3b8fd2de3449985e63a76b5b61cb688287a9a14429212e06e673129bba227f107b7b9b797ba9380c7ecb3653e79692f629

C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui

MD5 40a64e4a3cf775f4aaa6e7edd726ce82
SHA1 4e0cbf032afe795071644b3264d78033dd8dcee4
SHA256 69c5c5fd1497b5356bd5952006a57bb71110f35bd1b87a7c3840483edfe2731f
SHA512 eee3e763805d73b89596232b6450120c70a2cceedaab8529dc4f936c902b22219a23df0a48e6a5d087118226b6301c4db945b173a842b8923fc5e617af148698

C:\ProgramData\F126.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/4356-19728-0x000000007FDF0000-0x000000007FDF1000-memory.dmp

memory/4356-19725-0x0000000002650000-0x0000000002660000-memory.dmp

memory/4356-19727-0x000000007FE50000-0x000000007FE51000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE

MD5 14d84ad0e0c80bc14aa95b78eba04f4a
SHA1 460b58fa4a90b804815436b3a64486e10c34be4a
SHA256 e38ea41f4c7be92ff6621359228fd66e2f415644d21450ce07483e12d3161b48
SHA512 c77a40202f02528e9138799b532ed6cda6eeef765e46abbf5ebe9fca6e0b9ec35fafffaf886deaf5f3ff78d5cf2af853b6cae2074fa0833417ff3634816c5999

memory/4356-19726-0x0000000002650000-0x0000000002660000-memory.dmp

memory/4356-19724-0x000000007FE70000-0x000000007FE71000-memory.dmp

memory/4356-19757-0x000000007FE10000-0x000000007FE11000-memory.dmp

memory/4356-19758-0x000000007FE30000-0x000000007FE31000-memory.dmp