Malware Analysis Report

2025-05-05 20:48

Sample ID 250418-lq4plsskw7
Target 2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit
SHA256 2c9bb93dc2c9f841e58db43ba7dedd490cf7e0fd9e66c4b56a888e25e93a510c
Tags
lockbit defense_evasion discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2c9bb93dc2c9f841e58db43ba7dedd490cf7e0fd9e66c4b56a888e25e93a510c

Threat Level: Known bad

The file 2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit was found to be: Known bad.

Malicious Activity Summary

lockbit defense_evasion discovery ransomware spyware stealer

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit family

Renames multiple (7609) files with added filename extension

Renames multiple (7446) files with added filename extension

Reads user/profile data of web browsers

Deletes itself

Executes dropped EXE

Checks computer location settings

Indicator Removal: File Deletion

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-04-18 09:45

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-04-18 09:45

Reported

2025-04-18 09:47

Platform

win10v2004-20250314-en

Max time kernel

105s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe"

Signatures

Renames multiple (7609) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation C:\ProgramData\FEA3.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\FEA3.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\FEA3.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-83325578-304917428-1200496059-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-83325578-304917428-1200496059-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\ui-strings.js.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSmallTile.contrast-white_scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\BOLDSTRI.ELM C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.boot.tree.dat.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\iheart-radio.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg5.jpg C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_fw.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotContain.snippets.ps1xml C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ko-KR\View3d\3DViewerProductDescription-universal.xml C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-20.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PlaylistMediumTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\hi\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-cn\ui-strings.js.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\PackageManagementDscUtilities.strings.psd1 C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\ui-strings.js.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\SmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_2x.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\PlayStore_icon.svg.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-48_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailSmallTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-400_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileWide.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_pt_135x40.svg C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailLargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-64.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\FileAssociation.targetsize-20.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Microsoft.People.NativeComponents.winmd C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\MSFT_PackageManagement.strings.psd1.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailLargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Skins\Revert.wmz C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\FEA3.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe

"C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe"

C:\ProgramData\FEA3.tmp

"C:\ProgramData\FEA3.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\FEA3.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 c.pki.goog udp
NL 173.194.69.94:80 c.pki.goog tcp

Files

memory/5000-0-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

memory/5000-2-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

memory/5000-1-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-83325578-304917428-1200496059-1000\DDDDDDDDDDD

MD5 8303bb3068903ec510fffefa3f7afcc3
SHA1 61960cf1d208b2e7099b2be004642ca63d164fa8
SHA256 312e8cdd2a8a01d414a0f19e8e9341f8d3dd155cfa0fa6034e13386efb3d2a89
SHA512 93aebcdbab31530e2528a6a83ac9288330149b385848982c176803317b202d7f6b85e2eb4175863baa0b66f9671c956dd0b0306e9910efc3aca1d7fb98721a6d

F:\$RECYCLE.BIN\S-1-5-21-83325578-304917428-1200496059-1000\DDDDDDDDDDD

MD5 e13bfa8a8ad6349f346065a0a1ba3d68
SHA1 e33abe3ae78df395990f56fd211667e90125247d
SHA256 ecdede8b5d5cde1de5a00265051212ed76cf4b8539d2e399062da2431dedcbb6
SHA512 ce3292130bb68c05950ea3dbce56441110c64b063dec070babce35abd10de6dbb447b08fe0d16c6767c645db0a5557d2e8958e2a288368ad6a344523d6f0d5d6

C:\3T2S47O5t.README.txt

MD5 a614ebc98430a25bc689615a8d71a613
SHA1 f940c2db3c21f1264b05191dabf6dc41d6fb3561
SHA256 7c3de04e7a1d7a44f84994244470f05faca7fd22fd80376414c0c0a596b696f4
SHA512 d7b6192a5d9f3e9535ef14a183aeea85f9a0bb1e624d4a6420b407510102dcd018c83559d4cf6718e6455fbb03ec0256c13ccbaf2336786e94c7ee8b6408e151

memory/5000-7226-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

memory/5000-8341-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

memory/5000-9160-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui

MD5 073f07e21042c7b1b95eef56ca1f20ca
SHA1 d81294d65075c2f800dfdd9952bf293c4245342d
SHA256 07e68b644207864ff3958a70fe6d4abbf7061ecf17e643dda3e7d9da98209b8b
SHA512 acf9afb92d0ebef6d854f79ae91cbf2fa1ae40f557216c21d617782153bc42870a247ec5ed9276dae143841414626e8d691c4f167e46ca5f3d8ddea977e6a8f9

C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui

MD5 0ee30948f9159ae5fcd89a6599e5ccfd
SHA1 e1aa887d426db6e5b5d6aeabfeb267358d4fdb68
SHA256 d1dece1b3dca85aa39ebce35bd6f3b794cea4b8d32b4e67b9efe904f61ed364f
SHA512 7db6a5713c5d2aa24974426c1f334c438345df0946731dfde96bd8ba75778935672b46d67cdf655933b07e1590f1336cbc1dcffdc47acdef1ccfcfd823c0948f

C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui

MD5 b2ecd5cc489d9de60c8ab2a82ca2a3bd
SHA1 d8b9830fdc017f5e758c2fd619bb8fa7238a6eee
SHA256 7fbae1c517813aa185ff4b95296212f9730e26a313e9fac3a6a56dbe13b9b529
SHA512 4c2c2c88c7a636a94423390603e89e55881d6db2fbe605de2466cb88cc1ad0ee4234185bb3b917c68265c58e4f675dd2b4cd1d7e3984dd9b0e307bed07552cbc

C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui

MD5 83a3247ea122009c3f768ef0cc6b1bf7
SHA1 6ad5141b269b3020efd2d9d3fb84344977e6de50
SHA256 06d1c4450513bac29d3743ee35669d1ff4ef481b33eba9c6e0b0134bc1121e8a
SHA512 5a16afb2fa785c64c0070b668eb5704e8ea9b6dcc4cebfbd8f5b93ca57d24c41678c70c82c7e662b8340ec2c48d3c08bcdee815252cabb2b8c5016190b28cd3e

C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui

MD5 07a627e5ff1234e9ca3ac4d09b888002
SHA1 97b67c0c64b8ab0b757cb297224075ee0c33dc2c
SHA256 0059581981f233d1ce031c14a6610fba695e7b11addf83914c56fd2770dab788
SHA512 a451c2f1eee12e28f2d4259c99f5c36c18a72b629412e41d3300f52c98409d99c837bfde6cefbf9bfee1966b55c0bc5be873f65351bb0e626c58d14817042709

C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui

MD5 0acf1a88039e7c6f4667c218f088b9c3
SHA1 e90b5bad5feb70b487cd8c7ae5a5307da5f5c892
SHA256 f4d10bec2789b0c3143afc9d795414517dfb57a7cba447e614c1563b49f3b0c3
SHA512 7833bf1e94844e31c4303671c4998acad14370f4b8607a006e215827a2a9d1fe21637c2fd424e0f725613d07fbaf93eebea14006fd9d8319c6a152665254a792

C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui

MD5 33bd0f74841cbcc3d8ef4acf9670cb0f
SHA1 b6072334688e3a33b7c8ee50ac628fb4fe0ac58c
SHA256 5609617c35e493603a172c0de4d72e0d0ba20021e782a69830d7d866549f7e8f
SHA512 5d41d7ecfd8b5ad3a369205bc48e8ef30cf68e4844dfb7449d6085f9b9e90fa889b0773635bf1bc09fdf4567c95b4191274a5c798a49c9699644c05b51877a54

C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui

MD5 373e0cc1a7ba8af3b72330180b45423b
SHA1 0fabb3294f9eb5f46b45e81332e2e711b7983109
SHA256 e80837c416c3040de2ea39f3647db20d65158c990c66d43c87c3c19e17b85f6f
SHA512 2937b82bb5f98276ea80c607d30cd8678e83747cba3f4e9f2d9fefd7a70e86a3cc3812d5dd9c6fbe6f17d2ea8957d8ef4502e539f598ae0d66353b3381e914fa

C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui

MD5 f7824c0d338b569f28317322cd6593ea
SHA1 5fdfbc5764371186c3ec3b0623d4b065410d61ac
SHA256 0332cd57d652d4f568c1f572bcf1da1e33628d65f7752027ae2aef29de6b2dd1
SHA512 2086e67b9f5b3c891fb8ed0224355c148c851f384254edd4d6636bf0bc7f4a35ecfa54a85d7c0c23eb414401750105ac2d79c95d71753a2403375cdb0790a16a

C:\Program Files\Windows Media Player\uk-UA\wmplayer.exe.mui

MD5 032ba9cb610ae53a5c97100197b1a853
SHA1 993e8e9b879e9b292c5d003eb9ed9a78bae9815a
SHA256 00e8fcf6dfe7d562dde7f8bfec9463986ceee7646c96472dc440cc7a28d232c0
SHA512 c9522b9fb8ad880d4082f710c4a8ec172bdf7a6c69f589b044f4fbef1d8c983a0bafab972433e682895c239232d95f1d60b3e0f8d0f97fe0863025a83b2198c7

C:\Program Files\Windows Media Player\uk-UA\wmlaunch.exe.mui

MD5 6d6e8f7f3a5ab8dd140dd887e0f3d930
SHA1 44a61beeade3ca4ff6f9a2f7ebb44d283435be06
SHA256 a496701ce84cf6fab38f71cdc90c57467f4f2364ae11a37235ac57ff7303bf60
SHA512 8621a0a848f32e228303d62c6a5a4e79efe8d5b3e096b7a69006e5e50c6d537f862e0dd837da85d591c482f6a500342413feb5438dc8557b2bc7273174111cc6

C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui

MD5 952582e37eb1721fc2081856086d85e5
SHA1 3b8b640824ee7ba94d254a6a902c8f738a87febf
SHA256 8dd96d899dca6503df28432d8210a32cef90aa65e9f0d83a53fd2e526b85944b
SHA512 b13cc52430cdcb4d16b812aac38e483062edcf5437a3edf40196b6dee35f0a234bc445e7a7000be561228e3c509455354bc16157cb2c0d11b04371e07faacb40

C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui

MD5 dce8382b7d4eb258b6695a28bac7a54f
SHA1 cc1f7191f7f1d4f694e600f672d16f1953ba0c04
SHA256 57400ebcbdace42fd2003d735107e31b46f9ae7d1bf755d96d04417d24683cfc
SHA512 957ba1a45b88381b09f9bc68b3e9449e8b8441b2316dd5b9f8de1e5e04451de48eae1ff2d3594fbc396d99db04e372e53e72df9a63e84849e70dfc77400e1db1

C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui

MD5 23ce419cd35e6aa8b259f2e0cd80f13e
SHA1 340fe011b65e43c50edc0802d8c9d20da41d55fd
SHA256 f1a79020c4a768ae7c9c7b626a6a55483621f4cc9482e6e624a6bfba144a74bc
SHA512 8dbd2e91af76f5629ce23512878952c4aaa55d5c1230f0dabc827391667fcc8eb850f7c0fa80fd1bbaab08db978d756a77ec512c98085671a74da5c61c7eb78d

C:\Program Files\Windows Media Player\uk-UA\wmpnssci.dll.mui

MD5 c98247c577ccafa4987db0cb7017927e
SHA1 bf38c85af93b125b958ef4ba13871fc3a327e0e0
SHA256 6d6c2adde47041f2c4f42cc984fa16c2cc38b1c6eebda7f11e0509d2e2463193
SHA512 31b42f146746621a1b1a446caeac2b67dd91f8b6584c59e36fe5de9c642e0710c7afcd6628544865b32e2118272c77ffbc07c88644b33a947220e5ee5f52d792

C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui

MD5 8a8f44b573823b64b0e6f849d85b344a
SHA1 4c8f2655c3d9020fa95aa1b966eac70875aea252
SHA256 c3de92e7f24e5802df1fb03e1261e7b86c3f0a0371ae4ebd5c0d019244b20010
SHA512 953c9d57681307c7ce719bd1baf9702db9fe4e362bc7c693bbb9aba64211e33d1dc67fbff5e3f034aaec94930e47f1b9fe2c78f7864cfc3406ba32839da38be4

C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui

MD5 467de5975479160a8b1d2ffff42a0554
SHA1 823921b333c710f75675fa99c94934f1701c905c
SHA256 015e31c81561f2f9551cfdc5cc629517209e4024bb461713b586a0df02586ea6
SHA512 92a48c9bd1518db0de4d9eb2518fcfc5522359f3f8ba2c9cbd02bc7e276e38ed58f5d8fc3faffb6b9d48ba963a1965adcc330c9f315ffd7fc9d6caa9069a84f9

C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui

MD5 31939ee821b82ed9b4745fdbf09e396b
SHA1 f95b4cdf8f71eff6969b97b252395055a680fdfa
SHA256 cbcc22b2939126a86de68e7c9c8dbc3d516b13e68ae398b4c111b879edbc86e2
SHA512 d22be5360005e8cbe76d5fd5e6287d42b54a1506cb99c1130a931bcf571b8bd5ab4533540532ab13451a8e61d2236befbca754c605f0fa87c9553b8c22168620

C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui

MD5 97dd97fc31645952d700988fd477dad1
SHA1 413800350bcce94855a4ea215cb171c0d76987fb
SHA256 d194315632445fd7a934bd91cd128df0a23911ba0980a01fa2a207f79f4e37ae
SHA512 e38b17344d98b46f43798b21f6159ad9b8b8d2e90803301270e5df275585ffa5d7d82d8dd4316cac2b425e56c20408b23df2d107dff73584c3440a9c9086428d

C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui

MD5 fdb057ad66fb273a7f720707e2d688ee
SHA1 e42dfc2e3922fa8856d9db16b55e07567d817501
SHA256 acdedaed38a205b1636ed5b1a27ce7b7e83194a95836c7edb20020509aaf96aa
SHA512 5a5ab19466aad788940023a60d80a354d10f13f6a31d9f3e009adac5c6d3819bb12117657c94af861c77a373951d84a31783d664f88b054bba9788f5bc627b65

C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui

MD5 9d11a3d2270fb91df37eb70041af1e09
SHA1 476a690258cfe89b543189ab3737cea0737fba02
SHA256 b50783fd0b8950a2685c2d85c8bdc589a384321bc6c1d8b3f65860d21fca76be
SHA512 c4843f0410a1c08d8dc2206be0ecf322e50f85db4e78dc1198510c5e5ff44853be7f87a411e41220ea529c280acba61817c8308a6aad727d631d30013a098efb

C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui

MD5 9cead5b67fd2cb53f80f6f4ffc64e710
SHA1 581cd3fde7ac6ee315cf4219ef43ceeda9febd5c
SHA256 6319a9fd3ba83c3d8a451d2827cca1519d31be0ae5b6849530cd67ef8a2fbe38
SHA512 608068bc80b835cda11db644bf78e49f872b442bf2f5e8050874d0b20db661a4621554528a85d1b2260cb27fedaeed84e1c5ecbce8d7ecacfef5514455060c50

C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui

MD5 3a51f136c0dd3558c097374b9187243b
SHA1 66e6b96705a357ddc4be7bcbaeeb944aa266551f
SHA256 46ef6ed90297a8459a7d1d8f15bee3381bef1815a51052146a54989b52af9a12
SHA512 9bdef8b5048ce98069df86f89e1f5824eb876932c1c9c6f11e476e68481f282988695d3735287da60875b8536a8b1306f72afe56a7d61f0d5a8185c08f3dc1f4

C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui

MD5 d65bacef0a39b34a52aabf33aa006f8a
SHA1 72ace81e1ebcfabe5e016ace20bac1166ec84a6e
SHA256 9f7df33ba8371ddbeb7263004d7cf505d7928df309ad5b361b6963a4ae87788a
SHA512 3ec759a74035c15d2a0e80278610d89443c4924f738aa955376db0b276ee06c7a2b146eecc7e2927c623624700dfd367611ad8e15d6cdf61d50a2e585e0c7882

C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui

MD5 3d2ec248907b29b374845b9415f25165
SHA1 a09cd8b2813ee81804273210af0708d4c2b14717
SHA256 300492783ec3963ef885ce2e457b348fa7588506d33f27ef53875dbf8b0121b3
SHA512 c16542094c950cbb4ebb38e1af8b71a5e0c6a2cf909ab3d42fa57ca6f34b6c4f29e7bfc0f81e2d3503536eb0e3f325a44c5e69f4897d3d324bdeeefca1fc6692

C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui

MD5 57a5d64eaa5d4b22a7b91b56f411f70f
SHA1 baef6e2df331c553a76731a8d9ddf34c3d8263dd
SHA256 1b32444e7314763bd6f847bd4944728ca3f2b5fd7ce58192de00890781843178
SHA512 f4c2098cb9f8a29a44b170d5487c1611b23be40e11444eadb574aec10902ec9f7158acc3b393946dba07933e327bafa03b91ca12ab1e237c555ac981583a5293

C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui

MD5 4cb42ad3a9ef27c79f573ecc5d3889fd
SHA1 b15615f8294c7482dea55db773375b1a8b212a4a
SHA256 6ff88fa558d66f2548fc17b59161b0308742c0552daf90ac5ccdc323e36eb6c0
SHA512 3866cf0c572649890ab1b9ba3aa0c5846b86f4dde223975ce022dacc49bec5fc54a248899de6cbb54aead40f3c5acfc6da4480e50839e605a04842937e1624d7

C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui

MD5 7b5e796c1f1c7917fa93be01656f01da
SHA1 850844745e45f83b7f8f31a6f601262e45073140
SHA256 0c24c3aa1bddcbadaf269fbc1790d3269f9e4dace0b49ed1d5f1212a7ec312dd
SHA512 2623ae683fa195f372679b5c843933e4f58a2df05e3e4e4a34731154ad68f28fbe8330eadbe90e124990cd795880052fdf345e3a11fab1a44b288665cdfd04ef

C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui

MD5 d518f66c075dcd3f744e7b235c738adb
SHA1 dc5ba8a7fb9a65ce907deb0b10c13fc666c67742
SHA256 3b578c469dc6c4b15e4c1a4d5b8d25654d1b5b3e25ba28c7c2fcbc1e9fe62b45
SHA512 8f00db82a06eccf076f15baf972186bae408ba0320a2e8e46afdacf9dc13213c65f58c3105c9300792e3f5b8529ce054988f7714b20ae0671198251c65dec5f2

C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui

MD5 37d4f9eb92fe6b0c69e0ab5c134f042c
SHA1 27d4d8f88b3a6845fb0587649a05974b3f5d2944
SHA256 9ee4afcd7d33b4307013ae84485a810a5160262e5a55ae288afea6ce16534229
SHA512 1de7e8830b97bee67a43810b5ef8c589c22b062bf89fec7aa103a0d160e1df919383326e01565244ed7293c1105d6dec95c119452d5f8a289eaf1118a9f2cc14

C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui

MD5 96d04fa72aa6135f164dbeefec35268b
SHA1 f582fdedb5ae80516682974251326d7831c023b5
SHA256 fcadca27b5da0ce367098320993f9e1a460df4326e464e883b1a2f0dc002b29b
SHA512 76851a4e6a056e7b646de4827aabaf0546d7301f07738a1d72d5af2fb50a0fa2cce2f0ebec758f4cb55978e3df625107259e27392632a8e2054672487c2ec27f

C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui

MD5 43f89b3da62133093acdc14cf08a3736
SHA1 c937448fe487873f985a0ec873c11b7a7a5c52ca
SHA256 a4c242fed840ebf93e93a5edfc160f015eb9ab643f18882c253a0848e25b68a0
SHA512 99d8d1783f015546212b78ec07670f380167ee84d1e1a3cd97ad81af249a9351825b0f7801b8f6f72523de53b60da2759141135a79d9404d42e4241708f152a4

C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui

MD5 fb28545e0294668b21491e24d0432c56
SHA1 da1dbdba8d2d80fe67550dd811df07f9ac510f4c
SHA256 41be2a9e34fb4188ed4fb5988142dbeaa90689e41d8fc6e011edcc88dff3637f
SHA512 15a747ccb79b8e9f0fc8b3e14639144475634756035213c3dd9001a628473bad2d32610cdf7d00411b82989e11e8e80a05a29c2d499664f0a2648f1eecbca132

C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui

MD5 730a6ed9dfd50a7b6c68e1c827c8484a
SHA1 e10654b0298b7a1cbe141a699ae3ccb76750df7e
SHA256 ea4c820223dd03c777a9fe19d8ba7caa634f6d80f999ac733491f46a93bc3c1a
SHA512 2dad2c9f35d5ac02db61f591e5594f4b8a0339bdd274120970f98d87f24cc89dcefde100832a0123ebb5ce51f04c4a82f745b4ca5776cde0f868cd53af2a42f1

C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui

MD5 23283bbde891f235c7d51c64e91025a0
SHA1 05e85605753857dde17d0ba4ddc2e3447d21bcb5
SHA256 67177cb87ac9cd6c11665baa29dc45aba163bb4790504a28bd82371c0d5dbd0f
SHA512 38213678ecfed78e204204c05f066d785b00c78953e845a6e5a4fe0dc13545f9fedb865b5a4a3c24c256ed54ed9c798184c5099a194bbb2c79d060329d61591f

C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui

MD5 e665a1da34923bb01a06f2f0c71a1da4
SHA1 d02a61437d925a8eb1d49d76c6722e6f75ec186f
SHA256 d471e5dadbbd37f5e3b334a985426d6a0a99eaa750314cffb2a5b3e2bdac2315
SHA512 74e593b9bc53c263c554a9e3ac86f9ae69d1126d82f5684c389ef5db798829bf561158c50af545bddf89c84ccec47de058503dd89fc8b4cb1af867700b3f3558

C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui

MD5 4c4cc7a50f3e71e4fb2d807c4305a2c1
SHA1 a59915478b06ef06bc4e4d2b4289ff2e93506034
SHA256 4feb0f30200128d1501f066660494480bb6c489c6c9a670bac61362838d78969
SHA512 c195b890141c70d38ad04e894428f967cb041459cec8679eda4379722ff8be298238a05f5d3e13fb91b4deb663c6445e405c3a072e182cea5d6cfc621d691578

C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui

MD5 24ca1e2f98d388ba050946188e8e84c8
SHA1 3aa0250d8f5811f6b721fcb2eab6e4db7e41de6f
SHA256 005787a57be2f79ca58849b5873b64718f40d788bdc976f1cc3f03ccf9e4de38
SHA512 52dbb574c26fd7fa881b785e8edf1d5e5402f24d94975c230a11da40cdb14496665b6f4d8c60d7b3446932a7a93934d7f9a57ddfcd76de3202710d2fd6324f89

C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui

MD5 26c2c0d14f8a1175a22fa2276cf1644e
SHA1 66100df1d98b33c18b643429a74f2d61d870fa66
SHA256 01265a93d960445570d30716aae599b6db1d1fd0faad3c150c2599486305900a
SHA512 297d59a819c7fe738e39335fabca16eee0134e5bb31753ca90d1784693d4e174d8da94a47fbe326c757511fab05bf24eab8de967ecc4e24a95d210f4a69af6fc

C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui

MD5 2f679578d62de140dca35e4e70d23236
SHA1 4807a2b960e93c9292021692fef442ef81c82644
SHA256 408d0f00c2254a46b0d24e7f192d249e2a795ddabdca65851dfe4af7619fc1eb
SHA512 73145073c1d76e9ba7d64b3b248b2fbc970de7b17391e2473a73573191b0a231f79a8aba682aee005abe2eecfc0c28f412a3d58d58e80d6e13a7d7b57eba12c1

C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui

MD5 5d19a6b920b719172473fd34167c16a9
SHA1 344ed179d402c67c0dcce1c62aff419f1dfdd322
SHA256 fff46ed9943411bbfb6926c04b5811a281b14ecfddc993865dcf4d7df022277f
SHA512 1f9ea779e98982d57c23d2dd0ea73a4db631a38b4716464ddef4d97b373c180ef55cd6443a3c4b1054b21ec38fc0f03b2247ae0424f7ef9ea54ff8e240cba593

C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui

MD5 f69711048d93d1c82de936f67f177012
SHA1 68015b8052647a997a8b9c7fe41838e9a5f82822
SHA256 9b634ea0a2d8e4f7fd046f44134e9f957c2ae0ab4825abeec8674213e204272f
SHA512 62acee05a45a2474d2b3f624f29ea0f8bcc950e551d8f0230bdba459cac85abe09562ed7cdd9cf39991179f404644c5566fc254e75e53ca59b1fa1a265d857c2

C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui

MD5 762ecb6758c6075174bcc31b656910a1
SHA1 4a7e42d47208b00f40831cf77ae988c2404f57e4
SHA256 b1c38189fc243388f55f97221e1b88c31b8493907603da449d11b63dcef51154
SHA512 4b3b6628580c89e9929131a7af09895901f5842981da857e1fcf56c34f44d111eaa01311bec67465dbfc702dcf087c1caf47802bcab774feb214c24bcf5ce955

C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui

MD5 fb8bfc8143f2321b490cc6545b491db6
SHA1 0a060ee2564a525d76f4972997bac0abdbe3847c
SHA256 eab8c81604c487f415f53626f251e42c0df67d18db75f6e72f8b0e53c0779112
SHA512 0f3338db4326bb58024d4ce440d88758fe343b7dc6f99ec979fc7f6c61b9e2d067909e029c744c58447247bbf04e71ca356c09bc7c7b66c3051f03c33cae4b15

C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui

MD5 418a3ca1c518cc59b31a94da8940d19f
SHA1 3d3f51b957192ed1818e8f346bb901a949356c90
SHA256 899e12a976c0a1489376650ce57fb7779190fdb2821f75113cb4d63d105ddcb3
SHA512 b7a4df37fcb3833f5aeb6a260fa360bfe5bc447cbcea23cf0bff261679c05900569c21621bee6b7a74cf571852926ce31d11fa7b5dda21deb35f8de4548f6828

C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui

MD5 f1013601b57b9f5ac56936f3c5092042
SHA1 3b225b5577f25d1af864680ea4da2967f03e1048
SHA256 8d2b87da2272ae948105f9a510f3e0dfe728faf8142de98d265632a9cc5cccb4
SHA512 b0c927cdedae06f50ec3217ca3ddc06b441228e3032e0e81686ffe672eb727ae4d576c9aede080b9718a7376ce12f70b588345af753cf2ddcbc6013152818ba1

C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui

MD5 5ed927013b7b4196e7dd5ab02a5f96a1
SHA1 279eb63d7f2b02967f164f641a2ee51d684e6179
SHA256 724eb6122832133d4e511868d972df9c42fb6bcfb60b72b3bce214331fa71c29
SHA512 4f093630f26f7c43236207fc15a2c739eac315eaf70cb5267835db7185ca80f770732749acb216b473a3af43631943ca88aee9a60ddd4a878d96346b010a3d79

C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui

MD5 c8e04ea25d2801db8a21640b28da673e
SHA1 1f2f5ee015da8c17c8a29e5b4af8bf11fa03619d
SHA256 806b907080715e1a532163058e2c18d60ac9365508ccc8b160166d905a5fa68d
SHA512 2fe3990305411b1a69e666910aedd1bdc08d6735b07fc125d4b6828f460e46034d5c723ea1982bb9fa4144c7ab9b321f7bb15ce6be5da3a0c07b6129a116706e

C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui

MD5 5b751664796384bc70f2aa9dbbf0cd15
SHA1 61a679764f458ff23570b86072e3845122f8743e
SHA256 e2dc42d59896acefeb2fad3bdc59b35fe38d002375a2021b68a169b03a1925d5
SHA512 d018636b20d844b6897b531c0e32389dd68ef134d762cc2dc562df0d8404c8cf2323155335e4949b7319bde3b5215e1b9d77a8daa010e0c1bd6d90df65938d8e

C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui

MD5 c67f2cdddd05a93bb550e1edc717a83a
SHA1 083e4760872172f948f18d6b507809896d3b35c4
SHA256 03a7e190763b7a051fd7570c659c76aff0533d8242e84ece37778dba6ab2cb10
SHA512 7a2b22daaf6d5fbe7b02893a3ba63a9a83bb5a0319acae0a8588d4233d0cfae12bd5626d784cbaf15d7d67585804c46a1fb2433b19cab2bc5e38d6038d30c874

C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui

MD5 8458e181ea1ce7a04a931744142a64e4
SHA1 c204a44bab7b34e18914607a82ed55547dabcb00
SHA256 3f967ba7d34c9e08ac8e64a99097a593075e0f786b1305aa64f57f7a1fbb41ae
SHA512 a8bcab4d03137c3b1328fa5033ed25fd5ba92f7e5d46f0f37712bbdafb1ba40dd19281ccda1b248e4abaf026e902fe45f0c424980636ac85c5007401c5a688ce

C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui

MD5 0b41192e1d9fea82036d00b3f387c4dc
SHA1 2ea2f802af4a1051d39ae334baa9022e6637c9d6
SHA256 f204933ceac848a140eb0fc1b8d70201e655a3a5349f76ab4ec56361fcc7dff5
SHA512 f68f0827f98f5de3f6d43101c1661cdd3435462414842d249ec548c4e105847fb43bdd842e743e02afa4ddb404232d9cce990d610e789662545aff1cc33b3c65

C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui

MD5 44fd22976bb5479a084a152f23ea19ba
SHA1 341330e215773109576e3f95a88a6c7ec03ad9ba
SHA256 54cf0d0d83dc0e4af3ad4a5fb70980120c4178dae1fcb06858217123f7589fe9
SHA512 1803235c45878d4b106c13f619ff4e11721653ebda961069ec2b73ae289573bda6f49964817debc5cb9555f86706e9e7e414eb0dc11320186c4d08ffc079fa3e

C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui

MD5 4f9058a39e57077dea32febf7611f246
SHA1 8b6aa028fc5acc318934f8b769d3f6e0697e54b4
SHA256 1b871bcac333057ebe262d8b15202060adecb35fc79421a6f232e91e94665219
SHA512 52783f93e2bbd3900cbf335c9282552a62fb3b0c5bf25e3835478fcbb0e9a699723c1a44384e3a891ca888a8c5bac91424c7b1064a6f81adb0f1390890e34af8

C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui

MD5 6247c94c51cf1848e0925be7e92b938c
SHA1 35de37532e92b3cdf8c1ef1881aa1d4f3561bed6
SHA256 d7695ebaf52ebd629f3ab21f33bbc064c8144edfcbf934b4fefd8073123fe42e
SHA512 194defa58d9f361ec5f1738cc8a0f5b54c536cfbfbf5a1c97062ef0d14c3cda9bc8588b3c45b6d911ac69571ca761e0dbce400958bb4e69f038dc34682ce006b

C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui

MD5 6c9426e10ebf12fa6916bdbb1746b401
SHA1 a1127122f09f4b27460fa8276d27a46d1ad18f1d
SHA256 d3cd5b67aa1740af4b914ce11b363441428badb6f24f2b425081536a8d519f9b
SHA512 199dc6b317672f2b1c7c3a92895e5fb81266bba7e61fc734a938044a42baa3cecdd4802f4ba609e14648ac92e75ee2ce6c9f2d9df0eebead4e05dcd3e0df9a89

C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui

MD5 75076e23aa9a1366e590a8671bbb3127
SHA1 b6fd88df4e015b027c6190b0d05055f96a0e4d87
SHA256 33f34ec0f367a9be6df7408921965936b01c1ae2c1c935270d21f26a31071c47
SHA512 71437f785a710518a57b3638004d5c242393b244d0082ac2e53daf2b1b1de32e116a72b9ae4203c5af92238600efe0eb889785c553f6feb7737ddec235190bf9

C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui

MD5 e0abea52630c0a03b2b0cbdd7aa0f36c
SHA1 74ec0dc34c2043cce9b4061bdf38321967223fca
SHA256 e470888a1a0cc6e7f58c291bde343a2c22b42aa6c47650e2a4a40180f682f53e
SHA512 58210f88dd28d664c6342df46c876ef54a4ffc88186fb144867aa6b39901cc6690e0f0972ec3f2f6cfe69e1df7adefda319faa12715a883fecd22a713e0f9419

C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui

MD5 edf0d40e76d86be1bfa73bda3390da3e
SHA1 a076c774f793eeeac0a093a3950b5edb1ccd53d5
SHA256 4b85fa22cd4c9a8e2bc49263920b294b309733b7d272785304b11cec0ec14a8b
SHA512 b5fe342d6150d6b102d311711b27ef28018c9ff926fea6ae562e34b54d1db09cf2b3a08cbfd40280ec07e9576f76849015a4f50e207af7d855fc106b75348397

C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui

MD5 588384e498de29a1dd965ed455ef29bf
SHA1 0ec34b2dc88da9e853201e20af81fd0a1896a5e8
SHA256 9f39d910ef326482239659507fea1fabfd033e4be2ce597a6eada6e7c4ef54b4
SHA512 3b9fa632f0a9743683853a1bff1a0c31b7d14db86cd5c7cda3653ae03c0b85b07d1cb9e5318d949fd924974c4008816debc761a176ca98a8a96d69dbae31e793

C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui

MD5 283f5e6b0f4e4cb4dcdbf62f00c419fb
SHA1 7dd2ca7f6e8bd3331da42291b1ccebde2e78e509
SHA256 d06c8c84b35f19cc122ebbe760d25a72e1964a879b5df5ec2613999aeea89155
SHA512 ceca2c92650a3e99eaca356ef3a45d05f9097c854698413b36e264a3bbe8b5c0f12e5c8aae3b77c61ee20a6609e6f8ed16a8ce431dc9feead5fe3720b3dfee3e

C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui

MD5 2b6369a69a3d016892765b82f5fd6ea1
SHA1 6f05f77478902545e79943a6296d193dfd0f03cb
SHA256 516f4b5c57a2127d651cf0d8cb377db23cf579dc2a3760eeac7a10cab045ae83
SHA512 92dcc64822151a81b2f7a09e3ed415ced3342a4954f8b72779177345d51bcd560e081a98abbd58329555713aa37243bc2b64df35498e6aec3d646542282c8ab9

C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui

MD5 8f6bba41656f001c9b8d4cf7494d75ff
SHA1 ea1923fe650e378008a0cad11b62660dbdbff58b
SHA256 27266749980b0830dba68347ee66c9a6f20382f4aab798b5234611528497187e
SHA512 4cb0d8bf5f8eda82d1513ae01e580337ea58845bc395b985620814d661eb17af06fa3108e9957b00388ab7f39a989698033a5c91368bdfe1b640777e80e2acad

C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui

MD5 3c97ea1d6d19a7d2db54600d564589be
SHA1 9b4d0aaa8eb708f6e5960c81af5709f1455150cf
SHA256 ad42b731ca82e3496bee5a4162daea672a3f66fc786158476ab32b75154c1a37
SHA512 bd495e307f4f8582c0ced0b209efd57c6d9ebc8809b77c1c88aa3ada9b715bb9b23329ea9988762dc548f41fce434e9f44fc82d679e8da10cdebf38a6fd9ee86

C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui

MD5 80ecbfd522f5aeec8578cefd996cf35d
SHA1 3ba50b8961fd7af1e0375cab713c5958c2c1f85f
SHA256 9dd4b4d9e0c84a17f2cbbfce6a25c023f2161ce4da2644c948ac1dfec877b950
SHA512 3ba0647f27d566da1e7bbb3d57398e9ab63b24f5c5514bd26ef82abcc61abfbfee9cd58a3d54cb4e3bc7cf823070ba8f006cb05ad345c74600070e32ae2f5a72

C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui

MD5 d69c676d2445e053cd06fc788dfcea0e
SHA1 a09565c3a10b22796c59b2dcee834d445a5d6b92
SHA256 e49d5aa52976dbe40240ce186de69b177076078be0ec9c27b08ed99f5188f201
SHA512 9071c64ee4f09512d367a977920cdf670df46f11a2d60527926dd1fb41360ec75024dd34313569d01ea787e9a82c6e65778b5c68dd5b2bd50347c013d3ddc46a

C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui

MD5 a72e7a061ca30024ed5f6136fd113d20
SHA1 fd260a39dc216b051c0ec320c8a6a43f2b59f45f
SHA256 a6e27fdda7be8cb4c51ee87c69758c868da5605ea3e676d058e0eb582e21a97c
SHA512 7f044d8cc9bb8c5883a9456a9e0cffba32e247b56ec3ead95ab39f87371e4fe2f13c8f70ea75c988612b543185ddffa02ebee6496e49c89a475281e14ccd9bde

C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui

MD5 508df7dd03ff4477f2b52421f6de8b8c
SHA1 f3b69c4bc9ad64e1fc01b4d5f32f357430622184
SHA256 72e5f8d4c123cb7a0067418d4666aa2781e71f7088362e66db3d1892c2bedc70
SHA512 c8f1ce688461d036f804e04d5cb79b07c5a4f3b1e95a48b30154e6806064f54963fb8f8e6365d2a71f3a235e30fb62b3ed8edccfcec3730f9c02cb05c60e0870

C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui

MD5 5cb30f032524f083dea3b7e9978667a0
SHA1 fc89cdd82a8bd90232d6f956f13fbd912bc0cd4b
SHA256 4a0420ad07e7d82a1740585f2061f1a4cf2fd9e006cfc3cd267227849769eec9
SHA512 94cb6eb40b5c5a0c013efe7f1050fbe0b92e5da8d044331d2cd81f3121225d83a2f9e05e4945fad9f2bdc3340ce7df65cec7a0b0d349cb86946266bcc1e29fe3

C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui

MD5 21e620aaadef0c57df8926e6611a2074
SHA1 08b04291925bc2408a87e0cc420da577cf95525e
SHA256 512e56d485d9b117bc7d6be11820c60db43f15d3422d63a9a4421c04c35ee016
SHA512 54771591505f1fdbeac834765c92bc9c61b68cbf7648657c7a9b8b003a5c17ff0abe7484e02280a675ebf613ea64f910422be0b40aa70f44b95e4cd750414a1a

C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui

MD5 100cb861e633558af415e97963a82719
SHA1 ba2160147f4ac21f3b3c946ee2b6c18ad0f7647a
SHA256 3605e6201e85ebb99579de983df268ce89329b12e154a6af279c02de7d46071d
SHA512 a65f4c59d86162d9575a949e3b1f45e7bf4f2c0daa16855cfb8df1c392d4b9c451a137a345a87dfde20b46d3e0f99f9fb2c39452e786f6d4d387d2ae15c60236

C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui

MD5 9c7475a83686b13c6b7097abfd2f87b5
SHA1 8760ef983b439acf295f5a43c8ff8b3d8fa9b521
SHA256 4cc31a240cedea2915a67a021cba8e0a366e3a84e8268a9801d0fec86ee866bd
SHA512 efe4445563876dc562d8968446606db2f3cb069f3edea16701a769bf3e2ae2e35fc4f7deb8f2312fd95f81763e5945a3a6a68059eaac3cb938205568bcf96919

C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui

MD5 627ae43f8e3af82001ecd757bbab000f
SHA1 d27b3ace905c72866767560d8ab0f24167a3c164
SHA256 4ed1c403c01547d6763126705e6781f4f44949f45e8f14462a1ec6b6d3fd8f47
SHA512 de88a6cfd76359c26e8bc6ae20c958ae2baf6dbb0e1a2bff3d0e1a9cfee6330bb4f5e74f6b207da310fb9aa3e04862d2c3bb6361a12278182539ad99ddb3a777

C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui

MD5 a3b326f17d1089250d0170d8caa565a1
SHA1 5ab7910a8c30a587bda30f65b49e7b5ac36f137b
SHA256 fd6ea948fdaf33629b36cbbdaac5259fc892a203cfe3296ca7b9826208eb2de4
SHA512 2cdb7c3b4f24f7bbf80e504467433eec9262c114a2f61d1335712d647f7b8212a2d3fee6c923a2e3d7271e6aa14d6861ec9ccb907ceac89561cfcd7148094e43

C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui

MD5 6f5723e5e54593321308d2f41155130e
SHA1 98a7e49dd602d5f6e46de75b9f7d02fb4104ece4
SHA256 7094490894220ca7d40dcdd17f889b085332348cca9e50282b9480de35479442
SHA512 8682258f6ee015e60a7f1648f99514f39e454c3e9a6b7eed34781278bb3def2f4052632f98649440d3601750f92ddbb14f51dd15a5d197f453b035299e5ed06c

C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui

MD5 d85c750a0db02d5e82e7c48d88a13a29
SHA1 b62c7863e723647e77b3003bc622510ae0ec5d04
SHA256 6f3c5fd563f6c567280a2263ae762dc5aa0156b8935e5beca2c3c2830c0be70b
SHA512 ee0deeba25fc84ef2930e3e4ffc78551f0bac439f8c6d2bbb4425db8fdeb479c6be97fac8dde0f0c9e418d82bf8db3bc33a817cdaaaf690181f7b3b590894cc1

C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui

MD5 eebf838099a02c8d7732ec553e8e258a
SHA1 2c8cbfd8a0501ae897390000726f4734c164be79
SHA256 d3e9275e91cae14cc8cbfda758b3df1b90413e1982c96c4e0c4d0aae8c8b21e0
SHA512 0a274d294985e213441b454912fe9890a3d40abe952ec876fdea179971a5ac9b9ef9b25268808b0c38734254926dcfab9a57f7386547cf245931df7fd730059f

C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui

MD5 6636b3d91a5520759867da026e2a70a1
SHA1 9c54e3b2299c832f9f3736437be9beba2c0f42a7
SHA256 743d51d886400502d9975efe5be4cfa08b1ca30fe53b9e5e7d5ae8291aac2cf1
SHA512 b4a8be59b2cb22f0819f83222da97bfbcd0caae18b7f3d93bc83129bab365ba9c37c27365654cba37572c509443665b2f57a9689a37b952a04771bab14519011

C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui

MD5 9d4d91afb8a2a2b64257348311579888
SHA1 6626beb572c68a33a0bd7728e8326a75d98e6010
SHA256 7fee9ea34a84ed849cbd312ec6ea4bfd97131d4d7b8d5f80c12734c0127f7745
SHA512 1381ffafa6eac227792948f1b8be4f3bb758c9dae0059555eae65e1e525402715e47731be41df61fa0e6ad0d406ac6f64ceb2bfc5a32280ac2ef57aedff73361

C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui

MD5 8b4ec8028ce408e6c6499de24592a4e6
SHA1 7526eda33017b5f6b0f464e30c3c9bd6c5c17d0e
SHA256 e30533365587d468e34f5a96612446bc8f6d1affe65c54c7db5817dbe0ca92ed
SHA512 6b1d0d9de47f085e9e52e20d3ac3e6d63e4cdc7391a6d6384abdca41ff77311074ef44f3bfdd428645ebcc6ca76c366326eebf3038988b26e979d84898aff104

C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui

MD5 f79601cd0dde3cacc5e8d26ac2ac2d34
SHA1 b86e060430ea3937a94550adec4e2f1c96cf0131
SHA256 ff2ac4f7c7cc65953afd47d57841b43c13e736505862de6f1fd16fd1af8eca77
SHA512 285449806096dcfeac7e14f8700cc7a7f8c57c0b00ec1aae9796b55e00b722607fb1071ebcae949b6ecaac4fe931d5db6d05f3c69016c20477e1032366ef2188

C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui

MD5 04976f91023c542614f69934296e3046
SHA1 bd30be8a563aa1e2e9bbc3f1644c36588394bf5f
SHA256 6162f68c0c2deb6a878331699eff99d0de8283ccd0fb1e22aa86c17aa976f332
SHA512 67bc30a6bf7cd5a6d73f0408419eef8299043890cd5819a6632570e508dec42da861668aa12e487941831dc257c7d6364a26475327c02017eb820470351831c1

C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui

MD5 e42c29a85ea3becb1f2f78bfdf550f07
SHA1 64da7592bead7a91f3784f654d16f9e86156bbc7
SHA256 3791dc63f0eee2c089dfc62822f346d412e93ed10092ce994be15583e344c63d
SHA512 001f5af781ff6e39c1e1e6ca7647521343b72898d6c259a946cabf1020db6747bfa775759f1e828533748aa21c22e6ac4180f8f1744ddcb26e8e6a5e5efc8cc6

C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui

MD5 5c2d5bdfa3ff504a3e2dbe2c1e466d3a
SHA1 5a468e68547cca8b66c0f7a08f041deb3e1c9220
SHA256 48fb04935ac99af0b5b3bacd3d17d5affe9ef5f74dc614c6c0542af3a99150ab
SHA512 52d984a46b369187c6a9f8aeedfe6a16c9e0c6eb65af3c06ac14da0179759a1ff2e44a976c08a292055950eb22bfa935d67e01952a04e417cc2172281d77f007

C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui

MD5 23cacab868c06369bae60ab3d0fc2d05
SHA1 a9cc3822e87e6c323d4f1b5c0867034e9e87ee51
SHA256 23d3dbbd1ad19f841346e8e24727f768f5a09cb5516245c75a6999c3b691660a
SHA512 f36bd98c9d196ce4f66da4f6ab981877ec6f1c166779808bf4625ba05b503dc6f7ba979c17e81bae3fa828844c7324b047080b19a42f4be964184cbc7b98c440

C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui

MD5 5d827caefcee2ae1d022a90021244d29
SHA1 75ac7b8f46054df50d045788ffff934c04b01a3a
SHA256 256bdac4768df094b3ea48d7112aa2014816237dcb3b5a93b7b4584923bac335
SHA512 4599efb5385cfea1379cfa89a5d69ba717d06b752d01618957d7b80b853cbb37b9d9907f12699338523a116c6f848c4275e66cb6b76f509e0dd496805072b18e

C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui

MD5 9ade32971a31a12c6d4ca9ae66ba974b
SHA1 06fa867f2d211ae2e7b2ce92fa019834fc8503b0
SHA256 9a6ee7718e351642576aa493ccff0bba17edafc267f99b3770348fb28ed09b61
SHA512 3955ca96076cf544860008d5321ff14fae0497e7b4a89fb780107158a4c99fa94fe4babf9f0211bcd710d61be69cd560f557108e072575517af944f67921d19e

C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui

MD5 fbf0bd45683bbc7efc2680c529311414
SHA1 82bc545f3a483f27010e56f7de3c899245a694a2
SHA256 5deacb20d9b241fc39be01d9eec6c876e8d23a0fb5d1d1a963f266f5148a16dd
SHA512 b8f81a6a853fde23e380f29054fe748914df7461971865b9909a66352450f3ebfdeee8faa91ce77abb1759a81ed659a96ca9d5d2e03410685dc61ad355f15f5f

C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui

MD5 a98a59591874b19a81402db555b0ae8b
SHA1 55c365cab8a219fe96263ec42cafd289bb27bfa1
SHA256 24521cd6bcd33f97dc529aeec220fa30df1e62a285c19c4de9ed34fcb8bbc546
SHA512 ea532b1a39216edc5fabc0e0dae8c36e2d998bb60c9d50b21949f201e2196a0e1b90e0463628f84767d10ae17a37c89a37a26d0120655366fa9938dce646a45c

C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui

MD5 63891b51e2df4d7882e8d7a80c585d5f
SHA1 415b6ebddb34c805e6aba1790558e8959e789e16
SHA256 0415532e096526a229a186038630a30d224b6821f6d92346b7409028b35d011d
SHA512 529a03a1c28f238a641cc64b12be9ef137d4d513d4b375411297d78eedb8481fefd122b23d36df7ae2394e394779a51f5b49d137f82b10511272b8dd2b3063d5

C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui

MD5 aae6c7b0a4879f56b20149917a005dd6
SHA1 038f5a0c0d4da40162a81a171bcbb278fce19670
SHA256 ced83f74d0abc5bf5988291d500b51a9d6c7804e8a5e71d7d11fb7c5d9e64dfd
SHA512 fa7cd88aca08d792b523adb09048a8b4a89792f62339584f42db4a110760aa197017d67fadff2eafb54172d0479001634235bd47eae1a3a42098cb78658ce035

C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui

MD5 064797d0b1b850362e7d84e4f8ad2a25
SHA1 8030a6370735d01be4abdf5cef7c2721da354c84
SHA256 252d46362abd82e1bfdc15b33172fe4da50763e41384c40509468bff616b497b
SHA512 3b335e78e54d92ac91cdc612d4e8aaa9e176d5868fdf8e4c64eb3bb0e1647afb42455b12bae47312420d0f2955b2e2234d468ec9ef81565c698282ff128fbd15

C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui

MD5 c6559936f07aad44b9e7120b59c59a26
SHA1 d1eb0ef1415b049e9d175095fe6fed8c22ffe9f7
SHA256 426ba85e84d1fee12879d99cb21ea5d359b8d0dd810809c638dc9d2e25b15a37
SHA512 16510b0218e36d45c199ecb9343b9cc0dbffdf20036b2dddd63343003abd0b66ce8bf839d5436c52801e0b8e7b996b833a316fd6834f7f01bcf9427d50d40054

C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui

MD5 dd93bd9e966d42d1c242617b38b8eb1d
SHA1 a738abe0e4eb7959f2c239f6e44cc8eaa5a1615d
SHA256 9261252b302dc5c31b97b0f4e3043e530e658b3c3c66bd1dc41dd1d17b5d5752
SHA512 c00f5db0a10adccca275d4ad70bd33d24e3e1704b662ae87b4438a25f4cc853ba7d72d4b8fc142754632821ba73fe4ccde92d7b790adb3444072f57332948144

C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui

MD5 e493fe0311aac3bfa2e9e575f5661019
SHA1 33112c56776ab7b28adaa4df7fcd19a329f4d755
SHA256 0d120fd2a7dec617dac1ac14514cdea5255ab935f3fe19a2d4a9306d84a0668b
SHA512 a2f77d40921afb7b9fabdf9f4fe8ba699cd25fb34aa4b4749a5d29b9013dacd377b1775a84869c81d98001b6a99ac4c92f2af5f5f8dc9bc3ee42aed4d948b234

C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui

MD5 436e2b93a97216c2251f037c0742474d
SHA1 c4f0d40650f6896b575f69656f2f7cc92d951898
SHA256 963398759490c44c02b9ed61e55c8613c581145d739f6cc8343093b3a18a06d9
SHA512 fdb0a4a8ddda9f0cc948921339abe15f32f38a5314434bf1a6c68c6b29b1d5a1a2a9828b8b281f6ccea407920ec7faf42e84f22cc518b0b8de23a1fa04320473

C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui

MD5 1e292dd161f6b3f94fdff5cf68523ee5
SHA1 488b014de427220aa2aa257f654e88d72553cd70
SHA256 98a611e1c8d5b3ce1faa1597068cecb8f9af6f8733ae014fa59c05ae18eb4521
SHA512 5257785fb46a1dfd0e8da933c67dfc932684a3b4382a7c94e2818de16761f5c0c04e78c61f8ccd27bbbf827145b871c4c3e0aa870e0036279b22436bf5a7fa88

C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui

MD5 7c4a39a4617be55a50aeeca64541948a
SHA1 d1edef58fe738f67ad4f43fafd19451c4f755a47
SHA256 f27d4faa9dfa040ce306bcf2ae6d2da697bfbb6215bc6d29b88f843b0a201ba7
SHA512 f91d94062665530a3b9d9d0da8a461f86fbf760af5dfe82b8f95ec06ddaa0d691f99cc54977b5abe039cc807c97f51dbff97d1e2b4d19f6c4037c590252696b7

C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui

MD5 69593cab8c6373662ca949b936ad84cd
SHA1 0fe36f19bc6aa73e019d996821b28d629b150b55
SHA256 54a58879c9cafafd843844470df3d5ffb66ada9bd30096d3d9e03d5e1575cc02
SHA512 dd40036bea81dd21145f34db9bb1354fe47a457ab7df6fa6cdcecca6b3c18e5acb2fc1e0faca834349997274690352951ddce7d8f0b573e29af0c45fe6b8d24b

C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui

MD5 39ff80160f8c5689055f3da776afbe9c
SHA1 c75b49f4a76843103736ec9bba26d513ddd10128
SHA256 8693d43059d6acba7327b5f68d09c9fdee37cf3269801c1b00ef2ca97c41a4da
SHA512 ad1318f24dc9445c1fd36bcd5fc71c3f2790e24403f5dccfdad438b058e575b278322548a9b09e013686254a4788da614e2b1026ef5e20b5cd994d0fd55feea9

C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui

MD5 8b50f839e9478ee4f33d6d7818f9dac5
SHA1 61bdfc4ebb4ac67f4a80b4d2b2c42ae4e88e3b8d
SHA256 da588b8662735580ea8ce52b385b11859ee71e7f2c6b387157247d1e2d9c6434
SHA512 9aefedf55711014f57643da533a497d92f868758431fe9c7ab959c5c52de9608cc81465d96786b5e09daba9a60a23cecbffc497dec4c359bd115a3fcda75e1a5

C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui

MD5 5e657cba256fa3a9b9a73427cb1cc4db
SHA1 761c37991525b8a121859aadd3b290f7d4bb1ea6
SHA256 b0463322e51a4889be9cae04f4b8a631ccca1688f9e497b6f50941845a02b4dd
SHA512 ec70734e50f6d7d0e2908cca5180a62d59e14b113478d74b7949c0e84736f3ce807eab8dbc88fdf72090e905940bfb87ded47abd97e7c3102949685367dd3e0b

C:\Program Files\Common Files\System\en-US\wab32res.dll.mui

MD5 e66e0e6e703b3f69be8354f62d1d600d
SHA1 bbfbedc6e8cd78164391fd47e46600d7c03cb880
SHA256 817801abef8ea22ccf52ecfeb41f1b410fb4e8d8d374310ef411e749094bac09
SHA512 c9bb9dc193b64da434e2dcc73ce7a650300827285d7da0a44d4adccf49755e493341a2409be54100b3fdc65ef6540c990da1056fe302a00d070d618c14364732

C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui

MD5 05cdd246c70a41119cf84b0834db42ac
SHA1 85c14513d125df2e586a1deea2d3ee347613af63
SHA256 312f5ac588af0a54ff8a5047525de8c7688bbe1ce018ea6da5c9075c6d33a253
SHA512 f8e3fd69575eafe6fb572465732b13cbdb245c49bbfd035cf9743bfede7ed283b7ed72fce50ff561554b367abfc2d8b36032ffd07972f6849a559b467f3d989a

C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui

MD5 53846fca473b5bdba76f046e9fc00aa3
SHA1 fbdd8b458e84641b77696c8e2994838308300073
SHA256 80bd8591afe94f7b7d422ef928655fa9470cbf6fa29d128fd8da9f4ea7054c84
SHA512 7138c191cb291b9f3fd6ddb49360d64fea4c36a19eca0e51bf72f4d170ab5d0afed64f0110731696885de3062697def5f89e35cd5bb310c8ea413f9373bb3bd9

C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui

MD5 10503d10ec427e91fca31901c847da22
SHA1 0c10181cfb55f25ed10b2736247c7cf220760497
SHA256 b816b523e624222f4218bb8135991acf6ca69360802c878354a3caaac945298e
SHA512 c1fcbee061c6e858f9b2688d0fa363e46dfb1e86abb2ccd2a01e9d866be8f67be0ea6aed9ecbc12926b45c549869e0ff8253fe00d4f4f80619aeb1f056ef77b8

C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui

MD5 9a7f30c2f973dc75b40945219f0cbaae
SHA1 36e97acb9d77e1acb70b2806689e4139c820d318
SHA256 eec7874a19ac15e61c193e5a8ddb918b600cb010fc308e81f1b85ad462081137
SHA512 dd57a88964c296edc5642efb0418742d3305746b2db07d9717d396857b38f6eee57fc4f9b4c0900496c9fee14c1fe5ffe314fda8fb7abb6b0f0562047e098fce

C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui

MD5 40c348324ffe077a20cccf66bc7e4156
SHA1 607d5394bc26b55fc45ed48291b52711532c5012
SHA256 b15f676a65c16b141f92c33ae986ef585658d5860946cee757d855850cd888d0
SHA512 9850e3a096ea0c7913926cbefede07d6c7fab0078777a0e446a06c4b3ba708e299df53ca9aa6e1641b1bdbc163d8954b83dc1d5e51e516caa24463b94384bb61

C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui

MD5 7868392dec9b1bfd9fbd093702c4b7f9
SHA1 deab61e368909169547d0ad8b3e9f15a96ea91a5
SHA256 e2a6f5a37249fbbb8e464f32385847e1941a85f33ea118b715deb591a93e292e
SHA512 b6aaa8d2448a37f32c944df7a68af82ed5fc653b5f4c5a6d87f7c263efa00f850cea9198701de06c36d37186683d382467437bebf0e38cc193e4477b9c93a1cf

C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui

MD5 9d6be183e1adf13a2661cb36b1f04c5d
SHA1 53e8442be81fac88dae2edb02209394d730e5dc5
SHA256 a3bab0a993b0eda4eaf408cc8ba3b885818ed80e5cf546bf4600ccbe3e0a4d4a
SHA512 1b052a301057dfe32dcfedf2434dfe7c849450964ad836e59b6c43ce05bff69db96e6bb66317bb160cbd14766ce60d74be24a58b9fc4952a1fee479639c0ac48

C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui

MD5 c1814253d84d3ecfe2c249753b48aa1f
SHA1 d1fe1f2beb6c9e1c0b737561bfa850d1025f82a7
SHA256 4fffbc54d1fafa5fbda74e225c16345b8f8d23a75f6854478b4b2434da0ea5fd
SHA512 e34d3cae060b7976e8375ef0bc1eb12b2bcea074cf5a9c27a9cb8220d34f3bbda7bac71c5047624b5e2ff49bfa93a657c1fee4e523b95c5fffcaa69d60ad04db

C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui

MD5 4dc5855a0a1309b28cf4b12991a66417
SHA1 c7f20be66f31be40b27dba50f0ff8cd891c784f1
SHA256 96fbbdeedef0fcbdc55d0d744b5d4fbdffab4e501d88e9e8dd3c31202e3a2a31
SHA512 170b3868bab43ec367089260ceceb975c2846bbd2327160803b6d16aec68e5816973ea507e7a7080fce928591d3bfec8c9e084302bc5217f59ba56cf201a09d2

C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui

MD5 607390a5173b239f3ddecfcc745b2132
SHA1 5454d77aeff22235de0441adb97e8e2dcb71ad0e
SHA256 cafdd60ee30e1ad2d6abd527e95ef498a4f3f0aadd1faafcc1fb99758095c24f
SHA512 623d5c6aaa156cc45c80dd1d59ab8147d962777211a033b2d918d6548d70d8235e72a36065a13d51ce01eadb4e8ba524325fb760bfbf5ab03d2f9f541a865788

C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui

MD5 7e6d2c3e3d2132e66852dfc3a1719ad1
SHA1 96b3cc5ffa53e3057b16390425e62fd3b43e3c74
SHA256 502799a449bf784268da929430155268d2eff066a3e3294675435e96b3b749d2
SHA512 de3c79d9d25110f42586fd83439bb2c07df3ad187080f24a0bfa7da58cb8cb87574cd08f2e340876588ca2304cc0933f7a265bf2a5cf0100fa741f67f99714d3

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui

MD5 46d8e72efc8e104e5e36ca428d534865
SHA1 dfa6607a5821e6a293767d96a1dcd2156b2235c4
SHA256 5aed6e486d7ce275a66cdf834ed981de0b40d33120efaa93b8f551f46bcff682
SHA512 3c9a9943ebe8f3abb0ee90878cccbde8a2e3ccafe9430e3ea0d487c3e45b9a543aad52e0e6256938292304f19fbd37e46c2cdf27e64522f8b0a06826ae3d9c5d

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui

MD5 50c8080152d7d991c7a63ca243554ac4
SHA1 83b1410a1cb9e7a7d6fafd33bcb7ef3c4e83d29c
SHA256 dcc237a8fed400441dc3414d07c7de4a9b6a59af803b126fe2314759c814b06d
SHA512 69ac0d6f8768ea2b6b001fcb25061713553144457a23c0f2dd0a1c114cab17c0740909be2d1738434889ccb11be498431ab566acc555b01f4907d3bbf02001e7

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui

MD5 543c6e4c1bfbc6373dca26da9b083a2a
SHA1 a8a016f066c4b819436cf55e5b1cb897c102cb89
SHA256 be452581b86b4ab32d9c0be098d511c9a2748bc77e7317e0e1e2d20747c20fe1
SHA512 87be06b82dfc4f79496bae2d29bed0c14db69932d8558d4655191c2eec66caa49033630c1e4c91f403ca76539d520cd86e5c1aec12b325449d4c40ceacc483a6

C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui

MD5 dddb36f48319bd48188563e6eee42ace
SHA1 68b2b612c67f373f56082eabc43ba2fcb80f442f
SHA256 73fa8cc36e69c4c054af087df548b59142395ac0a90bae064f13ffa9269215a2
SHA512 cfe695e660a2b33ab921928bc665ba47510a3d5b1876aba6b9029bbfff7d3bf3f3b178091397299874254b37df9ad707c68d31a7547605def702339965906d7f

C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui

MD5 2b2fda18b1893397dd2f7fcb424266bd
SHA1 d7e08df28d01cba134546b8bb6bb8d07afaf20e9
SHA256 043bd3cda54040dc0dd9f0311259e8b1541b52538f74e62ead3bcbcb64a6bec9
SHA512 43d4dc00cd84ac1a412c851ab6f406dddd567bdf53265f9103edaf67fa3aca746f0386177acc40214242efd1289eb8c34e2015c093ed4101236a269732660a82

C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui

MD5 5ced9777f0fb82d2e7268b6af604893f
SHA1 c2a3508394325ad1431900c537ade97d3e2d5a4c
SHA256 c45150527df1bc2734b3bbc672ca7c34f803ac23faceeb04c8ff9d8e7d1fca56
SHA512 c73ff59345b9525f67970ac37e981579ecd38ab661b101330861f6835eaa6a6190db90ffe9aa0468621da1b4a234bbb9c0b3faf32bec9e26298ca7aaa679a053

C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui

MD5 902e8838c58a4a6b7bf4ed4f8600e60c
SHA1 e83bcf5ab8bf5f81bbc7d1f50da3bcd2c05d60cb
SHA256 bacf533551a06a02a534760a90f46b621504d6ca36c8a56f0d24ced27ac25c5c
SHA512 81c49590941b61a4f3ab305a6d23c6e3971ce9bad710bac2381a134d28b773719dc18049b89a920eb2819f97959b3ae4e7e6d0d01a7eadf44c317ab941dbde91

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui

MD5 6c7c715223493d6971083a7fc16389a1
SHA1 34eecbba12c7a429bc14f45eeea6dad7ac73a82a
SHA256 1434419b3bf27bd5bb423a25ddc912a1742cbea8a2f97e9947eb82178cd9ad9f
SHA512 898ff21ac204fc01c764c2eacaef95104dfa80d04e88aec37a44f7c6b01ce4c3ea2cd69cdaaa7740aeb668f0548fcd110a4129cc99209da8da5d40d0785d2ea7

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui

MD5 9874c7878ff1937df6c3a7afa41f03bd
SHA1 cf52e26532c3bb7768c429e5c62b43da9211aa10
SHA256 ccef6e243f2d4f2aa8cd89bb014a9ccce0d326739c11faf03d516fc9ec216f79
SHA512 4bc4d1c7e5d1686e09878e882cf655d15adb2bbda77ab9377224d4bc71ef474920bff10324318a5a2ee0026f4f25c017a850d331ea71b803670b65ebfd9441af

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui

MD5 63305bcbb0553803eb0f45c6e9f59ee0
SHA1 befd8473e3d1459405acab9be6e46100ee8d3dce
SHA256 83dd9bcdeed7597c6a0f3a404790355abf08fc22d6a1c3135d301c7dd74b8b83
SHA512 236283dd986dafeb65a6534dd2d953ec7689c7ebe3097bd662120511228a7d8592de1beba2c3fa8f93f372d57a7842761c603a16f3bf3b0bc866731ba14caf62

C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui

MD5 4593f88596debc869ee700dc703f091d
SHA1 0b864ebd8f11e3fced21366baa4658e689ee7fcd
SHA256 c258f41eb9bea297917c3e94d6253b9e661052742ace35ad7eb0040f0bf628ae
SHA512 56a484e4abec6ae32a96d689ea19bb1e06f214dbafc3194bf454eda8a48803dc481a6e89d5491647dcdb9df8ea206d46ae02e32b3747bc6250fd7c4e6b424a30

C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui

MD5 50929d97d9d95e00644fecbba611a19a
SHA1 a0882f56cf74d8c2d6c46e7e995044c09f59960c
SHA256 0dab194e6eebe1e45c8a13dfd4b7d4c06cbb1594b1d20be0015e49c0808f5ab4
SHA512 c24b7736fd97f0dfc7f91f8e08cb2a032f005458e227d4085c43957a9d07c386ad2071dbc10e2eaac99d60422b0d2fff510453fd49d88bbf4f621b9c7320b835

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui

MD5 a41bdb5c394c3f8ef83b385f533b6902
SHA1 609df2581dc2cbeef150ea93d8d5436d9b0570e1
SHA256 e5de17db3d4415dbea40ea678f0d75b1e258d4cd4f42d3e652bddbebca0f4512
SHA512 7e0996a5516988cc1db80a71809991c223a13b5df39b6dfe87591effd4028f577c12765a8209d2c842e2085ecb6f1a7f5b60226d492d0c7bc3d2cc699af9b2c1

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui

MD5 f1fa15cbdb3220f82aa156c5a8dc4df0
SHA1 fbb4c77a9be6d60c9c07e628740b6f801b0072e4
SHA256 445a67cd6c218485089889d077c3fb36dcec60e6cabb6ea8d8fc5798f93a1357
SHA512 f002451222463a129d574b8fce7887deeec8ea0fd49782f9dbe398484790c90a2dfd8ad74ba46a4b43d9b080e8d53594cb46ae58d9397137d95d1570d11d94f4

C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui

MD5 2fd5c4760d155fca7cf254ec688c5ecd
SHA1 5c763836a3d85b8767b4dd26bfee0a76eca2e9c7
SHA256 f33c4a700a36b8ed02e1f32c1643a6d00b145d7c373cb0166e9e05bd83887ba5
SHA512 84dd91f806a857a155fe41a00a6ac4a3113101c251b5fecf372775708cf8ccba461d6aa15a7cc405fea8ab7339576a8763a84807eb5edfb32fd63a695c84634b

C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui

MD5 961967ff65821a50d56248fcfc8808c9
SHA1 c28e7d0c3af0e6e6dcbc8c27eb525c3b0a8c6afc
SHA256 3c3ce41cc3c64e01f08a8b470c34e73858baf06011402911f47251e054525145
SHA512 7074d5f422b1b000009692e23f8dc25abf198a8331c5baafd3d448d8a516d643dc9e30a9419f2335f63ecf8b4c52f53e495073dcf3756049b0221a4cf81f6f89

C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui

MD5 7adbabb8ee8d49ed2b802f06e9d1a4d7
SHA1 4eb41369ef284f7402130e5d31ab72b048192383
SHA256 e85d676650a45fd7e1398821ae383a8d6afb76f2698adf0be422315e61055f10
SHA512 b43a162353585b30a4b61b35f44b101517f47647572e83ea4effba6e95620fc3d4dec57d2afcf0e3b28d931fdeb71631e164cdb4f2cc2581c0b6ca78eedb54da

C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui

MD5 42ad33b7d4a6b72358a1a15a3f5af68d
SHA1 8c1b64e6059f9557a0110870ba2ccf93144103bb
SHA256 0b23ad60a2eddcc8f0e03004a23ca85ee6570fc497ecab89b874c3a962dec8ac
SHA512 4f894ccdb34d2de3c3b29f5d3125a149cd8c22fe0ff65134919c1627ad6f7794e3100c5f5a275a7ef8e90a48d8b262245b3bcc68d06e5bcb94a42cd2f6927e89

C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui

MD5 989d20d5dc26a335978bfa5f8e0a6f1c
SHA1 035dcd5fb2a82bcdc4b2afa7d12c648b1ca67269
SHA256 f121f83e9a934046cd88bc2009bbeee8ca3bc37e8494cea2ed4d6609b924bf10
SHA512 c5e953a1508fbbd6269caa0dcd7c17a8852b5e69aabb9b857bfe26ce853f752ae9a8068a99d7f4ae75424b38ff87198dc20bf23ec1c8509fc8d9f1878a93f66e

C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui

MD5 845ef68ae0e45e8999d0c5c0efcae383
SHA1 85c4064410a43c254ee7de0d87eac50367169324
SHA256 fef342c056d8e3e0a3e70e4d3825f4063b2c0e8f14365a33adafae0f9d47dde0
SHA512 0b478ac1ec18ae6e32e2fa7a4be231334e92bdb07699afd75cc6de01b32053929f98cf002533e571702eccaa87172332b9e48b24c7d07168b3392ce7ed7d7512

C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui

MD5 222c0abf78f3548f109138eded3edb87
SHA1 e191d35f0e88390d720cba09171de9f1fde376ad
SHA256 ef0271f8093d2bfdfaa73302cdc10862a11a5c4c86548665d0fb4a730f6f9f10
SHA512 62906fc1cbb3acbfa2b1711635ce64870ccb5aa1d5b6a6b818b022be3987737300f66fcf1a3c3cdd7eb344a17458af7122984b246483ae79a962590ed6a68c60

C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui

MD5 fdbd4fe80389f18a398feef9668a4824
SHA1 e533bc789e4a0c93bf9b966d9c1c4a39e8f962c5
SHA256 b3b1d1d59ddb56134fde612582d0e5dce74cc98fe9a69b0928391e37474ce107
SHA512 3f56deb93bf78dba900a646ac29aeac458fd054be93e12749a1a4c4b98b7bce3aab5e8145bab0b00b5f3b29065f0dce064f4315d5425bbbacfbb185fdd7cc67a

C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui

MD5 6ae8d3053ce38be51577ee04e2244b70
SHA1 3bb2ae5d44bbd5f8fc864299729f8e78b0ebf6ff
SHA256 e5066fcad995f7f230fd0800b0df24082e0ac68c816f49642239905bed8afae1
SHA512 b77c25328da81b75a8a8b4bb1aec010a3b9b0bbf7da3a44187289b41589f58f819f3d78b90a315d798e938e0d3b67bc72ecc883ac566dcfedddca87a0f25aad8

C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui

MD5 355f17eb2fb63975da98f844c67ee6a8
SHA1 72281890b96a10a7b32e00d671bfa60a9bfa80cf
SHA256 97c0a3e38ac1f97c2deae938b041c5e82402566858f8d43f68fb8147c3e31066
SHA512 318389023dc642e9937f0732a78cf11223a59630c8e64f6ec6168644721b0b8193f45056b820837b23a4491ed07fa6b75ca20ec78633fe49e91895dae6a4510d

C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui

MD5 08cc9030f323291f15da6b08c7818540
SHA1 8485887b3a21643b03545dc73eb4a6eedd888c2e
SHA256 1e8040f1f7d81b240f54e995ff5e5bd10e658c0d1eb004d26cb21137b92e21b7
SHA512 782b073bf64c6a8e4cdfa2bde8a478ee019eacd5b77fa4526105a44a541d9c696b0a03aba2ff9641bb91fdf53be13ec382ab12578427d3eafc6ece70a759d7e9

C:\ProgramData\FEA3.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2884-19882-0x0000000002520000-0x0000000002530000-memory.dmp

memory/2884-19884-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

memory/2884-19883-0x000000007FE20000-0x000000007FE21000-memory.dmp

memory/2884-19880-0x000000007FE40000-0x000000007FE41000-memory.dmp

memory/2884-19881-0x0000000002520000-0x0000000002530000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG

MD5 b21628a81e040b0879714c5aa8582b6d
SHA1 4c374eefb845592770d79a2c289e6eca20571664
SHA256 4121176c71a55b1bb66e0635a4828887a39533e92febbe1436ad4b69f5cbdab4
SHA512 90019b16c63e854527da0816f3b12746b3b37d45d95bb7246b4f74d581797f4be88befa25266e63c3b37833448d3c7a2baf75382a8f827689f79dd4321e4dfc5

memory/2884-19914-0x000000007FE00000-0x000000007FE01000-memory.dmp

memory/2884-19913-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-04-18 09:45

Reported

2025-04-18 09:47

Platform

win11-20250410-en

Max time kernel

101s

Max time network

104s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe"

Signatures

Renames multiple (7446) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\D987.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\D987.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-4239789418-2672923313-1754393631-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4239789418-2672923313-1754393631-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\Breadcrumb\Breadcrumb.base.js C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBUI6.CHM C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.MSOUC.16.1033.hxn.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL086.XML C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\PlayStore_icon.svg.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailMediumTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-32_altform-lightunplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsWideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\ui-strings.js.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\eula.ini C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib\server.js C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\PowerAutomateAppIcon.scale-400.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-125_8wekyb3d8bbwe\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\uk-UA\wmlaunch.exe.mui C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\createpdf.svg.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-48_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-24_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\WeatherAppList.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\StoreBadgeLogo.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\ui-strings.js.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-16_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ug\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7wre_en.dub.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-48_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\Images\splashscreen.scale-200_altform-colorful_theme-light.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\Internet Explorer\it-IT\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\orcl7.xsl C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\DocumentCard\DocumentCardLogo.base.js C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\de-de\ui-strings.js C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_radio_selected_18.svg C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib\types\IAnimationStyles.js C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxBadge.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\MSFT_PackageManagementSource.strings.psd1.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\de-de\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\main.css.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_backarrow_default.svg C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintAppList.targetsize-60_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\Illustrations\errorIllustration.scale-200.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-125_8wekyb3d8bbwe\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\init.js.3T2S47O5t C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\3T2S47O5t.README.txt C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib\DeepPartial.js C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\CameraMedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\D987.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe

"C:\Users\Admin\AppData\Local\Temp\2025-04-18_41050b2b9f619cdd9916e3bdd5b9f2f9_darkside_elex_lockbit.exe"

C:\ProgramData\D987.tmp

"C:\ProgramData\D987.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D987.tmp >> NUL

Network

Files

memory/2700-0-0x0000000003030000-0x0000000003040000-memory.dmp

memory/2700-2-0x0000000003030000-0x0000000003040000-memory.dmp

memory/2700-1-0x0000000003030000-0x0000000003040000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4239789418-2672923313-1754393631-1000\BBBBBBBBBBB

MD5 0c0e6c09524ea758a065918612a73c0b
SHA1 bff5dfb2011c5525e46a6e03c92ebaf2dc40b656
SHA256 b3ce233f60354f59fe910c18877814dcc33514c2d6298116cf6000494b98c363
SHA512 dcd5bf8be234a6ac89313894236c9cf26b26ab1825d4cdf7a8f6f34c17f9ca404e92b5c3f60a913561552d4a922053e617e1aef50ce0e369a868fea7b30f77a0

F:\$RECYCLE.BIN\S-1-5-21-4239789418-2672923313-1754393631-1000\DDDDDDDDDDD

MD5 bb69fefd6aacb7bb42407ca05117fe34
SHA1 1abcaf516f846bf6e0e30fff4d2d6f3b87a87606
SHA256 6fd97fa67e7dda4af48a70515fa9c18fcef46044b22c824d285602b83d7c21e5
SHA512 9d5314faad2cb55b786f17b58229df8f117a9188e985ed7f33174d83705545865d0f2db89c11048b145222c0c9636216d54d4beed99974824e970d6097b2441c

C:\3T2S47O5t.README.txt

MD5 a614ebc98430a25bc689615a8d71a613
SHA1 f940c2db3c21f1264b05191dabf6dc41d6fb3561
SHA256 7c3de04e7a1d7a44f84994244470f05faca7fd22fd80376414c0c0a596b696f4
SHA512 d7b6192a5d9f3e9535ef14a183aeea85f9a0bb1e624d4a6420b407510102dcd018c83559d4cf6718e6455fbb03ec0256c13ccbaf2336786e94c7ee8b6408e151

memory/2700-7944-0x0000000003030000-0x0000000003040000-memory.dmp

memory/2700-9061-0x0000000003030000-0x0000000003040000-memory.dmp

memory/2700-10250-0x0000000003030000-0x0000000003040000-memory.dmp

C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui

MD5 7c899643a18239bb3477c45c6dd29d9e
SHA1 e80155b3b8b27b5eddea354b2efd33059eb62251
SHA256 9747d0afc65e9fe00d92eec0229b733102256c98933e3a9ae10102a7c08ab151
SHA512 4659049f7974398ca1257f31711fcc7968d22872fb7745b83e4b235b64fdbe4bd58befaf57837240ee0005b577ed620062b154033c1607c51977af9a04892ae2

C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui

MD5 fcf8f7d58fe3982e416313737f927318
SHA1 b640ab68bf6e6bb7d0cde4b4363de6c0cddf5756
SHA256 05914daefedbd2102abc56910c2150ba5701d794c485b393e50301290486b1c9
SHA512 818df675836b0d61b272714a352abc1f4e1994ccad4783d60cdfb3029f44dd54090006b6baebfa1813bc08746d324e8b0d58a6736e339596517b3fa21dd3376f

C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui

MD5 de3cefc02b855c060d78d56fa7131443
SHA1 faea55ad0a32bb027fb2453a2f86bca15a750a82
SHA256 b72d002e5efc79ad7aecb0c5d4aefa04415978b89948628778d012309fc11536
SHA512 8e4c4b2479e8ed935c68cf734319869b9258e015fe48e00e10656704026f9854bf9e3dbc28b1aa7e463c24bf1df48cc06a2c029180573a5ecfb9be49bcf76cd7

C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui

MD5 659004cbf10849af6da32de687effbfa
SHA1 e7d9a54217f274a375e8dd89ae5a2ce037e2d4a6
SHA256 b1534c44fb5a6087d81244df4b4ba3f2ceaabdb54f81f9988cb7ce4884065228
SHA512 05bf9adce6e5b80287baae4825d14e9991680519f11b372a2def34f05ded698be8790730623a2e2a364f8eb7e5e93d92230b2d76998516e4f4e1050b047b0501

C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui

MD5 cafb12299535cccb9880d59f9aad60eb
SHA1 d363d37c97362dd7e17b25514dfe3871b535cc35
SHA256 9bbfba778840a50b79195d292b2628a2a783b398fc85ef62492ff352f987785c
SHA512 556877b1651e1366a3862837f1206af61e20c192a98d801cb02933cefe2ac7e6dda9a5f9b0ef58e01f67291906f593e2ceef29a79b5ebf2f4da5cd9178d95974

C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui

MD5 5bfd5b2ae70a5bb4f10b285dc2aad84f
SHA1 1bf19436fa763c3af8fba96388e5b95ca87b8863
SHA256 82475a9a2d89e7dfbffe8cb355557150da21c3eb5fd5551476303d11acdf75a7
SHA512 d42cfc6b349e13670503b442c15588fd26f0109b9e0fe0d572d145f58fe4a4c04bb9594107797df699a52ce4034624cd58ab4357e39f86e2f7d96aae393e25fb

C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui

MD5 49e26fed284dca07d3c7163ff6b2b8cd
SHA1 c75a4907a4e98d11cb965e95909ea3e566d71874
SHA256 9e7c593a431d0774887ea64247c3de56475fc529ba9ad17343a3e4e9eff9e5bc
SHA512 2f8e23f0d6c4f38734b46835f96d63346f0f510ab5a400a7ea2114d897232b611081790f2b2169698e9e7005bbb7541e475740a0353274371e93dba287a856a4

C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui

MD5 ce7502ce04964a90a25fddb4a65ac59c
SHA1 509d3df07071d17b8285a08f042969a6ceaa2a52
SHA256 2ef8466d36c7e4e40945ce956a9f3dc0d04e5e1a82763d70505993de3c7b1bd6
SHA512 3e141df567fc95213daec7d70d5fd2778cce5e43afb16782212e95aa3417557e87be347733e0979fa7cb6374a31fa3e065733a850714eeefaab0e2a03b6d40fa

C:\Program Files\Windows NT\Accessories\uk-UA\wordpad.exe.mui

MD5 79b49713625ef3487333fa3f234a7683
SHA1 5cb69b710782726524551a9fcd76648574927a1e
SHA256 9a212d85780a7f7556e26d4a27a7acd66a1f8a8b19ee9bf173a7a112b894399e
SHA512 198cd8e4db9b5ae8ab90de495f8c16b228ccc7db24f8f3e202c40faa4675b389e1c0b3b1fcd6d1bdaa217439c1736d0fb01901191eef0d076b3cd48bc5e44d54

C:\Program Files\Windows NT\Accessories\it-IT\wordpad.exe.mui

MD5 93462fa9089abd9f8814255bfeed103e
SHA1 0c6e2b3d4cfc83a6a61af1ef5ecec88968dddeef
SHA256 65e734a833d510cc676c4b0f118cb3c3ec04dcbb2d8920b70d2ccbb192ea96a7
SHA512 70de6b5f768c9491b20f84de395150caa81c9a2844b6d6a098d03d90d6ec17e95ec46fdb404d94b134609d527662d92573f1c6148a258335b6e5028bc344d6c5

C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui

MD5 03ad39bd2e6e0e37f5dce5105fb89f1b
SHA1 d26f4bc6fa6a9397fd6a9e5b3d8b6e12a2de1366
SHA256 1694ed6b61f737777121de45e099b0e9a4eab096261a38344fe205bfaad16de0
SHA512 bf24cb5f3ae8fa2fefc5c622193f430603365849d6795db0bbcfda0de336cac149d97709d6a176682ea3233580e9c5d85e0671a3332b0dfe45f1979a9080ae37

C:\Program Files\Windows Media Player\uk-UA\wmplayer.exe.mui

MD5 04507faa2c47b93c9e610ae2f7aec317
SHA1 41f17d3e8c462745dad7684c4e7b6e37c77e1af7
SHA256 2ac3a829d898da7c7cd8f173fc87123fd5533d9b28cacc24cfbcfb8716f461a6
SHA512 2e16dd0970e270f4e80e6134d5432456b2367875bd15cd3d9fb5fe5ff8cef9ef103e0c64c908bfe6740d507c4a269ec25c2478dd0e4fed2026edb2b89822777a

C:\Program Files\Windows Media Player\uk-UA\wmlaunch.exe.mui

MD5 56148c49c5e48e8af5ffec09d0c7bc68
SHA1 4852631485324992810cdea64121dc82280debd1
SHA256 ebe77271abd48b14e58fa71057c7602d7c06b3364d34e84f57d197a229038e7c
SHA512 5934a943761785355710e9cd88f90b1fb7fa54134234110a61d578bc19fc7ca27806656bcf67ef684d47421d685c0d257566e90da4fd579c575991bad08395bd

C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui

MD5 be6f072af21941ca592d69a81dffcdfa
SHA1 1eb8b323eded5ae3c7dc9ca4df1ad3df896d0857
SHA256 37779f95deb19ca9c165351a25139db746a056c7586847199f993abdfd9c6acf
SHA512 9b53283bd9b17b5e93c39e15fed08bcaa64567ebd3395adb3fb1f358f828e92b44790b1ec2880fef2b378a41747ad851b0ca5a6808b3a8f0ed2a867c8e1b7d5e

C:\Program Files\Windows NT\Accessories\de-DE\wordpad.exe.mui

MD5 6fd863b4eda2c2895bae2883c395a4b2
SHA1 3ea9c23529996842797ea97a06d71a10bf266339
SHA256 5329b1d8a1e274be9c3b8b1fcd15102701215ef936134f65db348a0ca6b041d2
SHA512 51f87f45f4f8e7c69aa2208b6aa98230483faed436115378d6c99b9a9e58c48dc68760dc750372940ae0b0cabd2743c1bb91d80bdb5e2be8c40125995c4dbd9a

C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui

MD5 fa5b440ddea2270438400b762ab72a81
SHA1 dddf6b778b76075607d29264562a9072dbaaba74
SHA256 f4942bf7516d694d7eac3849978c761f9f405226532f0142feefd9165b885f66
SHA512 1b93345c84d14894f7681538abab1888052f2dcf563ec8bf628b59aac6dd506cc21c32f3853b707bb717f5fc747023c75ce8bb4122ce7194dce219e976098b38

C:\Program Files\Windows NT\Accessories\es-ES\wordpad.exe.mui

MD5 f46ba1fa27bdbad1c3816310acb8efb3
SHA1 28493350c735ff7824ecdc4c8355d32340769a8b
SHA256 9711db9e95685755a00e8b4dc0d629a8722a99f84fb90b345dd2399f9c70af50
SHA512 73f843adbd4b1fb7e5c0a8f6fb4e14ec631657e60d377ba19584cc49cbffda3d42e12f8ee6acb8515a5bf7ba8b6eef06c758a588b2354c03f8619415c141cfa9

C:\Program Files\Windows NT\Accessories\fr-FR\wordpad.exe.mui

MD5 7d3fce4027ed630e5f0138cfa7f4766d
SHA1 35f5baf0a06e416f59f39bc29cb530adbb55480e
SHA256 ea19a72ab8286e295afaebef189ea7425c62a053d5ee64429d5dc3e669ea69a1
SHA512 6d2441ddda5f202a9b33da819003cc147aab7a04e28a6b969b3fb5d1966e1d108a535eba6e685870672c023443f406e7224ddde114544fcbb0a08ca41a6fe89a

C:\Program Files\Windows NT\Accessories\ja-JP\wordpad.exe.mui

MD5 1d1e8feb9d6af987a6ce114c557d8395
SHA1 b5c00dc42002de9ae9de121b38811526a3e4b490
SHA256 1647ea578b49e93dcf8e3e6895ba0a1f95e346ba7c90cb94ef293014175d1e76
SHA512 ae3b32af878e094179f756744983516253eeacf3605b0d5199eba547444ae9b6c3c56a4ff50fc8a937ea1fc7819c06d7333042aa9c53ff3e719871c9ca77404d

C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui

MD5 b27c4ff87b4570f5d8e2a43c67b063a0
SHA1 db65d060075208dd6ed7d91756a6b5ef4bfbe084
SHA256 340d39e69bd1bc208e5c10b60d8b465a7065cdd873e0687468899e3b5b400dcd
SHA512 2591c61ff72e12d07c1a630707068bc91e02da7d09e7c7b034b8df2dd452b4b280d5d9d45eacb492d8b1d2eb349e26fb6340791d6a1a037f72ad59bbdaf80167

C:\Program Files\Windows Media Player\uk-UA\wmpnssci.dll.mui

MD5 687ed8b04bf3ca78babb1399447a8837
SHA1 eacbdf95d98600d155ef4e1e3d70b0b5f6caa9fe
SHA256 aa687b30d697a571e5782ef1e4f11594620770e7fb9709bce5f3c23094f66ed1
SHA512 d50e6b932bac939af37efb9ff12fd0e31a4e94c7ddf202b27d201c2d90120c918f031190de683823cdcf90ab22c391a8402fc408813833dfebdf2cd83a1eb7d1

C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui

MD5 11026ea70b137618654a9e66c767e154
SHA1 353dd0c721ff4eae353610648b0054e7fca14a72
SHA256 8ba120c0341ea7233246259ec5fcadf9c708205815e164621e32a10780911c25
SHA512 b58e204bb091af5cf84322643c9a78e814b05ce51c48a6276ab1789667f20847ed25a2c93c13dbda55e591d083b29ed2599060df976059a74fe6a96ad8d97dc8

C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui

MD5 8bf73b8336cfee18ef3d1c972d334faa
SHA1 5844d90d5d1720ff0d6bebd709a56dae633e9ff1
SHA256 ec7963fad391626fb699e94c696f41d46fe7940402c5003a5499669ff199d3a0
SHA512 28b65effe060b8209ce2f134b793091f1f8dcd8e27678c9ca8e3fe5974e695b81e602abf4524608f9a4ae92960227d0e3ec2888688740a4dd8b05ad2dae1fe97

C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui

MD5 02c2a51f769a97bf47df2b526ce52745
SHA1 7d83d6d4c45f752cb31e1dd6261d756227137fd5
SHA256 0a9b8219b1d1bb3b91c067bbe38005cd4bcd941bc7b10dbe3087920334590eda
SHA512 c9cdd797926aeec0fef20c6e16acaf73eacecec15daba3730755bfcdf5e56334c8fd8730ffa39439679c4ae38bf54dd62850db6a335a27ae561887d74535e0d5

C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui

MD5 52869149d0b924402b750551dfb825cd
SHA1 f112ece69a09f81d0ad26dad3d2f78aa1d993300
SHA256 960608c14406bb01ba9ab43ca8646937da9aedab3900899aca672ddd2c9b5841
SHA512 5089ab5153e5f33760ac0e318206865bd7398f13afbee57cd9ca09ddcfab372e0c72e8f59844e18d3875b63233eee784d70e0d8858b45f939ba54668b6bee06f

C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui

MD5 a1f696294df685bcd6e19ff74fd5f89c
SHA1 0ab7b80456e7c295787910e3ab6d3910f09567b9
SHA256 31576d34eba186f988552ba096910607b8b2776deb3bbfaad91c8e25af887b5a
SHA512 6bbc5797f29b00060fae8a4c02e77e4fe5eeac887c6f6b3a3233986fe38639068565771ef5ddf9189e02d7faf1fae9b9bc1d2a6a121bf66f90e0d84e5a1bb99d

C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui

MD5 e087f0f99479ae2841c8add8591b1161
SHA1 bb410b824dc06c61b22ef1fba6cf3a20de12e47e
SHA256 fb4c8a96133d1dc86eb586103ad42581b2c3fb14cfef2d0a2779f6f180fdc14a
SHA512 24d878d2ff36cc545e50293625f357b3dc00908655d278e6b9df11c879b26f66af532f1443bfa3bccbc35c2e487c422f32534f8d0ea8352dd315ee60cfd189fa

C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui

MD5 6e3c60a8aa1c11d6b22c2f782d070023
SHA1 1db6e8902c2299c9ac96c53d95f063f02a8b2602
SHA256 2393c00b173b312e8d89b903e3d337c17885a0d4b59ca68dd7ed779cebd60c3f
SHA512 75ab0017911341bcb9041bb21bcb87792b4a7f07b54927ec6eacb476a161cf1c214fdef3ee2059f7e272c050015be62eb4ae514d88596c3dbcb4f617ce1f57c2

C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui

MD5 ca7006cb438dafef59881b94b85d3fd0
SHA1 20f6188dd61d7ba8e90383c0e347a0c04af12754
SHA256 3c4b6a811eaca6d986bf5386b2d5e1ae4bb55bcf240c74aeb8951e6b9e594355
SHA512 2208bb5c6e027329bdd6515d68065af6c2f49b5bfb5479958ae792a33e0de9728d69b5c397d73c425d3069dc59b320ebad17d05f0bac7080fe5657edfde05671

C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui

MD5 2bedb01be62fe765f660c08a789909c2
SHA1 86156a192b266697a74dc060c9509339538f8bbe
SHA256 4aa7325ecc8ce3709874d46e16947f3bbef5e511623566bd8419cd2161d69a8c
SHA512 6d210e8dc8d1d0e327b7e8c3e2739af46c044da1e96d198d25dd046da534617bbaf591b3fc9160abdcc8ff4c073a332365eeab96d2e5bb5ff10a2b7e746b5905

C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui

MD5 a1770d8635ebb0d6cbb91e3256bcaead
SHA1 094828492f3fe4799d1ac38faaad567741e8c46f
SHA256 60c79171ca3fda8cf84ab21ecfe19e6c6f20eae36aabffbe9c96563c3c669817
SHA512 173bc46b1017969e846a208fa415cbb3fbde3b19da0f314a52129e1b940fe32cd386510a1156069b7553e3742ebe6628373a89db138e41b97274e634ddcc5a20

C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui

MD5 6f5bee9db912ab26c96fe95b9e33e6df
SHA1 bd5b12ff3b032f11c8656526c0588636cbef8a5d
SHA256 f90cd079089f7cf92075dd616842821e4a355e6080f6b4754f444ec160e7f9e3
SHA512 90632f800e3a2a036283c65c72eba91786e6e0a5b9babe661e537d120befc4b8b204392aa33dd7437da57c9db1c77a2f7581dffa8242f06ec79742f2aa619d64

C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui

MD5 bd176759f947c02e0970b12ac67781aa
SHA1 644d22589dded41deb0d3b3fe7a0a57ffb80b7be
SHA256 b9abbdd790c0c842e74bf6524bda4e6ea42b1540919b9e61a860f63fb6a70fa1
SHA512 995298efeab5ff48aaf18a78c1b193a6121cef386fa2e0102baeb2f1ec51fc8a81daa509881edb9f364a9923d02ce5c585461937a17289c1a33fbc65e600ee1d

C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui

MD5 db14d15c191032471d5b8072c1e94012
SHA1 c0ff30fa951718941f5f94f145f588f18d4a3550
SHA256 c360fe726e5626cfbc8f36f09e71f91703c89635e333e8f0a9cce010332bf287
SHA512 80107904d315ebaf6f7fd757c476d54187d516a35f74b65049e01f6287e4ed0265a36a05aed0cedf7ea9aaf89d5b859e749afb22e70a4bd07b159480de0472c0

C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui

MD5 dfc6c43a6d73d4c61f6e87b1fefec15f
SHA1 7571f516663dc291d68d34205bed88e4effe7ac2
SHA256 5bb41a8dd2516e351420be189afc9ba24b5af13da830e92f50dc3eeb5e53f2ff
SHA512 5d95c5c5831b99c01dd2a9b480cb648f5b5a394cc9ebe547643cbe5018080b5168207c432b47a9cb2400a5f94321afc5b158a59f34cc53a17a0aaec84190eec8

C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui

MD5 64f690412923a85454d59d22f74987f8
SHA1 5a300c3556c708fb9b3816f7a0c2d68d65f95439
SHA256 7e05fd846e8850f290ec97494a308519ebc2e9fd200828a01d70aad49f4849ed
SHA512 b2d034cdf00a0ad26147c8d4e82a37eac50603807d984a56481d77d74c45dba6088bd1a468820e39dac32aa5bf15ccc33da08b8b4297550951672df169a974e3

C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui

MD5 57760c699dac64f2f07496fc1ace3e64
SHA1 1e123ccd79733a4312c87763a40e6097d46eb5b6
SHA256 a483150b257ec1efface7883c0139ab5753539b36e0713b718a26c4114c85a64
SHA512 7a57dad166d3643622812c7a280ae32b1d40729026cb72b6283b869ec66f65567f45ec858ae3bd625a8f8e12ae74ad8783b85047848881910ecbd498bae3160f

C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui

MD5 5b5c0a005c3d89e115435715757b8603
SHA1 2ee99c60f20c5e268aa2840374384dc97376cd14
SHA256 be70840ee683f4dd8bb82970534834bca5f904bb3d8a8923b7b038f709228eb8
SHA512 8646e9fa4f194a524df636e1f89b7790ddc5b426ad34855b0cea4b58e41338ca4816d22abf62702d0d5a9a52212ccaa2467f6dfcb8bbaa0ed563551dcdd8c737

C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui

MD5 5b44efaebde4cffffbc2b589c6328467
SHA1 0e3a7b0726215dfd7f91b8896480c106c36b2829
SHA256 54ab8d11d611d0c734947707c0e551ae3bff21319e24da52a447158c25b19115
SHA512 af9dc6c885b9d20e5a417818575501195cb6d8f5abc475d0546a966644eb338486ef4e32f6b6b95022466d74f38abe99dc7332370c53512c280f17f59e71d10d

C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui

MD5 1bdc27de0a592a64e464147d0ec0037e
SHA1 5bb601efe8561ecf639403e1d8096fbfd86e3961
SHA256 f62e1c337c133319d8844c388f764518b4f335444d75a0bdfb56753ad3fe004e
SHA512 ef7a8a356bee8ca047664a052b75e9031aaceaec48d72580fdf8b2ad4eeb02a44ed1948ecbe35c3a06b7c2d9aea44eff2a1a284532591635b1538b2cbd50b1c3

C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui

MD5 c07e68feb516efd4606f543e730eb6d9
SHA1 ddd0097325807ec4d42a7b537467bf2a5bccf027
SHA256 848878f7a91e989efad4940af0de7a7e42aea4a696e3e5e5e1138932a15a480c
SHA512 fd179d27d6948b91e139a9ce033b007474754c011197e84380c2a69a1f91d1056cd86f66e26da8f2af777ec692ec0c0a38ae454518f30e94e5cbd6e7b24f2175

C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui

MD5 ffc385ed595306ae8d102637e5113347
SHA1 8cc62a993e34d0a0b66567499fc9ce6d215447e1
SHA256 c5c45e6fdc2fa70103bfcc0e9930eb44c488baca1dd2f038653ae627ff8cd055
SHA512 02ea062984053fc491ea2f6457db683e8e199b5fa96362bb4c4bcffdf9bf41484d82452a94d4839f6e992fa11f4fc7250de1c3107fb3af33a07a79dd5d781fc1

C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui

MD5 b4d507d07cdba24bcafbfb0e8f7cc087
SHA1 62d63daf58a1acd345a31ec7a0c8b7704d892376
SHA256 71678dcac5cef12bd98c518a8d35db9891ac3184d041a03c68ae440702fb8c5f
SHA512 e5b48c627875e85ba4b57ab90ccf3017354b61300ebfce544fdb1aca10082c40843be9b794088727a28293baa7c2b4e5dc0cb4dbc353fc0417704fc162182bb5

C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui

MD5 e6e86e4d916170f3292eeb9d49c657ec
SHA1 3b91db815bb9e4e7842acf7d3e1ac88ee088fa7c
SHA256 1a93ebe8ca6af3396b4dd43bd49623ede82dba42f771ca23cfa8942569bdd85e
SHA512 8893df57fda468b4ac2fa5f5f32d95c1cfc2bd69e4bf0f0169c926d21dfc5ea06327e503a135191a6e69e4fc65eeafe354e56a088b738f3375ed49ba1c01510e

C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui

MD5 c7a1f96e99ad5209db8a2e7719f3f366
SHA1 82845849658a5c7257699562105874c683ae7466
SHA256 8c184e8fdf1d3115c48df6eca95193300000b89f7da9f65c40cd289415be9577
SHA512 16bac538318135e7765b0ce239cdc090c8f66b2fec4cce06ebb64b9c437269f1d2189f5a1bf25234d5f00ae587b33e6e69ea8ff8a3d34228aa8926dfa98a11a5

C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui

MD5 28aa7dc6f13b4067dba6b2e5476e3d46
SHA1 298c8368166bfd9f71126b346659b8b7e7bd7dd4
SHA256 80f053189baf5fb95ea3d5ce62fcb10446f59c41b99cabf101b6cf19486eda56
SHA512 5772686c776a1da5562942be45cd5b00c619959fdb4ae1d94a3487e12d929185a120cecd68959d39d173d6d92fb1662aabf4eb26da567172a3da9f50b773c838

C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui

MD5 0ec5a3aa85353eda00353edc0d493990
SHA1 2dcd72cbbd7cfb618c565b8a702707e5e9b51b9d
SHA256 6b42d6dd6fcd7a5e4c38c866f04fc70b28d877d7b1d4f39f109c7ea182435f0f
SHA512 ec8be876296499e92f238e6718f952904b7cb0c37b7e82bf28ba820f41eb41074b7544ea6e6c32ed4180e24f63de184de5a31ee85eade7c7c0a8bdc8751e5682

C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui

MD5 e4c32b259bb1a0645048a82442bbdab1
SHA1 d36bbbf42206e2391dc4f2307f75d6dabe801ae3
SHA256 3f56851933e2ab962874a9a519f7ac089bf51522cd6a84168bd1057eed690554
SHA512 57dfd378cf27104501bb803ebcdc496625b3c62138bba53faba01bbd8436d84bc494c0cbeffe6959ed5646445b2271e7a7655745619d094506b036ee0a2e1583

C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui

MD5 f94828175696a1f9659a6e1ea4fd3b05
SHA1 afdd8c14d93ba9779df8cdd1a8e7baeaa7f8d05d
SHA256 231f34727ae6ae8984da8620e466c4d2c2d8bf5ce96f7cda0a6f01dd8b2d4560
SHA512 27d7e2c33eb88c2ea642b0c6c592d57a5e3b6dcbfe03b00dbbc555473f872cd9f41aa90967b2eb49874f82e5ada84d5b23eb1a97871890650f7f55e95dda99f8

C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui

MD5 0e29a304fdde23cab758266db928dd97
SHA1 4f5f10fe21ecbcbf70b85c63ffd67b2934b0f1e0
SHA256 15818c9dab0b9678f6e43bf7ba78b036fbdd0a86be5db881717f2bbd7255b414
SHA512 ed5a7100a7e2d4c6adaa6b2f1446967229c60a3bea905e5d9d4811db397b6b1a2981113ea293a980d281340e68d9a13d83a42a7142e110cca04b0525cf413f39

C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui

MD5 7d12cb0ce32f8ca556991d89c153aeac
SHA1 121f09febdebd6d923f9f75b0ed99da45740ed3e
SHA256 02144aa28ad5b682fea5fb3d5c0f26464a54293fb1ab2babf445166a782e7111
SHA512 5ed4d1b5795cf69f2572770756be20bdeb2301400fb7e5a76c1f2bea06c6cb048c90b3395687153e889c2bc0c50e32f059499e49d90c94e09505ebd0149ab848

C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui

MD5 3116957115a29bbeeda4c539ae9fffea
SHA1 03a1db0dd15f30c86452389409de3cc56e86a851
SHA256 57a91105968efa4cc952509519b1d514ea32f32e3fcd239acab6145fcfb21655
SHA512 debf2f5fe0a11d7215feeaeb0665aa6008364665e87f2f3ba9c7914ac4b028b0b6446059cb8440c28de73b0c6756ade7ac55af240f1a7797eb0f1f4b1bd29b9d

C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui

MD5 dc47abe4f51fb9a4bbea160afa2f503e
SHA1 d0c41a200dbc2a3be5bf8ce7fd2591640915debb
SHA256 87900676f5f77029340b6b1c7787eb8aaea26f5df16cf147f0ffcb872e109d8e
SHA512 97592450fc17782137306dbc8157657a5cf563cff576ec1572b93265ff803145a1b7cbb5ac56f786622bfbc3d93e0c50a6a38dd4a703880c169c0ca84381294e

C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui

MD5 b3f69e539d18904c208f88d61ff8ab8c
SHA1 15e8354be3dfcceb18d6943712ddfa44f634d3fd
SHA256 4c44e605c482902a43df20ad8e8df0badb65a7f00b57cfe07d98ad078f60bbbc
SHA512 e060a35dff1483faba45edc63a7cfea1566d0663feb2c31d62d7fbb91474fc9191052686aa9e0d1ab4ae22108159b73a59f411ebc7ed2ee2e1a3914264a4ce73

C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui

MD5 df99e8f720568b5db9e441b0a87cf0ea
SHA1 6844ead46676c324fdf6336a6f9e50b30d9b6193
SHA256 5b8b634f3456312cfc1df25c4530cbcfa5d5a14d8d06a1a37834b1e7f3d1ae05
SHA512 c167a9cc025aa7a76fe8319bfaaa0a8e33938ca2a82bd79314f33de9583a78d4562de10e845bdcbfc7c485029dd2913cb2eb3c93beecf89e1ba29595cdfd268a

C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui

MD5 1d8f612d291f9b5b625129bcd252c740
SHA1 844a9028fb51cd8e1a63a0b6a016078bacf68829
SHA256 c50c8f2635ad37430dbbe6cb2348bbc947ee555e0c58596da4fbc9824975879b
SHA512 54d4f6f5cd933ccf3ba540ea402d913fe499ea47a6fc2056b3f985793c2ed7d9cb0c3945cadf05f140039d6189b71abc2b04efb22b39d118eea43f35ad9e6cc5

C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui

MD5 74d75d835644687dff27f3d8dbfb6198
SHA1 80c522edf7b4f1e815ebf2b32a74f6a6e1977159
SHA256 beecb06ec46417b4155428e05d80b0b005d7c3e8dca5be3037b631fe998dda98
SHA512 21ef2eb0257897a0bd63a5d78687abe22427eda630d56adda0111e5f01b6a9b5b98d11c5aa6ce3ac4fcab8da10a69fe179b432b87dbe62e39221cee162356ef7

C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui

MD5 57ee99b9c4c74b19591f72d6d05bbe91
SHA1 8db930add7176ad7b2c47d58ff135c4c713e1e7c
SHA256 6fcbbd6bfcaf95ceca7a2c2843fe521083116ba302c1b8e950e8c037bc85ac5d
SHA512 2221da9124c4b8fa3a0f45cc2bc788611bb5536149f9ae5ce2dc820b30f103bd08095db8837fea5f1e1914a0b7e326b010e045efdd0ae1c5d5a6c6cd31db6e27

C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui

MD5 6a9bec2e6310a1170a09f38ca9c59d59
SHA1 6c9435d787302ac471178b7b051df8abfee1ff0b
SHA256 d773ecaee4abec023297fab3b086af407eb412f63bc1341e0685726bfc7c9a31
SHA512 23de8ae355bcdbe3a217c55048598928e6a8494af760757f2603bcd73ee08e6fb61c2b3ebcc25966ccf012f9c4536953f73b179178417bdbd171179589ce745b

C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui

MD5 911aff37b6bc25bf219ed195a535ffe9
SHA1 fbc53ef39252d39145d30896a1afc47770094e83
SHA256 674067987e3edd0272daa08f8737db07c0619edd9c3b5bbf3266817ad1cea0cd
SHA512 eb963088527bac4fe5ab69ff19039eeb9db0e5da6a06f99327d46da748526596056e11e5a07f4194d22b0b10e0c9f1c954d9c52f355258beea22018e32601143

C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui

MD5 e048f4580f5d4861e72d1119dc129b8e
SHA1 3a0673c41f58c8dcd426415857760d63cfb7975a
SHA256 9390d862dc2ddd79591f3ea8a7c33654e0c503b1af0f0806852c7cbfa41f28b6
SHA512 56266b8799ff208bc821a8b7bc3e57b87226ad127515c56769cf511d97b6b42cf47bcc089c9e79c6b77039c84bae20a50e099ccc212279cb51b91e5b39762bc9

C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui

MD5 cddf5933420dbd74b1e24e4f45c067e0
SHA1 43b6a728568cce0c4f62f937495736e29d7a97c7
SHA256 9fe11701545cedc69c8f911dfdf54cdffe64043d832f680c94cfc421d5704978
SHA512 36b24ff5516fc94ccacd6cc0ede4b1ca7621303802f3e314c1fa2cd37c12338f5ab848b7daa11fc54b6ed1703a817eb5e4873baa2532ea42aced4ef520b642d6

C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui

MD5 b9afc9e099bdef6b0c2421a0bf751323
SHA1 87c7fa88b89aa748f704836e0af0b12f7b454210
SHA256 21de9a6a1ea1bc984f4554d9773139feca9e1b62830873be4ba1354cdc2fb332
SHA512 a6407381c20446bde4fd5c66c2fc5e887625d4bdde7888eda94d0c8ccd270a91037bcba840a1ca392b3523beb6b0527f13a71b9bbdf2cf18cfdae815d4fb14e6

C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui

MD5 d80858d85a3b0cb63a04eea6d5e9129f
SHA1 04cf1a555165669a648411f0bfa3ea02cbd0b972
SHA256 a93ccab3a27109184d3bdd2e08fef7151eea74a98c80a456062bc1f57b695911
SHA512 6fa695041ef4ec708e18a64139967b2d957a905bbc8817ae357314bc3d844e04cb178b9aa3010ecf177ff98492966ec9a7a27799449787272a0547273631cc3b

C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui

MD5 7e7bcd1fbad066fe060935b041d80924
SHA1 011a13d9eab7686dc00d61adf28bbe798bea1664
SHA256 6326ad0aca40624bb6f3bee80ad1c97776f9a325414db902aa1fa6c21c012524
SHA512 9db411d035e205bf98be0ca485ae031a6a7bbf70ebe68e13fa63d425df1a52c8fdd372fd0acda6be7fc2ffaefbc68430a3f7362dab664ad7ce7dbad4e2aa4bc0

C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui

MD5 afb2c94545d6669f99c2fb637a14f616
SHA1 17a954a91fcd007def86fd922bccc806bf6c0877
SHA256 d00de85418dcc980ab6ea91d56c40a8e431227b49e309ab1c6d05ccb70609196
SHA512 3ead833b7453b6149b5873295219856d91a3d7d0d5ee1b7b6e82fa2d51ee48092c787dcc2b13713d63f7f73aa73cb6862f638143b7583a622bd7ab2886c5c9f4

C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui

MD5 50ea7b2b5bed4a70dd772b86fada5d33
SHA1 3e952656657b55513786bc89cfef41e54abcd0c8
SHA256 2b21187d0b5c59cfa9071880a0b04804a491e07e9d78244b87dc335ebaeefbdf
SHA512 4494ff6c81d709fc91c70f6af8e11036319b90078eb1ce16ce5bdbecdf28af472fee97c0d6996072b4944b8ece4b9f7cf7c1d4b14c3272fb78ee7a085debc2ef

C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui

MD5 ced83e92d2559af6ec8d0f0f4983dead
SHA1 c5dc1ca9a2264dedd054b9883b7cc4ad2efec0f2
SHA256 f8bdeca7e2ad1d34166a3cd214d5609fdfcdfe93c1fd4fca0c9969593fa43577
SHA512 abf2bcad4d0a9ae62a95f1dd8c319bb84e216236ad78b69bd411b3b5572b1c104b0d9e1ec6efd9af85527d198b1130c17f3415da4dc0f65dba7e2b501ca2e8c2

C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui

MD5 09c9192d8bbfccca15f28668900e23fc
SHA1 39631e90b24552865fc3df94338f14302d208554
SHA256 17225a94851d444aa72e428845ddedcc516e394086ebbad3754aea8785a48185
SHA512 ef1d4ddaef452a16bb65c8add960d19b3f5b58668e4bf57b8cdb2cf56e44d3d662c2a5db2cb129ea11b27b11f00e50ece025225c3461875d31d751d376438cfd

C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui

MD5 7d4b54859f7b7c6e8a2a3fb94c852d5b
SHA1 cd56bc94caf18e50307ea31908c1f2c25b86bdf1
SHA256 6e3d1457002d5752745bee2222f7b14de4ec6f49299a768c857bd26d455d03ad
SHA512 f1c37dde235f14675371185d1cd0fdbf0c16b87c907fac0a88287117e4a35597de78a705b3465095f039bf3247afb9857951a8b69725b91052a9f3344ff4b301

C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui

MD5 8d9c97ea81873bf3cc92333ad2b48dc1
SHA1 69c794cfa208c0e052b78651f943de9ed915ef43
SHA256 05f560a84c943df2e66c1a2f1b4e61cec546b5b1c7eb75ef97d1c26123757afe
SHA512 7df17edcf729ca373bfade60b5ab0c190983995383123326132214b7e98671e093f72a6b36dbad0b9887ef70d6181e668597412e094f8b094c372010276ebf8f

C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui

MD5 2f264794f46819baa079994c3bad81c1
SHA1 372c4b2415f47a062357c51db988ae4504cfdc3e
SHA256 91a6586e0a16e64499e81afe740a620aa10d601c261c26ef844857ee687de92b
SHA512 04cab5822a76cb166be59186c9e55c2734e808cfd0ba2d0296119320026450a3a452ff1bad71bf13faa00befa6d1a609de661d3043f1d9f4c63f2fcbc57f2813

C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui

MD5 4cdcc8c298e061ef110ccc827be09d66
SHA1 bc480d42697166ec9fc95b9bf01d9dacebf258e6
SHA256 6abe3095f1a302486cad86274c726e5acc2cd5e025fedc8dfac9b35d464f7a71
SHA512 122f8c0267d90270c9f222921021808f597587ac3e085f141e83e5a11ac024c35c50a02147fc9c10c6b2787e74712eb0afb645fbb592bf1b849616884b0c1993

C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui

MD5 ab1d9065f1beed59e532a7ecef5f1abe
SHA1 5bb2e6c8a75be6c31bed155bd0f17df29f2c0ab6
SHA256 7955006674cacc676ac52eedeb4fddd40f7aab60a0bfda982977f958c90bf55e
SHA512 816b30a906eedaf3f0d0e293d84b1bab7c8bcbdfc49ca9b2d8bc69c96a5d856a301a36702ea40836ecdeae89cd2afca4788815841c155e2c0126af01f90da764

C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui

MD5 fc8d0b48c4dde744e63a4a7ba9c5f55d
SHA1 0f3c60304fe56f4361f57f978f0c312bdd278a84
SHA256 e2988d8c71d932cbabe6f7ef6aceeae3938d0502f284cb1c205a50a391115b7b
SHA512 81c32d835c177334231d8310a9f42ed958f5990f2f7da7dbf73ee64e2cc044f9b7df77b3d88977d208f8bb12b6e19d4e87655fe62438c2687065f202e4d9d7ec

C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui

MD5 e47507d9a7e14e042bbc74355a30c536
SHA1 7a73c140ed01987b54dad615e29cdb06f425519f
SHA256 570252e0daedc686535fd8fdefda745c2cf1268e27b89525da004026c8d41bdc
SHA512 5ebcaef133dcbe55db347263e491fa92353cedc44f9ed729582a9d1fcfd023cea49cee089f6a9bb5ed98bbf24790b90dbe6af14f10b48e86e6937a28b92c6021

C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui

MD5 844e485ce22e356fbca9cdc0f9152998
SHA1 85d91b0b1438b23a9790fb33cc9a02f6ecba6046
SHA256 881cda41a4cd3b12b7ba0b185141168e0710cc9fdb33d73f02e7eada9deda610
SHA512 31402ab945824df3048fe61b861287f6987decbdbf3058a4bf3edc50c811b65575dbf9fdf2e7716d408e2a2251eb46bdc165ae93fcc489987473856345575793

C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui

MD5 052c8d735a5879c95f07b469887cf4e5
SHA1 c786ce7b26a978bab159fed3f7f5569b4a03aacc
SHA256 2540bf6835a2a54f63bb0664b3db59f98e34ba487e6ad06d2d4a8f7a132cf7c9
SHA512 4f5cbdcdd212cd6adb21d3aaaca37ed813f1a26f6318fa5786488d7a92a8c61becdb1deed38eebd5e34498de124505a4e1c93153be7bd978c16dd5e63497ad90

C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui

MD5 3bdb181aea07611fa1de308696663da9
SHA1 da4d5862deacf478a7c38c553992601c6ec17617
SHA256 f1f2a714096bb01fe07cbec01a3960adf022690d8dc458c59a2fda3ee45d48dd
SHA512 abb0d7ac26a32a0dc4e24334108f3b9fb92cb7abe3edf957e7e2ba1de47e0f54bb50862266eab3bd1b036022bc843a97bdcd99e9e46a7cb73c54b35b886d910a

C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui

MD5 114af9d45cb6509226342c64ad681ddc
SHA1 a6bee6e7b2170729b5dd3675954cb848aea96090
SHA256 9aed211e2416d9424100815525ea24e471b46dde4fb8aae594d7b495f562786b
SHA512 8bfd81b78549f5f8c81f6fffc9b55f42d44d87d76ddde4963fb659ba6fa666e780704ba09e43498f080f71bb8e862339064c2850d56ce480a0424f91cbf19f06

C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui

MD5 1fa57bc1010e7f13688e52de1fe070fb
SHA1 9d77a9cce8cbabee7427ae54a0d65c02a8ff91e9
SHA256 06ffd7d2f3a6e8b768012786070e2d8329bb92c7cc7ad27436e843bc2c7a9ad7
SHA512 cc32f953303c55f15b30b80e71e1d3c705e07e6fed1bcfcd4263f0cc852d2a0f467cf8af3c9fe3b5ca87e6b8119bc190e193cc50fe3e6feab9a3f51ffcabedaa

C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui

MD5 56e43181d58f998c88cc8ea53a90ad77
SHA1 a2fcee3eb6dd4a626a9651a171cf26d0f77aca38
SHA256 8d5acf878729b426f60d7fb5d4e26369873c530fe7f510f893797f778c2bd923
SHA512 2bcf3bb248dbcccbf82d879dd442acd60fc86899cdd7705f20606050d3fcfb6cbdc6634e0b582ef893b1a2c55a81acac1f00d3e15a51fa134eb67126e7b2bd6a

C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui

MD5 5c23a29fa10536c9889f61c6b598758d
SHA1 32a7bfeb84b9826f3ab0f42b05546a3fbf51d36e
SHA256 e0ca89f87e47ab828fcdb96afc45991ec9325c813a7e4211c4c399dc527ca874
SHA512 b80165a1d17c48d958c436402589ee59cb9f85b7f0635db4949fe0f070f22885c97cc62f309e837a882ee26410ae70678e9af25c82fdfc9a0d8f219881c320a3

C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui

MD5 0b56ece59a5581aabc392c6b81d77a5f
SHA1 9f2cc048cc2ab78424050e3e1c1dbc828db9b512
SHA256 0b9fdda7c23d3aff2d31e4229f15de2db6b01890299edaa6857a3abf15a691a5
SHA512 7893a0e43f3fc1b4d5eea32609651edc5cf4e8d2caee26cfbd66c41414bba1d8b6c96d4e592f5101887929bfc76c2f654ddf43538a0e4b427bd61da7b3c2f5c4

C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui

MD5 b4b36ed96cb3c834c378ddf3ee0953fa
SHA1 c0e05c92f19ea7646e566bfa2909ad332a88e13e
SHA256 b7292e7b8a82fc4d5bb6158ba08f453e868f7bd0b4dcdc8ad7d3d3c19813ff70
SHA512 0484100a50bf36dd1f908669b92abda666983750040bd7032e37efc485be56c2039223d143a3cb5d7d755385b14d72ac3c52e59c93634b19cf37dda49ad2f53a

C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui

MD5 dfce16cfbb5d93ca4b7b6e053e3df8bb
SHA1 181ca2c7be2d35f54379743ac688284f48098894
SHA256 a1b8b98f3ab85268b139b2a392c556049adc3d662a5b787323d2f0d34d60de42
SHA512 e0ff04391fac92058609f1ef82372dfb858c35f5a96f33de88e468a93a395de1a24f06dd5f498136a62335f29c9e23982a3eda08c24d0b642ae052748610a38a

C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui

MD5 fb88bbf61540702efb1ec49ce7b4851d
SHA1 878e9bd51185f5be032f6c093de66c56fa4780c3
SHA256 0f9e8684c698c1f11f766244715e89df43d0645b26455d25308b5adfe66a5892
SHA512 616946ca2fd27a4811f8360eacb05302386d68a5d7179552666314ab497e0b89cb3637fa698d17ed4ffb245a5e0bf9d6269af658bd926d18d99fb81ae5a2ed46

C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui

MD5 45bdc6b9185fed1314ac95af3af171ee
SHA1 0b517696748319c89d31ca9ec0b1dbede296a284
SHA256 0fa6c352d9eaac2a9cf4e053fac8e5c936bd6b91ccc9792496e7d2d2dfd6d6cd
SHA512 e1931741d1727ed33cb0ebd7d847138ea1d23cefe2ca5b3ec3fbef3d6cb0dcd95b1cc79098f7c9f079bdb9cdb3bd89eb7487623d95e8c732597409a85175c04d

C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui

MD5 708762a4f703964b91182b43b93ffcd1
SHA1 e3695c8ddb33894714ec27c38d32203dd7f32b19
SHA256 3ef125ba17ce13297eac1cde0d25e3689ac7c007e38e29d2257220e01f6a4109
SHA512 944bcd632efc4d968128f7f82dd207e0ac45e0cf93777af9fdf5e62bb6edc99c5fb931a9636bfe6c5129ce3c413590799f9afda7b4b531e17971240346e1a791

C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui

MD5 0ffe1f27466919f6f5a064375e4976b6
SHA1 57058b0dd59802be2b690498008c719c1d2d27b3
SHA256 d4f645c57bf94d5f1e952eb6472760cc3c200ee93d9552d02f8f726b62d7e9c5
SHA512 81b8b0bc666f7bece1678a56cb3c93acb4ad5ec6571b7eb7fec867556b86c6abd384be8daffbff55fc36e2e34d49236d38258b2f66fb248198632b84ee9049e8

C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui

MD5 af5578c585d9ea22b8862871a1dbb97c
SHA1 f973daeebd050e3c8ed049a3321f74f708285187
SHA256 d71973e24ab13feeb9b5a3ff618f355e5373858e0bf343f3fe80d157901180f0
SHA512 aa37a879af1c59f3dcf3dded02afe55d5c4e395f265f2dbe8658c85d47b1faecb7fa2e3edcd30c611db1f7687e53803a58a04aef7259757f9aec8c849b220bdf

C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui

MD5 8f480cd82cde1448f8a31a2d29d4df5d
SHA1 b92ae8a25f3d4373160e823ba0d139d35c5aff6c
SHA256 7cb9642ebbca17bdb0ee49c0dfb6a1568fffee9ad25f37406e4b587d0093fa8e
SHA512 dee3d0b1ef4df20cff91fdae03a6527094d3dbb5654110d8b243376c971c4475c8e52d1fc06a2261cecbf44e6bbf0d7778f3a8fa909ff4e19f14a138b43f6f31

C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui

MD5 e94019f4432b745feb8b9432a4978f61
SHA1 c6e97c5888a4a90bff59b9d63a0da25ba00b9988
SHA256 8396d59338d8d21936cbcb97228687a6010dd365fdd6e7d038309279334a08da
SHA512 11bfe76cec16615a8c9a65cb97f173360b17883263e2528fc2d6fa01f65d15424cf68ec87c4e53a4e919270336a4979931c916ac6b8cf5cc28537bd4a51dff48

C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui

MD5 1ac0b9109ec7bc9d56c9a4b1b967d4dc
SHA1 1bb7d83da6f14e44b8e4e3fd7f9d23a0e1ceb17e
SHA256 f395e89aa0e29a184a0d22c58663e670b3433978ff1d5f3657e559f08ae55b8c
SHA512 7784d075c701934567eb7cd6b841bd798d6c980e737ab3dda490326b105255fe5c5ec1e0bedac955a3525767cc1b4b6a2b033fe2f0aeb6b701ad0e48e00f8e7f

C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui

MD5 8af3b92767ecdba861c39afed088eeeb
SHA1 279634c4747c0140abc9443ed4d4c1a8d4625a41
SHA256 387097f54b71979844891c948fa5d9d3fa0a7b75d5d17dcefa369c8ad71d3a93
SHA512 086be315e5ef3006a1db7dcc46b0c85ce9dcc548207a9f022be75ba807a3ee51a5dc63430c67810a4f49cf2ab4d1b3dc5d01718f524bbe235b602de9d93539f7

C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui

MD5 9444689d9e5a2a77f59f215d570a6b20
SHA1 21ac863eae0302ffbfd7c2c079a25833e17c8c45
SHA256 a243d99e79075ef23b66bc00b18e0f58b0602fbaae2094e842136a5c1b792ddd
SHA512 2a44c6aefc7ae20376ccace70a7f95738105862ef4c259c6ef105f84769bc8f841eb8fe986a275b46674950dfac4215fa005bbceee44c758bc3bd1924a329383

C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui

MD5 8524e71ebb96358a1a1b8d661a031b65
SHA1 6b754f22be0de1c6b1aabaa2bab6d92401222be3
SHA256 2815733de9dd497d5ceb66c46e4135e4e7f8ae09e5608adfb80791121bda8504
SHA512 9e3ebebb555d73283d5d63c393a9e08e68d8fe282d3e49d2649b64e59cb5a7d7681461d485e76ff4d4bd3bc73e578d153b5f18f4987a5d177f7b33ce57f5a6e3

C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui

MD5 844ad23c11de92a27565e14f842db035
SHA1 ab6e6fd9c07f6694b0c27d2e567eaf617f433136
SHA256 4933601d5dd7f1a0c45777e9d1057566be67d62d1b691ff72dc496e71d79d90e
SHA512 7cf234857988225c73e1d1b15e3ab04492d65e7d8c9d6141ccd96e2aa5e01ed7644b636971ed93cdcd4741df0cc909bba878dce6ac0a32e08ae0a441afaf7372

C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui

MD5 046e422cb19fa849fa00b2d84e7bf589
SHA1 9950b60e5468f0d8c4895bfa9bd68970bba48ac4
SHA256 e67455ea06d87c58dd1bfc75b6beeb5bdbc11d2cdc6cb02a1b2230570a7b74c2
SHA512 b3395f87f1412a71ed901357af60e7d2492cc6aa441c5f7d9398274f7fbe3f26e699a0e037c50895e0f02ce3a569ca3ee545532b675b8b3089bb5335e19096d2

C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui

MD5 5ed59a342f40c538f5e348b1f7cf836e
SHA1 b58386ea58498c9fe59f122c274e9347f50850d9
SHA256 fe81fca769e5612f37a22a938353975c89810338efd38afc41e6445e04e55973
SHA512 45714c145a58c2258c3af337cdfb8a190efd4e77e84b42f0743232383ade27cc31e3b5eb6c4ab7e4b09e0ef64eb7638e1945ca9b8245ad585266cef63b289e89

C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui

MD5 b71b70406fdb06b8bf4b1a310f4c34c4
SHA1 e371bd8a875f9a50e3cec3556344e4bdefbaacda
SHA256 b22b804dd9b7e7aeba47d2b0aefa204737ab46b0462e047462cbcdd6395ac428
SHA512 e60ce116fc13de5c0fa4d4bd858d03e5c73407ce4713afa626d4f13e83edc111b2f1b3f9d983dee5a2faee8e16a39b3f428fffdd5ddac505188a3fa43d42d40f

C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui

MD5 c913722f3ca673b2c48f578e3d5e70b3
SHA1 4c3fa00298d422095748c2ff8be8eba4b9cf89f5
SHA256 7858fc8c486ec1c400c81c695f772062ec8d481b3638da321acb42af65c62dd7
SHA512 6dbc0db310f9636861d313ab1d35d50e765dd4ec5ad495a950fe9b7bca81e10e9a8b2df176237154453cbd34cd3850243288b21efc7771c723e1b6b55f048828

C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui

MD5 91b1922f88d4803ba8515e3ce84af3b5
SHA1 661b8136e40bc092da0633fd234c7a043dd2e265
SHA256 4136589677f9b7b449de8984ea758684f5cd5e7ec37080cebabf2385ae21cc93
SHA512 95ee8ad068b58a1a0ad713ea7de91952b8e3dea56ef7fdb429c66d11cb37f13fd65668700e072295702568c04cd112ca575e45aff41697aa8869855666286d72

C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui

MD5 ceec9ffb397e2253b937942c81836df8
SHA1 09b5e2ad50a90cbbf08b96ed3fd79a069d520546
SHA256 806c3a4e5f84cfa7aa77c0d910057bb3933bc7385d7e636584e728a24eac0818
SHA512 2e8eee773a1d61a8daaf9540870c5c397ba04b47311fe996ed39e93039c98fe6865ffda8e2dffda3557ecac4c365eb24396049a48a7bd1b111e790dc12d39128

C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui

MD5 915e53b15b71d17f9790aa32fa74f0b8
SHA1 87fa390003809f17756bd5d53d12e1e86e6f1698
SHA256 c2625c3fe3d071cd7a7869b4662f076f4b5069fbdd0d650c577661352f5f5208
SHA512 5b504862c2ded4eb3d0bb1292c98278295ce33a4e072f10a46bfc6d607feccc4496c4724be8993714f4790af69421815f7cea0991cc1cf9834619cc5583d06d7

C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui

MD5 1abe7194f15caaeb0e92843fd60a9f9d
SHA1 20fd8cd45f2813b74665f29c675b94b3674c099b
SHA256 fdc01983f65579d1d0a156587285126a71ac7dba68bed4d06e1419cfee4f7c2e
SHA512 f90ffabe9c985e5b776ba54e0d5bf0847124cb27f9fab12d9cf62fbdf97f8af4c6a4aea20ff1e5601931617e0ca0b0061f5e387556b77840b0c5abd3cf791ec1

C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui

MD5 3dd0fdbd27c2c5e70f22a0aac4607e60
SHA1 2a022ee44bf3e0f3d502b657001c832fc4948140
SHA256 b35ea5f814bf2156b4807e5470e49086e4792ea3963eceb69c183ea1186b9245
SHA512 5d7adaa345df57a1c81c43119d2c5a7864ddfe3b4e6c09a8be0027826111e237ef06880f53f0dbde143d4285dc1f506ead64376645e7281fea408122451d442d

C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui

MD5 a2fa53811afa742b53de887270bb1dde
SHA1 fb8a58312b0587da68f99dfb45d67a6bf7262869
SHA256 e92abdf9bea2da871c6dc5d9995edf81877f82b85fc83969327b65605b6e059f
SHA512 9ab22d09e417ccfc596d4b3a705512360a48590bf63d75626549d81fd4e9ac56e9f4e87b6e95c6a2466fdc00a7fc898d9e1c055e417cc72a2b7b1455232a45b6

C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui

MD5 9350b781de47e6bffeb6d823cf705064
SHA1 502bd1c995ba533eef3e06486c3e0125641a1b97
SHA256 8c58fb56208874784babf6965a761c09a4de171c3c5aacad82edf2342e84976a
SHA512 1e14a50900f6d316fce2115f0e4b92b955f19b5c5a61ff9805ec79cf4d2edf9b065ebbad43ec31127e1ef16d17ea486c1b1176864b51142278c67e566494c3cd

C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui

MD5 fb74a31cc5e3f6bc57cbb456997e29db
SHA1 4b1aaf08708f9bece893802964b63ed3571cefd9
SHA256 62fa3054515ad7e12598e8fc2e4b8101e5c9343fffb36b4841a6ecca3aa5d03f
SHA512 9232c6d4f77c8a62c2c12999cea332f884f1cd72e920aba6a8bdcf566adaefa4ed854909d6aee8dc6acb9b058a8ff61a8cf5562eece50c812d9115fe99509406

C:\Program Files\Common Files\System\en-US\wab32res.dll.mui

MD5 1dc0f3ef48da4735e9eac05c23d8bbd8
SHA1 108e8f2a65140594b24a8e2e5d12360e9f2c656d
SHA256 6753a8edcaa10fde36b633bf45d0086bb3f4a8ed5c585414ffe206047fa011df
SHA512 d8644a3815fcc258ec2d260f2cc17eed3bc5c5468a8066ab65a9b9cab57e5b4fd2bae5f68ee62ea51205409c6af3464fe6722ea9078b8d95525090df9e60d2c2

C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui

MD5 5239e9ed2bbe7134fecf1b7b84b1e0af
SHA1 62e5f9c8733ed18d178f9839fc3df14a46837d5b
SHA256 5ae106def763874067041f213254d44661c562fe3b2cc51f668c35f7c186c13e
SHA512 96fbe0985903d8acd857085307b8c640a6d8fec0a1273213fb5ab388322f3fe02873af72fd382665bea71c082268579e060db7c5d2c94684a1156f2b6453ea4b

C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui

MD5 4863311ce0ab3e9653469b01cbdbebea
SHA1 76349619acf23de550368b1dd8b46453213d7e21
SHA256 55e31eee8c5505e68803a69bfac5df886a3f536523caa8ac954f35f78f15d3eb
SHA512 487a933d78687972f6eb7cec95f85626b0e3377cb24b74be6a7276f603f043da4dcb4e9b77ff9b7dc2260c5c33e87ce33c9961f4ddfe8d2fc1c8071e559c95d6

C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui

MD5 b14f837aa33b5083f1e9fcfd2bad5007
SHA1 8b485209c8f00b302de217764ac6aff9728362dd
SHA256 045a13941a18b0d9342b6f22849acad39202c89cb312cc4cb7967bc5812bfe8e
SHA512 fae0d64e1b004c4c6fbd77c4043f3fa8449244d51bebc4ff0197ef17a956c97f734da47004b62ac8d7d48fe533a42bc700b61a8f5dc179e464d9b3d3da904a87

C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui

MD5 f2b1a7d944a1f39c20a7e48dfbf4eb94
SHA1 60e7794033bc875e74de36bf62740453711ac098
SHA256 b2df33b426cc60660553e74a97d50285aa984648d878d419c9a93f351a90dc5e
SHA512 c7277f046aee99ca74caf5925a96de9e919c70b811d97bd10d0ddf2c7be53ca9f06eb1863cca27fe2bf4fce1fa27c87aac983353c61522202dfe52296dac962a

C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui

MD5 eb56017075edb1831488832d007f57aa
SHA1 ca90bd1b8b64a927d4ce03a897ff0001039908e1
SHA256 bcd70ae8da0d3c16cb72583db884789cd7ec5d755cb1eba138147247289b49d0
SHA512 8df40b252a38308c13e9d9ed4efec133b63782e47b722223971bc5c4dde42fa29d82ab8f63d84360baa5c4e0f8d6eaa0a1017f9beb4b90ed8f3a31e4634c6141

C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui

MD5 f53eecfd941f90f99102e0fb5474ce27
SHA1 d07f6e99e44f3c7596a584f1c6915bde9c50e52c
SHA256 7d05818632dcf05dbfa1b4aac84c1ac28b3f8c402150e536ce4164e89f8a4870
SHA512 de432f653e8c850b2a084dff8f432912a1da862e005ac34e1529d8d833e448a74e97bab0129552eba5c2e3036eb25f09ca49a7e3a2fe3bfa9144b99cb86a8f8e

C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui

MD5 c4cd48b774162d4838a477de383b70e7
SHA1 b92e01bf0fb331116072db4036a533927b288ed5
SHA256 9cc6834f1cdd6d4871d999da42b724c71d308521880908d91134e14d4e95fcd8
SHA512 f239eb3cc8471e2b64016833727e0a77cb61f12fd4174b53edfafb03da4a4c1bf5e3fddd19ec60942ca11e1f0cdccfc5099e010a8a61b8f94d9c8e65eeda7381

C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui

MD5 472271f7ceb128aa875363349f651bb9
SHA1 2f3367fc847c495f59c1bc9e556d1e708581f282
SHA256 2e75457f8f895b079f178c3bbc006d5f6bf3bc312b96078fd5cfce1f0d0d55cb
SHA512 6675c013bbd170f6067e51d6d8a2828f40f8a6cd1aedc75790327ec10e849d0726d0504ea28d94646731a99cee4dc2c8a77475e5177a2210f9a53877f011bfab

C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui

MD5 9e9916975e6223237662f26ca2319d02
SHA1 eab03a8ab4041574647dc560929f17173b79d258
SHA256 acc7499cee271945e808d7a80b8868218aba02da61f8b501df64fdd2ccc4190d
SHA512 bbdadc106918bb1b6e4aadeba5348bc1a8ebbd79d6aae6b59770fd64dc33b91fb16d04b232908763a017bf69903fb5b5b2d75f55114036b8a386e8e3ec0ed8e5

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui

MD5 2e0087e7a322a3bf1cd0074602c678ba
SHA1 77689c73df3d6b9d86d5ed8b4e82406e6bdc4c73
SHA256 b73be585a0172bab44410f46e89ee35a028ec6b49086b536dea58789a9ee5457
SHA512 39ac300506f333ad94b7fda44afc8c0d15bb06ae05109f67848c6737c50508653763b3038fba1ae8e8fdbae3d40c1ad4d8809419f26dc5e2f15b45519d248edd

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui

MD5 9cb3cc8f4d5dcad24c9b3707e3eafec7
SHA1 9c7f9b49dbbc7ea62b1a1a641ca65e03710c2ea4
SHA256 3e40b0a2ef2e4c5cbc3b0a01fd1ce390cbd8b8f6f898bd42b7f79a354cb3bd23
SHA512 139475739c066a24594a91eff8d07eac14b477607ec46d9495ac587c0674dead1278004776013a66ed5301205f918793036dc370d0e41207ef39314007929894

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui

MD5 ae2a85f17acbcca55a6570d304ded8ee
SHA1 b68aba908f3d226099a8784062a3bdd314459896
SHA256 ae479ee2c288283c18e1f139e9ef21252b637526b5bfea4f5c24b9691c6b4e02
SHA512 7b92637b0d6d686424caf6933591b5079bee8c6837d807bddfbf6db72fdb46944351c05631ac5c64d36e7781f928315362eafdb25608e6b74a0bf9f7e3bf2173

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui

MD5 9974138640c56007c3d2d7e7e31b60f9
SHA1 159ec98236091caed1dabecebd20784b1ff27a41
SHA256 76fc6bef2e094567a8329368e7f4b541b335f3fd72b176b4ee6f0262bdb243e4
SHA512 c99e821bd64f38c498c90bb13e242f3b61400620dd8e14321a843e7f8d5f1b688320bc885f1163b0ef18aaa2387b578118c4aa2d5f7f0e2c7403ec7fe5f28a53

C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui

MD5 9de7d7109e0b17dd619dda12d7c89945
SHA1 200df6f6fbd9ed6cd0ddae888e4bea9724112626
SHA256 5e0ba55b78b0c9df67efb566095b8e118c02e836f90e5c958251a9fe55deb320
SHA512 aa3fcaeb53bd2e50ba0a94e79b0fee94198a3846eb857d0796d97c8bfd387afbb99feb3ef7d1a24e9aa02098204fb6d75a6aebb60b7e9e2257b4762a7986e087

C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui

MD5 d1654ce9211665cd55761b81c3e4f900
SHA1 d907ec79936a081d3c8d97229c2b7f50eab29f55
SHA256 860a51ccfcb1be819f9a7c4c56760ae7de6846f50718112079c7f88afa980dc3
SHA512 41064f33266203068278b5b45e38e259f03599644a605e6cd378a85f94673fdf8a1320ae167d1b014d75fc99ed1e9ffa2753fead5718cfe824a1d838ec2258db

C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui

MD5 ef431a4734ee34d1b921bd835277c4bf
SHA1 b297a886f20e8b2c3bebbca177c215cbd469d8e1
SHA256 eb8fcb950ac6303866dc554008bd336b10f5e88ed0c7e3ba3e56c3c4b8919374
SHA512 da3c1546f8106cf7139684cc3b3fff43fd8dedb182292ed6401904bd790359f960b6a19488adfc587a917ef92add287974f783b4a6292e536c4ab6df86db3167

C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui

MD5 5474792c48d9485fc72474b39fad3b2b
SHA1 67d3d5c2f0ee7dfcf142aaade7b9edb75ae7ace2
SHA256 633123cb1b948476325caf92ed0f86345b92e71b0321f257bb1e43ea081ec3e7
SHA512 17422e546735bffdd4e71250c46d97632c3aaf6e072d8f05642d2a551aab1f50bfa7017f280aa2011b5f9230e54d49a5040aeb081301774091a75b41fbf0d4f5

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui

MD5 66be0dec5328c9ae48ca0f00888af7ba
SHA1 ea011ff02f60fb1dd76d2cffb9cecf4bb251ac79
SHA256 ea04d89d17011d90b086edb45f72e3dfe534fad7625db9bee974010538f0918a
SHA512 bd729a8018f761050a848ff897e1683bad5a477ac410e6fc8189dfc72c78916f708e9226764b56e14e85843b7e72c1f981ee6970a6753589a65f37608d9c182e

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui

MD5 84d44444b0bb2dea3f11eb92ef3fffc0
SHA1 dafc104c4ffc14251bc93dc3249b17846a522790
SHA256 59e9a1e8e66cdceb206d9fa2c0f5ad014cc3d6b6082e031b7c96a21d4f557a6c
SHA512 bf5bca1f126e261f0bee1434949dba807c8dbf0d8ec5bd401ada59d448e10bc8b7cd795c839c1874cb06eae4db2ea8370f96902637c1ae805e44b9a44ffc203d

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui

MD5 4edab48b1f499a51150f46ae829b3a5b
SHA1 640a1a6a4d36b29b481f472e977987e3d21b02b0
SHA256 1e8394e79e810f41793eebb8538eeaf383625127fd11bdc461c3ec34017872aa
SHA512 a80b88423f914c016bd3a4cf56ca0e0f56647066170a3f1018ab8adb4eb270aa735980e4d51bef50cdfdc701c5462c02602d5ae017ae84949b033d2bf91f7df6

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui

MD5 5e830b92aa8f2959ae6ab3d6b8989171
SHA1 78539f8108ce4f25de420cfd2b48712e69d3aab0
SHA256 3721ca7bd3876bf96953a4f8ab47a890262c0d473df828994f31cbb6af8b98ce
SHA512 a72a4c8d332d433ca3293996b05bae0a548beb6a42ecb517b5417e5f07af3afc033e0b1b17f41da3445feffa81ee257ba501d22efe535f978b38482fccd365cd

C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui

MD5 dfcc1988e081107327052b1ce926cefe
SHA1 cff3b2ba233598e029e60429c21b8dde4e4d2b76
SHA256 571e6bdd84a8777468c21b6bf39922c4159b7c2c67d9987be101ac692899513f
SHA512 e3534daa80eba9f2d7f964e10749c69408908aadc46364cfb915108882f07d4e47ac4244ac7b544c82ab648b952ef7eb256d0a3bcda9f03c912d43d7ee90cb9d

C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui

MD5 ba3036eb61eeffda645764cfa130dd55
SHA1 9104e88fd313c954e016398be5a19705bd9dd824
SHA256 f4c444417c3abc5ebe00aff40a66077b93a268a1eb9812cde383b9c833ffaaff
SHA512 d237c2820ebe51eab0130d1297755c9f71855ebe50fcfb94b090fcb7457f38d03de85185e8b212ec18dfd11e6443e97fb5d8615e6e0b38623d21fe60817041a0

C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui

MD5 d548a486427c1f5bf2e6f95447756b4c
SHA1 742b264426ed04e54a96978757c47309195a44d3
SHA256 62eeeb7be298cabf8c484d8b4170cd676581a07c3a6d55e867b1af77a18fccdb
SHA512 ed8e524d9bb0a8393a7228a8fbe8b442eb09cd481d6203988d26df52b31193aa0a2da0b903ccb6e5f372286016e7932a77bd4febdf1b1d4ebcf46e945407d054

C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui

MD5 000155ad486144ec3b763a5f9988d481
SHA1 7752ff0a1b7fcf168fbb32033ecca09d5b62c224
SHA256 3333552d29c9dbc3b0b5c0a09d1fe3bf0d7a47682412d54d67a71a95629c9b53
SHA512 01c8e8fa8badd56892dcb7db6272c94ce2ef9686635416bbca936aac5c54b9fc166c4350c7af555adfcf0f8da82703dd92585ccbabe111eaf02bcaa7169fae0a

C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui

MD5 da3781f9a1a745126e7413a9bbd2d8d2
SHA1 35bef9cc3a49203253ddac10508001dd499e1d0d
SHA256 ccd13acc0f406481cde49037c37795817df6ea794ee4ae9460165d3a06250608
SHA512 104a35e3dee595ab470549f1fc8a91f4cb812845a6bfc6c663597a7ef90328e2763b76a985055f9107297f29983bad4f899ef9b1248a3041d76790e2d88f5616

C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui

MD5 c6608272d0eba2556e35dc754182a736
SHA1 586d7215ef04caf8398d4be8fc4036ba54dbd0ce
SHA256 944a2130d3058c8041b60c08dc9f1eab7264b941b1c3319fc18495675809b1aa
SHA512 cb91ebe50fbcd60250146ff05e9b08aebf5782d524875349102a7a9d5e751aa8aa72190b653e06f20591b86c950fd152798c923541cb484b1ea88a22427bd9dd

C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui

MD5 782307192118333a5053c89bf21f2ba1
SHA1 c365b54c57b0dc5f76f87378b5a39775ff9dbd53
SHA256 2532d3b1c3ef6396475c6ad7b2b178eb1d44533baf3dbcaad4b8051bf9f8da27
SHA512 eded843918b6ae75576144c2f96cad40b61e702846759ef96194c3839deb19b099da326f34df7fddce88a7e40bbcfd879f9b300ec9654c5fc29888d27472f4d8

C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui

MD5 f7e762a35d9ce45849e777bbe08f73e8
SHA1 79c587a96dfb6fe1e2301b2a0f2147b3aabae05a
SHA256 17e75d3c9d257557d080e03b033255918dbc5e2781572ca6b25b5151ad396526
SHA512 6dbe94129680b270ba67117ed06c75b97c318f496eec25bbd8ed16606076ae6750f965acacf0d88257fdbd762672ce4a78551de895bc38275b388b0ed60dfefb

C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui

MD5 edfbbd6242ff73b21a5b8c29da584f32
SHA1 3835f35b125aa0cf35b1581aec9691349b31fd10
SHA256 3aec1367462c0ad0238c141a96369df5f09a6c3e266ea78e430fa9ecf0f1ecec
SHA512 966f4f1b2aa5c16adb1e985ef9e724b9cba492b548d705f065073f6fd29af94eba9896fd57fcc60cafb23148844593e1ee58bd1379133e7da97d1472fa26e5c1

C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui

MD5 a4b9b76cd63ab3e35c97983fe5bd356c
SHA1 2d66b75157f09a1c891aacf6f22bc70b73a00785
SHA256 c956d35d0598f4f6f9dea86700cfd1141f899ca231360c75392fd9088e62820a
SHA512 e0a920915d611a3d2477614259ab336e6bcfd6e14853fba87f4053522c35c85acf8463108d75bcd72ce67f97993c3944cd853287ca567253a7ede7f5254506a0

C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui

MD5 00da42cf54972ae060a0f2cd7ce1f69f
SHA1 74fe331327c1f93e6ce25ff801b6463b8cfefa29
SHA256 4026fb571ce35fb5488b0a5b0f980a1b0a36b0d9f0b0a18645d7fb6d235ef403
SHA512 11ccfb8e021d60db65b6e716fd97e3063376a6b54ac5917141baad1bc4766ebeea9fe4adf6d5974b7a57893bf4b138a4247b2541e2e4874ac01649ef4a2d7a73

C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui

MD5 254fd63cbe365b77af9a46762aebe4c1
SHA1 7f8ef7f2422c6e4e693f2d0016046d526cddda01
SHA256 2550f14bcc83af94e8b457e14228dee9dade93adf12b2e52ec114612595fbbac
SHA512 564fde18c25001d2f5133d26c9473d4edc444726413dc6a39948388daa559244c1aa2f39288e32a1c86edd3f179877789e263d0cc0db7e8a9be4575e5284486b

C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui

MD5 6a0e2b072d71fc38b4138e74db5004ad
SHA1 b3a9dfd80afb98c6bac09bba0db98eb4995f1496
SHA256 391d2a19ffb265ddd52443105f1f0f0123751cc623ba4d9edebeb2f499372220
SHA512 562b69baf6d17dded53bd197c16e0a674634def75f561a066fbdf73ab9a8e69aff3fa35e33053da5d04fbc0581545927c5e15828ee4a40ee22539cb1236f2735

C:\ProgramData\D987.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/4908-19652-0x000000007FDF0000-0x000000007FDF1000-memory.dmp

memory/4908-19651-0x000000007FE50000-0x000000007FE51000-memory.dmp

memory/4908-19650-0x00000000023E0000-0x00000000023F0000-memory.dmp

memory/4908-19649-0x00000000023E0000-0x00000000023F0000-memory.dmp

memory/4908-19648-0x000000007FE70000-0x000000007FE71000-memory.dmp

memory/4908-19682-0x000000007FE30000-0x000000007FE31000-memory.dmp

memory/4908-19681-0x000000007FE10000-0x000000007FE11000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 0d377adcffe5c69b15394dca598919e1
SHA1 b088f957c50052bf353ad58b84393a38baa02fa7
SHA256 5dea2f4d74e94aa7251282810d1f79e92c5bca42d92a22b95ccec8b6dbff14d1
SHA512 afbd0d7e3406c0eef925d07109c3ff0220772f9fcfa6fc9418767284c688f8d25fec9b8204bf7e6af7ea20ee30356ec24799bf5ce9f7efe871c7a5ac99b8e686