Analysis

  • max time kernel
    101s
  • max time network
    106s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250410-en
  • resource tags

    arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21/04/2025, 13:28

General

  • Target
    2025-04-21_f94d17b5f232e9cfd2255ca9823cb18a_darkside_elex_lockbit.exe
  • Size 147KB
  • Sample250421-qq281avxes
  • SHA256 ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Path
  • C:\jErs0FgGP.README.txt

  • braincipher

Ransom Note
  • *** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! ATTENTION! If you do not contact us within 48 hours, we will post the record on our website: vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://brain4zoadgr6clxecixffvxjsw43cflyprnpfeak72nfh664kqqriyd.onion This page can take up to 30 minutes to load. 3. Enter your encryption ID: DOuB5Pp206I1khMQMjQLVqnpqbROD+iJrJWwtl92dTQLsNqq8RdnSymqONiThx7G1rN+ddOiF8kXtGc3n10XdIN3Q1WFk1 Email to support: [email protected]
URLs
  • http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion

  • http://brain4zoadgr6clxecixffvxjsw43cflyprnpfeak72nfh664kqqriyd.onion

Signatures

  • Brain Cipher

    Ransomware family based on Lockbit that was first observed in June 2024.

  • Braincipher family
  • Renames multiple (7567) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-21_f94d17b5f232e9cfd2255ca9823cb18a_darkside_elex_lockbit.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-21_f94d17b5f232e9cfd2255ca9823cb18a_darkside_elex_lockbit.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\ProgramData\2219.tmp
      "C:\ProgramData\2219.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:3420
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2219.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4308

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        desktop.ini

        • Path C:\$Recycle.Bin\S-1-5-21-3664858464-2411077738-2029630556-1000\desktop.ini
        • Size 129B
        • SHA256 8b1bb90ab857686b31bacfdd8514e6906b47c571dd0ae50795c9d7d14377be49
        • MD5 SHA1 SHA512

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui
        • Size 56KB
        • SHA256 79f18c98bb75e8c4a369f56d789ba25a095f5a3b47eeea38452d48dabb71ffe6
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui
        • Size 47KB
        • SHA256 d187e6f547c354f6fde46f1be543abf22614e4ce41f626813d61dfdb23c2249c
        • MD5 SHA1 SHA512 SSDEEP

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui
        • Size 47KB
        • SHA256 a4bcfd794b15e3f04687da79853c50fcabae6fc9c4c29608c9e0819401807dc2
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui
        • Size 43KB
        • SHA256 01de5be01646e3da29a675d722d951a553d5eed46e5409c19c20a25f990662db
        • MD5 SHA1 SHA512 SSDEEP

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui
        • Size 53KB
        • SHA256 a966e3629cc4801344dbb38df5a26029df44a14b226c61e81a6a70f9d8deddb0
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui
        • Size 47KB
        • SHA256 b68f81fcc5c9cde3965d55f2c0b57af0d564395874315a4b73ad52f6bc9c72d3
        • MD5 SHA1 SHA512 SSDEEP

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui
        • Size 57KB
        • SHA256 85dcd98bf818ba5f3e06765a64b3eeecafe0f900165f921e6d9433d79939c779
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui
        • Size 47KB
        • SHA256 da3846d5d41eafa793d9fccafb00ebd7fe2c90f9ff279d770ea0483b8606f473
        • MD5 SHA1 SHA512 SSDEEP

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui
        • Size 54KB
        • SHA256 b886c264662c5e6f25dec15a074977ac09ddf19742cb578867f996a14a212343
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui
        • Size 47KB
        • SHA256 9a5448cd51cbd2f061bdc3b7c83a2bda1fe2566b5c96c8efad8eddcc7b650dd8
        • MD5 SHA1 SHA512 SSDEEP

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui
        • Size 32KB
        • SHA256 276f0fffd690257800e6ac71239dd1163ef9ed92df39001725e02ecc0d22ec9b
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui
        • Size 37KB
        • SHA256 afc42ac985f1b0a4704ecd33011e812ed4a675cbdd3d0ad47eabe3ae932ece99
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui
        • Size 20KB
        • SHA256 0a68548a14472c83c4e16c643d7c8405faedd6da55bf0a06225b92f866d50429
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui
        • Size 17KB
        • SHA256 acbc637d95e208c1404662bf4e6192053be3bc8edd10ce1a55070671fe30d0ef
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui
        • Size 19KB
        • SHA256 dce2617f5dc31df6ddea48aab4598fe74ddf0c21f0d440912859ba28bef3d6d2
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui
        • Size 20KB
        • SHA256 8092bf05e3cb3905a606faa5edb7082a7dde099fbc2a2e433d59be26c8362a23
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui
        • Size 19KB
        • SHA256 88ca8df02778df6dd8c8c56acd352f755cb7e0d4f267fbb97f663b4b6fe45a2c
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui
        • Size 11KB
        • SHA256 2ebdb1069fdd1a3e85c1058ee4264dc770ad53cfe776163b93e49e2866a61126
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui
        • Size 102KB
        • SHA256 b3cd53568c5775b13b632d116a9689dd2110976a52fa7e6e48798c094d12ea63
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\en-US\wab32res.dll.mui
        • Size 92KB
        • SHA256 3ae72f2f1a8ae88485f3f53b7e272275d787bf95d31383e145bd1d3c2fc3e1b5
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui
        • Size 102KB
        • SHA256 14b2ce0ec04eaff680aa008ef9427b67748ad372d4f23ac3d93e00006e83266a
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui
        • Size 104KB
        • SHA256 fa10401dd32c7054211bdc37c88ff526584134b1b0e41c2c26b3633814bccb37
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui
        • Size 97KB
        • SHA256 b90cd610a1d804629c2a2866eb9338bb82b2745755701b00ed9e71e2ca05b0d7
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui
        • Size 69KB
        • SHA256 c78472e95a59949ea9bf69530c7c11cf0fb03f78c73ae7f1f37b1c4dd3a5715f
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui
        • Size 12KB
        • SHA256 25e1d7d84e98c7d98aed29de3a193c45890c147ee82236d2c6c3825a1b01737b
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui
        • Size 9KB
        • SHA256 e281b4c991e944e1d58ca12c07c9dad31af10dcfb2c4824808ace553d2a804ac
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui
        • Size 10KB
        • SHA256 d9f8dab5395c1392f0f57ae4478dd24babbe1a76a53523de27f733700ca6c8a2
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui
        • Size 7KB
        • SHA256 71611c8761bf35b820b38cf973f9ba352e916b120c25d954238b118331ca2597
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui
        • Size 11KB
        • SHA256 64d9b100240fe2f2a397f530878a142d1d0c57e6079b57d7ba6f14d156c8fc85
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui
        • Size 8KB
        • SHA256 82893454d242c4a95a477e512f1b0d6a11ef6688fef18104123f503c0136c3a6
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui
        • Size 12KB
        • SHA256 f801e425a852fee09d7c4e2fa7534d6ed0301fc0c4eeba2d24fc322e22d0fd9f
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui
        • Size 9KB
        • SHA256 a34585ec6b94f492194886406322b0e9549ba23cfbfecc0992a471c0acb4c8bd
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui
        • Size 11KB
        • SHA256 b9f91b3cae572c80e7d0212c7c0473e9ab586d7822b4f130714a6b89aaf7b92d
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui
        • Size 9KB
        • SHA256 8726cc8ea19df3442e6339512bb90dc76c7d52f97ee635c9f524f74841a93dd1
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui
        • Size 6KB
        • SHA256 83408dd201d1ce6f2a1f63637d9b39b6ce2a56cdc7ee00fa59d4c95332c8757d
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui
        • Size 6KB
        • SHA256 56d161a8cf70ff5a70afe1f66af30cf97714f8531bfd22c50dfe88a201ab0604
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui
        • Size 94KB
        • SHA256 f206754c6a2406773f138a11acaf77aa996c1b88b307cc71c046a0e5d1e7f092
        • MD5 SHA1 SHA512 SSDEEP

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui
        • Size 5KB
        • SHA256 751e47b2b63f4dae478a895ee98658d55c9d72ccd1231b40aff6321ef5ce4b69
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui
        • Size 27KB
        • SHA256 3c3228ad36acbb9b9b63e3dd0ba05027a5289b86c32a81417c45f2c0833113e3
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui
        • Size 3KB
        • SHA256 6f7ec482de849f1f142cea0ffadf57b1415e8e46a96e456c3523d19cc89bbd0c
        • MD5 SHA1 SHA512

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui
        • Size 3KB
        • SHA256 fd18311fac201f8260ed41de5bfd2564f95d42c4774637bd93210a50c1f3f430
        • MD5 SHA1 SHA512

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui
        • Size 5KB
        • SHA256 d7184105aeec820bf3c2fad98323b3b9fb9e545733e2f161027813ff612c0399
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui
        • Size 24KB
        • SHA256 31832dd50bf1f7a53992f66e1af9f3d18f6368b62876b641e1dbfb4105598d5e
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui
        • Size 3KB
        • SHA256 6215caff4c39d8ead681a3afe76f2a06863a360001bc4b209192f2f6d649d914
        • MD5 SHA1 SHA512

        micaut.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui
        • Size 9KB
        • SHA256 6b5140b115715b11d77e415c7e77f6729d2dabc7d391508696574f9b78e8d721
        • MD5 SHA1 SHA512 SSDEEP

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui
        • Size 3KB
        • SHA256 2c5ab6c7a01ddbfea09565c179d4a841ebc5979a2ec3406f23e427bbe31b6226
        • MD5 SHA1 SHA512

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui
        • Size 5KB
        • SHA256 8d386bab533feb17726581040a22dbae5434a622f92196cd29498ce96eab44ac
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui
        • Size 27KB
        • SHA256 d2502f86da6b616048cbb5138ea2daba7d65eb699942dec00227cd97222b89a3
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui
        • Size 3KB
        • SHA256 5ac284d235e4ae919c2c5a1e095b6e67958c35504b6eb36cc24433909ffe46ce
        • MD5 SHA1 SHA512

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui
        • Size 3KB
        • SHA256 59eef130d84f525bed82bdb396244d5178a973782ee8296e035a1c45db246e44
        • MD5 SHA1 SHA512

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui
        • Size 5KB
        • SHA256 8615b63d799790728259d4f303b6d6f3e548c739d3731654bfec9bb69fb0fdce
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui
        • Size 27KB
        • SHA256 6ae0e9d9c3e6e0e96d42fac91fe053814505f0c61e844c707f5e7625a597f2e6
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui
        • Size 3KB
        • SHA256 189113b5950f05312a6314559fd974334b7ae3c9d05a49a34c865603aa9d112f
        • MD5 SHA1 SHA512

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui
        • Size 3KB
        • SHA256 da24898370b206130113e7042c2a9e9d65039d85cde87610955da42bbae1e2b0
        • MD5 SHA1 SHA512

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui
        • Size 5KB
        • SHA256 542b8173ba4ffdb35442c516839c871a84295117cfac4d165e5a6ad34370d810
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui
        • Size 27KB
        • SHA256 0145bae24c77c95a806a3af71c531503ef67fdcd3426d79758238a060c74511d
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui
        • Size 3KB
        • SHA256 4121cd97c4e091c92f59d73379e067ecb8ede390a2d2f3cb20b5a2608c8dc32b
        • MD5 SHA1 SHA512

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui
        • Size 3KB
        • SHA256 b425217a245e4c3f5ddc33cee53fe671ab86864a563d9e587cd1f7a206e7967b
        • MD5 SHA1 SHA512

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui
        • Size 4KB
        • SHA256 dfcc6f469f8b3e05d3585b1ddef1bb57783d2ad303ec97f706af8ffc483f64a1
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui
        • Size 16KB
        • SHA256 43db77a806d8429447ae016d9bed62f9ce611d4bf74d9d70dbf4a742321f23b4
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui
        • Size 3KB
        • SHA256 178a51a4506e27746e95b4a701e3992ee959a1581b37cc6f94ff97719401adac
        • MD5 SHA1 SHA512

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui
        • Size 3KB
        • SHA256 e8e3d5b0988c7b1e4f25062f540aca0427ce69a8c218cc4815b6eb44d9104422
        • MD5 SHA1 SHA512

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui
        • Size 26KB
        • SHA256 cbb5fe5b0324cc41204585604779ef91db80b16d4f80ef1cccd1fa9563d9c540
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui
        • Size 3KB
        • SHA256 6dcc3bac80ded3aa73986bc233182c497a08a4614680eb8293aad7a96a5a969c
        • MD5 SHA1 SHA512

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui
        • Size 6KB
        • SHA256 1c9e304f7693b8fc1c61109c190643e20d5e8e303d3d7be654d43be826d03436
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
        • Size 5KB
        • SHA256 01f37c54d98a30fb2dfad1a05da49750e906118adbf72d2476effeab6a258f09
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui
        • Size 6KB
        • SHA256 3215698fb9d430b8ad012e0e2c1f67fa3ed1fdcedaf0496f9790dac40d1c4209
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui
        • Size 6KB
        • SHA256 2086a85a0e6952adbce1c63aa0568451c58c1f34fc974972ccf8ae1b3d35b251
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui
        • Size 6KB
        • SHA256 bd6b89d7bcbff18245963eb59afdba2ef8431efb55de76ce63c9c4153ffc7233
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui
        • Size 5KB
        • SHA256 a9225480edf6bb83114ef62749c400d24a6f24ecd3496d4c3ae8af608c3ed2b2
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui
        • Size 6KB
        • SHA256 fbcb0b112fad1a1eecfa690dab1ed71e8d2e7ffc0b9ec65ebec03440f3564a7f
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui
        • Size 2KB
        • SHA256 f00399d1ecc8c7f9385eb414952c45e15ab466891eeb36783bd2197414ff1f19
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui
        • Size 60KB
        • SHA256 5401cddf5302de6ff92c509d07b3b1005cf3b0a9243a1d147ddf0d8640ac0fb0
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui
        • Size 3KB
        • SHA256 7a31e76d5b75514708c8073400f1b503fd1235a35f1c045d9fac26cb4efcad6d
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui
        • Size 58KB
        • SHA256 73bda4dc4abfec32220451e60f3d17faadbede9d3b2910e7ea01445d91657a2a
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui
        • Size 3KB
        • SHA256 418aeb969868d9483869fed26e083d54ba225d9a48a6e9437e3eaf83b2344b77
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui
        • Size 61KB
        • SHA256 36d76e2a49b74372f5c825fc20d67c8b11341eaf6f9bbf1cbe7957999c5644ff
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui
        • Size 2KB
        • SHA256 cf6c441f56704a46faede6251207d581a86381f6e945b1589bfeef952cc12dcc
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui
        • Size 57KB
        • SHA256 5c1b1b4061130ca7c001b911c4dc6a600d52a7148db04b269374839534179f83
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui
        • Size 2KB
        • SHA256 47c6e8fa26b5056ca76c2d321ae53dea24f5a878121ff3e3a6594e4fa33e6d5e
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui
        • Size 31KB
        • SHA256 1cb14bbb587cf9f671e200c3cab9b9dc5f114f222ff623f87356290aba7d9065
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui
        • Size 3KB
        • SHA256 9b7e556bc257e674f6a4efb5db6598b5ae35fe9d02c152ce642199c9c5023c98
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui
        • Size 56KB
        • SHA256 477600616e29e1a38b7dceb1721b913180543bd9461ebb3807d91152811c4469
        • MD5 SHA1 SHA512 SSDEEP

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 5b29d194251c92cbea18218cba873c91fe5599cfa8c0a79a4e301edaad523397
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui
        • Size 3KB
        • SHA256 5c33c1ea81d6eb621033a07f4eccd51c5422824f38fd30d9d1e84c2fb4d6475e
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui
        • Size 61KB
        • SHA256 f6091bb2e45fbaa47fa318cefcb0f5af6112f43421b9c798e79933a6146c5c24
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 9c06c0c084a3db32f4efc92493ed3f16703166d42ebe182845d8defa0e66f113
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui
        • Size 3KB
        • SHA256 db1a4b90720ce5c24744ae474ee1390880edeefab229ee10fa5a47c43ef13e23
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 6813639774994370c34c8b1ac9631eee5dc4b85afc35d7e84a734decbe39aa12
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 c9a1e601df690c68190ff8885d24534c07dda5caf74f828ab0cd651821155a34
        • MD5 SHA1 SHA512

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 07f26ad6183e950a9d47a9f84a8e457be02d90a5628af2a72885befc41fe463b
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui
        • Size 3KB
        • SHA256 53fa15b999a3b85357ba2f2d49a858a6ee3ea96f33c1874af5f8750e2ddc18b0
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui
        • Size 53KB
        • SHA256 ecb01c50cd0f13f0ce4979d6dfc8cfe6d6c4e86accfa2c7f261b59b72b07e32b
        • MD5 SHA1 SHA512 SSDEEP

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui
        • Size 3KB
        • SHA256 512672ffba904a5b0a1df22b25334c909e2a7cb89543f13b66f0e6a10647756d
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 f56e471020bc923ac1b9158aac6a22523826b160ca8a9c2fe1abd830d6ccf30a
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 f74f3ad126d2327843f236f46da966c2d5234ac8bc4a850f9d843efb13ac019e
        • MD5 SHA1 SHA512

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 c5fbb2f156228b75c8e5b358096f325be60dc659d12949c2bf77d0090aaab510
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui
        • Size 3KB
        • SHA256 80e92a9fd668b292beca8cd0c9a6e0e8fc9e2e7be66badf0758ffed1080ad81c
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui
        • Size 62KB
        • SHA256 904f35dce0598de29473e7a03020930b16c33711aece515f1f8ec39d93a47805
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 509db922ca3ea17f8d0e0250fd5d0e25089064bde1fe970c277a047f1da1bb89
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui
        • Size 3KB
        • SHA256 40b80c0f0e46d13fe4533dc1bc72bc1aa4bd3cdc26e14e1b102efe6f8f2ba847
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 3da0434ba9ce1ea801ee06f58a4c0d6ddc0410c56af7d9a1220daf53d1671875
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 bb589e41731a3dae6903a0fce5b197cb864e607d7e3eb7b2064c9ef6a8fc0ed6
        • MD5 SHA1 SHA512

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 d8b0eea11aad29c079b79bf77d6e0ec09ed984320d7c51709268af737cb37f3a
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui
        • Size 3KB
        • SHA256 4b53ecd849c644a1908571e4785a18fdae3ba2cf35ba30517a8b558a6b3b8e79
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui
        • Size 63KB
        • SHA256 0ff931e8e2f3995e9e1a79f1b8ba8764c53221ecee4c18f02f2729ff2b634735
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 9467fdb7e8e7756b2ff4b825bf9636ec76e66c4c5d6f1c004c03f2fd62e54dc8
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui
        • Size 3KB
        • SHA256 e30d711a88acf79e9cb6ca91a3e34ab7710fbd490e88ff97bc764683b9254840
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 4c92e086e7f8cb0cdbb0cf5a954cde7c9ef7954a034b720c6f447030af3258fc
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 af0eaaa933a2ad25763edd4bd3880a11fdc25939f8b77e29f6a8bac62df131ff
        • MD5 SHA1 SHA512

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 cfb7ff12bb150b76fd1078db43016df93e7e6f4a71e60ad515b7ab2d4174cc3c
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui
        • Size 3KB
        • SHA256 c26da4e16074bf732d6ad7eff110fd44ebe1e095e8917481087688e3416875a2
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui
        • Size 61KB
        • SHA256 a2208f5271ee836c41c37dbacac6a8625f867c3ee57394cbaeb4af41a6cabd52
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 7ccfee6c51bd9a760062fab74f8795a542c50f66ba5ab2edab08d0c2d8660489
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui
        • Size 3KB
        • SHA256 f1d1baf3ed493c1b41b22dbe0be251852848452fd1edbd513d8a1e7d136fd936
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 6701397183ab426f7f92c1dc8c8dc02bbc9cc04e5631989e81b2e53f1e65855a
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 bd47a9df0a02a59334b004dcef1a3841609aae93d50f85d1c71c3f25206a6189
        • MD5 SHA1 SHA512

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 51da24e743c5f9b2007fd4217c46965957995cf0932654c4412c12b718367e7c
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui
        • Size 3KB
        • SHA256 f412c24959b2e9b44f92385bef66e1ce8554bbf902bb38c530f48b82a43f1cce
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui
        • Size 40KB
        • SHA256 93e497acbf5181d5478172702de4789af97edf7cf8351886b616d04770d7ab27
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 11409067f87bcf439a5ef020a5ff75b2869a6ee478bcf9c5cff42a8bda3aa6d6
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui
        • Size 3KB
        • SHA256 d2532c61d853e3645fd97be4be4a53e129252491037aeb3c306011ecd82d3947
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 e46bffd65862394d1c39bf499472004239ef6bd3a353dc47adf1ec201e08835e
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 0ad7189e89234dbb198fcd774457595d7e075cfa6a0802af6ddc14adcc86b961
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui
        • Size 3KB
        • SHA256 4c22fff06c59a179a732bd3fe9384c77bddaefe9df3d2341f42a932dfa3d57d9
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui
        • Size 56KB
        • SHA256 445a694a772ba353865abbaa409ed06b46ecb6583e0ff730780779aef5d4f0ca
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 5427c4344437ad2407cf37285f5de97ed2598fd315d2f7ea33f486cf84c64c29
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\wmplayer.exe.mui
        • Size 3KB
        • SHA256 776c8bbd07698be2827a9ab9e388f0b943b84b98ea9f97e1d344428067b89a8a
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 c01f2f0fbd5a169752d371cb04279ee2e8d9810a7eb2519191988741d2b129b8
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 32ca8c13b4fff486f566483782b2df7ea2c5e9ad67714836a105ebfd247af2a5
        • MD5 SHA1 SHA512

        wordpad.exe.mui

        • Path C:\Program Files\Windows NT\Accessories\de-DE\wordpad.exe.mui
        • Size 163KB
        • SHA256 bf5269329f254909c3855645883464bbb703ab569f32e19503dd539c0a79aefe
        • MD5 SHA1 SHA512 SSDEEP

        wordpad.exe.mui

        • Path C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui
        • Size 49KB
        • SHA256 a411c370a8c0ef17376d122a66fa3d7997f8f01ede57dfcc22aa1f274e00e2a3
        • MD5 SHA1 SHA512 SSDEEP

        wordpad.exe.mui

        • Path C:\Program Files\Windows NT\Accessories\es-ES\wordpad.exe.mui
        • Size 163KB
        • SHA256 c77a6f64a3b7f3539035f53e76bdd8b8a979662e48c853bf2d438bfecd9419f9
        • MD5 SHA1 SHA512 SSDEEP

        wordpad.exe.mui

        • Path C:\Program Files\Windows NT\Accessories\fr-FR\wordpad.exe.mui
        • Size 164KB
        • SHA256 5a3504efaf4b2476154aa1e5c746649f919e316b41a00860d472cd572bfc1f9d
        • MD5 SHA1 SHA512 SSDEEP

        wordpad.exe.mui

        • Path C:\Program Files\Windows NT\Accessories\it-IT\wordpad.exe.mui
        • Size 163KB
        • SHA256 5b5e9ac3ccda559e512c05eab4683835f6654c821e7777b2fbdb447598ef952e
        • MD5 SHA1 SHA512 SSDEEP

        wordpad.exe.mui

        • Path C:\Program Files\Windows NT\Accessories\ja-JP\wordpad.exe.mui
        • Size 150KB
        • SHA256 283deb4de5a38986db7048ddba1bac9e65c56a4f8cfffc226783a7dd8ea25ffc
        • MD5 SHA1 SHA512 SSDEEP

        wordpad.exe.mui

        • Path C:\Program Files\Windows NT\Accessories\uk-UA\wordpad.exe.mui
        • Size 53KB
        • SHA256 afcdfe5f4e2cbc7836c312c683177d90d97b66e459d951fc9e54225c13de3f7a
        • MD5 SHA1 SHA512 SSDEEP

        TableTextService.dll.mui

        • Path C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui
        • Size 8KB
        • SHA256 877bb49a07685cd611ecffe2fc9528c1463e782c61f866438843732d4560d6a3
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui
        • Size 18KB
        • SHA256 0291d15710991da9812eba7258d0a03f80d46816eaf1f2fc1232a827fe9c58ee
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui
        • Size 16KB
        • SHA256 844af329d948c0178363158b8dde67e910fe8bf35c5bfacf31f48f9b26425a78
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui
        • Size 18KB
        • SHA256 c700108a4810285f34b12555976293c39eb7ad6cce73180f62ea4bd9752d6497
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui
        • Size 19KB
        • SHA256 fecd4a45002a52cd979de2bf8760c8879c40843c65439cf6710dceb3d629459a
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui
        • Size 18KB
        • SHA256 2875764dc0af7897ca72842c6eb179102d46a1a52498df93c082b3d12aa81685
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui
        • Size 11KB
        • SHA256 a3aa78bed59b9a885410744e220beac5775fdf3fc57a0d585c180b9b233ebc94
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui
        • Size 17KB
        • SHA256 ee11d0f7b573b7d6d9ebbbcadaf0fe53737d0a90edcb04711387520152bfd37c
        • MD5 SHA1 SHA512 SSDEEP

        2219.tmp

        • Path C:\ProgramData\2219.tmp
        • Size 14KB
        • SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
        • MD5 SHA1 SHA512 SSDEEP

        DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

        • Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        • Size 147KB
        • SHA256 4ba2d1ae1191f8a84500f7dc1db84c75658c74c4b77b75156bc3969ea7fd3ecd
        • MD5 SHA1 SHA512 SSDEEP

        jErs0FgGP.README.txt

        • Path C:\jErs0FgGP.README.txt
        • Size 1KB
        • SHA256 15140e9a6ea6dd4a6e5c3a3e52b64c1afd65cbd786a4970aff8aa1b528ebaca2
        • MD5 SHA1 SHA512

        DDDDDDDDDDD

        • Path F:\$RECYCLE.BIN\S-1-5-21-3664858464-2411077738-2029630556-1000\DDDDDDDDDDD
        • Size 129B
        • SHA256 bc370afadf4f401fb4cf4d044d321a9c8f85d13c164805194b6aa515b9d15ba0
        • MD5 SHA1 SHA512

        memory/2140-8758-0x0000000002F00000-0x0000000002F10000-memory.dmp

        memory/2140-1-0x0000000002F00000-0x0000000002F10000-memory.dmp

        memory/2140-0-0x0000000002F00000-0x0000000002F10000-memory.dmp

        memory/3420-20080-0x000000007FE50000-0x000000007FE51000-memory.dmp

        memory/3420-20078-0x0000000002790000-0x00000000027A0000-memory.dmp

        memory/3420-20077-0x000000007FE70000-0x000000007FE71000-memory.dmp

        memory/3420-20081-0x000000007FDF0000-0x000000007FDF1000-memory.dmp

        memory/3420-20079-0x0000000002790000-0x00000000027A0000-memory.dmp

        memory/3420-20111-0x000000007FE30000-0x000000007FE31000-memory.dmp

        memory/3420-20110-0x000000007FE10000-0x000000007FE11000-memory.dmp