Malware Analysis Report

2025-05-05 20:48

Sample ID 250421-hgyv8atxgw
Target ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe
SHA256 ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f
Tags
lockbit braincipher defense_evasion discovery ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f

Threat Level: Known bad

The file ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe was found to be: Known bad.

Malicious Activity Summary

lockbit braincipher defense_evasion discovery ransomware spyware stealer

Rule to detect Lockbit 3.0 ransomware Windows payload

Brain Cipher

Braincipher family

Lockbit family

Renames multiple (7701) files with added filename extension

Renames multiple (7567) files with added filename extension

Deletes itself

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Indicator Removal: File Deletion

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: RenamesItself

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-04-21 06:43

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-04-21 06:43

Reported

2025-04-21 06:45

Platform

win10v2004-20250410-en

Max time kernel

103s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe"

Signatures

Brain Cipher

ransomware braincipher

Braincipher family

braincipher

Renames multiple (7701) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation C:\ProgramData\EF51.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\EF51.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\EF51.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3027557611-1484967174-339164627-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3027557611-1484967174-339164627-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-72.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\5.rsrc C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\LargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\Office365LogoWLockup.scale-140.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vreg\powerview.x-none.msi.16.x-none.vreg.dat.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\fa.pak C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_SadMouth.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\MSFT.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-ae\ui-strings.js.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-100_contrast-high.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyShare.scale-200.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jvisualvm.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\text_2x.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\Doughboy.scale-300.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_listview-hover.svg C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\contacts_permission_ios.gif C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\LargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_scale-125.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\ui-strings.js C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\12.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\install.log C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_opencarat_18.svg C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_radio_unselected_18.svg.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ar-ae\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\FaceReco_Illustration_LRG.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-48_altform-unplated_contrast-white_devicefamily-colorfulunplated.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSplashScreen.scale-400_contrast-black.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\MediumTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessCompare.rdlc.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\check-mark-1x.png.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-left.gif.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ru-RU\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\ui-strings.js.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\EF51.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe

"C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe"

C:\ProgramData\EF51.tmp

"C:\ProgramData\EF51.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\EF51.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 c.pki.goog udp
DE 172.217.16.67:80 c.pki.goog tcp

Files

memory/3888-0-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

memory/3888-1-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

memory/3888-2-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3027557611-1484967174-339164627-1000\desktop.ini

MD5 fb95d15e7f20edb13b9313d369b1ee79
SHA1 bc15bcba1856576bb0354cddb5e436156092fd58
SHA256 a314f9123f15241f4fbea765c1bb8173231a68fa10f043337fe0edc9867c4b1a
SHA512 219ff55d49aa55f87a1745938507da6dec32786a76fa01b530fc9164b4ca0f6dba35f99a95bd62d0bf9010677451fa4584ae57efdd959b81114c58f7857df47a

F:\$RECYCLE.BIN\S-1-5-21-3027557611-1484967174-339164627-1000\EEEEEEEEEEE

MD5 c5be3f716de00f4c17bf736fe835ffe0
SHA1 5d011d2a0e05c4e5bfddfd1b9a76dc0f992c1b0e
SHA256 5145bcbad2eb1f40ba800a13a64bfc5eff0cf11caae222fea07995cc02ad0bc1
SHA512 ff0145dd27f6f4ca7ead4e1ad4ac7e72407c8928c3fa1de6dd1d38f02cd12a4c8f17849e9c7a0c46b83c9d5eb28a6555d8a67efd7d957f6dcfead3d9e3465f2a

C:\jErs0FgGP.README.txt

MD5 f1172d69de35d3e2529b4eed29ee3ef4
SHA1 ab82e7d1d666443d4e9cf644e45e8faccc81d91c
SHA256 15140e9a6ea6dd4a6e5c3a3e52b64c1afd65cbd786a4970aff8aa1b528ebaca2
SHA512 8dab284fe36ea55d76afedeb161389fc520c93d042dd7ea935ecf79826a7edd3b89400ecd9b4ffdbbcf4556abbe323a388ae24ab8b5edad7307664a90ca5851b

memory/3888-8294-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

memory/3888-8293-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

memory/3888-8295-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui

MD5 98e1b359795742953613ce956217bb6b
SHA1 01473759ceabc906b948dd0c29ddb9e83ec0bd18
SHA256 51c1ea3430eacc367205594c717c045f9514120cfa244ec55663d54805d1476f
SHA512 db335cfba0391bf92bca6d5327d4daab42944e263e9fc42685ead5f78f85598aa7db681489c33482e5130c0552f245f7491f27ae83a282b11cf8ca48390615ae

C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui

MD5 61a7324fa00bf94c8334d12530f9a2ca
SHA1 2a870c741404a9c92dc6c4f6d20004772abd7265
SHA256 2e8caf844e11027910d95a4ec3724e18773baa0d01f1e8bc830790765fd93a3a
SHA512 dad63478a5071c8759ee5f46bd3cdd9e94608a2236db043e7c7e46ed03bec44e70dc292a0a3661401453a643a455f0907351c83e9ef492c5771157d0729164fe

C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui

MD5 92a3300d8fa94d33fd608c9a48b847c8
SHA1 0df92be8e0c124cd74455974db0df2d8dc12ef29
SHA256 a75eef8f00aacd8de645da09ad709e7c0220220a95a6c8e2ab6b7d6db7126aa3
SHA512 d443e13aea2d44baecd95b2a4bca48bc7f2fa240476a996ab22fddeefc579b5d18f7ed3331b1c70012ac66477b36cae1a064dcda38ef4b5f4a6df2da058ad42d

C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui

MD5 8d74b8926d5c2b6b60a5c4af8691c49c
SHA1 832a241c6d96d7c330dab48ca94bbe2b1488bfc2
SHA256 d0c60676e2b2c920ce613bc7706e6a6509f5915eeb2f6cee7e32f7c9cdb5737c
SHA512 0bc7ccafdc7a3803128081713030f2b7913f15a58e76d5906e76f2652d7cf5f29f4377d934432632e0761652dd8093b1f148f500b8c708508956cf3222316ef4

C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui

MD5 b68359b6d145cbe483e36bb704d89cf4
SHA1 770d0c801070ad8d521beb7612e1f15241c95359
SHA256 512d5d4087fae20c4da6d2897824f23fb7c56091aec02f094ee204629eab647e
SHA512 2edb671ec2bef4c7d3bc7bd8476bfc6194f6e0cefd6909beb50c024ae550ecae73e6c8c87c038fb778c71676cf43b4916815fd14ab5d570ee281563bd901121d

C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui

MD5 6c3cf99de8d89a69454e8a5bd13a0f19
SHA1 39d92e8b01c24e59732184799c4d66af277b55b3
SHA256 6974097c8b1aaa9c5e4c4f78913231b3b39e10c47fdddf74b470306edaba3ce0
SHA512 b5802a7fde9dc9a8bca21039308b40dec8c1d4737d7b5cb578c74c04daf84fd3f955c526e5220e225ee86a5b66eca0ac3a8a1d854e56c523428274974246cae4

C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui

MD5 46adcb689c4ac521395abafd177ec57e
SHA1 fe7ba56de05e847352100f237538377685eb6f2d
SHA256 db7088fc0b6c0e660715fb600a480c4e6d8e508c97ec6e67e7dfdd26234264ab
SHA512 63081898bd78fc8a84b019bddcf36760f18c751de79e8b141b9ca127dd6f37de9e797830de8d93497f0748ac281e309c4a07f1666f3188df70e218299ef7ac47

C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui

MD5 44e154cc1220a1845ba2814b657ec8d1
SHA1 5542010946b275bd5e4948cef9b5eef06f7cb5f3
SHA256 43df41ea50fd3ac84c4a2132bfdc3bdc81dec2048cd167d37c132f523578d3d4
SHA512 0812cced367a9ed6c63ce2d03ee19e062fe4c11720fb7dcc6e19b8520ad7c8b7a2873d874afa782e207b268b6393f492c131457b71b66ca4ff211dc70b42e14b

C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui

MD5 e99bacaadf4371447140f3d572743445
SHA1 8fcd91b13f435e387ecea92e07af3b640d7c91e8
SHA256 adc53310f1fc80efaefa9efbaa9cf6f45e3d02d83bb52b334b56b223224be8e1
SHA512 9b1cb45ff9290219d3d6697d6fe20bd431235dfffbf6d7c92d9fb4fbf7b70e63802ab008d896997a8011d38a9d18d456c60c518738a073c1a2d75a0a1a9ffeaf

C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui

MD5 ed0934c284ed35ede23b6c3ec5a28703
SHA1 90acf19d1b4b6486d813156de0f5ad7028004dae
SHA256 56ab412d7eb010b4814a3fe07916c523a1676146c3840d3e3f7eaab57a38fb59
SHA512 6ea6f77e844cd6897cfff9aff6abcc1aaf43929fed69177b1fb63df9f4688a6b206d71f20146951ea39a70d1f2a154c1394bf2c871f4a22b06bf4cb4465fb9c6

C:\Program Files\Windows Media Player\uk-UA\wmplayer.exe.mui

MD5 d01f5655fdff7f467b4b69139437952b
SHA1 599055d3fa5bc265a59e4a4e796132ba9da3183c
SHA256 a4a463c137d39bc495003710b15cc6f3dbb7fdd5f29cd31e4992dce001060565
SHA512 125a8172fd65fce473f0f2757844deb79c5505ebd806eaa06b6a983e0f072178951dab1b3bacfa9134146bfc0b01da4360fdf2caee1ab9b02eb6493752b7ed45

C:\Program Files\Windows Media Player\uk-UA\wmlaunch.exe.mui

MD5 36a88469342e601b21cc12f59d3e2d78
SHA1 fe9669a6a88c769f67ed4167664806be6750a180
SHA256 61ddb58a521edaa7efc0a39214ab75bbb9ddcf195701b2da7cc777b2a64decd5
SHA512 526983555001f983a4664c42c0f289b1c82d0389c3bbb499b47860e057fdb08e110f482cd20c999c0e1db7493672b8c223e5785314cb9b765193f5324f2d4491

C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui

MD5 8b88e5f3f24578c70126da276a254b9f
SHA1 4ee759bbdc14a9539dff6f28375140125c5e5f62
SHA256 5af7770d67198f193a60746b5bf9e9ee54f30277b9c45f966530f80ae3f26733
SHA512 b0693b96874a640f1729d597a5fb49478d66088d426ae7d2947e19c51fbc1ee799c1e44004541adef42acf11bba7f3ee8b7e99d5c00f862b3601e6ec2e2dceb6

C:\Program Files\Windows Media Player\uk-UA\wmpnssci.dll.mui

MD5 155d07042f0d3deb73f040d7d09cf1c9
SHA1 0f79f02e39438d914066b26c160f45566cb7bf7f
SHA256 0f859901a14023bb3179a9fb0f3cda9d153fb60bbd539513a916b1133a0aafd1
SHA512 b2b6ee776d2e8a09798e666f80d54ad10a8e2f3feebdeebd13fcd8ede128122063ad6569529f4903648998dcd9e56e41bc8f3fef352a11c09a9ed7eb458cb47e

C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui

MD5 9f2a3b84580ca75264b26dbd70add7c3
SHA1 e64ea8255fd3bf1068b2ea448cda5c53bcae9d14
SHA256 b104244dea820ca2d41bb5a4aa70b891af27988f7fa3f6ee1dbd79d02c2ce58d
SHA512 bce4c4be71d6ee2fc6dda3e55055461b834cf8e14a6ee15632815ca971e4e988947c29c3716f0c61c4f37541bd9b2395b5242d4102454160dbe3a70db160cb95

C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui

MD5 550008cfada46f5a47b56b2f8bca4743
SHA1 8ca50fc1d3dc0c3ce72064cbd28c1d2150b6007e
SHA256 deccff149a65555ec93d50798e67aa39dbac43f748da460bef39c1316a42a000
SHA512 3fd3213da2ad567ad4b5b37e3b6ccf3c69cac7bec92cbedbe6fb3c23d1a763f64544f092349bd988b8bfe0130340baf236e2835358435e387aba8d7319be7aed

C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui

MD5 1c62636828928e5fb4b0de19a55d47b6
SHA1 f803200f97ab81821a9f46d1024a32da202e62e8
SHA256 a20d3cd0bda964e71b4897bfd3ca49f20a2dfee48d4250c0d0c4e32c201e711d
SHA512 013aea1a3149b7657247e1ce901ca5e7fb3056aa7deb2a27cce64f90434dffe1d0d07c94fcd3dfe7cdbea5a73004de56171504759b53133d87634acbc7609a4e

C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui

MD5 f70ff4a6f92a16b80746e96da21dc689
SHA1 cdb2f86f1afe90fe0a05e91748e07261b8ebbd13
SHA256 aaa7e3c99ac90733b371a0a63fd24fb2d814df1a796218d8ac2358f50dca9174
SHA512 8e2439ffd1caea1eb9d7546bb62f5882ab2cb7d313fd33c07e501f583ddf2fa94d8af8051686cf411c5e79e0d56a600f79e0eff9875db1651643ee36284a9822

C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui

MD5 ca760ad71f12d8e4428941cdb13a4838
SHA1 793f5a903ca4d8cfe03aedeed6762bd6486dbffb
SHA256 1ff1d0ee20f0ca7863b7231160a93b96053cb03fb1ddf7e7f9ea6820d77767b6
SHA512 faa618930e0c60429e4adf71eab1d51ff679ff8d38723d1ef16031c1376cf9aab7de950b0284b8365366e20f53d67d5805ca061c6f76897647a7dd92f5b856c6

C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui

MD5 b05cacbd728abce8bf72235cd6cf04bd
SHA1 6d0f2f110872e135a62a5ccf5872c1ab3d1ba462
SHA256 72084a09314409a7f54aa358cb4979916fd1ffa2e5dbee4c6847b24f7e197912
SHA512 51048970aae10d6468b9cc4eb39478bb22653784f6b63d174a0669394d0e2cba46944d7087adcb862746cd652a936be00e74cff772a942304bf28de9cec6a39e

C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui

MD5 ac6774577c71bc9d69a76759bf91cbf3
SHA1 9789ef9692270a564ed7636a7093900f9cf6f61e
SHA256 650468d05be83922ff114ab29c458f8161d5d5314367abad70f0931b7824b54b
SHA512 2c2fac2cee90ec963914e75e8da5ccb897307a4184e42a0002472a2184f23b04e7805482d619943d64c133c646bc807774bd50fb83e41067633c284e88b7ce06

C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui

MD5 58357e33f8fa5df8df40bc8837d1de32
SHA1 8a0509baaffc60398c6176963274732338ea3d65
SHA256 620329e260da03aa37ed2bcc3eecb2aefb63df419a1486ce81847c25f71befae
SHA512 31b6ce800cf743938d3ce6780ed5ad130d31c7e3d7617d9c0371bd8d8bda03d3c93e7e0d2d9b22872bc3fa54baafd7eeb9164be77357887db1dcdf642bca6ba1

C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui

MD5 86c33ad8fa9edc4d0a5d827fbd93cdfa
SHA1 c80320824053fea2d0c5518bf4002cc468aa6538
SHA256 493f1763302ee4bf63d389ea93f1c17cef8c74e24ec370e9eb56165415b5121b
SHA512 213aa157895106ed45943116ea600f4ce56fb98fa2f7a3a80c4b555b0f1298cc8054476faa0771fbca08c2393bd4a48185ebedda93466c1ddbfbaee9e11683f1

C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui

MD5 cd9c580fe471b8a713c7c645c9c061d3
SHA1 01d3bf03458e58c9a643705d5ab202f642bc6e0b
SHA256 1d4a67a1a2cdf635e7b45e8a7fd8592f7dc77d7ab4fec150d700c362b9e1adcb
SHA512 9d5dd2540988a9f10260392038948f6fbc5f775715d2fe63e7dc93d20f911bd4eb8c47560578179b4160bf9e4d422586ca942f794048338454b6b1b012e2eda4

C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui

MD5 435cf5a7b172a032dcf5c6744177cfb9
SHA1 8c5916d21c756e2cf69601dd5d4bc1a8aba09a60
SHA256 4cdc719574e663b2a06339bdbde22eeea4351de1fefc06e9576fac0c1b55b948
SHA512 fb8d7a0bf44896e4f7ff51025e1260f2c692afe89018b1fcaf8cd8c926d4e864458f4cfa315e23b7ed2e188f34f960c0e49311520f4ea8acf8b6bc2653f442ae

C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui

MD5 a7a96562c1afcff344485b8e4e3311d4
SHA1 ed5ed70e22b562c18f9f9125826b99322fb183f1
SHA256 86cac36e7619521cc904716dd7325fdc88bba06828337eb34bd3098017bb64a8
SHA512 cc0bd183eeccd548fb816f4050c227afa302513abd8a2b82d2e269f0f568fffbe98650af1650c51df5448b77642565941744e10c771a9590e31a18e2d51ebfc1

C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui

MD5 8fc5e53983088cec90abbee51c28b3c2
SHA1 ecdb4d5b2eb7969ce5d6e355ae5a254c53ff7832
SHA256 6cb12c67726bf200feb33044184b22db4ca0d936dc6faaa8f83d651f59299e89
SHA512 fd35ce28a4ec2585c8d4f2cf3d2124f7a741faf61dd1803e27338f9de1df43eedc52af70549c6d5b93413067db0589ce66f78add69c4999f3b6ac9a4985399e1

C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui

MD5 6c0a0a154154b7de7f05cb2e3c26ec6d
SHA1 4e33e54eaabc723a042a616957e3c0307c7c8eb6
SHA256 b343940a898835e8013817e56f217c654a13caed255e6c5433b1f05e673056a0
SHA512 fa53b5d73f3aeab411a3ee9c211d1836eea664b1664207dbd95de7224de308c82cc497869a0c182336e8371484e6f9ec2a8b44e8042031d6888458a3dc91a23d

C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui

MD5 ec257b92080daa17512a6bb42b07fded
SHA1 d9263d9b29af2de281af084c0a1dba8316e15aac
SHA256 56b1313eb281ff50b6ff5204e058e4e9e7601ef99cfab6a0412ea192ed25b6ad
SHA512 376feea4e12a7d6e2579f5391fb4190676e39d1baf18dbc84e392fb6259fcb79f12fb170c33d850ec140d36d752918a11ba6c9c7ce1f7afc9bc44973a7582b38

C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui

MD5 113f386faa265d55874a8acee7946ab8
SHA1 2f1b4ff1d5930a4df8a9f736a0f9ad04e6343d72
SHA256 76bb27e3c17272146d43d2c8bd98884005e2c079f3df42dcaab071965c7e9acc
SHA512 61ad62e8191e5d97e34d0e9fed40627794d9360e4d4d1d769c355fb37e3d8392f69c1bcf2e786e6c018120fdedf24115049e8e01069b87d221c30361be11bcdd

C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui

MD5 88292696080b242cab170925dbbbe275
SHA1 a8625fdd45d7c780ddaace8df537fc826cc011fb
SHA256 709972fd4a113307cd16f4c881f03d4b027b3806f72d7773683e37111ba6a254
SHA512 9c66321c4313c90c374532a677234d27368e19f4015d184c4d7e005a2ff18f1f61b00789403a9cf999becee64502a1a129cf265016b1b55c795635a02909f88f

C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui

MD5 99a4a2919bc8619d55d4c7b7e1e92b95
SHA1 fd8589ecb8f57650114c59cd8b2b388201f9ce2b
SHA256 22b7eec0f30f6996578a92cfefa0d7acb763dcc91a03586720e3da7c6081d88e
SHA512 94de6f066007370f5412bc1b02171349323f00f5dd0b4a8b00b44f0f3ec4462230b8af0b5df68b2d805b9b9deb635376a9ca26da1417c207d283bb69ea40322f

C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui

MD5 16ffceccfa45782506157fcaf0b1ddb0
SHA1 3b806f2263d4a74fa3d2c65d2030afe7471c7a92
SHA256 9a7d8da267af723cadbb38c2f7881c97f816e27a3529a01607da02210ffea00c
SHA512 6951eb78f1896dab979bfdd2296b020363bb5987926055ba131b1ffcdde898308477bee0ac1ab98ebc7b1f2c181b3b7202c43f655357ef640931d48f3a61fa44

C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui

MD5 244dad96d1cf47535302a40a60c44028
SHA1 07b6290176189123200d589c577245f9cf9cffc5
SHA256 1be7f7e72d39a48f2ae0afb172ab137328d54ac56241e7dcb9ce18f48d5ca880
SHA512 97d475b114ddefd0b320f9adc3fefbeba8e7cfc582d2321569790228e87e93604089afb2b3bb1054f465d70c735ee10a47b6c5eb0829ce7a83dcb227a456475a

C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui

MD5 de41cd91451831cf2ae3d90c14361241
SHA1 cad88344fa61aa12cafb3bb6a414dc2c19518861
SHA256 05e56b76d55818bde0c05d422e3e20db47b07a84105a539fbbee4c827dbcf073
SHA512 8edd1fbf42287e186e23b45b0eb9008f249dcf3ca25c39f067085a7cc1b4f6797ea6535bb690ad7bd984e9d1695579df9e3d0301af21b022cba3f77e13e405f4

C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui

MD5 03482763cfec37a71d68955046a7baf6
SHA1 92d5be933c57d5b60830f459291c9cb314aac4a9
SHA256 55087190603ac2715d1d1e4787514402aa335c3ad007855566b0968674438630
SHA512 2f8f3e29765eea7acf2886cd11b4120036fc748df174cc4cfdf166f06834350cd7846d07134a060eeb07f7d55f6335f81e4274a89dc0f3d76ae92498e5c11b2f

C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui

MD5 c64bed76966e40baba2765064641932c
SHA1 d560eba3f51bdbbd08b232b95ff72afb2ce5d4e8
SHA256 2572a31a1055092cf7b1d502329b9b9c5e5827d0c712e9f2fdef9d39545efe0a
SHA512 ac84bbe4784175f4472d7b077764dc957de3476673eb2072d2f394d1b162f74416346769629d2e1f00bfffa02ffce89d822245b17c328e101ef319b4f1b11c03

C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui

MD5 006122c99f10dbee1c5b5d2eb17f91c5
SHA1 40e9338bcfecba2291c2b8f525e0e645cd7de0a9
SHA256 fe39faa3a02ad9849dad941f84159ebea056586c090aa8b36c41351515deefe6
SHA512 20c20de29cf256faf8b15a97a8a57cb1f04f73e3b2408c9148a21669bde899d45ad701dd43978f4d5922a9b324b5c981bebe7d5a831abad32d998013e17da72d

C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui

MD5 be01511a67c21edd5cce8c8b3356aa68
SHA1 e4ace9be8ced6933c2d2e613e4128e0059547d73
SHA256 ca1ac03c91fab93db6ca941aa9c02c9879a6175039ba2ee050f8d975e5b77f23
SHA512 3926b45aafac798b1c5a3591cedad1eddd5d9e54f8083bf8f8677f63f349978fa918ecbcc63fb759d42541792d1bfacbc924c84187c2a4023e7669a27069fc29

C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui

MD5 74e97ca0754f8e54150b0a849091f9ff
SHA1 ea91add1bb5387882adfdfbe90a0b9046be50ef1
SHA256 18e2a65cc9d94129d0b6830a515771fe0ad01d07208bd72682c742ab739bb38b
SHA512 01b86e56e1668b68eb87e5ce2d3d667b3a50f37ced47b9ed1cbd21732c5b39cf0ad7e583413663bd4268c038377c879d9761eeb209def8712b6e4c435cffb32d

C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui

MD5 7d3a23fbb14b00e04358700c9f33e208
SHA1 ab00c14a53448b9b5f1551296430ff8016c78e3c
SHA256 5522936d90a1086022e2d351d3f1b8d3951f968f8dabfb3ab15eaff69ae63c78
SHA512 dbe670a996aedb8ff706989c62d290bdda7daa95f3f508e774fd0af856563ee3b10c19436cbdc1ffd0bb2b2f3bb7dd5c9879093f843d55eab778d4d85fcf6fb2

C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui

MD5 1262de261993b4ec204a5eec00751c6b
SHA1 b586645ef4778ba9a53ab0d2c12b86f7bece1c1c
SHA256 266660f72964014a8dc5d9ecabf7ee192cacc16953fe155b4bc3b9ed5951c050
SHA512 9400499c3af5365989830a52f3b0300ab3780c91343dd2e3150211b5047be422bbeaf245faf9402f001c594a56a9b634ac1ff030a5a5b0f2e04c63f103c96d67

C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui

MD5 8cbf7a58f0cebe5c1a973bce27da9813
SHA1 39db7065757bae16ddab5c5e0911c9242c4addfd
SHA256 b4e7fe1c145a9e130a1d04eb2289c547bddda20967268dcca41ecd9b67b8d743
SHA512 fb89b158866442e0e95bd9a98358c242a6d95191cea7367e93ffab20f1933dc3a4e5a3cc4741e11a736fbb806713b7b2791283afcacf1bca911a2d6ca7392e39

C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui

MD5 8d6d3443c374ffb4cf05d59c0d939846
SHA1 9e3a2e76ce534e05e51b72a04573ab0037e4a227
SHA256 17520446712dc08114bbe2fd97c8aafb1f0eeb2e7d4ac49bba29d764b49c610a
SHA512 767a6bf2d29f85ed0a1c074c7f596775fa492e6e72b414d03effc4960860cf20b9f352ca07ec0627299b24f12deaf3952a4329cbd978d26b77244968827a2080

C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui

MD5 2f1520cba9b4b35b94cc8c1be6d4afbd
SHA1 8fa5a19d5aa701cddb51cd505daad8b65cfda622
SHA256 2598f6bc95e384e512f68f313f31bf6f9e062a48403dd5ad48ecf5c3e003c464
SHA512 773960ee40cc405e556ef4c1a8b616483a619464c1313eb0de65ab1df2aaf46ff0249ad24cea5b27a12551591bfcfe57292900f9dfe22d6068a1aca0d0073faf

C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui

MD5 541b99db5fecf86e037fcd9dd478dc7b
SHA1 f6965e435bd7f05fecdd7d98ea7cfb55d30e3788
SHA256 71fa097fc9287eea4c3ab89c807b8d307a2440f97224b277f244c118c9b2b6b3
SHA512 a6711df346efda0e19aa25042cb133988770eaf062d09b4647a8a5bdf1bb20bdb43324b35792217847e8317b188d3a0f956105557a04c39bbc811d008d6f180f

C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui

MD5 04b17833d47e7605a3bdf37e2b576f2c
SHA1 5c0db730802e9a1230badf39f8f1175bd3933c11
SHA256 65764f790aade279ec6107a43f68122b58a6a44567941d121663438178a5ceea
SHA512 2509dad38f7e46ee283a87bdfb24a4f69fa7d47c6110c40fb091353f52d4da1dbf9b33ad8d15890eb30d50fa21cb3af47df66fa57ad86c577e84276fbf2db8cb

C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui

MD5 342c0fa7b0161130cbd8d65b714b2f76
SHA1 c389f59c6ed76ddad42c8733b49ae30209acccc9
SHA256 b7d895870957b1af8e868e4badea746247fb2d2f3cbae21b81ce88e03c657d23
SHA512 4f1bcf0c0e6b5231c119da674dfb239fab4219151c2397947c5c07e46fd4ba79a317957225c508e3f0befe60445603684b47586fdd4466505d45aa1ee8601ca9

C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui

MD5 bb0d0df5b1b3d63fe9fb1799636ac873
SHA1 09187a9221a357f3d7d85ee2a71fdb1d1b78d95f
SHA256 670b76bf8fcc87746ef61953e2b577b192ee8591d5f046bff93477b98a9baa3c
SHA512 9b02ea4d0635afee41feead5cfb9b56e8961f05b5ab08228fc286c4f864a31dfa81ce26ee547982e94e005e7def78821e97df78cef60b027111ade994625d286

C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui

MD5 77701d031de846db6fe6ce74f2801f9e
SHA1 34c047d1568fb48912391803a2694d3f25fc33d6
SHA256 60123fb433eb327ac8edc40ef4d181cef306612e0a1cbc946868694104e9415d
SHA512 83a8d16d101187d24723f229e5470aeeb7af8c2c683db8fcb28395905bb0241f65301ff4faefbfc402f625dd7f38b90eac9dec2aa1eb3b17165c657de394ce7e

C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui

MD5 d28ee7e419f56777a145429c9899e7e5
SHA1 7249f78932922c8d5d21d119e5ec605dc2cf14ff
SHA256 e3f62af882892e39fc369abd176321b11dc46c2a0dc499ac89c6ba3e36256a5f
SHA512 6df727c5b475fc71a710504c1d96c52980843eded8c6b6ced020aae03cedda7edf80b4f1c8f74ec3e1f1e68148ebcbaefb7b6589e805c5df5df7e91774fab07b

C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui

MD5 255dfca2a1068f9b641eaf8fd43c86ab
SHA1 13c5acaaffdbdaa3462c7d42de272849b35b9dc7
SHA256 8f73fd6e9d64711ebf7eb85ce698b34db6d69ac58a5ab4565c29839b221156ac
SHA512 4c9600713b7b96ac15caec2b924fae6f0d85daa8eeb5ff994d6cfad3ea040d286102caf5543453ded056b08982669e66a76b475e04169dfe59655f8c9cfdb48e

C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui

MD5 e44a9d5af18fa2e1a54c0cf1ddb16791
SHA1 08a0486d0e3a99741e56cab55b285bc5f854b8c9
SHA256 304db1ffd0ff38764d8b5a5989ba17d3f3c138cb64e1450cfa6d81236f0f022e
SHA512 09af13f1e60d285031accca9564929678cc259a58f30402d637f2ae3463fb6e43bba04b38639e5d770278f733bd944d9b67aa8f7f460b2bca341c2eedbc275ef

C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui

MD5 3c3172ba3afeaf6f3c8f6a77ddbe1617
SHA1 971f9181c5567da1bc2253b099ceda55eb192ca5
SHA256 eb1a6e058d322ac1368d1cf95dc006229f0ddf379bc82f2a945df2296e92b214
SHA512 95889d464315bb14c9b3554a86df25f906cd28aa2d9a6ddd1f135ffa9f31943ac7a4255240850fe7715de7be674877971ee29d4d902e7a3758238c2ab3542c54

C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui

MD5 3f2ad788c47d0450139c255fdc6da745
SHA1 6f7524e108fd99e355b8dc447f98c2d22c29d8f2
SHA256 f77b730cee893e34bbd908fc4a6d3e8a20c4c6f2bd19f7191ca51a4f55495416
SHA512 b7ad525216383e4929d62e5d991ad8cd731df25c29b1ab80216f658797d5fa2018dd91100762adf0ce9630d1c09f95cb2f368a42fc8195bdcdee398f62a2f108

C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui

MD5 3466ed72c6ea6f8fd8043f4a61b7e46a
SHA1 d4e28ec912adcaa754f2240c350edf129204b71d
SHA256 9149f29a19c11efdc0e3f79c6d4da2cfce2042ecea58c13b4ab304e112e9d560
SHA512 04db44e1265995e7206518416fa5573bf2052586be27d3093733fa0133349337770acfded9287b8cb78b2998e8152f5181fc6ffb0112fadd8564702e9b60aaac

C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui

MD5 d915a9636eab2a6b55cb5d3329c40293
SHA1 6c4411337526b7f61870b15ecb94d6cc93b13b6f
SHA256 666c8ef904b9f9db41069ae1cd98bdbd84db71e694a7f5056bd3606e70d68332
SHA512 803bfb0e02c2c90bcca2588437c8b318ecfbcffa9a56555bc5f582823ea92813cd0e92a37a8bafe73c2cc0bfc2c4d24229fc4cbbf7637c312324961961196fbd

C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui

MD5 301aa2363d56998ba711282b7077e177
SHA1 ec952e467b45f967c279cf69b081e1214acec5e2
SHA256 502e9b6e84d07ef9bf2644848cfafe34c6698823a9a219e47e3a7e9493ffb929
SHA512 459f745a96dff2f1a8ebaf505265c3e3bb63bad4a9e20729fd4afe8431af2775c8e2eb620590769c13d1ae001eab31192a13d09562e445d967abfe4069e0792e

C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui

MD5 f2f1c2e3bc811a5cfd1aaf98cda152be
SHA1 ea1e26439f3edf985a1e0503e9024889abe83b94
SHA256 4dc16867f1d6d30c7a960e67e3ad9249744d1b78e09a31cd8b1ff57379da5e20
SHA512 3561f9165e84f7c0298e1362571da7f4e70dcb1f7b3cbab76e8a98c3e0cb24175be0d917e550be2b3577c09add31bd8736c4ec52bb9f684134558bf3bdbd7c85

C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui

MD5 74e4665a78fee8fe25a47cbd059b960f
SHA1 9f8a3c541a17ef1642946e6b4d47b24c32261ae1
SHA256 e4237e2db25bc1e28363f2b3ba66428733a57c22b071286d31efe76ec8fd1d10
SHA512 5d7f2bf904c28f14cfa809c6b14810097ad7fc399a2c0de900927b9ada2b10ab38820943831e72bd8ae3a6724ad793cad86e7462c356c5734a8cfcec8e88a2e0

C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui

MD5 cb07d70a9529d3fedc9030b532497cb4
SHA1 7eb194179745dcbd2459e8126197a5ebb8ceeaab
SHA256 002bd3b29a5803e8a84ddb6de3333b4a4c59473e8539594552a5b55a965b2012
SHA512 0dc88bf1d52ab45dcd8836b96cbd7a6bb9463b281f0c87ae2b2a657d732354e8f2b32047aa540cd00e4c8803eca87743c073c70fab78a1e7ee03013e6e4b426a

C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui

MD5 ddc23d77cb6ebedb32eef8a9c1080d11
SHA1 642f1287079ac577be724cacff6e4221c7f0a239
SHA256 efffa4f31bf2e685fe02a9dfc1b80e27ff2c116657967c02ec1304988b9f943f
SHA512 915d9f84d570379e94403f0db39fd6cfa27caea90d909ef72cd1f4e780dc1983865574349bc28a78cccc97d7e35e05f91065d17ee29ef2554e22586105311af5

C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui

MD5 ffd2b037102c825f6bbcc031e856953c
SHA1 757aa798248ed5d700fc4da2a7b7d5a12a93494a
SHA256 9603e75caead0a75bb9e097bae187c0db8648269d617b66a18dc41e5f07054d7
SHA512 382197480cf01374e8367bc6c41f02b04d719c407b39ddfe427ba0c8f2eebb6c370ccb55c6185d2682d58bc97305cea78e760a88a13728cf843088a4e8eaf7cb

C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui

MD5 3c7f6a9965a0463a76af3aa90995e716
SHA1 ccf7f6b58afb2963cff8aababb13f1fefbd18e80
SHA256 1941b0b6412d7cb9a1b88817d670062f9a40506a44945b9e2ca05cc6b0421a24
SHA512 45a60d372a0274ec4740ca144846aab903bd9c074e3a336c7856afdb6effefd69fd8eca1f10a339578cd1f83e1af985e611d2e6147a0e2cc392e8ceb8d1d9ce9

C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui

MD5 330c0230fc205fade56c29997ab8451b
SHA1 dd40e3fed1bbcfffe2382a236895c928c89bccdd
SHA256 8d073828b243a157c709152d08398227f9685e9ce8e2634973d390b690ba020d
SHA512 1a08f426deea83e80fabd5e21934a8b5aa67f91ba105503d4d4addfec05ba2157edcc7d86df9616741fbd350fe270ddc94ed617a31f7a115068bda7e4d2d05d7

C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui

MD5 c942a113a2de6fa1dc4ef1c78190e9c5
SHA1 61a637b4a85ac377bc1795d9526b063264edd5f1
SHA256 43bce340ce39ba31a59a1022842892e9286b439fe222edea578563ae879a352e
SHA512 05c41ebc7ddef327356e308895b45b8d3b5e01f1bc75d4104581e76d3536dd0db941f41eff092ada1a3e4f76637e1948055a674be17f3aa359132c7af52d8471

C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui

MD5 6122e644ea814f56b372dc3f3c857da9
SHA1 c93e817fe85c1bbae13f756ccb81063ae4eebb02
SHA256 bfd695ca8148b62c44d57d1eb8800eba0c98f79ff1bab423e61b86c6f84d377c
SHA512 d1fd9ba406ff7d73aa671c1387312889287b04e51efaf120f8610c0eb1f89fcf8d571994693fcb24ce1afa3e2bd35e8287a30a24ffcc78957a38f6510abc7e02

C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui

MD5 d2866025e7a9dd4f6a24953ea019a9a4
SHA1 0c892b3d4cac942654a8e92098d736f66d2f79ec
SHA256 51496134058519f32cb037a7f617e0af47f3cfab34aecece0e789918802541a3
SHA512 86505360adc92a1e26ea5d721eb524ddb73d2141ae5b4aa170d799f6de2bc1a3777c4fa8ed2dd3510bbadefa5d9660a8f8bc845c527f06281d48534ae320eb66

C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui

MD5 e6d5e0a068dc4b0f22d60f2292b2cf15
SHA1 47cd8bfa293d7194369859ed116f266c7f5fea97
SHA256 119e71a0505b3b667deb4ce63880d5722ee8ce2bfadd07a6cf3b53e635621c03
SHA512 17eaa0276677c5f211968d1266d2ede5f7c0d24b0e3459a09f79d02428fcec4ec7bb755b16b11a443c3595eaf09a614409b8cbd8d5f5736b44da87a5b7a9a3ac

C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui

MD5 6735a01cfdcbd80230a648ea2f29f2d3
SHA1 d87afbabbf09e9346b5a3bf481e3c55c4f9d0ea9
SHA256 2b1f096d2c59aa5fa3a11feee748b1b8f08be5cb5221982b25620e88a515a62e
SHA512 27d25eff31c3b1571c650921bbed6c4d78e08c0e14aa5be066d9bf5f6f576490ba0118e2983758ebb524b309e44259b0f89adeda908a88c897bff151843dd4b0

C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui

MD5 adc0cb1f1877cff5ecf6446d0fbf594f
SHA1 a7c764474f6b94900a15922f772bcea66dcab212
SHA256 637b174a62a63ab21e53008efc35e75b088a7a9fda85df7065400eba660d16a4
SHA512 7c98c43a38263a63fca968e4f7b6a24ab5daa1319bfc544976acac71e2026f35f59b8d612ab6f2e70a29d7ce2d05b77e60ad8a33448ef7086296f98aea0bea9e

C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui

MD5 d385a75807b167314b3f2a6f4cd2ff69
SHA1 2cf5378f68cb756b3019989de3f7ead549b93ec2
SHA256 e9c12859321aab1ce882e9bd9beaf08af2cdd8c0568a93f3502400d06f910f10
SHA512 dbe8295bbeaeedeadd45a5e4b16361253f17039e66423525f5c3c43afd3d512c3d1650f140420fe6db61cf880622a8018a8cddabb966281dc2854af8b8675015

C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui

MD5 2837cd8e618e9811a61c11c73a44594f
SHA1 a30c16bbef39f53623598462d4a21da513c0da4e
SHA256 862c1b81d3129ddb7c6a756b43018b4ce0b2f658a3ba8d433649698c46b8c925
SHA512 a31c2e2f0730ceb48c4c3a3f2d59cec2ccc6b743c330a63afe09838cdfe2cc646749f16404cb6562de7c28a80ec04d0c14fc2badb28e1897d0b539813afe87fb

C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui

MD5 c1d3d79fd6fcbfa4b4c23b0885922e4e
SHA1 a0db88c8f39f6614bc09479b10c5c44fbdf11b39
SHA256 fa2522f9d394566b529416c41d149a478fa8bf82f1805d736140fdf945d51fc6
SHA512 1ae48bd8fd1aada9d0324eba209a0e3b3a827e92c01074f414f2bdb9136073277ac2525549d7f8ddca823b4c69bb8127c1760e7922b06852b941a712214962ce

C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui

MD5 0457862788a35ec747d46207aafb3d6b
SHA1 52c727d3c7157e71a8281004ee9b49347abf423d
SHA256 5746229423a80f2327eaad5aa2e3d94af32ba41ea8e1d760db83ef2d22a423dc
SHA512 3fc9eb54b072a3afb55cb12ddd0c3f3649624ca0acf1115c0bdc852d5af8418518535b32294caf27be6fbda8e425d85c889e2f358b8db06cdc6d14a1eb60a3ab

C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui

MD5 fa0582605bd507717436a6db73f48d43
SHA1 8f5b76b6085d2525d8237925da7c2f513276ad46
SHA256 9779f1041169248a064ee1a71e9f826718e654743169adf4658b9169f79e1729
SHA512 aaa778d7474e79c46ffe8ddef2bfe79bf8a3514a8660ac23ad95654c4bfa6e78565684e4e6060edf08bb70bd816ef8cbf73dbaf90e57757724152923dd19dcad

C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui

MD5 20153e2e84aaf34ee750bd8268331954
SHA1 48fe3108f4495cc0a6d0e59d2e02ea893a9b5161
SHA256 f67a536670c55e20f07c0db387e16a43e3ed7802fea87db08f37adf7dd2089cd
SHA512 7c5a9991ad759d50807e192edc128baae0b021ba41913c58edea390ed7252db0221089f9da27699f0a235eff32b3572a4a6402ebff8e97fbd4bd4519d4d844c4

C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui

MD5 2971dde485413b7066c38965924928dd
SHA1 9b51fa985e5e8cf9934f973050572d04cdd422ac
SHA256 4a54ca1a18319305c333f211d679cad99722025ce45802d6001d23723ff24144
SHA512 d423ea3a3f62e09ba924a73dbf85495f21e1a59514679f5ab8c76f71402f2b42a1f366264ba8ca9146cebfb5c12f35c5be867c0826cb2d1d1281cc9fde6dfb45

C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui

MD5 e99c3c90b51df2ecfd4ae481f87f89a9
SHA1 b23cfc817e97ab941f25ac018033a04dc8dfe816
SHA256 431a7c355942aa5d30471e23f85a3e93c4aea4445e67eba7950fcd2d86fa8f0e
SHA512 142a00b81070111eada8911f7c57e63a7b139cbd98861dc79cef87c1f88d5f0c630e3ba1487e16acd90cbf1dd98dc2a8ffc80fb414fb923271ba1fb71b7ebf70

C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui

MD5 f2a4eac0db61f9cee90093d0e7f0f1cf
SHA1 20d060300db46de33895ffb623844e362bca50c6
SHA256 0e094aff02d1dbfa61cbb8fcff5aa771b7d5ee24f237477a4eea1e67ea7439c4
SHA512 a9e3bec228995289c027e6e67f865ba2187e8ca54f8e70a48e6133b817c48544dfe940d6366f91e0f10b9966a278643153606a36aa190678f3b8a423f90b90fd

C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui

MD5 e2b7c45e8e5f88f4869ab53d51dafa63
SHA1 4eea2335991d1d9cff1f176c04d3c4ca90f22fde
SHA256 c6dc7cdd9b13a3d6d41663be9e395e2b0c1f8e3897f78f83b9d385064c322f75
SHA512 4374b6e99469c2deede86d3e4fae61f52a986d61fdd861f3ca8278c25dfb2c6ef4fa15249209862be1f19a7ec77639108a690784d0ec2d20a3945441424ffa64

C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui

MD5 04733f776483165590435e55f8c78532
SHA1 bded3417057557ccdc7dcf50a12b94f1723464a7
SHA256 cc963a57d44a779c15fd1eabff0b0c1d68da23b3844484d7fc286620a7122b40
SHA512 17b1e569118ec5149b6a3531e40bee444706b5b564488e85f359901d779d0a1e2b89a2e9ab25eee1341cefb36152e1eb769439536f76774d27b044d566ad942e

C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui

MD5 1e8299d44934ba64db7fafec1210e635
SHA1 650ea2f578abe634545c2d98c80c62e6699605cc
SHA256 b560024bcd07aec6258558bd718ec01b1c0971926ebb03912c57b56e3f590c66
SHA512 4686a6cc5471e43cc2dbbe49f53733ce737c8562065957dd55b21c09bab24bd9940925f1e6f72d301fba65e0e5274b49bfaee81c8fbd604b26779b5ce7edfb1b

C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui

MD5 00f423e1d83b0bfd2680b533f1092c50
SHA1 22d9fff9a367a42be50387674588ffb8ce468fad
SHA256 acfd393ee9c9e725910b421c4dfad7a28ababdf32d2db76275c3ee4744aa7f71
SHA512 0582f288d45ab580d7fe81ffca5a59a191bc8c82b3bd1f3cb944ef5e45824b12b9d1109eecab659199e004ee3458f950708da0afaac301ab19b74751c0a6efbd

C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui

MD5 ac195c0616371b782a9c177a5eb12fa9
SHA1 4e57e9cb6d7d70cd2e784ad4f6f55772c4890f51
SHA256 da7727bf6acdcc8ed8d046bdf0c94f794d66e9da7e25ee2de9be89f176aa7dd1
SHA512 7fc4251560fea872acf29cd8d98fd747b1b814d18bb571728a69a4eac7f3ac8da0e3691172cc0c9b5bbaeb5fa22b11f6974d6b07c2ec5ded098b07a9a723d7bf

C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui

MD5 d2cddc1b9e4bd32c2a096115a1a606b8
SHA1 8fee38fc24de642e34124a650c81d51f4216bceb
SHA256 ff102c24b2f3da7464f289d4802ba1903140754f27fd67225ff67d953ee66f01
SHA512 ad6104fb132dba183f3d0809c9491518f5b1f5e3871ae0cea45e193b626bb7ffccfb82823d2ce2fea2c08d8a268a6486281da04666e23e4009018cf5a94bbdd8

C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui

MD5 e36e82de7d163ff279513736cfc68da8
SHA1 294a73ddfae68a0dd85f8e174e8ff3c550808ccf
SHA256 e988e14f6e4775e417678994630d27500609c4bc2dc513cf30d37470427f3016
SHA512 89edbfbaa20d6592d6675544f505e7c64ba3bc211609c8cd165a50edec8dfea698e1625b366c34bcb7f0acf224da20dabf8f3be3ec871768dfb33cb46f2c1e22

C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui

MD5 7ec6a9979df8713c5fa3d44ba6865d01
SHA1 7e8ee9234eb7f8db9773e941b47bde99e67433cc
SHA256 8fe4e570b8959c0b027c5da946dd3d5f9e1e9ee9bcbad99b684a9c272cbf8b2c
SHA512 90858eec868784e4a7a878e280596786076d1c67c1351d7136b54c14b5b857e3494873677fc08193a49f629db201d80aa7726de894dc9927b70cd43cef35a6db

C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui

MD5 895da763c2b248c2e9f1bf2171ac46cc
SHA1 ec05cd374f55a8a9ed390573079c1dc40e34b86f
SHA256 f7063d3dc36a43dbc118a6d6c0601bf53b24a45e1a2aefca6b5e0db7d3e15321
SHA512 2968ed0c788b7ef8ceea1497aa30bd60195b84800c35939f9371c2f17b4a13221400d44b886c34c2f1fb2f080b973215b7df1256aa604119ee93279339197303

C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui

MD5 e5d3f57ee08d27e31e8754e7b77efd74
SHA1 6d8f7b4e8213819266b01c7b47d6c40895bba26c
SHA256 a8c5cdfa16e406d455d720b8e19b347dd734f815ce9762152db0a15f0824f464
SHA512 55d911372685fb5ad47f09efefe8caf1e8bcd2826279bfa55834081ed0b06e3a96caaea118912c8c2e114890bb56bc9777cdf5975d98daef3c84d50733e25bb6

C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui

MD5 7c4cc0ff26428c3fb5c7e8e9a7a3b637
SHA1 cabe31a688479d09bfeb84be393635139a07d2cb
SHA256 fd4e7e3ab1911c312ef11016283a53e68d5a0bacd6c80bcb71e260a00236acd4
SHA512 679e63108e503012d4c17469241d7cb6838e1a24614caeae6c653eb84c35ece69bc1dde17643047d4599133772f87b8f57d3fb4025556cc26f071cd9ada2705f

C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui

MD5 e7bc365ca610dc9e042f450bc94ec436
SHA1 9ba62240c83c4f48eb9440b2c1d81495c1ee4c1b
SHA256 77811746ce24da1588b42f2b0c18f8266d5eafba0733d3249f526a84dae5f6c5
SHA512 e8fe29dfa879dafe374a8a5c7f4c03761e56c4e40972674799586e9f1776f1557e7a07711d984eaa9223a31bf5d5baa6943ece06a3332168ecfef58c73da9db3

C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui

MD5 10cbb11996ffe57bbc0c89aa08a763b4
SHA1 afe5d1296fac27438b78fb3f0588190faa708b86
SHA256 c53d36ce9395306c53924415624a4243fe5e75465fd58d490f61e7ab5945b3b5
SHA512 ab3eb4b79a821d2a293c1b564fe4b1def90e8ebea8c62abbde4dbd928e5391651073b1af8fc3a9264b7bfe45f6db9afe91499db8af45b2712845a3ae2ec466f3

C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui

MD5 4ae25236d31fc55d29df2b465f8783bf
SHA1 b7af4813998f8933a981cd14f64e07ff79bc46ce
SHA256 9f85ab32db8b988439bebb0ab0e7a4d5c59b695cfc1069c19e9b0fd2ec5d669c
SHA512 137db6128873688b3f3ac293601bace1352b52442fa87e11996a9a1f4096dda119e0c66d0c8b9686ea74d5b4bebaec9acf68e4a14e36bee6a705169c36928ecb

C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui

MD5 9d323254d7dfdf46fbc731bac47a5a0c
SHA1 15e20992e21ff630f685df74b7d5c2efb65b7bb9
SHA256 2c1a5723b3c43f812d1628500aaf5ffdd64c67c881b47ec4e2f98247892ebad7
SHA512 22c92b9e01149a0cf02005056a90a9d5865b2aba09e4f3b8b2c3706bb2df2a25bff2e39830f7bd10d7ce1a75115745abad44ad7757c9f2c7813f62f32950e128

C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui

MD5 99589ebe5a9244b6614110a6450ec181
SHA1 891712ce226fd45a3f1c576a5b68f553d20582a3
SHA256 64615e7ab92faa44e1e853c4632d7795eb38457cd19118bb4f6d5f689623af9d
SHA512 f5f5caeb4f137b562d2ef1f64eac906a8f9ddc01aec2e3968513e67b868f3a9ecdc2afea7297b2926bb70a3c2f8c27dc920e7949e76c036ec2edcef295e04360

C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui

MD5 cce9b3c65c331417f55b9318f5de433d
SHA1 c927b69c41dc7fd7689a51fff1c729700dc4559f
SHA256 0dfdbad0126822171d750f89d21fd45e92f3275012172ed2d25c871e28a311b3
SHA512 3a69ee44dcc35d135ea1a1be71de812724c879d4c603dedf826abef1ac89e18ac2b75855878626d568e28c683db478c89cbdd32f5bce1d818a589025fda806c8

C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui

MD5 769155c0cbaf7ee92cb4b1c1ea099f12
SHA1 ced7777935b895698cd052a8f9a3d33b4ebed524
SHA256 c92093e4aaf20a86d02a95bb2e1818caf19e2952cfd9cc2f42b885b7c4944703
SHA512 2dc140244049b551c0fa987cc01dd99269280d0f92b4ec1216556d7ce2408a28c2e5fe0bee507881cc8079dad85cabaf6d3430c68c5445325205f36df415e6f2

C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui

MD5 e59d6c605d1a55f7cd4b22e014ffadc8
SHA1 c1ad51b121c1b1e4a50d4a1a478ea1caf51e2e57
SHA256 993053075c9c274d1338bf386e2f31c0081c5a5ee6fc1a0c25571edfebec2090
SHA512 0e5f142d9affd2350076c4e9dd39f4c6c64c836a656ea987b68b88df1c41a870bd8aa4e0b5cf3774a89e91ed449b1aae364d2feb6d1c4f601c081b9e8a181a6b

C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui

MD5 c8138f23d1e66490ef54cecdfb83a8df
SHA1 d1551a4dfcbcf702424fbb8a37b9aa83a9b8c70d
SHA256 fc28a3213736033c1db4c81af3d6cf2898d0c10cb192d93f6c60765b01331cab
SHA512 5b33844b6a7b9d4f9063f3237a61eff7154d7d75ce5897883317a5cabd1af63150d80dc83bf5a078c95daf31e8df7ae6372af879adb0a28f7f9ad1fc4f0e0700

C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui

MD5 b27122f8fb525fb55ecfe82224e5843c
SHA1 5b88b981de63fbaa43e4820b49fca20aeca9d673
SHA256 84249ad21a0cc25197f7d30f5686e0c120c2beeb5f67ea8a85f808949a503c62
SHA512 534df29e373de3f537321654ea90c9450b35a26cdbffbc706d1bdb1323ceb84f5d636bb0bfbc4992108805e6c5ae3daba9e62364cac595bc01277aa5b14a52c9

C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui

MD5 6c014660635b20fb741e4d3291007a94
SHA1 e5c03179bddff5885a9b01a55fd51f01afc17049
SHA256 647eab882e3daf330e960245e80e23d6a10e02ca1bb98cc6a2e063610c738cdf
SHA512 51cfde95423dc6ea36985e8cbb343e2c247da6ccb2dfc71ed6887e1f8833cd477c4043f1e708651011e3edecbd220735738cbc0223b5d299b3a60f5e0cfea61e

C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui

MD5 f77e224c105445fc239ced9653a0861d
SHA1 c1edc94a983f596f063f38e53cf8b03ecff128c7
SHA256 74b59271adaca6b698b78464713f19ecc1c4475ff0b62b52d83988e6544ae08c
SHA512 ff8795b23f11b89e589a027f4b33ccee3a5a0467b0007fd4ec026a994621a7204bc0f7c4191b0314d50fcbd9254dab22f333de20b221e0a20100657f176e6ade

C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui

MD5 5f0ad507c7b7af8fcaae447820c421bb
SHA1 d7923b24d9d38c59d56bf181b9c2b902f20b90e2
SHA256 2ed676bfbe1472e10b52c38485abb1084c8b0c699cc6da4f2661a4a0646b1c0f
SHA512 4c92e455c52c9f1cbc9bbc24abd224db24938b87a84fc8467b2c9ee4367031ec5fef8c160a91ad6d0974ba33c55cbb44abcd2639c7b5d0c7f4cdafb3da45843a

C:\Program Files\Common Files\System\en-US\wab32res.dll.mui

MD5 5ca495a9bfab2f3a60939cab1c04f205
SHA1 fe77dd0c025e049f67235de73bcb6470ed8c173f
SHA256 02a5ead58e33770e8fdff80e6a36ab4881ff77ed7e2da4c7b45de8631a7185f4
SHA512 574018dffae14f86e072f81c4e0cdde747342665bd7f73c76c22e2f03358fd8a855a56bfe6f74bb409f5492cb66ab37b6fae2600b151a9ca4be086ea8faa47e1

C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui

MD5 3b99220a144b6848a3f8a963a12a8d60
SHA1 c066b84da561d846ee5fecb13e76c5055a8093cb
SHA256 7b6c93ec56b0d49592778bbeb1e18cfc79b77438e29fbada84184978d0d7d81b
SHA512 c4aa967c3a1c6a3478d16c457ba53d6eca4d39db372eda67b9cc57586084e891a838e9b3d2957e7a4c0cd6a7af599e8d7094a8c1d4deb962db1101802c61a6c4

C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui

MD5 5fc8785c7462c0cc7d25ff3c6e3b05c3
SHA1 cd72aebccf42329ad761cfabe1dcd0f7e9856250
SHA256 f021f4478ec6059429f44d84dc2d4222105f7e544b0064a7f573a5f25f62f27e
SHA512 0b01b20c548b1f31b9c40c5b44530ed13d2a4a56ee6ef0a1f7dd2d69e8250b4488c46933237a308290f982714972689b79b544b043ad2b4e63c00a85083e4173

C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui

MD5 4b9174132f2437ecec96965f667550fc
SHA1 4c2df1c8321e253ffcb90f8b1976baee1e4102d4
SHA256 5766c4600e4a1fb387a4e008384909ecbb27020b61586f4e5e1b89f465e0ae23
SHA512 68b544483f097a82d88f4a6a5ae62c13bf2837ed93cd5c7331baf6f4d549c95fcbc4dd9c7110477ce7ccd9eb1b79275ee1b49b174302e755a80b9c3ceb6d0628

C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui

MD5 afefa168b4d44d67046dcbcde99fe887
SHA1 393bc0d7d0e38fb055c36e7500f0d6f8c8ab44ca
SHA256 89079994d69e20742c6a518f4440f6348a862a510fad09674933c0b13c2218f6
SHA512 902d7dcb0a8e82b84bf485ac2d126d8c1bedf7dedbd519eefca41910ca489ff9fbd6b513245213fd70a0e9891df94baf8bd35f929d948e9a9fb754dc2ce37b83

C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui

MD5 22b508c9ec65ae10ea7d6929c784e13d
SHA1 c09765a106de4e0e8071e3a7a3d39bf79cd5a717
SHA256 1d394b9dd45c0af70786c69a23dd06b82e53627493df3e682155b0b19f78ac4d
SHA512 03c8b35ce94886bb1ffe6f4a65165e152f6b66734cbcac512eae5c6a5317d65ed4bddc384510015beceeffc17a7bce2425f828c3c189bf9d0851871bdddacaaf

C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui

MD5 60044c1c44555cd23f535e6833b6136c
SHA1 4779c637f6c214d0b659522af9241b0bc290b547
SHA256 22820f17f50f92601eab0659c7114b2ba98025e7035a3bffdb020d27aa53ff5b
SHA512 9ee0c05b1d97495b28cbf07c34e438d5c271d08af639bbc2ba5b7647bf6c608c3345ee3671b6930d0ab3f98f79c2df55c33b96d02a802691fe3adaa66703e42d

C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui

MD5 edf901d6091490d82694e44f5c3795e0
SHA1 fee5ba31cb395c7da81afb2dc6568e8674fa5259
SHA256 d1dceff22b6cbf936aacf4e117be5136a4f8cdf45bbf41695f488ac3b35288cb
SHA512 fdf421b3c9193519dd87ae18263d2d91d6ef02a896797f01ef5043717ff753ec0cf30548d8b58c780409c9eeb6efbf4d6cab07cf4177b6e0eb5e387d29395854

C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui

MD5 fc4e75251ba8aecd110f7933c01ee6da
SHA1 e08bbfdb812adb4d99138df8c6463159ee243ddf
SHA256 ccb52415b3867794171a25b4b22dca3e688c536eb23742eb965704f2434dbf48
SHA512 dc5f612ae3f01382dc50e1efdc8a7926e84e28c677858141472951f23b8fa7b1d831efc4bc98937f69654e168288c5d9c67a4b6860b836100c27d6bf62a9bc50

C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui

MD5 153469ca90036a9a534a5d47487d7a49
SHA1 84fc66a11e475672853d2e582a6450a9c0fdce25
SHA256 a2791de07eab1dbec69ddecba7779df00853e13284061cfc358cab09ac442c55
SHA512 f1a325a647a3f695a7b9b4e9395f82b90063d5f6d2361859cbdbb074e88debb0ad765d8ab718530f58f3d9c38a3ec0265169c286c3633745cc75f4361f2f8522

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui

MD5 0c7e6a12f8ee05499b89842ae85257ab
SHA1 abde0f375d08592021be8a9c93c12c3d09960a23
SHA256 d484f57fc52b58f750a97d626c000f4b7cc87bec2330915ecf85dc625e5af79f
SHA512 d30e406d6fee0594868858ce057f8884d72fb33f97568123f971695dd58b5ef1b5c6fb89435beb5278041d2df2c1f5cb828f0657f171e79956f1d1ac3f74e68d

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui

MD5 a90527ae99e1f61daefba278a34eadbc
SHA1 55b4269ada29d87034fdd796e94fe2cecc585731
SHA256 1b59ff3338cf468cb7ad557017b9890c5241793c0130fe4224f1ade8a1bcfd7d
SHA512 d57ff9601945f7e688d636c0a26621d51a4a93d75a901d2c7a854f6fe0f2b1eede5e9d3fa5b9e06625c382a6e8e2111f76282fd271f4b405b5e693bd600aeefd

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui

MD5 380269a42dbe4814cd614de44b81a921
SHA1 d13ea68e495d8dc453088a0f6a1a286ae9404220
SHA256 36fa72912f61c6fb7593943634deffc79b84d68ab919238f29d9d9a1af3948a2
SHA512 4898be24511b9f03c83f570af61491b8e8c431b2dd8000cd18235b59c391782b1182c49fb59b14bb33825a8098be032b5c57b4829fe7442028f31ad603b30dce

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui

MD5 658060e130622673ded7af43c94a09b1
SHA1 c9aecf3751a20ebd99975eb4607599cc2614b38e
SHA256 056d2e31276da4269c5a0aad337e4aa5ff927b92f70de22a575479690a496241
SHA512 85d6e77f8f5d3376cec1dc76d3b4cc90b896b82ee6af659d5583791041022ae258784276450ba4dd67e72a353b23381b4e74bffb0bb6d107d172ba203db3b814

C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui

MD5 00a820a3cb9154eb47d55f0ec3ec6ef7
SHA1 b61046d79bbac504e5f46be001638ab398d597d2
SHA256 02eeaccb051405ac12070446d8d6fde37e431d0badcc5262cd00ce0eb4bf3ac4
SHA512 09b994b9a454c24a776f15faab38f4a274228502fe0a48298c45c59f220595fd1fbb0cf52230792b5bab31431add892ccec57012b28e99c5742c1539e510f909

C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui

MD5 ba6fc046171c37364eb227ca80b76fa0
SHA1 0eacb5a07d8839985982ed9f73fab7206f56f59f
SHA256 3b366823c0e060bb37f045d9ca764d9b11b10d876578dcb8e9e5e778e930544a
SHA512 7da49e19f7de37ab4b6e7ebfd1b72b8d69fd256343d2d4ea68020ad473cb8d76154eb9c77bb5cc2755cb00e60f1901c7abe06282e0804129e87ad767bad04134

C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui

MD5 39570ae8a638eef64f0308dd954ba6e3
SHA1 74ea9b5a968d6f8aebb8d694790ace97cd92e35f
SHA256 60224e9aca6b20d1b88b43a2b8c7d176828bf8a9ee19bd21df0c23c80098dca6
SHA512 d043b93033fd787867c464088a5e6a901abe1e5fad4727cfd17f452ebfeb76b209284716ea66987776eeb64ecf599c0473272286b40272ca3aa7534c00ea6033

C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui

MD5 867636e41b5f258f2962b1f0a662c0e8
SHA1 daa9e41056cc8c52e5a289eb3b2e0dc58178039c
SHA256 c4d738700f4ee060a009f1cf19a99abef13e7f2e7dd3c49097d96f55539ef910
SHA512 44b4c608c840c82c2e5d473c83d2a6bcd91564fb6462ac4edff4871c654d32ed2a3fbf08592c031bad15f6115a399bcdf9e048bf56ddb199504421685368fdf3

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui

MD5 0e764e42e14bf285642e43633c5754b2
SHA1 4b55daa3305534cc4c6b5a34a5e60b14e6fc832e
SHA256 6505a6ce0c4a3ee4751e56edee13cd59e54e6a4ca04d8d2a58dd6e6b0f2ba49c
SHA512 071f1691bced9956d062fee05581d88db89cd8adfcd54c28e4312a0fa6f7e205a45b4e090b50127aadc78cd39930a7d8adef723f41533d51506b07004dfda782

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui

MD5 d0defb648dfc6b3a236066fec207899a
SHA1 0010268e7c699c986842ebd5a44090defc094cb8
SHA256 b1ec9fce5041fb10c6f68d98c7fab3d633ef6365786be5bd26b9635537db3fd2
SHA512 6fc7b47cde99e4b1a026f43380f5cd88f80559646911be1a9aab31e3dad0313d8e85c4ea8775f1e5aa2a884c5212a88395fa1c80746f83b85be1f9b547df4bd1

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui

MD5 e4b3428c2c47daacf45b1d30b2465bed
SHA1 ba721383a74220db8054fd7fc716800fd7c7d6d8
SHA256 bab2d3753e19d0e7785e0999c45aade04c13536c20ad891eb2ce8009ff4ff6dd
SHA512 6f15732845f48b04d4efbc5343a5f0f40af2b037ab49ed36b662e2829abe56e0572f1070f56070ab826892e84e1236923277cb2919e242363f67cde41396f46b

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui

MD5 6313f86755b8ebd73cd20f9438637fa5
SHA1 24f7636198b05aa328adb89141fac17d0a76c2e7
SHA256 e72fd2f0afc3476ed02f29f901d6e5e0af111061a320da587b61246b40031f16
SHA512 296d8e0604a4281b90981519bea38e2573155cffd47a6c64ad5c75ab0add6f1c64045f4671894a5476ac6c37100daf1068403a5cc2fa5bef33462a7241e37b69

C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui

MD5 884b0a8b1e583f19387cced8e1a03774
SHA1 311b0e34375dafc8cd5e29d661784697a1efe007
SHA256 8a40d2c440d564f45e85adf5c2c9f6fcf35172225e611b6b7868507a07c49ed4
SHA512 f0da3a19ee5dde8c22f86eab22f63a0a9bed1c41b019b716c726006d10b851b1baa992289fcb7cfee6a9eb9e781705895236b69e94f83d256447527fbea3c099

C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui

MD5 1291b460195bf612042afabb61ab4a28
SHA1 d86fc99ac4d7c35e047051e2b1be02dced50e8a3
SHA256 31f1616f39206848e5a515e425df2adc55bf7e75c9176ea12a74a99305815784
SHA512 327138e8abbe4d433e19fc3e432395085d206b7027a5779c428043ff32029b0286cb4245ae71beba2544302f35aeb087029dfa5a84296d4755abda6c8b51059f

C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui

MD5 b795e3f831f540e10955210cdcf4879f
SHA1 dff5ae62b75cb033fba630d680fdc6abded201ec
SHA256 4ef7eab2ddcf99e217d1faf3e7d6d3bd463041756b9e3967241925635f768968
SHA512 212acee9d4ecf294b72e4e93b997475bfee5bf037378e6d23a523c7937910db8463908d10d241e0ef7e0f68b40bded4f12d61e5eb23c6022834fc3cd97fe7d35

C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui

MD5 829e2c3d1ee0eea245110915e8f28fcd
SHA1 4c31ca8b55d600260d951a580efc2939ccb328e8
SHA256 5936f25d110e01d8f67317aacab3c93232cca26d7a02e382756997ec7f7f3a55
SHA512 718b809b6df40ffdf2a0b585fb0af035c9d370cff9216cdbfa94fe018e246eb3c857b16f9849b2b52ebe469d2767abb829c961b49087bb7836e36711eaff5138

C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui

MD5 c79caba29506c4e5012cc772569660b0
SHA1 af95951d2ede943d93fce9a27b819892cdcf855d
SHA256 0411b7b061aeb0f64bd824676bfd3286dbc45ceb207f1ff59085f53c30c7ffbb
SHA512 5733ce05c0673fb16b81a5e78fb497d8f25a879dc2566d21efaaa1e21fee93469afae0500e992ca4c82ab13ac49675473b70d017e2f5a75c77ffc2085596ed3c

C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui

MD5 5e784fdcc3623c0d77a38504b5c33293
SHA1 6ab3c9043f77fb039418a86043b14e8062bd3af6
SHA256 094ab998f800834bb8a699f016763af7d905fd73f4e199e9b41b7eb80664f5cb
SHA512 8209ff99e61cfebbba783756b9786c02fc09afc8d09412ea47e0b8178769e405c895053e2e48113ebddebc422ed648acadd9ff038aa6d0ae62101661e9374740

C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui

MD5 047fe7118563b7b5910037bc06d5409b
SHA1 1b04843b1f18ed3444c252aa58ced1e951d6f514
SHA256 2f8b8e315d2a60d874af34010ddfdcd913b4b7348f0320662d44c39732532f49
SHA512 162746cb58eb2a544046de127cb29869de9239ca0a30b1328b51001ee66b462298934151193f2c0c029c200879a08a74955e9eefa994be438a34683d48bb5e67

C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui

MD5 23989fd6da252e2cde683e488dcf47e2
SHA1 dc4c7f569d07c21070924f5c17ff56af54118108
SHA256 2c6546b1bee3e35d587a0b2b32322b186adebaa227aa655031e7f007aaa042f3
SHA512 ba75bb0ae61b0aaf919aba5f5abded19e1adcb4d5683afcbdbf9e48ac8c414681f9e560ebb46544807dc8b9ba9e6b706e26afa73b950bd55e3ff866381c25ca0

C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui

MD5 246ed0f1a775e86879d6f621589246d7
SHA1 c2c553c6ea2d3c89db579719a87aeb2346dcd673
SHA256 8f6b59a72052778c2834d34402a5bf2ce025ddc4d17fe891c9e63c513f309757
SHA512 ddebee9892f366d97849f1bd20532ea1cb0b78781a736cb7d2bf3316945aae38524095b3fa69acd5ca29afee1be59aaefc9aa982cd2fd81b29345f269d231046

C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui

MD5 98bb2e9aae2f615b1cd56f8172f4dac3
SHA1 069071ec028a8e59140be9813506cd30f4f9d8a6
SHA256 1983be92cdb618feb54f1b9a28f6c84f973ea1b9048de317515cbd097757d35b
SHA512 79265cc6a03e714209b3951ace3e102796e824f36b21edc0cbc6ee7e7135407e2b88e85cceeb11be569bc58bd0a696c76d37d5dc654b3af33ccf71b9644ca1b8

C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui

MD5 e1d41d7aa50c54992f0fa86912d158e5
SHA1 0c1b05e11ce7797f30445e2e8ff36896b2bcfa16
SHA256 22459497cce1a363f62a8235f2829f1f27e7d29b9487ad039eeba394a89de6c3
SHA512 0778c40204f1f95ed3820c54c8742d435037d53d3590b582603bf52e08d92d6bdcc3ad57e6157eeda3fbea4b0aa353fd2e301a32470385429cafee1f12c689d0

C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui

MD5 77c5a2f87356ff25d02625ee4b1a3b64
SHA1 eccd8d30a1a59bdec060ddd611d6162e5ceedabf
SHA256 222f789534aacc50d91fef69ea5a3ba12dd6af3179e52c1f1edef18f3a839b57
SHA512 bfa3e116834921217afa1561f9493811b4d6b04501cc42bdc22e1d55ce14b3f5c80400864f4f286dd3923895b156c3b854088c59d23910d2903e2a5a84807dfd

C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui

MD5 086811bb24dbf400f8d874d69fd3802f
SHA1 aa915b5f40f496a0e2d2870f46660ad1bd1b667e
SHA256 a04803035a72bdf3c3cdcb6c0f9087a083413d1870f6720685106f63126535ec
SHA512 18e8f7b9716481b61f33208d0b7725a34b02817b48c6031491ffe185068eaf210cb7be0d632f228d8ccd2df597128c05639ce55a19077561808485de586262e1

C:\ProgramData\EF51.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/3284-20017-0x000000007FE40000-0x000000007FE41000-memory.dmp

memory/3284-20018-0x00000000023F0000-0x0000000002400000-memory.dmp

memory/3284-20019-0x00000000023F0000-0x0000000002400000-memory.dmp

memory/3284-20020-0x000000007FE20000-0x000000007FE21000-memory.dmp

memory/3284-20021-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 0f64fc6ffd44e31eb40f9ecbe7b43315
SHA1 ae98a773ae113f2aa07f00c6e68bb29ecd995d2a
SHA256 bd5a970996a7e9e4a4bacb2d8afb0f0119e93434ff0964b7f2bbe3647cfe8288
SHA512 80aa36f04cfe34043ad919a8c067bb0ba612838861a85b73f6ae1a20b33d8ddbf07fcb52276cac35a1bcaedcf8e7f08040c12d2bd44a2402b1e19e139bcb37a0

memory/3284-20051-0x000000007FE00000-0x000000007FE01000-memory.dmp

memory/3284-20050-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-04-21 06:43

Reported

2025-04-21 06:45

Platform

win11-20250410-en

Max time kernel

101s

Max time network

111s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe"

Signatures

Brain Cipher

ransomware braincipher

Braincipher family

braincipher

Renames multiple (7567) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\18C3.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\18C3.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2627618461-2240074273-3604016983-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-2627618461-2240074273-3604016983-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Windows Media Player\de-DE\wmpnetwk.exe.mui C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Windows Defender\it-IT\ProtectionManagement.dll.mui C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\es_MX\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GADUGIB.TTF.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\css\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SnipSketchAppList.targetsize-72_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\gu.pak C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ro-ro\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\LockScreenLogo.scale-125.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\fonts\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\ui-strings.js.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\ui-strings.js.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldContain.snippets.ps1xml.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LibrarySquare150x150Logo.scale-125.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\ui-strings.js C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-black\PowerAutomateSquare150x150Logo.scale-100.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Xbox_AppList.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_checkbox_partialselected-default_18.svg.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-mac.css C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\keyboard.js C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateSquare70x70Logo.scale-140.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\ui-strings.js.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@fluentui\dom-utilities\lib\setVirtualParent.js C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GetHelpSmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-80_altform-lightunplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Images\docx.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_4.0.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Icons\StickyNotesAppList.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ie9props.propdesc.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\faf-main.css.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\ui-strings.js C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\selection-actions.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@fluentui\dom-utilities\lib-commonjs\getParent.js C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-125.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\installation_telemetry.json C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\ui-strings.js.jErs0FgGP C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\DetailsList\DetailsColumn.js C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\ps1file.targetsize-32.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-20_contrast-white.png C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_thumbnailview_18.svg C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\jErs0FgGP.README.txt C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\18C3.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe

"C:\Users\Admin\AppData\Local\Temp\ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f.exe"

C:\ProgramData\18C3.tmp

"C:\ProgramData\18C3.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\18C3.tmp >> NUL

Network

Files

memory/1380-2-0x0000000003150000-0x0000000003160000-memory.dmp

memory/1380-1-0x0000000003150000-0x0000000003160000-memory.dmp

memory/1380-0-0x0000000003150000-0x0000000003160000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2627618461-2240074273-3604016983-1000\CCCCCCCCCCC

MD5 d73daa5838ac1d9e220a0d4d3bacb804
SHA1 2e60bafb5865e744d73e5be0e7eed41acc924c38
SHA256 c1fa8ce4652f057ce85e83623153055fd1a877d8ed97355a2293f26618f4d67d
SHA512 70b9ec029f3e2f832396d04fec1c11545fa90b552952ed3a9a60dec7650e9773f053db797b948336f056c9569255e7a8858ddd11b09b508a9ce08223f3a23474

F:\$RECYCLE.BIN\S-1-5-21-2627618461-2240074273-3604016983-1000\DDDDDDDDDDD

MD5 514c7771d8372d79ebebf0388dae0f04
SHA1 099a03a492b19b6b1a1f9cb1137d1585f4c1164b
SHA256 2726ca0aa408d7fc3a8748f5ca11b9bfe5b06aa556df8938fe5a8d7faf625b91
SHA512 5a4f62a85be6ec84bc929f0d3525f25cd83e73f6b62a3b8d912479fa466ab4801c945d64cc1eb5c70ac2b19f794ca14ffc66ff1a33553d5633fd85e6a99ddb9a

C:\jErs0FgGP.README.txt

MD5 f1172d69de35d3e2529b4eed29ee3ef4
SHA1 ab82e7d1d666443d4e9cf644e45e8faccc81d91c
SHA256 15140e9a6ea6dd4a6e5c3a3e52b64c1afd65cbd786a4970aff8aa1b528ebaca2
SHA512 8dab284fe36ea55d76afedeb161389fc520c93d042dd7ea935ecf79826a7edd3b89400ecd9b4ffdbbcf4556abbe323a388ae24ab8b5edad7307664a90ca5851b

memory/1380-5610-0x0000000003150000-0x0000000003160000-memory.dmp

memory/1380-6445-0x0000000003150000-0x0000000003160000-memory.dmp

memory/1380-7354-0x0000000003150000-0x0000000003160000-memory.dmp

C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui

MD5 12bd705259e12b920f57a1cbba114ebd
SHA1 48edcdfe46d16d6abc6a55e702a7eea78b5a6f1b
SHA256 dcc4d3580a99de68ca08ed8d475a469945c1999f949676ffa448a6a0de9ced12
SHA512 845ad981c3120a63b430f136c154be568ada141350b49d3b7e848d88f485bbc7e1597ddeb46a027cb0b9c99bbe7944057f1fd08686b79b08b77614bff1df82cd

C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui

MD5 3818bba350b8332cb9fc7d99f05133eb
SHA1 b8a969463ce6d54be15c0df0053deea2dd654e42
SHA256 3393b65d7873ef7df41398fea50b0595dcf410ed100f431885a1db3fc32eb9a1
SHA512 7772745ebc43402f6b4186849726b9f2710a267766766ad0f77282d476c1a69516df53137001fb673199ed132092db367a752f361b852f2459945161b4624556

C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui

MD5 c7d66c39632f20f3925e8267b08b8005
SHA1 32ba4cb793f097575682f20e408bb7042f6f601c
SHA256 5bd5c4fef936689bee809259335da051d98adb2cb308eb9cae6edf9c4d3dc9d5
SHA512 3ce648dc580f5e71bebc90e7b084345f20ff1fd456159f0d0bbea827fc2c09c3546a45a1fbcebc1bfac089d37875cfb9c0715a21c11d689fa4a12f540e886c55

C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui

MD5 0bb4fccd50f51bb9b6ffc270ea1398a5
SHA1 cc9e7938b556d90fd77107551c18792e5fdf1ed5
SHA256 92fa32488a2e9cf3b38f4dbb125dad55c79620586a028bd9ad656197db93ba92
SHA512 ab9389ffb351e63e9c355118b1d0d7016ff8147c6822f68f48bfa6051de574634ad5e87bba24d25ac621b26c811fe43d0b4d86ba2b354d40bfdbad05a18aace6

C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui

MD5 f1646c495d9e9ff8313204a2ab8d8e07
SHA1 20f65f860a403c2361b635b9894c1a9861953031
SHA256 f4f9f39167f5f495eae5d9c607655361845386d5abae4a9ae2209592a5724e26
SHA512 b671c2227a800c6e9767a00eb670baadf3a7326c0421c4117255e50a82f09109b16f75632d95da18ae5b1f3f82ed42a4ef951fa64152a11e40d3fcafeeea9945

C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui

MD5 bc20a3a56895baafb84e8a9188de30e6
SHA1 51a6a882b801fb82cebd27c50e8d0272ef7c0aab
SHA256 cb6006047e14f03c6564af5130093b5129c8be4a601600e0029cefb761675189
SHA512 c961dc6f5d4191b14c184cf2aaccb83bcd8b313d3e5292114342e133fe0d79f101066b0eed4dc2c13e378ff670fd34adbd0f32e0023ed12dd959ed640435c265

C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui

MD5 146739c9a898ba59d08474d076970f91
SHA1 ed557b03b8832aa77d4a53ee4d7076af27053119
SHA256 12ae39220cbbea434e4d1949eedd49ff770f730255c4001100265a937eb44143
SHA512 50542d0ac597dc04edb4052044957d0944bdb96cfd3d183d10470d4933f9a29fc81d152a1f8eca2035e390a97516c5f459ff5fc702ed1d5b0959eaff09f7cc11

C:\Program Files\Windows NT\Accessories\uk-UA\wordpad.exe.mui

MD5 4d58a7a4174beecd73f5514da52251d6
SHA1 9f2b963bf06a46147dce361102264d7c22fb10df
SHA256 2271f3dae601b194927010e409afa81f5617e5880ad403a7a95962dcd38b67d9
SHA512 af47cd31afd8c9c0f92ca604e9b7685477907e4716a6f9ae2d7a08c035a42035582507e53c50297bd5417d29e0417bcda032933ed2520b0856f5f3e6d95e04de

C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui

MD5 e719a00bf2586b1ab9efe11913f6c827
SHA1 23c290fd477489abdbd75a2cdf00d020310c8dee
SHA256 cd28391cf2d84afdda06453b831dfcca2d7f611f0e3499cbe791622f1735d99c
SHA512 9e2c77b72d570633f22057267abd3a7d0f71b3a842c6118d437591940e5e08378d6aa57497dd427f2366754c8c333851078829bb8476231e92855ab891c38ed6

C:\Program Files\Windows NT\Accessories\ja-JP\wordpad.exe.mui

MD5 46a87f462c48bded91a1ae3f5e00342f
SHA1 ef6d0ccf4465754539bb937cef27ba26df8f2732
SHA256 084c82b6e9ff36c904666aa05cbd046c0066f68e514e69c1794a1f0c86289c9a
SHA512 b75887d6e51dff1d2bcfe54f9ba31df200fe7927236f17136e42a6e21e04571095c6594a13155d68447d3f975362072faed715f7d73b81ab69c3722fe2f94880

C:\Program Files\Windows NT\Accessories\it-IT\wordpad.exe.mui

MD5 f67412e94760a4e4345da1c1842b0717
SHA1 43e93677e63ec7d53d402cc6de9d54fc50fdaa6e
SHA256 468e16c4824fb6ee8d9e76008450dac9d1b1025d15510d148466db1f026fc830
SHA512 06a0b6ad0625f389703abd95f9f28a30b35eb5f9a142f1912dd90762da5d795c38dfd742f39f278844793cd7ee63f164ea9e4f42727d54808bb6fc5e430b81f2

C:\Program Files\Windows NT\Accessories\de-DE\wordpad.exe.mui

MD5 477dd48456d4e26a352cae8f810a0eeb
SHA1 dbd0479ef3712c28e1bdbfbef19257f8787fff92
SHA256 f2449bc750aaa1e1ca2575e9ec7b7498378964bfa9ac4228d7f0f218cca75011
SHA512 1fb9004c99fb0200f23f38cec892758205f3a25d8e8c19374e69d36ea0d883a58b59f9874426668bf173ecbf967f0f30aeb1a29e0c06a08b9ee59fdf734f378e

C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui

MD5 9d362126bb810e39642354151f6a35b4
SHA1 af62aa96cf6e32631d7f5a032b61e158fb53fcd6
SHA256 9b82887cafc6db465f22fe1b6b6319d51b0f56f840754fbd77b9cec323ce90bd
SHA512 42d42a674cd25e6cdaff40b87099f30648c6f31a33e6e0156f9f362cddef2f353cc987b367d8499a8e4857d0926f8dd97e0c9b22c7a619004a76f79e3a03c4eb

C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui

MD5 9ea760d1caecfa267feb9bcf87ead5cd
SHA1 ac13e1c3e8ff9758bbcb8778dd56a832fc6ed1f0
SHA256 fcda5e404bd7d7a196e89b686f6043ff56f4d2896526b07cdca2dd365e93ea8b
SHA512 cf5074983a30f1dd3193bcd9fc386fa47277365dbc254a6bf44ff1f9bbab0b7d0f8e1f528962a996bddc63a0461bbf3182bb896a5cc2f7b4ad5c9dd2d219c08d

C:\Program Files\Windows Media Player\uk-UA\wmpnssci.dll.mui

MD5 37d370979a72acb2fe73196073e9ebea
SHA1 90c2bc3b2edbd69d8e36ddd65b4a46ae2d120a09
SHA256 18b16edac1c2849d49f883dff9f92615d5e7f07bc08d3a0a5a8e2a8edeb6a4da
SHA512 69d9f53abbfa4cf1f9920d5bc91689a0d60ed8bc328dad06e50260cbe9fad154714cf9f5a512a0616bbad365c25ce25f978469a96969121a2e1c8e1be24d16a6

C:\Program Files\Windows Media Player\uk-UA\wmplayer.exe.mui

MD5 678d408808042cd59c9f84f721fcfa87
SHA1 c5ce72ba0030f91aaf0812be09e9b23082793577
SHA256 6b1c8290b072b6bd60d1dd95c5cecfb96f7be2049981008938c8c7a984a160eb
SHA512 0962f93d65d1dd70100844c16978fa6b6cd7b2e0977aa466f7893ac320178b6d1ab73f4694b6ee2e06ca46de7e1e63d8187db04f0dc2795d235e1f6d847326c9

C:\Program Files\Windows Media Player\uk-UA\wmlaunch.exe.mui

MD5 a4c81d1b8aa123f993bf705094655d3d
SHA1 bd96514fcd5f01703a889a770a870d0e4023a38e
SHA256 8760e6d47879d2ec82c079583f930efbeebf31bca7d809004fa28b6e397a5936
SHA512 696d2905159fb4e2dc83e56577d1de9dd79df66cbaed74f66d9bce05f1dc41d0d6a0a143d8cf21fb23a381496905c43dd7b85e678ea48e5b0227e24e24e8e587

C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui

MD5 c49453effe6056578be23f5801619cce
SHA1 f126033b870a245217a1e1bfb883c87c386b8283
SHA256 88c688cf6d8f26248b94eae0164bcfbae077dd0293846b0cd4209dfc77f3bddc
SHA512 689f9374bc990de1387c0d92e839b27a5304629ef70d9a26564adef6e97f9ecf5d1c9b3da54a6d3e31ba99b16c109b26538567535822a9f5128eb66dad239ee2

C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui

MD5 679691148b5db81c4e283eb8f93328b3
SHA1 ad36cdc5a900b320e8208d1ed84ef980cc4fd240
SHA256 87e974cdd2cea273c39b5b389df3613e68591eec1ce8610a55e28afd2446dc81
SHA512 c94781afff3eb959befd484f85c5e5a662944154aabca224dae96219c8f05abf475e98c629d9f95de727da25964f85551840bad325cf2cfa32e768203ee83b7d

C:\Program Files\Windows NT\Accessories\es-ES\wordpad.exe.mui

MD5 f72c5ae97729866b3f553a66ae38385e
SHA1 ab6848bcb1ad9673907b02b078efbb6fb8ab2184
SHA256 3e071019e53995c92dfe6da07dc66cd6fa8cb785c232841398d1a5f65ec5f3bf
SHA512 18c77870f72620052e8a72c8b85ab5856881f3c5aa412b83b2c570b2800bed2d4262028dece83063c8835615ee3b628c068aad3462f16350d9e538a4a6535ec8

C:\Program Files\Windows NT\Accessories\fr-FR\wordpad.exe.mui

MD5 dfcc05d08831ff629f41d5a07e79488d
SHA1 9b270b1fcadfa9037dc5569ede2921629a33afc2
SHA256 d7a682c1901ba6c935dcd7a774c5a8a4f76cd25eb8c15e23d17d8b69517f8d43
SHA512 49794e27c88a611467b4d084a0addc484ef0da7682234007da20d5e9c2f57a963a2f2c30970190c7bc61c66082f3f4062a362efc57311c02ac853d89b60bb857

C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui

MD5 f72b3e1e581be3e75d8ecbe70dd77374
SHA1 405bc401e6dc54ac4a302ff17a5ac38024faeb5e
SHA256 d84af9858a1d3b25d406b35c7a9a1bcaba03e6edfee95ee348f1f0367b134384
SHA512 c0270de6ed22e7d8324b50e8954937190eed19b67ae96d8d91769f422381d65e164a8091c74b8afa31ab050b3fd14cde701abf6f0f519edf004decede89904c7

C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui

MD5 844e12418da71bcd8efcb23fb8049656
SHA1 4b9022196de3276bc0193203631910b7a3efb615
SHA256 23705e2c05c72b653f0213bd4b2c73096cb0ac046342a6f17b1b0cd3c3c76133
SHA512 ee5a6f05979be310aa6b0596baf11453f53e747bf18c7f676d1d095bea726ab369dfe9ca17d6820e480c0c2f6f2ae24d6a0c42beb915c90736937e2c6a9c4d4b

C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui

MD5 3002a0378a05099b6a80d89267f37ee6
SHA1 9ade36bc7c671429a5206e1deb48f44929a02217
SHA256 fd7d6507bee1d2f6848258e760e7237bcd01c052a3ae1e33f95a512133933bb2
SHA512 ad03ab3454af365aac1ab79fbd00649488c98a0729743a11015ee1bd2eb26fc3fc150f21e7e3414d9c99abfd2aaa5c70111dd4eeaf4f7db68a08a5cd5be14641

C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui

MD5 5537b16923b9e395eb2ef7446c522abf
SHA1 2b5ba27918e1f0876667a1c822754c23e1445fa0
SHA256 0fe8e3092ea6ef98a085cf67e59f033085d69503046b2747945b8835f24b7d37
SHA512 8ba9ab5fd2446838aea2c78441824aeaf7b0f8e8113ebc0295c6f8368d028296f10baf2525148c591d3f08298a8648f7a84aa67a3d41c79a594126760715b89c

C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui

MD5 e4e3b20143dd2ae81791d86314e9d658
SHA1 fcdf6474447948c6da2964c3bc75be44c7a6ecbd
SHA256 6041f8457f820ee87d1b48b05760753ee183eb2111b4cddd1222b4cb7c2a65d8
SHA512 8597c4f369df5395c58378f645b2419eeeb4ef7ea49f3c59fa78571e1280d5c7cff2494cd25475df43f0af8221c1485f5cf590fe3cead29df441c7a374826028

C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui

MD5 261ef933c19003bba43fc6490e4cefad
SHA1 ff9be35b62608a1e53472134cc4e719eb3c7f70e
SHA256 dc61744532bb7926c3f16411dc222cc2f2b6c3e8dea48adb5bf0d5080844053b
SHA512 4dab8b2b760dbad4905f5cbc3db0426fcf489f9347407465dcb6bea7c43e4c81ffbd11f1ef410d762a939ad23308ef118a963d979681d75edab5e36f62880309

C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui

MD5 f5d523ffb41d0557cae5271f3695691c
SHA1 184639e907ae0251bc71c97f45a32276c6c27887
SHA256 ed5312bb93cb320bdd76ff1a05e4ca65e2b1344b99892564fcc3182747fd635c
SHA512 09a724f5fd897ccd27c3f63104b576f55ad6fce95708d5e59634f6cc06aa69e55a898ecd3ff3cfa67f06c76919f1e1e50b6abcd76c6e53da81f223bca52501ef

C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui

MD5 af03fd409315dcfa76cbfd5352cb23ed
SHA1 fd41540024e55513666712f6ac9e47937bc400c5
SHA256 582e933d5fc55341985711e41e2a3dd76cf22ed791f06e89b196111beee4aa9f
SHA512 9b9d245260378fb99a1ab2c672d4ad0adec26248f0573b01908542468b3be43d454e781beb20402dc6279cadc45209ae8953b2ed8514e8d6e0c04b8fa7f5a4e2

C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui

MD5 327243e140cb0be40105cf5fbdf7429c
SHA1 7ce7fdd0584f576e45f8df0bc9b8a57d7d0a859b
SHA256 b1da219e6d5a524df1af7b58ecd8405f418fa3a2534671414ce5138c6d5527c1
SHA512 e4b7576ffeeccb8ebfef1e71332328c54e3f41acd211c92ea4e8f7f30bac0916d796a368611788366e574beef630c5537ffc69e9ad99d56b00812b64d594d706

C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui

MD5 d32318c13c001bdb16d5fa56e9764bca
SHA1 2c1e46ac74ab9bf988a7b2a086a58623b6fb2ca0
SHA256 7254bb3f7bf68109c5a0d9158ab0992e599a352bd17e8d22046b9b904a93a3d1
SHA512 53986856263b6499951753ba41384cebcd140a48a03107dcfc454d05337ffdea9d348d18b84c37f4cd3172d5dd51a83feb108d554e7252edee88e7fa641f2542

C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui

MD5 3c6c33a2d51d43f94de1fb33f353b3da
SHA1 691f62f5e07f14f38b29a80c8ace4bce398f1135
SHA256 7b0fb8bb79d47634850c63a6736283b6f4eeeb5d36ee113b283a28498017904d
SHA512 997c11fa2aa355a075a1df5201fc800b89fbb77087abcc9d02503129b2dec84f79b2a5e14add8776c369789cb6c026b3a12bc61475008e3e8592a8b8e922f872

C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui

MD5 9a4b9840615676af582ad5fea2541c7c
SHA1 2e20c557a8890ee578fc7eee891a5a926d2c36dc
SHA256 f90cd701d7bae6782f86c9617caf5dff3a588321775d4782a93c2e0a1651456f
SHA512 e1942da7d03dda300afa3d7ab9a68f0a49aed2a33cc6f3a5a42e97b5572b374f622004120cbc13d2f0f92568c1d5fb6b9b5eb5aa7062fd2226eee620fd0db710

C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui

MD5 a91cca644574db60b5f797016077f851
SHA1 bb3b5fff94b3a8977592c38c406d6531628dd981
SHA256 e1853e3daa7559da53e3de1914c31b1b80189ca46d4bedc7b2fb4df100b049a8
SHA512 4452b123a541e2fb2f535ad723342f9baa9117668a69cffaae6d290907dc20cbc4b50f75659f5bfa894a1d18e5a197db95073c3cfcf56345c95dd0a39880e783

C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui

MD5 f3507163c85424bddf3a0ca5de33222c
SHA1 b6275aa8ba15116eb5d74845a82b274cdba9a927
SHA256 329c14172c229d939fafc9637b1dd9563c1a31be13bedec97b9b743720045b61
SHA512 4efd188d3edc6fe574d3b7c1dfa6d2565306c71e48feb69bafb21bc4f03d4fcf72bed10f2b61041d4eadd54573189946691a363f6ea0bf38cbe06eedbcbb75ad

C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui

MD5 584962049893ac8683cfb40e0d23c49b
SHA1 bcd87da670f5d841c6d83f2f2028689a3efc76aa
SHA256 072a0ef0a71c471c50a79651cfd2e01e6734533cba01f712239432591e3b7d3e
SHA512 8348cdfc0d112a012417cdb2ec037a753adcaf9145a31248e27b0fff0b6c7abd606cb413b1455a6a4e964560285da6cbdd9aefee3d1026581d146f217f381fbd

C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui

MD5 93da92e5f761c1905d12ac0e6ee2c2c8
SHA1 3a113b967800d12c93b328d610e8b669082e6d69
SHA256 2af202da97dcbc06a8f55adac0b642b72ad6c9e71990d1ac91f366411463d2d6
SHA512 4c02ac1926f2643e8fd385afcd394c55dd484908a8ec69ec26e7c7adbc3ca95b35869f11494f0b39b4952447bc2a7aa61c54b3ee305a356366ea52ddd2ae94d6

C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui

MD5 3cd4cba534e4039a5b4075029da6abfa
SHA1 f6f07050c4608e2b1539707bd5729007dfb4540f
SHA256 d484c65974580ddd8555927bd9ba6d4b55505755f8bdc9776fc573f350d18808
SHA512 2837e9b2b8cfd672a42020dfc2837cbdd2eaf655f888185dc158bac58ce1bca194b218e4097b70f24120e190b0d80d02f2c8ac77fb306d7c2ce1e2145c4da021

C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui

MD5 1092b29f6bbb3d8ef529e7bc1f21caf6
SHA1 50128155f4cc3bf69aba48678ef92ec03aac3983
SHA256 bab0eee7ee2e289439ee28b1916c0a572e9b22a83a16bdc0b36621fec245d782
SHA512 52c01872667f7eb97989e211e85297fa3aa2fa1900c74908ead817646d57eb3e36102ced1321af3cd268097e5f94341d4c2cda7fa9242422cf3ea46376158b4a

C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui

MD5 f8c79480027ff7cb359fe43ed05c8568
SHA1 c187ebfc76b17073f7380e9054b678a41c9c79a1
SHA256 012a07f1e0a4765d7c6dbd3cccc1a68fe64a47cd6c18c00b7a74bda27f7312fd
SHA512 0d5948cdcdaef4b95e4752f348fd9380aca1aca254f70d4739cdb55c17e6f61fabd270cc6eca99d5d0037bcc48b07a52548a9976e4607c38a38799ee44f8d840

C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui

MD5 e1185b9160c7b20846dd8992c972127f
SHA1 470334279b279e6a47b7ab367142208ec9f9424a
SHA256 12daa8d4e26e0c06bf0de9f558d6d271dce8f19b1141b74c044fd6cf88b02527
SHA512 096374e78b980d98f2d6c2dc90da41fc67a36e41bd00eda13ddd824b28b79ec69b1ee72a13425de740e59d3580ccb72d375f3a8955c69f11b00873e2d932d146

C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui

MD5 3a33ff18bbc9aa4f197ff944317621e8
SHA1 290ca80f769a5d07bb960949246bcdb2aa347da0
SHA256 ce7cd96118d542ebe4829a3e0ee177665b82ae6aabebec0e146010f6619cab14
SHA512 81652c727f45f4c72f0824c5920098ac510d036c28c087a2d86397a937516d8c13b1e67bf5d33ff1cea0e0676e2da3c7766553e52e219bdb68dcb0ae3f2ff97b

C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui

MD5 ecb7675abff115b4d98ba7e0f6818875
SHA1 f00013dbb906b8e5722840d76035e3d904116129
SHA256 915fa295c3f4d14ad94dd006ce0a60cba5f80f13f3bcad1713e5024c6144bb54
SHA512 af336394e70da5a9599a29ba1b7fb1cc68df59ed50e391078f4bd5d84524b435bc18824714c27ec9bbe09ba03de4f3321fbd2948ea89b6767a1852f2d28fc7f6

C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui

MD5 35e457de2a84d6c89f5010e490fa701c
SHA1 bd4716ac44ce01b7a738f70d877e49f15df649ce
SHA256 def4f3ac06a66112441d0327bc3420b4a65dae063f9724fa9f66ea3331faf003
SHA512 88a03ab505fdc2a9c73c75d104cb5978d7625119e9f1b8e5eb7a24d80b1618ace4ac3baa1667b8e4a72f6cec53726b541846eca4e5743416ba476097709a0ce5

C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui

MD5 cd58c22d2c615c37d0c363d88aa6bfdb
SHA1 30f1bfad1a3df4223c2b28de768081682a60a7e4
SHA256 1bf0d3d7cdcd1ab3478a986b2a55523273c6c87f2a1961000cde6f73ac1e2c0c
SHA512 e37dedcb843d839fc0e31afa50cf9d0d17c9dc6b5b04dbca0c91fd105678dab9811d558090f81fb5097429950309da69c8c20f4b80665191e364583e584eaf63

C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui

MD5 771ec7246ec3e18a758a76f512b706db
SHA1 434c45d0cb63eb181d29650aa5a058105908eefb
SHA256 77d53c3d35239cdf065fa89a573acffb80abb04e006b0a3b9e1c2359155ba2fa
SHA512 4317550a45b8827956e74a1b7845b802c3f63c01dd433a1ad4f6e68c7ea24310ddd41a850b1826bd23af5823a6a194faf324f812ed120316c52d1d16f6930daa

C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui

MD5 0a465528c32bdff29f073cf8b7042b19
SHA1 e97217eabd325fb6c1210b62fbd5a202731269da
SHA256 30ef38ab53e5f186284dd693e53e7613f6346aa9cea2ee775fb2652f2f48ef43
SHA512 583590a1c92903fdfeb35898662c7882efb45af36ecb3e14c702aaa160f7237c526b45d9943dd379399c1641466db7d6783c4e846df2b674a1572f204f9e26cc

C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui

MD5 13712af601a2cca74507cf3ba9b9d9dc
SHA1 1f24bdd7b68b91554e76437926d9a41bf5659aa9
SHA256 c03e327e3abe2e4999bcab312c4a3deeb1058edad13dbfe2c4c612a3a6c32c13
SHA512 ea014872c63626dd9973c94ea3fb3fcb835c102a06d4c03d069e6182516c995ced9c9310e4e31799ec26815c57c2f4800e7e3e5aafcdfd40d1b137d21f8dd2b7

C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui

MD5 9e527cf71b6965b8f6763f95cf9ecdf0
SHA1 9551b603036c7de16558ee5569a80b43d605ca64
SHA256 ad88aec4945c9bbec67fa255a6c5dea032d1312d1d247f00d2311c7466e632d6
SHA512 a1196c2f088a1186076014e60e115b39cd4d07cf31b3f5329a097e6157223f24c740bf3fff23ce7e96e3c61515bf0c120a61d58797725a8706a2c3fa62ac62bf

C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui

MD5 eb6505aa5f6ab0482e93b2f4716dc7aa
SHA1 12bf1d50bd1031f81876032a9d6c93a02dc0d1fb
SHA256 c03c315d598b4c5cd8f76afadc0a63c445baaaaad6ddf045bce6154095d7b1b7
SHA512 ab8ef4981553303d3996b72d378828a19da9626dcf9e82992a85405078f2a653a8c34ea0e2ac5c101527252e7f5243d503a577df45ec57f49353a29823969f4b

C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui

MD5 a9e9f848ba0d3fd15571f75630cd64a6
SHA1 cfcebe0c5aec06b6b147ac43b20b1fee7eb2e34c
SHA256 bdf124b2163bf3b277fb5070d834d63112087ce498f4de66f8ed1730d9b1d7e4
SHA512 5b257e91368e430f4b639518f01cbd548b599939c04467acb0941fcd4355f5e11690fb3b8404a2151aff11508931f0d979a4160388bcba6c1c9644a5180d7699

C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui

MD5 da809fc7d67e8b89aa0c7dbe8b15a589
SHA1 183d71f0354f5b2c459d03bc9518fb6535027c80
SHA256 248ef019358bddf3599f17b07f2a781dc6cfb8387f4772575a7270cde28bcbf9
SHA512 bcf4eb4f36f5db4bd993b372d11d43a2f02e7a5d67ddf6fa3d02aa72356827c4105ecf0724678d95b058c1e8a786ab7de6debb27d2f788db8932dd2a4940e8a5

C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui

MD5 e0a579be1811ca5d2ec2d25f1e43a2da
SHA1 ad603725005db9d8d5352eb50197a69ca3538b67
SHA256 6f8ccbb2765b73167fda5529dc8fe8fa80be349f899bd69de291988a26148293
SHA512 2d946a777077db014fde5b3d5117d438c451deffe50ae98d2ecb6bab5cb90df45fec6933aa251eae23b0a0d472a087667e9f20ebd22425f39333c91e2acbc3a9

C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui

MD5 06b3233cb4c37ccf587f3f551299f4ec
SHA1 27d7184ea4cbf5bb6a467a1b46478da347d54d40
SHA256 e584495614df592704f768500694b5e16f70d21f83ff62f70d5687ee77cb6763
SHA512 9b20fb2e8585aa606c86300ab0504122dc96fe0e6464fe802eea49d3130a9f579aa282a67e9c5e2195209bc4a86df8b3f8f59e05dbf35bd3d68aaea44a5f3555

C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui

MD5 ab9ca660e2a85c13e4d417e2ed1454fd
SHA1 e82015a473909ac76628cb2f846cbd2b71fea5a4
SHA256 59fdf12067215be894c299e88f30ee6fb869bfeafec199e001d0e6408e655d10
SHA512 b2f7550c695a279350f1856ce6563a29e9219fd8140ca378c18ba76e787e12b3e836a1ff6df3405407c297870b536fc2f9dfcfe5e2e77a50e302eae24b9d23c0

C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui

MD5 eab2c0f18e9b43d5e3c37d5d9241fb7d
SHA1 bb27854d87430c64ca0f53a3d69e4347bc71a417
SHA256 06afb6f266ead639f4fb048ed719d221951279adfc53d354e31829db83eaafa9
SHA512 0a8d43924a82f889067bdcc0484f786bc98dc88ae51143b24a4d1980b145a5aba737a491c7943f5e0d190b615feb1b203f5f8fbd609ec0cabad2d0be0c018f09

C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui

MD5 aa3e23fb2c32de15fc4dec991002509e
SHA1 56823795d8709e282223fc31639db6a52060d2d2
SHA256 382cec885697e4ec6801ac8d3c95116e341346d4f4d96a43ec37826a302fe1d7
SHA512 26435e7687863878e90ff90642363de2da690461d50e5c08a44f21c492fb6bb7213c841db4ed0640c485a85087c7f6d7d5d1871cc50a6d30768101d6801db17e

C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui

MD5 c35f1253c277f8f23b5245e7f0c65a20
SHA1 457866c22c1998df74171a16066312203fd83d8d
SHA256 5885dca39920e8fa9ead48b31bb3d02abe794640d128535e77a91af51f493044
SHA512 920be92d789e98d1104fc71be71143ca029f743c9ea297f0842f8c40cd32eea5b776b7f82de1a2c8db6c994aa77bf2e31d6eff9e56114cd179f8592fdaeba694

C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui

MD5 a52559c203f7dc9d3d5e58902b6c9068
SHA1 dd70a3031349cb839d597834ad512cb8968f7b46
SHA256 61cecf228e94a2732b04e6af57ec1577cd43ee9b839e365f05dfe560963fc541
SHA512 d5261b154579845bceebec299fa80129933b92e4d1e57474ef6fc5ccd8b462fdbb95582240ea38d3e15bf7070fa49988bbbe5a9c37177da979b8911ed14a6cc6

C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui

MD5 bb59d7351418556c17d40220ea4d21a9
SHA1 a54f21a92eeaf261502ec745587fa38e88d65b36
SHA256 fe42fe0e0336422c5d73f4cf4042f9d45d895285fb0e82d83ba72f103a482faf
SHA512 113711a600fee7cab8656b3ed48c95eb38f0367e12dc9fc646eab2508a236ae260440f056c72c8763351370c7a5e9373a21039090ed00660dcd5e192311a3424

C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui

MD5 5b8f7f6b8157f7a7113fd333c4da5d55
SHA1 0583ee3319606dff794b113fd3074d61b3415530
SHA256 b319ed84928f666638457faad98fc46e33acf29682bf3883242b58a9a10c2f80
SHA512 8b80dbfad9d99df999f65a6029bcd2ace7937726fc381bf46050a55d6758423866a7de66d665cff1a96bfbd62826ffb68144029f35a5631011b0e5046defa8e3

C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui

MD5 feb29164913c32ee26b34f65e7101d69
SHA1 6e646821b018c3ffef69d97dd051f716e0f08049
SHA256 4e0c9f9116e8a5b25c26c0983cff3c841cfba9e67a59cdacbdafb4414b4bd958
SHA512 4ba0658b0ce41818cad87b6436890fd3a6e76f61164ab3ce504aab17338b94eccb1ed45f482412e1d197f55917aef088ed62a0fb37f7954250da6942795627f9

C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui

MD5 c0995a8e3c42510f5496452b67d71f63
SHA1 70ba08f8a8279eb18f0e656723eb0b6ac7d3d72d
SHA256 64e498d485750d636a52743c6160ad79e6ee42b0d81708c5dac3b8613c0a8ceb
SHA512 063cf119d35f65a8f70101d085a3eb7dce230f355acf0b7d47104f6a0952f41d32db7a46db71010fc58168b25bead60d8de01ee747c1d966473785151ee95e73

C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui

MD5 4e9643d17fde504fca135bdeac8d102f
SHA1 50dd89f34cdee076fdc84c7e8f197662f40a8f47
SHA256 81b29b599f939ca5610f38caac27f7fe345b4379fe3d456a5e2b3328a5464b16
SHA512 db7a6d4686153f39b787a6406f2335b40defa478751f993e721453846625a0e3df70b1dd5ddb59ec61fcd571bdb77688f715cf90a3119143926286a0b36b02f8

C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui

MD5 18fcdecba858ecf2ebcd547cab445bdd
SHA1 4ae6f1aa57dfb9a8b5094dc51f8246f069f6d356
SHA256 eee911da6881fac83a95e5220a1f15142fc55a7de8c93edd5799a4124d820dac
SHA512 9c62316cabd5814c166cc57a047700820249c88378635eec123293e840e4264dec3912f87a709b35639f854b8a7dc9478fcb0353284e8109bae9841308a117b6

C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui

MD5 cf64ce0906a64641574214cc0c0bfd1f
SHA1 0a64a7e0ee6aece500cb9e87ed84d9de0535e15d
SHA256 a8d8280b6b287506cfc23151cf4c187756dc9ce296845bbad86d35531f2e2a5d
SHA512 89b353cda6d67701946e54948b95b62e01e03a89431bdf93a57890065153700d352ff839df5d25718feb456453443f41c519f6656fbb850373e23da3e185e346

C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui

MD5 cb929bc28f6264cb323849d1d397f328
SHA1 91c95c392bbc5da51088f015f5ce0f301324472b
SHA256 ba380d9e249d225eee2e5d9e94e55ee93cb685f947284d8226f1188e6a7db55b
SHA512 1307bf3ce06030d125f6aeff386913da22f5012f488cec7181e7dfee7066e2dfe497e89771a8614e1f3b8115c91b148be62cf6092a1509e1e7f9b277d80cfed2

C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui

MD5 afbfef88a9b53997569f0a3ee0e01e05
SHA1 3d624e63b1d483d037c0e3339c089db679a6dd31
SHA256 06df96df98d1431ef55e277c858ea3f71c80b955cf32733dfdfab98ca7197fc7
SHA512 df377ec3bebac25929b97ff8b01099e373d7561836d3963cdacabd23426a9cca18ddd7911006a40154a860a47926d5ab5d8a515f2e37e0dee1d9429f8b77599f

C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui

MD5 37f17228ce1f9f3c9c213239882e94d4
SHA1 415ba92f86f6123d439480bde143899200946d73
SHA256 b126686f7935114bf5dbc4ec589b89a2bb52b13e49462f4fb80c10f86822b365
SHA512 4d9f614c2cf2adfd98f9cd8ae17c5354220127a402e802fc0580e1af1774ab9129ff4b7a1eac16af5443003d655af41a7a11783b3ad62ba0ab73cff93b439309

C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui

MD5 b4ec110cfb0900830fca08c8261660af
SHA1 ef84ad80ff09adf723881ac85b60bc38e4a70dfe
SHA256 988656b9595fd4a3484f15506dd5a26612714841b6a81d1ede887964cb3c5666
SHA512 848ee1700f014de67d32a46ba765cceb8c5b8d67c7240bf84c059575d6ac8d8cdaf4ebe9074f725c6072b28acd8f493aeb27e272c44ac9d1eea7f18b568b71b1

C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui

MD5 d2aedb62b3243054335e2c792cbad180
SHA1 58ada28cd83a32df74726e7244e57945ae2510b9
SHA256 6d53f4e7caad92f04c45fff977b604b314bac3b23695a6aacc406a593cd5ea7c
SHA512 2f8d9509944bab2347325b1903673f70440f6d56df8cbd622ac6a2d22d3bcfaea006cc0d4cb1d360593d23c50453bf20673a39645803f17870560e652f987790

C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui

MD5 ec5e7ae1970fc6003688885ae8001099
SHA1 5c1acf65a1498193bd43086f1b6f737128b81a2a
SHA256 eaf0b9f80b2e7665401b070156daf39a3353a25bd5999eb2df342a667b16e653
SHA512 acdec9a250cf235abc4292afd4ee9157e3cf8ff7e2d7ec613b28d3b7a5d8c4014db6d0670d50960475e431b99abbcddbe3105b983d67cac59fe2addab521ece7

C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui

MD5 a732812e3d3de66afa20f9f650d28219
SHA1 fad828d7f4c08797b8a77490c84e31475a61141d
SHA256 4e1cb415496274474c5b5495d3516de1149cd11483ce707e07c40b88fb046aa2
SHA512 92d0879e00540dd7b70a21c233e5261592fd0094e021fcca70695e64d8ec091e331c305a090eb47666188aa4593b50267fc34330d82e5fc1439dee44fd14c1cd

C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui

MD5 a49e1e6dc856a0c7a2e8750eb05b32c1
SHA1 c9c34dede4623a9395b87c760e9c982fd173528e
SHA256 a5bbaa20e9aad4b38cc53c5fbc45a7b1673953949ac322e9793d347837977ba4
SHA512 6ccf98347a8d47755424a7da4066584eabf9b39ca953f85e2dfd35c361315eabe90e49f23d3117893d197cc26398c351c693d03ab2e84e914dea440ea8399585

C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui

MD5 30b99e7c3c4962edfc55b8766350420f
SHA1 51d5b5a2b4573728ea8564c8dbd7d91d4ce20be2
SHA256 713c80be0f72db3fb6b804b4f2b020a2adb50152d224d972fffe4b6e5bd58629
SHA512 7157de8fe213ca5f18047071979cea2e8307c61120a9194f56c6c01f77246bb45a636a1cd278c31a87ff6e082fe0285d894d6bad100a9c041e3c306914ec68ad

C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui

MD5 92cd7564010aafd45fe5582fe5f17dd3
SHA1 3ff6aa4cc997af11a0a57e5ac7897bac10984ced
SHA256 75c9b98dd537315a1627748b01fbb04b678166ed12ee71872f24cb029a6bf2ff
SHA512 ffcb568d0ac0e611ca016473b3de062961e6719aa770081183b7a27d1f9c761369b2ff010fce6f2910d6a598a093661650c08422c116c95bb9023a83009ce701

C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui

MD5 10d3c4c7fcb3ebfea8fae088a5ea40fe
SHA1 6295ac9d5ceb77e4f6f08178b172e84e08fdfd7f
SHA256 94b7e24e67c8f77adc2f7cc80acca78a6463a763185306a9bb8fc73d4c29dae7
SHA512 5e88ebaed7a51ab8511d8f9d9272345fb17b9c9afe9fe1b63284bbe775e0541a3d982dd9642d03ac84903c32b23ecfd6a6bf45a9223de97373f8371a9b81efa7

C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui

MD5 2efb040425d5fb8893d0aaad48d4be1e
SHA1 0d52b7c38703327a483dc3fc9da7c8b09a52e949
SHA256 7087562aab8eb286c5fbe934d1868cc51ad7f65bfe6b08e2748967db1d16f55b
SHA512 96bafed345ec3223b75348cd435813c6cb3437d6311bca242ba6d7a320d8e7c9f75ddf00a8b62f61b159d77dad4bdd15b274285f62af0f1eb9718cf44a3a3b4b

C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui

MD5 ddc1d6444a59460c07266b0f72d8ccf0
SHA1 c63f2bbaf5deaac1ce7b3e70801d43085010b07e
SHA256 ff1a922ecb203d1fb7d694f6235c55363952c9e73ae7984211c634223f2deedb
SHA512 ee02c506b2aecb14a41fc049bfd02b0cbd7b5f29c8327746af4adf746e3da70bad597f1f6541c4f8249b3dae30d225d5c1bb693e570383648c2e7f0fcfd1000b

C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui

MD5 85e94071cd9dd27366501055ebe2fed2
SHA1 b1ce7fea1a1b7697e0899a8c625d79994b5b2b27
SHA256 9fbe17dc7019c895eb5e7f88231a4330df9eb6be4fdc1faa2fde12a43b02a064
SHA512 c148a3339e3c458d4f397960a4a7f671c98fb9040f70bb4d87ea89555e85f67305ff56e4d2fe7cdb41910b5eab21d527c46b91d08597bb94c7665459d3d2a7d1

C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui

MD5 fd8a423e61ef88d5ed7f857f6573263d
SHA1 fcb3571d988a63659d80480393d5edea86437645
SHA256 6d2a35c3608beb1c626d58077b149102b848ff24b5ee89b9d3bb00bc1a572492
SHA512 5046c3b6c309cfa3638bf85ccc6f4569517104a028497840bfe5f4c906086117d283d403c1828878cd23ffce4370e77b05676a7594109926f4f6fbc641f881e5

C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui

MD5 99790a6ed8a206e087d6fa39b207513b
SHA1 5445f3cb173f1be065ef9e797b4e0e0d8ddb795d
SHA256 eea6981a222db9489b2561c071977780d6850545e68af2303eb6f19fb98e9cba
SHA512 16a23c54b8f293d73e3a7cd8105ae4fde59d6b0400236b642166d470b84543c9fe807e46ecef5566b8a5585e8816fcf876248d78a0516adc5f04a40c9828f189

C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui

MD5 40c30b52e2088a8bd7fa0298b0519514
SHA1 f877feb8ae122030e1105cf60f8ebe6096cf43c9
SHA256 9a0e8c3d1f2d6dee20dce8355ae9d2ff7499b939068b78b9701750b10ac6bc65
SHA512 ab26f248c056e090634bc8f877ac76ebd598c407205060df0d96a8713521b966e2bd1944c3493c2e4f911a0372f93c354d6764a3ea16989c2480f63ae646c96c

C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui

MD5 3cd8b1b97074c744929c9db0781b0a08
SHA1 b44513e8f12d47778077d198f6107bcde56a1d14
SHA256 4cb4b863324ea76ff9f9483111943513701030d13b3da68b786947834f96fc27
SHA512 4a4f8ba3e194b3cb8d017c6d3184cfb3c29223a0967d7a33ea78c3ad300a30dc1fd7c0672308a18a52ec0dfcd97ba1ff3d9f011dbd401950dae0697fcee89051

C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui

MD5 483d5e8a668d5852674a684adb83504e
SHA1 ff8f55d8e91a93b2a9b056e05d6a0e23223b857d
SHA256 acad72488838ffe654e92c3beaa387771b7c7a589c8b9c0fda11bbe2930c3fcc
SHA512 59930ab2033f27463c2e2d21c2f31a1d8e4983442e5a6c4f050f3dfbfd030fde86227bc28cf97bee9f9bd48e5ff16f20ad74c70c94a0c73e5f37b6bbe4f06b37

C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui

MD5 fcb479c1fff9792ab6b2d11a1b41e8f5
SHA1 78c0520a016de847c032ebd0169881ff8625fe75
SHA256 5fe5e37a44b9d3dd3d679b64dde0d3d67cc3d056934e0bc671b03d0bfde318a9
SHA512 7fd5691dbb9827c608dd1149f9e80a01c0c091480beca1612f9857804c836bba1d6a6d267fdf8fa1aa7e6963e03d4b675700589ff34be32116aaa9fe4d65a5d5

C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui

MD5 4d8751cb25704d4fa2d1104c6d12b304
SHA1 93c797ae011e03d5f8dedc602eb05cf195d404c3
SHA256 8d44acfd599b187cdb6fe311dfe029dd3cc951f2df8504732b27facffd148511
SHA512 fd13a10bbde4de376d72235d26fbd14b51a352fabe8db793b86303115ecdc5fde5a13c1272b5aae8fdf362f8ad1eacb1afeb485fc830432d7ad8ec7e7a874699

C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui

MD5 daf78a8619a6a73ff2a740c2c48e574c
SHA1 2eb6b91a3e25ee24e44744bc291f3db9ed952b32
SHA256 7f0d9ded3a01dcb8c74d49f75f75cde6ae8b78f16e205e7979fb4acdaeba06a6
SHA512 3ff3a24f8204da22fac864012bdefea37634813816ce911fda2467c531cec2285e8ff85e22eaad2b8a0f2ed963b80811f34dc5034c258793f26a9d294eec2055

C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui

MD5 db9ef8272d8741f6d71249e2252aa607
SHA1 93b46e543d278632c11c64d0dd54837704a5233c
SHA256 8061455548d0c2ae9880ec8d1b113e428e4447a1317371fbdc1739e8ac9008ae
SHA512 0328ad05a7867c1f260ab93b30ca280e8441f5e31a366f7552bda75f9b186b42ca8b40badb36b985fada3e03247138da28555da89c4ea46be824750407ae5c3e

C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui

MD5 d4ef66f1358e02051aad089f7c6fba19
SHA1 5e474ff6eecaaceaddef4e3e35fdd02221352eba
SHA256 7eabeef32038c32996a82c5334a3500d7ef5e0c365736be92c70481de57b64da
SHA512 fbd863acc11fe2c11807aa31a221340946b762734df0d66f38a7e9030b66ff803421df36e2febe8154fd018ea12fa30b1a8b8ab65f06c6473a319e6a26e97a93

C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui

MD5 e12f414c28dbe1f3198a25659ed3dba9
SHA1 cbc9223d9a4f4078fd5ca960cee59069e2e0038f
SHA256 9c2cf49f8418e413ecc1fd3fd2fc7797cd6ee6fa3f4dbb4ad8debb3915e85a17
SHA512 d60df8e42a91b52646e6c96e1f58979ce64a415615f0b98763941091aa5c7863c8d6311c6c15863f3041f61024e40a3087afceb4bbae8c4ae3e1e3e0344adb2d

C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui

MD5 835d6ecfab2e7c49dfea00c7df53dac0
SHA1 957aae477dfbce4677b9525de149488919eac223
SHA256 7ac53277953dbbb570006ab119d63a30fc42c5c1e0b710958b812d6e62736811
SHA512 b26562f29bf96fe56e58058d8485835df595da76f804adfdf60986c087fc6c5c39df558930a20243af82586d9d11189105fc81c09bb8b53e5acdc4ec59ffa629

C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui

MD5 e67998d55cd95a452a22e39a566334e2
SHA1 0fd2fc31c8fb3e8a647b8b0b60b2ea0ed75018e8
SHA256 d05f6587c75a090a49ab0b7d4bcf7f12d9f93dd0705dd96643dd6b59b63b92de
SHA512 9d7b99f3ee66a4e5b429f557ea79f464af3d271fdd04c632e1aaf78fee7588f9efb53bf233caa69240801d6212216ba99dc34e5f58b56df8baabda4404d3bcc0

C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui

MD5 2c29ef8155c3baf8a6b46862cb13949d
SHA1 a2123f0c49cd4cc269a209452356c8544f775144
SHA256 d474f59d0b97d2a240e91b2fcb1034b98b0c3c7ad90089d1f0659ca6a897b60a
SHA512 79b2a855340747f77b93363b14d42853a38252fdcbe09211e52578fcaf1fcd66393e44161b02d1ff9d1005b0532223f7958c96638b12bb7ebf3562976b57200d

C:\Program Files\Common Files\System\en-US\wab32res.dll.mui

MD5 fadf24c016e0d0db7532c8001dd42f24
SHA1 743c0c7d83403d3183c53c89fe067d7eafe2fb9a
SHA256 9feeec2e170cd243d10f20c2b166cd0b410954817348eb9246ff42e079159688
SHA512 9550d61c5f4b791393826e338a874ba2dbcf800bd81a42aab353680999a371c635da10061c21e09a4d6802a994b75efe530eaba29c39028a8db0fca86f0aff61

C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui

MD5 107493305bc79b849c64de90ac41176c
SHA1 316fc2bc325031775e0002e2f1cd3ce70ac9b619
SHA256 67cd0f6b665d5bc8bf9d1287d2462de3aebf4fad4d48a9199cba8e17b3d47346
SHA512 eec3f0023ce76a656121ef9042688418d855a4e7f4dccda1e858e7533520dd822a07b4ee8c2a62005b184ff6bad0bc361f05ac64042bef924b93c4535e80ddb8

C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui

MD5 9ff62d0c34b0ccdc817afb4fe9955d67
SHA1 60a3a0b85ca5b6b0766fea2a8e1d0f9d1b7d2f9e
SHA256 21afa3c17298c78adf05a4b1ebdac55b1aeada829ebf2a7d95411ba9bc2d7dd6
SHA512 b591a2647a67aab64da4ef126cbcf7a021d737e0124efc3c7c145abdb62736c2d1fb308b5a654a388606567d10a21c77582bb18f0962d814f76beff4cbe5ed52

C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui

MD5 55fb675e9187200b905fe7a4a3b5fbba
SHA1 1f91efad19d017644c66bb72a6faee85d5c14e86
SHA256 d30585b6455fff56b786d62832c9ec293165ccdf0c1f8f40029757a77bd51fdc
SHA512 7effd09ced0990ad2d299ce2aab978ba7add2b37660cc6516462ce71157e01b46b9f5d08f977472fdc6e35626af5762587ba44d28db24a6a9d4cd790a75e8a0b

C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui

MD5 b7d20f7b353cbd71bcbe9320b3640661
SHA1 f9b13694fa5682e60c60c43c8e28b1ee5994c35a
SHA256 64bce5154c03ef67980c61d1c55cc7d7923769e44bd1179aa8f69f12dae1a59e
SHA512 af41ded60c22eb5b7b9db679f8c4100c43afae1f9872343088915b4c60da6196f43decae578a98a2cc798150ba4968092069423dba4916d0a29501ba88971808

C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui

MD5 481f2e82897319d33b2c213d81c4bc10
SHA1 602e3f51130cc791aef285d136f7fdc656645a1f
SHA256 8fdb31548d6b2d939a6d6e2613369655d554b5fd99c063aeff51bc795e567750
SHA512 6c1a5e846b09424b240e539a5b6485220040238575382da0bdbcecd4b45c1d850736cd060ca953be4784e9b8e8232046356daa91bc54a344cc5aed8f715994c1

C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui

MD5 93c28af2a9649e804d357099248b49b9
SHA1 acca4d30760876a540d71347babd7d71beec6d68
SHA256 55b0a70af3ffdea9b095a1a82548ae068fa8c7d8e87e91869cd0aed141490553
SHA512 2bb894ef8a7f229b508f2f65ba09de27bf8d75593d85f0a7060084bf7b7cd012d2bea60b28b15d72d7e49950e7ad8f5a16e3473f5e59ea167ef7df039729007a

C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui

MD5 f7a51eac496b7256b77095c10ea93307
SHA1 ec7dc31b79578fa735a6ee73379f7f15601a6b6b
SHA256 b88a0785e684b72248484b2a559a906eec3ca8ef98b01b47ef2796218992b9f6
SHA512 669146a36629591befc3788adaad69b64e823d364b1173b3bdab47ca26d05ce36e05ce9369f9f2683057c73e5c26fdac6a334b9815c28ded322526d6af9d4253

C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui

MD5 abdfe13ac526285e9860f7ff62fa5ef3
SHA1 0ee9fece169011a3f74c45c18060b7f413145f14
SHA256 ea553b0aea040d7665db1b8453ccc8ac587274a763a62f937c4d0e2a854373c2
SHA512 ea15c861a4f596acc066d3273c5ff1bca2c94929a3586c06fdbb2d52c5b2122f2f16825da3dbf5c73d0d29fa418571e3c7f4c49b4a80797359e183a89c46b841

C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui

MD5 52cb9a7713f2c0a5f1da91eefcb9eba0
SHA1 7214eb0098196964f694ac889514eb354ec30e98
SHA256 54d8f324ce5aff863ce486cef497dfd814792078fa37eedbda39cc50354cfb18
SHA512 8ccac8e2297625ce5f403a71355a1e6e951b0d0ca1bfc3497ee8dd22627e605abb8d7959b45e5c44fdc0d4d6cee994a299f7e80a91a169d2272976ef9db704ab

C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui

MD5 27bfcab1e15ac266e3ec1c1cdad6d243
SHA1 7d61ece7d6450e0e57f6c208b20c36d4e875e45a
SHA256 562ea006cfed40a7ee9df5d3ba3041f185ea8e399acdc25bd06157845407d00f
SHA512 08eb8a1a046815ea32afd0d27acfa5d9c54faf7827a6ce0962892760495137b88bcaa53e067c0e7732678f48b33929a8f70969bb56a4c38bf09b5bd5e6a0f77c

C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui

MD5 920102427a1a9d6443a8d036156fe28f
SHA1 619cbe38a03f476dbb2441325bc0737a1887156a
SHA256 37bc317f120c627a8f7364f1686428a94b2397f5e03491eeb05bfc022bee3e62
SHA512 1ef03585bf7aa29c0e95b37c3011fe08a4014e9b133d869a289390d0717e5ec4c48c109eaa1b0ee129efaeccd9827610fdbd8bb48f8d53a08201b5344b964948

C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui

MD5 b87b24c6b17a8dcf40699229977b643c
SHA1 000feb05db7dcbd06cb99400fd873ac6f41d3603
SHA256 e3f830c5bfc840e21f3324de5a10406fa2b974469c6e54d67dde47ed044da86b
SHA512 ba305d0ae7f2a18c87ebc00c3da1b07a79cadf4c4233b1a8a2812f32cb1a58833b62f3a2a226a5e0b6c650b69136c83a60a19fe9cef547d9636ba3e518d115ee

C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui

MD5 a54f2205992d15776e0a4224288f07f7
SHA1 d41b0e21100b7a771660425d5713f1062b63da40
SHA256 de93c2587fd9cd956b4b2da08a9a48153f68264b8af19d3db62d05cd83b9e026
SHA512 ca1494ed60d8f75d89dca36fd9caad2b39f67767b88172e4b420ac7a411bdd64eb1082c26c27b8692a1f489724706d2fbf2ce6a426b4701702dd62c59582ad35

C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui

MD5 600cb28944c3509e4e76a13c36b65377
SHA1 74fc831507f7ad386da50366f678b3275c21e4dc
SHA256 b56f8cb4c41768fec8be2b51d73440a234d099b000600f66bdd9674b93832ab8
SHA512 ffa0060f69a8cc2ad59504bea5ddf0717fe32824432fb8a40c6ec2882b190b61a663c26d8a5b693f2875bf458ba75a6eff01092486e25f8d987b331f30a94d53

C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui

MD5 8f5279604f85cc6a770a03a5d01c39b5
SHA1 750f4645ff1d8e86dd828aa137a6280ab1d60d34
SHA256 20af791f11607f71671f2c5b1ef4e42cb354e116477f5998525f65744811792d
SHA512 5b93cae41a656fc6b6ed018aacd1a6dd3546e51e95397f8778e4e3a3ca0bd667546360e5763eb96e8d89a157e1701581a232e72332d10ef9fca9323d21657685

C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui

MD5 23022d56fc293bb0d2ef15eab8f73462
SHA1 a1c04842e9f6519885fdb8d621dd75678c9fb3cb
SHA256 a66837e0e547f84c4193d05ebb95253b7275b51bfaf6ea1d33675016d0e7af6f
SHA512 65d7f297cdb6a3bc8f7efc4092fdbdd82a39c2925e8693de497ed101c05228ad985307d9fee9192a129ae6465be8cff7d3ad68f1a6961871eeda1569bc9bac55

C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui

MD5 1535383da33bd17734ebedb1413d53ab
SHA1 ba4617b548f32c478e52880055f6880e17bc3e2b
SHA256 c3b928ea5a430c07ea671944df351954e88bca56a96677d57208cde12279d0b7
SHA512 a69dbf17ceb21858af4adabf86233593e4637c763b15b28d8770f7e865caf7cf05bfc4a3b7aebf02457349ebdb61d957dfeeca81255a73ab43271e382bf64274

C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui

MD5 d9395513ed70b411e037054d581b6a8c
SHA1 dd400272d106dc99120e2c004b94a306464ac6d0
SHA256 57849a579e9f4a5c61ecc9b6903d157e0e2e31f53c57d4729a4511d0359cdf55
SHA512 3dd4bdbabfa60fa24c9dfecec74279d1e32d9778218f75719a96bd11eabf8506e54b2a697ecf3b04961649d1889d3b2af859cb87bdc269acc4108c5f791c9ca1

C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui

MD5 92ddccfe340aa4cfe67c54f1a3aacd2b
SHA1 7ff76dd6a21feee3886df267f00431099810b628
SHA256 9b618e95f6241f71894bb7a2c50d3e393666ed07ded6d6e7984a53c1e9da6c0f
SHA512 32baed23e83ca39463419c020477555c61203956f3c2b816a37af19d0847c6f39ffa6ef6dfed424ca326f1bb01e31c55d8f586140e5ced39d2a8b7a1b19b24fd

C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui

MD5 b3f33d7315986bc48b20ae6c983eec7b
SHA1 7259633fb6acea1c0e1ea1433eb7194ed685dd5f
SHA256 c3cfec26e39015deb08e4865dbbc990b20d6ebd25911558525fc1f022458161d
SHA512 bb41fa2e7b49027176cfafcc40e6a31c6078e202d6f83db5e9fff06046fd285bfb0051b538b4260a28104af9f2f0f1b2bb00c21fac88c0289121c5003972858f

C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui

MD5 cf62546ffd7ac9ae916a47dad59196ef
SHA1 915b034b8081d5a1b3436b8da457f0e069109432
SHA256 a1a362795ecee32460a91cb6135e8740d961c108885801095b3f2d0db50d7b93
SHA512 6062b5a9fa3d31097fd0ebb2a81a27bfffb1f13375625aeb0f4e7e64041abb673403e7941eadcad978c11537a789d8b797e7219bc76722844cde971891f14df2

C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui

MD5 2c95f6d4fcac2a8ba38c95629f10531a
SHA1 da6f06b11141faff28dfb8b33d8b642d134f1e99
SHA256 cd7a36bb0a294f28d0a82d47277e520d80413d762a52fd9757a8e66d2ac94f40
SHA512 fa5dc6fa077441eea2dd51486e3bac2724e955fff5bd8a913e59046ccf5e16a29492fc8031cdd6201596534bb0fbc9752ef109f56c30e02db75bb7702c841e94

C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui

MD5 399f778a0a1a53ccb328b7d5aa121f24
SHA1 acfe83f2236672f5588c744b1507a6f072f66985
SHA256 3ac9ec7bdd00b2a906762cc4e120600f854062d7a3e487c094cf7e9d1bf42778
SHA512 4d5c10a66779810984831230ede1819cd9affa1ed8d44ed57c25a27b9b467c7fb3a77392f284f8fea4c9aa476c9e2562cbe82aaf728a82ed018eb5cc085d9ef4

C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui

MD5 7f301a24f830c64326aaefe8287ca0fb
SHA1 9e8c119f0f7b62475b31cffad27a8f6bffedf8c9
SHA256 cd315e50e9756d5ea20d76c093c7e702f925b3bd4d2d347f7cdd043e57dc72ab
SHA512 51b72d5ca497429377b607d579072b527211b105cdd9d18e699bce6a803e3157f97e5f51d36df0a4277839095cd33b9f903737ef8ada91d71b564068b1500f92

C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui

MD5 6d44b5bd64e69b7f2278320ab0cad559
SHA1 326b4273216a49cea240b0af4b223015544dca76
SHA256 6a7ebe398cc6740a2dacfddc1c590a1a75c49b1f22e71900f911d9b2806e838a
SHA512 6bde892fe5f2650052f4689ae2557b0f708b77933cdd23343ebf6944de3e8e18860bf43c0a764c0741e2cc0dc2799261e96c8f2cb134d475967260aff507b004

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui

MD5 945bfd95538880faeb0015fab5515116
SHA1 be0b428191449da447c39a38f57717fcdcb7a40d
SHA256 13beea5322b80daef7af54fa1eb08acd173edab97cef7bf5833f14d84cb7b604
SHA512 acb3d90c0bba1555d4b0648e7b1fbe8f62c1b17c35250d1ecc6454f130783c5b593eefa2fa83bcdf08f1bcf4c639838383bdd5967b86adbf06c34846d69a7c18

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui

MD5 2c5d75ee7f839682187f87cc7e15de23
SHA1 17b52b5ee5e1311e99e79d5e5e4990308e04a0ba
SHA256 0bb1dd16d0259de92dd58815a8807f35da9ebb31818e2329137c5eed903ee370
SHA512 0532c031a2a83c5d4b0d6fcd5d6703b2d9c2f32ce9826934be0676a0b77a10f1751ba63db42d5c4b837baeb321b1d30205f3b40d6c8350addad14bf6140fc481

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui

MD5 89b4a11b944435905db3459546bb743f
SHA1 988e9fd56afc2be256b65342c52ea015784405c3
SHA256 deeabab0fdbb8c1a0364c2380a86b80eda45de4d400fcc3ce3b1d07eb6ffc1f4
SHA512 074c32b189a5656033dcc1b5be03d496d026752fa28e481e1afc3afdf58478f5a41cfc10946f6935bc2626a5011367e902a36b9eadcd93ae9cbd1193825b505d

C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui

MD5 38d9e5316c405cd32725c7c778558d62
SHA1 4c2cdba0b21d0d07a89f4fd9291c7e739fabab2d
SHA256 268a05373f45769e9b4b376361b8f616530c59eb41a47c4074fa9e0e1cd81816
SHA512 8e99054ea0e1aae973bf956035855a97b3c339ac92b21c41f5f7db198da119d5bac3dd1e56f6de8aa803ca8d1e57c37524197994256055625e5dffc0a2fa84ae

C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui

MD5 9658d683921b76606a1bc2fd44497506
SHA1 f28fb309e10484ec787ad23a57937cd5ab39e4e7
SHA256 5f0bc7e0efb77977c31bec8ebc55df400f23709ea2e36e0a4d5628595e7f6de2
SHA512 bea3d75f2ae3a9fba7377dbcc57852898cf595030bb3822a8b3b4605b14342f80112b1d1d3840caf9a981d94960c82f41af2f0a4443315321d93009d62cf5432

C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui

MD5 bc1feee9e511ba131a6077c8637e4a13
SHA1 34c59defc1b87f5b3345c2b22e47b7c6a13b2d4f
SHA256 14fb5c340081c993d9d27ad154356e01863085dfba38f7979765464f10a91e36
SHA512 b20ff6b77cbe44ec53b5f315839cc2bd4bad464929b4042a6bef4f500d556b30bb3063ccd46ed1041a328da1c42e97ae88e063798c7b8c4bc424db1672b9753b

C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui

MD5 05e1d87fc4965c534a14e5002e9c7539
SHA1 1d86094a55c0ead78fb42f9c9493a10d24441593
SHA256 ac3a19521ac2dde4e188b3f84b1fbf6b279c913bc0275e4e4a18e4ca2fb98720
SHA512 19c17d195412e1f49749351bb9770feeb6b88427451cb9430e7b52e3184d2004f4fb85c4b9164f2e68907389445398794d8a20d25109352c6783e67481e580ca

C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui

MD5 01d913f5c2b017956d09a1d83838be2c
SHA1 bd378be4b9bc5a6768beb6471329925e69184049
SHA256 d38368f531fd281bcb763791f502102310fc914535b9d0c30e71005ca34f4ad6
SHA512 64151904737fab630231f5dd9f7c6ba4990c2461893530f5e2c8bed301e2f6f6c70922be2d41635607f9b6181ea17d25c9d092a809bf06a81c802baae2de206a

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui

MD5 18c68a1199ea72ee42d4f68e24241f18
SHA1 78b10d37e015b8d5ab49861b90fbd4dd3cb9a4eb
SHA256 1b17eb9b533d21c7d3393e93679c122dfe1bf05eee2e96af3c181195ab9f282c
SHA512 d9204b88b74f83d356f1f652608c5c52baad4b2fa3157b95a76cba442b134a6ceabcd829ccfdc0a0ce5ada396e9f76a6edda91c9aeebc04c3eead5890a6e13a0

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui

MD5 e3b9b3bfc4f52fc5288d4f240cf7671b
SHA1 4f5d75dff9bdeb47581f3448b7f1b6513f76ed56
SHA256 94f3ad5a5e1d9d10a16f141438f9172808ac436e5ffa676074cd249f00a99913
SHA512 c1eb5b9205178be31c0a2560180bb4ee5c153df888a2e4cc41a9ffbaf8ed56e939fea4d1371dda808a59dd21a23162aa2fa59392aaa1c41d446ef0db36637011

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui

MD5 1c732a3fb01996c5fef801523401a564
SHA1 d52c11f5a4834f36e1eda2bdccb4de27302e73c5
SHA256 59a88663628d2cf2183f0138dc2dfb91c7d5f81381ff5f8a7b8b36a26595bb9b
SHA512 5122fbc7b9fbdd4392ee7ecec6ee07fa0d463f85562bfadf7719bfd9be44c2ed67e5a5a4dea8660716d3ed926f5ce9a5226b8a52f01a6f2bf18c9055f0393677

C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui

MD5 8ee83ff64823291836bca6d03bebf48f
SHA1 22fcdc4c273bf7f9cf423d54bd00b6b2f0656bce
SHA256 50cbc60e0af04395a2e96684be3db18e9bc8c370466389f0b85096215522fa47
SHA512 cf5a25cd9251b57663d7cbc724a2063a2bfdfa0c0039e4b04ab5b984acf4d5bf7c3e42d96f67fe7f4ffb79b3c2a402063a3106e7590e5a2b4c0f401a62819400

C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui

MD5 ed691e0b5b245f3d93bc7789fb0c8c16
SHA1 956f855021c9051398d6f668dbd67bcbe4ece49c
SHA256 b190defbbb45a3197e8c603eb65de14279d5cdf50f63604ad5e53db1b30131a9
SHA512 a5337a3deb45f461b2697a70930fdcf9ad4aac4863539be74307804ca3b15e3500e875b9b1370410a6ce510f1f43464b0a28bfc0b1e202bd806f434be8517b43

C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui

MD5 70d5051016a5248de40649d855236c52
SHA1 3d08f171161c2c7102265681bd5b04369a00bfe6
SHA256 d2e8f2bbad02e1b8dcb1e64f137a3ba0d2bae9fca9f4f6d4162ee91595163b91
SHA512 c1bf66a246dbd6f89467ac1212e2a9dce77b40e7893d79a1ae28d79ca7c061d2a0e19285bba703fb82baee4943b5fd630527d6bbe0ff8a25f99845d21059cc22

C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui

MD5 af1b91ee3e40f255e871717c94ef9d50
SHA1 f5b5474b496b4e54ad135e2b389bee1c274b4a8b
SHA256 0e49fceee7ad310004cccd1434b9a5ee7c9b2093cccdccd779959a548fdab576
SHA512 08865c5af154122e6bfd4e7314415aa55a2c94efed86761f5a090423a3ad1b9fb037f36fec50e1f3be56ede4c626f717e19778f06764284d3596b560460a849f

C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui

MD5 f3d5c716c14557c77ed9ed83e419242b
SHA1 7f287a2652e6ac1cee5d9eaa3152f34de117f314
SHA256 0c586c5b6873cda6b1ae41f125a4e76f02e02edb76f37839c1ca2061ffdd2dc2
SHA512 8ffa69ba955a35dd4f8b336bd46e93a40bcf857f9ee5e7cc7e2343cf14f9122943255d3a1db46a3e26724c9962f956ae478cab20454df853ca712345746cd787

C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui

MD5 a02966b9678c6a76a6dec7c8f4409064
SHA1 5cde26e6ac765b080e8bbffdbcf0b6e9f1f561e0
SHA256 13aad0a217b323411ce23a80273fd597d4c267ec4218ab8b645a7982cf1adf7d
SHA512 f10e6d172fc11a62ad8684182c67a415aaceefe67f7597b98a23baa845f17fe2087a68a3d599bf5ec5a44150703845344d0f899221bb77886f47ab9cf976994a

C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui

MD5 8cd6cc2f074f629b938deb1478738634
SHA1 d5dc6bf54141cc2828a18dd2bf7f69f43a350e94
SHA256 cb3077d8feb75982a34ef194f6dd7193c11878a3d0685bdd804659f0c0cb5b14
SHA512 165fa7506c485da4c9bb5f98ffbfc1466b68692f34d33efef3075deb8d98c8825e69221fc1af0bc54e1e29fd54129326c80a882753633eba9df0217f5e22daa1

C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui

MD5 7eac699344c086f0ff2908ce304175bf
SHA1 bb4b10e9fbda392aff64312a5a4d6b46fc34be8f
SHA256 9143e1cf199828f4f03ec35712ef046b3b24d6f20aa3c1a541797ea1a0bdc06a
SHA512 da9123af6998276f387aedc28f04cd027f719f01b83dff0c6136efac72afc6c0b8d2a6e5fbf7804c64de5610fd3dcbfa92246ee082a904769ee32ab8cead7a7d

C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui

MD5 d3666fb93627344ff9e131691ce0acf5
SHA1 943e9e30d6225db91e7d0cf6fefb8095627ff2aa
SHA256 b48040f74c42fac956b5c3dd6213b5fb449010510b8524fd7fb58a4e9b4843e1
SHA512 049a49e6e5b950720c7000365c721e49eab73f49aa47405677fd49d6c64a3b812b2d0ec0d924ca23061a9721b79b4eaa0c5ddd6855d4cbd9442c7186dec84c53

C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui

MD5 c3392b74aabba2a289a11b58e3ddee82
SHA1 1e9767f99239331c94a1ed2b0d5d24865ec9bc56
SHA256 c0018dc438fd439c76004cabae4fd4513bfbb3fa99a4e66d9ab83f1cccbbd033
SHA512 79f627f7c2290b72a5653647f0eae496d6057c08038409cedc21cb49c70e58780af620a3903da5447b76b31ce39c1b801c8125dd752c4bbf3ba4f4113ab99bac

C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui

MD5 11406abab49cbaaa6b6f3af88c882100
SHA1 f717089560569e5f8de73ccbf1d9dd1d803eccce
SHA256 07afe18be8ad54894d249a7ed1f8b0a28822575f9e670eca5fbd1dd35537ad5d
SHA512 d1a6325f64b15040ffeba30179968e4816ceb50090bd23fc75804be8709703468a9d2fdb0baf50254b9b771bd09ac7369b1731bff6d21cbcbd44f0287863d7c3

C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui

MD5 4bd9e2d53cb08b41007cab31be9efc79
SHA1 3fd8e8fefb816253e1a2782d7ae5c013dac5191c
SHA256 6441e65ceb2381f8c2a9763cd2375cd8a3b4d0bfd1698695aeab5aff789533ed
SHA512 c7130c0b4215da7711c2f1edf2e0309de807fca11e5214a9893f5b0345aace4257e063898dbf644f3219d00d4a1546667de8066eedf8590dfe6dce92c914735a

C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui

MD5 478ffe7710409a799bad1a16c85cd38f
SHA1 01a5bb4d01892c708f432aca37bca98ba8fb8089
SHA256 a1ce9b084a89c69354f517a15a6d06f041ffd5df63838710745873991e9180d4
SHA512 4b666d2ec5c180d9b8462e0c40dcd7413f83b29528c5df2f56efd69a52545519b9bc28e4865589da7f31457dfc80c45adb6baa3cba1cf7f7e5d75e5810b41482

C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui

MD5 5fd80bbe01aa49e9353bab9b6ec93d1f
SHA1 16aff20a6aa34aed55e743db9b09d45adca93fcb
SHA256 0805cc104b75979bc9cf7f123e395ad831e2ae625278760bc403feb3a3fd43c1
SHA512 73adc0e59b92839a1ebe0db3cf6296cacc28e93700df9b28e45dedf98b53acf1ae1baad9d8452e0b864accd3f632fd1637b0bb0d904f6a32283daf45749d8d6f

C:\ProgramData\18C3.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2192-19957-0x000000007FDF0000-0x000000007FDF1000-memory.dmp

memory/2192-19955-0x00000000024D0000-0x00000000024E0000-memory.dmp

memory/2192-19954-0x00000000024D0000-0x00000000024E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 8b602077a7bbb9f69eed217d5be9f299
SHA1 02f195a708bd9d3f1cc488f063329108aecf0eed
SHA256 51160740c2a8470e37d29484bce2d865a60ee903f906914372ce4c03c3de58ca
SHA512 9084ffd437bf4d99673140b40d63f729a7fe61c9abaa9a409b558512d9a6842e442dab2ac1b30bcef802576431d1a602fbc4c8290badc38c375422a64640918b

memory/2192-19956-0x000000007FE50000-0x000000007FE51000-memory.dmp

memory/2192-19953-0x000000007FE70000-0x000000007FE71000-memory.dmp

memory/2192-19986-0x000000007FE10000-0x000000007FE11000-memory.dmp

memory/2192-19987-0x000000007FE30000-0x000000007FE31000-memory.dmp