Analysis

  • max time kernel
    104s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/04/2025, 13:28

General

  • Target
    2025-04-21_f94d17b5f232e9cfd2255ca9823cb18a_darkside_elex_lockbit.exe
  • Size 147KB
  • Sample250421-qq281avxes
  • SHA256 ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Path
  • C:\jErs0FgGP.README.txt

  • braincipher

Ransom Note
  • *** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! ATTENTION! If you do not contact us within 48 hours, we will post the record on our website: vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://brain4zoadgr6clxecixffvxjsw43cflyprnpfeak72nfh664kqqriyd.onion This page can take up to 30 minutes to load. 3. Enter your encryption ID: DOuB5Pp206I1khMQMjQLVqnpqbROD+iJrJWwtl92dTQLsNqq8RdnSymqONiThx7G1rN+ddOiF8kXtGc3n10XdIN3Q1WFk1 Email to support: [email protected]
URLs
  • http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion

  • http://brain4zoadgr6clxecixffvxjsw43cflyprnpfeak72nfh664kqqriyd.onion

Signatures

  • Brain Cipher

    Ransomware family based on Lockbit that was first observed in June 2024.

  • Braincipher family
  • Renames multiple (7637) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-21_f94d17b5f232e9cfd2255ca9823cb18a_darkside_elex_lockbit.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-21_f94d17b5f232e9cfd2255ca9823cb18a_darkside_elex_lockbit.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4876
    • C:\ProgramData\F1E.tmp
      "C:\ProgramData\F1E.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1552
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F1E.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5812

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        KKKKKKKKKKK

        • Path C:\$Recycle.Bin\S-1-5-21-308834014-1004923324-1191300197-1000\KKKKKKKKKKK
        • Size 129B
        • SHA256 c78298e9cd4f4b649fa1f501f648baccc42e30cf37b2b0de0972be5b940ee671
        • MD5 SHA1 SHA512

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui
        • Size 56KB
        • SHA256 83876ed4a7ea57fde5bc3186a270996dd9569ce48dbc1dde11dfaf76f4f87e23
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui
        • Size 47KB
        • SHA256 524eaa7a966af3bcb91fe70f0322adb090638bd0d2fda342ac41b4c4eb35d7e5
        • MD5 SHA1 SHA512 SSDEEP

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui
        • Size 47KB
        • SHA256 5df2f9f7e02f9f696fe0e34dd7aba0a6719b8412aa8faf91209e4fb6bed7c9ce
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui
        • Size 43KB
        • SHA256 dc6fe7e1f1616ebbe06876f5185d0d150ad11b4e6904d6a845f3cefd41ca9abf
        • MD5 SHA1 SHA512 SSDEEP

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui
        • Size 53KB
        • SHA256 8774d1c6c084d2273f2efe4edb7543f3c8a6853afbbe9d22220079ef6b6e1cae
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui
        • Size 47KB
        • SHA256 196174fab75c569cb0a9aaf7186d9c66ca0a9c85e55d8ddf75af940744769360
        • MD5 SHA1 SHA512 SSDEEP

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui
        • Size 57KB
        • SHA256 4c351533e79208c9d3c78e9c3982d361e505cb58844fa4e58fdf1e5f0117b568
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui
        • Size 47KB
        • SHA256 9e2e2cc208a73c33fd30ab6fe243691375f5111f5d8e2f8447da0e90cec762db
        • MD5 SHA1 SHA512 SSDEEP

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui
        • Size 54KB
        • SHA256 08597d8a17e7fc03661a4782b34e9c806c493838b33ca63dc3877e2b2096da06
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui
        • Size 47KB
        • SHA256 b9803dbd3cd511290c59d85500fe8366306d4f451ebc5575a91d4db7fe63a14c
        • MD5 SHA1 SHA512 SSDEEP

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui
        • Size 32KB
        • SHA256 c93a9a9db28affb99cf7b3603cc4c459592ea658d092eb479afea15034ba0fba
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui
        • Size 37KB
        • SHA256 5b3bb4d2f083500ec94639e22584811a8e4aefe99d4e1c1f64036e1978112575
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui
        • Size 20KB
        • SHA256 6f737f9ede07d8a0e4f6501903fae418150747d48900f7d63056d208d854dc0a
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui
        • Size 17KB
        • SHA256 0bad35c84d2ace313fe43fca3fead43ec4994129cd5b9625880ee4fcb5c438e5
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui
        • Size 19KB
        • SHA256 f04e9454c8f166283b81f12d325271f2645357dcbd94e363aa7efd79327815ea
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui
        • Size 20KB
        • SHA256 7a1cbe6ac7a3ed715f9809d7199ebc8cbf531810fb26a0aa35d9a6823e46e31b
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui
        • Size 19KB
        • SHA256 681bf37ba0240b07e60e68f8498faa45b7b87720ceb5403631908a4bfaca3638
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui
        • Size 11KB
        • SHA256 a2ec2e6d691ae1df770ea96e5952c8fbecb6210faa9fa0585af88d40690aefa2
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui
        • Size 102KB
        • SHA256 5dd5b86933133b8333c4f34588ca8a79e045caaf203a1e4f5076d5e89224ed45
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\en-US\wab32res.dll.mui
        • Size 92KB
        • SHA256 f580a16840fb52bba214749bee8c7535689287bb737b35d05fd78091db8b915b
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui
        • Size 102KB
        • SHA256 dfb5c1e3c7510de2cd356cb4a3c665441d9b8f62b7287032fd47f1e6dd97bd6d
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui
        • Size 104KB
        • SHA256 7d81036bf13ef53e205426c953957d76a747eecddd9f8c368093a5f2e646ecc2
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui
        • Size 97KB
        • SHA256 8e3ad943972e73e4bd00be2549d7ec83a917be99d84ff56f6928ed22631a3e54
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui
        • Size 69KB
        • SHA256 e03e5695b510da7c1231f1d4ad20aec5462d9ba324bda7f82894ac0441ab3003
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui
        • Size 12KB
        • SHA256 01f01848c33f9982c9984bfeec9cc4a239d39f552a903dc2d254dc5324095663
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui
        • Size 9KB
        • SHA256 e28c0445a20186f73522e11e8e2c19f1a1ed0e26b540ae4b5aef67ace5a5dc31
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui
        • Size 10KB
        • SHA256 6dbdfe64e38d80de94a130b9cce56805b99d2fe53f500499f3dc74a28aaa1108
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui
        • Size 7KB
        • SHA256 f6c01b802651d648bce74bbd4b727bb881698bb375b6fe83289064d0a60952d2
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui
        • Size 11KB
        • SHA256 71683d4ba1ba49453487b372735d6db66cba913ba4526f1047182581c02ec7a0
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui
        • Size 8KB
        • SHA256 8395f66abd7af9e80fb1f7c692b542e70d5aae258e4c69042b5c62800c21fe1a
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui
        • Size 12KB
        • SHA256 1b49e0d5ef165147b23e41f8c99eafa17dff8901a33b14e0f4be3646c33c5ee1
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui
        • Size 9KB
        • SHA256 b286610c8a2e3e56a374d4f6c97de9a6da3adf0c866ae5a85ede1c7e762aad82
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui
        • Size 11KB
        • SHA256 f64a02c79e20fae0d7f337887a96e6ea0d4a5502883365c9ef0f556c01e5e277
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui
        • Size 9KB
        • SHA256 c127e52e0ef9bb77e5073398b3423f99d7d9175b4ecbcbb7b5140610df43a729
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui
        • Size 6KB
        • SHA256 95072bc15869f7c27b06885a3d71a0bf52751fa852bbe29ed4a93a01bbf1c0fa
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui
        • Size 6KB
        • SHA256 e61157c7b0bb1ea8af567380a82a31872ca35b479a90dae85f1363ae4d2c9cfa
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui
        • Size 94KB
        • SHA256 49c8ce0a9a2d9c0c29645d823eac9a92f30aff859690b08ac7dc8a4812f0b4f6
        • MD5 SHA1 SHA512 SSDEEP

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui
        • Size 5KB
        • SHA256 b2b6c2687ed55dcae868f4cfb6cbf08b7b70b4cfba0d826c1e48e93e3d18421e
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui
        • Size 27KB
        • SHA256 8522f0a3a5218ec73cbb9744a5ffe5fa35f5887a8de5ec77651eb28e80444333
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui
        • Size 3KB
        • SHA256 e7a5fd1bbc6e7f2557f0061713fec98ddb3e2f71f080f2a95f24d7bb21efcc0a
        • MD5 SHA1 SHA512

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui
        • Size 3KB
        • SHA256 070aee700ce2c1b48e319bc3827bb6ed6ac0fe0564e6973eff897b12f052c41b
        • MD5 SHA1 SHA512

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui
        • Size 5KB
        • SHA256 74961f111d371dbdde47d6159fab31f28c4586fb0e98a606c44ae2d2332a3e38
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui
        • Size 24KB
        • SHA256 271e20adfabeacd0a99cbad83173e0ee56f238c0b4bbe7884cf64a35d271ddcd
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui
        • Size 3KB
        • SHA256 44b7883390680bdad7aa4868c2c3484ba9656c00082a8a21a2f36f9f8ed45708
        • MD5 SHA1 SHA512

        micaut.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui
        • Size 9KB
        • SHA256 9d9d5e4028fa271b081d081f2c6b2110ad05a3d74256e6d1774ae53a572581dd
        • MD5 SHA1 SHA512 SSDEEP

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui
        • Size 3KB
        • SHA256 e742a71e507fed718b1abc53d6baaa7235020ee963b2ee9d07dc32beb43f778d
        • MD5 SHA1 SHA512

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui
        • Size 5KB
        • SHA256 a5a58e6193ace809a2f0848010b990362e903a1ab70f547ce0e307416541bdc9
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui
        • Size 27KB
        • SHA256 b94218d79fbccf6a754ae00d315cc0226ccb2304d9af18554f0e574ac19838a6
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui
        • Size 3KB
        • SHA256 2c696978d06d05803d155707bd25fcbb9ef8a514b2fd6d97739800009a3affa2
        • MD5 SHA1 SHA512

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui
        • Size 3KB
        • SHA256 ce432086a507304b92429edd86eb19be8881199b491fa2652c3570517ff2360c
        • MD5 SHA1 SHA512

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui
        • Size 5KB
        • SHA256 a3f715162457e8f47b71774e2def380b145bbde37e5539035a2a359d39c8999a
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui
        • Size 27KB
        • SHA256 7ba25b088b59668649db36149149455e947bc9d744502c13ee563f71ed71ae6e
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui
        • Size 3KB
        • SHA256 01f87f8bfc9732a5516265a3f1a45a97ef0b9c1b5b2d8ebfb535b4e2dbeb7db9
        • MD5 SHA1 SHA512

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui
        • Size 3KB
        • SHA256 361f8f26e0f9cb9cb42ce04bff830ebf926ca00788732e4bae5954fa52194e0b
        • MD5 SHA1 SHA512

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui
        • Size 5KB
        • SHA256 7d8c8cd34a4d0e5217ce65196e595e0e5b3b1ea7600eba7bf3b4d03b70172d9a
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui
        • Size 27KB
        • SHA256 7da3bfe1e1f6457dd94bd10c3e74222b30bfff7df692770f7e79f87ff429a526
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui
        • Size 3KB
        • SHA256 1a610ee46a2c81f5de1f6bee604fa823e0ff0a98985fb69acee3bcd4ef817c0a
        • MD5 SHA1 SHA512

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui
        • Size 3KB
        • SHA256 1f16ab1c2edce9102395d898714e54b8b25a76c27ee84aac4f89aff5b3311cd5
        • MD5 SHA1 SHA512

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui
        • Size 4KB
        • SHA256 da37032f50f4ec5f547e01deffe204a466519344c3de31943083caf250af3bbf
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui
        • Size 16KB
        • SHA256 d2ce1ddd1d4abf9eb1b8ab3fddac79d12ebae41326b5c7d3a7d2ef2874d79ad9
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui
        • Size 3KB
        • SHA256 9c7c29b067b7c76248c215ecb39135a7d3f27d1d2548bff6414a5651e4119d85
        • MD5 SHA1 SHA512

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui
        • Size 3KB
        • SHA256 886ff60561f1e5dd0346b4f0a8f3e7adebaa29c7cb043a7771afddea19696d61
        • MD5 SHA1 SHA512

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui
        • Size 26KB
        • SHA256 46d4c3bfe1e808e44b6b4187565858837e72ad190606d9192d1c9dbe20e2a2eb
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui
        • Size 3KB
        • SHA256 fc56248898441efa072f7cd586b67fcb199b75795c55503143f54cdc5bffa4a9
        • MD5 SHA1 SHA512

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui
        • Size 6KB
        • SHA256 abad9d5df1e6beccb0081ccf926bc7ccd13dbc3e396007030d8ed774bf1b44a5
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
        • Size 5KB
        • SHA256 b6f020ecc0e30bf4e684a58c29f5fc1acc75f2032cc842a48d771f339686d71c
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui
        • Size 6KB
        • SHA256 5e95bc4645eed44f8cda29d5f3f966fb109213fc26bf681adf8ba4cbaf5a2d98
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui
        • Size 6KB
        • SHA256 37c5753ed13c8abf495937cbb65f7b2f507efc30799c0931b63c14539492ac6e
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui
        • Size 6KB
        • SHA256 2a4ad2d114e7266c70b3de9d90e7b384eca330f170f2eb8ff77c597eeec56c9a
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui
        • Size 5KB
        • SHA256 253fd642b90701c2616553f700b3402ed93d5c7373678bd65dad2a653b3cf517
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui
        • Size 6KB
        • SHA256 4840ff0651fa0869fe7ec6db364b01c1da0ab23dbadee0ad60f44bc2c382166f
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui
        • Size 2KB
        • SHA256 87b913f1f45f99f25b73418b294c6f1545e91a13298939f98e2ee1c5f91ab865
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui
        • Size 60KB
        • SHA256 2ead356a782dd9429f79fa66716cfd12f76e7f4dc226f412a72bf1d468e7a49f
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui
        • Size 3KB
        • SHA256 a5f582af300b36e2993d70dad3645624a2a1262d93d84fdcb73364b2964e063a
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui
        • Size 58KB
        • SHA256 c7a6b6546ca6f72b12810e41c0886a5a1dee0ec4f414d64d539fedb30df1611d
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui
        • Size 3KB
        • SHA256 fdcb5f120f1a7ee4af2a6a8d9bcb2c9dd4953fdec2432f9a3e20812797992ed3
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui
        • Size 61KB
        • SHA256 88e5d2d973c30b71bcc544bbc75a159bf0fbe41ee3547d9a6627b6331bd9b554
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui
        • Size 2KB
        • SHA256 8d5597e0319591327191c3dae2ba9779ed6c34b753c958b762108dbec3968fba
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui
        • Size 57KB
        • SHA256 fe424052f7e17344cc1103490ac690c6d0c103b0d9215d19aa14ec9bdf957337
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui
        • Size 2KB
        • SHA256 5474f178af7e316f5ba06b0e6866a8c7be7a015f8c5284e60d45bc0ba0a03486
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui
        • Size 31KB
        • SHA256 d8dc654144c34d5d61df69120c8e5ffced6d2a1c80b82b3029d4b751077f5074
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui
        • Size 3KB
        • SHA256 b41645575af0efd564eac380411d8dc43628acdc341fb0951b05aae6ea1f7319
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui
        • Size 56KB
        • SHA256 978ac14092e1d0a08b5d426b331640192c27d2b6f62b3cdba0da57b03c0fd908
        • MD5 SHA1 SHA512 SSDEEP

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 a5fc1b47e9c9bcbf50245090836613cb1716a5cb7487b2cc2dee1210aa80a7b6
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui
        • Size 3KB
        • SHA256 09aa723d2f2888c7b46dcbf01a526c7cd1cc197fe8b9ecf1be522cb20a461e61
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui
        • Size 61KB
        • SHA256 c48c6bcb7260d59b6e05b2d4084a8b8c1eeaae0aa84a5ff522b7cfc8539473e9
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 84a6dbd8a064c54e68f9f7256ea48dd5f3e1d92e1892dd76142c4bcefba9e8f4
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui
        • Size 3KB
        • SHA256 22fcf40b6404ef4a332a438062832cef9fd730021377a6493b7f68d2fbec0b4b
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 15e13257b892fca602251abe66c6fafa41c81ee19c9aa22df9c7a06701a1c84c
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 c4802485f7b39c7681b9bd8b331a08beb9377d31ac024d0d32da07ca6a897727
        • MD5 SHA1 SHA512

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 cbb4e54653a85a82ca7d0096b379a4ca208f3ce60cf0112d4e85da004a2ad276
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui
        • Size 3KB
        • SHA256 fd52e4d78bd1d32273a3ff5dc544f22631a489a4d11a968028094778becd4a32
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui
        • Size 53KB
        • SHA256 dc641cc3136ddffb672afb30193620b4acf7b5288c235164c85248c3b7adaaaf
        • MD5 SHA1 SHA512 SSDEEP

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui
        • Size 3KB
        • SHA256 50f37d32cea6e99d62ce19c4282e999d6bb5798938a2bfaa4da50f42dff5700f
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 4115d709747b1a0ba6a7b4dd9cd06ead80d5dcd92aa4514e72e2e7ce57fbbfc9
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 d9e470961b2d78adfca58b80b612afa2aa0eca353cc03b26f6ea40b7dea656ba
        • MD5 SHA1 SHA512

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 786ffbd72bf70c0448afc417279869ec9e0edcefdc4f84cc34dd0520886e4f9a
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui
        • Size 3KB
        • SHA256 fcc989dba63a921be6132870f534c3b5411ebb153b2888225461a8c2be4c9283
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui
        • Size 62KB
        • SHA256 3e589e3fa40e256c220bdfa13bee6ca9297ae6142d7df5bdf9c556875c74d268
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 819e22e468b6f8848ee8a067b34a6da1eb2374ac1a104a342e35edf2a7ebaed0
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui
        • Size 3KB
        • SHA256 d189f4b606e4a09535ff1c4d13e551a374ac22968c1c229f3139b0ddd27ecffb
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 d1650020a2d1201ea67d4736ce4fc99d258fc476e1945abf87be6ea07f0ee8a7
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 5a381713f0d5db1b8a3371d4c1042d0511a9f8050c7bb129ad2f8caec54a6b30
        • MD5 SHA1 SHA512

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 8e1affa591f5432d4f1fc01d1af34e9b288ac590c72d417a0e5a1c6e2e6af94b
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui
        • Size 3KB
        • SHA256 e828b5b4391de92a27cc594d8cb93b1c70d18f865a44ec42393ce397a830f18f
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui
        • Size 63KB
        • SHA256 247a86ec12caf289f48f25ab5f7c11e9ee504e782a46db915348bf7774cc7a1b
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 92471cafb56ebc9f2e74a830c71d43d5b35aec1aa00ec15f9d2ad37523b4e19f
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui
        • Size 3KB
        • SHA256 a2006cf7115fb02074e994d380a9caf6607cbd1431223356721273d7938ff360
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 435ec303043eb06f36375d93a53fad57573b30641d2bc840cbcfeede64797505
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 1bced3bb0e238c7bba07872aa574a1d1e74e301adc60f3cc5b9eb020a39c8ba4
        • MD5 SHA1 SHA512

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 0b67d02f335fb604afbe587f6f0e0a105c43d15cbdd30a7176cd0bdcf116ae65
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui
        • Size 3KB
        • SHA256 81d81b9e1b54b6a90ce5225e6605e9eb5cfd3c47f4ad91e8f93686ed196693b2
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui
        • Size 61KB
        • SHA256 79d57ec10740d82146208707003b9ae5a25569dfa92fe173f21c7145146957ed
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 3b622e19f3cf4aba1b467d0d5d0780daac1cd996327561ca1ba7138bd5dfb142
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui
        • Size 3KB
        • SHA256 431e68437923e6d47f943454ffd0f0c188e2259f4935d5292296df3267782244
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 1308943bd2d216cb44ed33303f51812310fd7c0e602beec1c417bf4ab49658bb
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 e54676ad7701ab8b461b6983920842477340e28585e4bbf1fd13e6d9a56c0a79
        • MD5 SHA1 SHA512

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 91b6e128278dc7246ee79cd83435786dab44b4812102084de108776dac776ac2
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui
        • Size 3KB
        • SHA256 92aec36c1d62dd8267692b8347ec87ae1871dd9b4c820b40942547b770008969
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui
        • Size 40KB
        • SHA256 8ee94d094d63eedc251f7ac193e4202d740180d8c779e47b565b3b891ab2e917
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 07f344c2d0a155dcdcab0b128fa814cf18563d3953e450cbc0ef76cbee3bc549
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui
        • Size 3KB
        • SHA256 e9aac32deef22a9d87c9652e03a5ead1463bc456d1a972c54105dda0661a511a
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 3e5d790e6393db9923aa8760bc494f0d205adbf831dfb9c93ef8254e411583e1
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 1c3102ab93fe488c2b9039a771938a6f1be6c92e07057069861c728e0e913aea
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui
        • Size 3KB
        • SHA256 886f58e8b79781cf62cc683ee2a1de03250314b64fa04fc5f83b07043415e8c2
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui
        • Size 56KB
        • SHA256 f728547888affae684d71f98c30027851fd1b60ee0f6656a1fa61952f37ec5aa
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 cf0359414679fba68587ca34d63f52ecc715bb33802ef5b4601edc39de0a5e99
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\wmplayer.exe.mui
        • Size 3KB
        • SHA256 3053a26a82c98f69c31f45f7a579f279aae9b0c30b9b1309a38de8a27d7bf89e
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 9c73231637aee495bfc48dac62a639e79dffeb60e8478d6e2588a7ea2ce9ad59
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 b86da67f8ffa4ef92bcd2504c54d93ee5f107d735f781c79f2b76048cb482a55
        • MD5 SHA1 SHA512

        wordpad.exe.mui

        • Path C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui
        • Size 49KB
        • SHA256 a908df6636f1f0cd10f96ba878128c80ff111c886743924ead396b52aa906327
        • MD5 SHA1 SHA512 SSDEEP

        TableTextService.dll.mui

        • Path C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui
        • Size 8KB
        • SHA256 9771f81a23fb2c673bb5f8e267e1402c16508b4077ad8fb62bba9012c53a6ef0
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui
        • Size 18KB
        • SHA256 454bf7fb6618988f6f650a44f1073175650fecb6cdbd751830b058bb75efc451
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui
        • Size 16KB
        • SHA256 9d3741d774acb26b70302bc68c1d41d0c6ca4c8037015c446cf48dc26459b87b
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui
        • Size 18KB
        • SHA256 b3a9f87dd51c4e24335bf4430e6da9569e7a60c4d10f1f58e62c6c79716b78f0
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui
        • Size 19KB
        • SHA256 cf2c1fe82ec4564e8a43ca85928d51f64ea9c1608761ff3c186ad99194034bec
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui
        • Size 18KB
        • SHA256 c5235322f396f18386c3266d34fba3a7035593ad6a2c8d3bada6988b899df23b
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui
        • Size 11KB
        • SHA256 242993c92e4385d891e685d8ad069e070d5074462cb84c02c3133e4e23eecbc6
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui
        • Size 17KB
        • SHA256 327ee0833ab3122ec992f8f12777c34ce5b2dc14af1685a80384344fcc136fd3
        • MD5 SHA1 SHA512 SSDEEP

        F1E.tmp

        • Path C:\ProgramData\F1E.tmp
        • Size 14KB
        • SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
        • MD5 SHA1 SHA512 SSDEEP

        DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

        • Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        • Size 147KB
        • SHA256 fe90c93138e031cd105941e60be95827d23be779cec30d8babfe14637cc82282
        • MD5 SHA1 SHA512 SSDEEP

        jErs0FgGP.README.txt

        • Path C:\jErs0FgGP.README.txt
        • Size 1KB
        • SHA256 15140e9a6ea6dd4a6e5c3a3e52b64c1afd65cbd786a4970aff8aa1b528ebaca2
        • MD5 SHA1 SHA512

        DDDDDDDDDDD

        • Path F:\$RECYCLE.BIN\S-1-5-21-308834014-1004923324-1191300197-1000\DDDDDDDDDDD
        • Size 129B
        • SHA256 379eb550612a2fd63e8ddac674d27ab2e6a2e7515a836ebd97ad21542abd8bf4
        • MD5 SHA1 SHA512

        memory/1552-20062-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

        memory/1552-20061-0x000000007FE20000-0x000000007FE21000-memory.dmp

        memory/1552-20060-0x0000000002590000-0x00000000025A0000-memory.dmp

        memory/1552-20059-0x0000000002590000-0x00000000025A0000-memory.dmp

        memory/1552-20058-0x000000007FE40000-0x000000007FE41000-memory.dmp

        memory/1552-20091-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

        memory/1552-20092-0x000000007FE00000-0x000000007FE01000-memory.dmp

        memory/4876-6873-0x0000000002B10000-0x0000000002B20000-memory.dmp

        memory/4876-2-0x0000000002B10000-0x0000000002B20000-memory.dmp

        memory/4876-0-0x0000000002B10000-0x0000000002B20000-memory.dmp

        memory/4876-1-0x0000000002B10000-0x0000000002B20000-memory.dmp

        memory/4876-8670-0x0000000002B10000-0x0000000002B20000-memory.dmp

        memory/4876-7619-0x0000000002B10000-0x0000000002B20000-memory.dmp