Analysis

  • max time kernel
    102s
  • max time network
    104s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250502-en
  • resource tags

    arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/05/2025, 23:41

General

  • Target
    2025-05-27_8dbd57b042bc63b9ecdc9e3e5506ce85_darkside_elex_lockbit.exe
  • Size 147KB
  • Sample250527-3prr4azrt5
  • SHA256 2d04d802438ae93b095acfbb87cf5760bfaf1bbd300a609d6941a6861bcc68a7
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Path
  • C:\ZWgvlAMeS.README.txt

  • braincipher

Ransom Note
  • *** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! ATTENTION! If you do not contact us within 48 hours, we will post the record on our website: vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://brain4zoadgr6clxecixffvxjsw43cflyprnpfeak72nfh664kqqriyd.onion This page can take up to 30 minutes to load. 3. Enter your encryption ID: HqfDKBqDbBLj6qMXyrXyAXwrT7GXRvtPkbuDL7YB8yxX4PSOKTyUzj9lqNjWAltr48E5KCYWk4Vrsm6qb2jIVE1U1IwalNo Email to support: [email protected]
URLs
  • http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion

  • http://brain4zoadgr6clxecixffvxjsw43cflyprnpfeak72nfh664kqqriyd.onion

Signatures

  • Brain Cipher

    Ransomware family based on Lockbit that was first observed in June 2024.

  • Braincipher family
  • Renames multiple (7526) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-05-27_8dbd57b042bc63b9ecdc9e3e5506ce85_darkside_elex_lockbit.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-05-27_8dbd57b042bc63b9ecdc9e3e5506ce85_darkside_elex_lockbit.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5296
    • C:\ProgramData\88.tmp
      "C:\ProgramData\88.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4988
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\88.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1300

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        HHHHHHHHHHH

        • Path C:\$Recycle.Bin\S-1-5-21-330179853-1108322181-418488014-1000\HHHHHHHHHHH
        • Size 129B
        • SHA256 dab6c6e95affdb793c0527f7cbebbe0aac34c85cce910828bcd26b23b2bebf7d
        • MD5 SHA1 SHA512

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui
        • Size 56KB
        • SHA256 aa25b1db9ea8e063a30c745f3f82cf1dade6e076a5eb72e42f65182a6df0578a
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui
        • Size 47KB
        • SHA256 fa98ed2e30270007df5897e94616a19b329098e46d2ad951f60ca3027a6b9d55
        • MD5 SHA1 SHA512 SSDEEP

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui
        • Size 47KB
        • SHA256 636e1d3dcdad8bb2242ce3b7097666d03021e7875f63cc14e2a5d071a5546b68
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui
        • Size 43KB
        • SHA256 9c360fb5bb9edae056429c852f32ce171b81a24c478fc060d2a12949d9f93a41
        • MD5 SHA1 SHA512 SSDEEP

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui
        • Size 53KB
        • SHA256 a5e790926cb8c45827b391b5f3c05b2ed9d1831a7eec30bebdfb4e29921c975f
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui
        • Size 47KB
        • SHA256 697797eda5181d5b60821a8e04aa884a4722b2b147ec6ee4d20115f092bec402
        • MD5 SHA1 SHA512 SSDEEP

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui
        • Size 57KB
        • SHA256 b0cd108f8b8553a02a35249da34c279bda6c1a0ef91229d176408e092be86e92
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui
        • Size 47KB
        • SHA256 5b8f0369b49d1018ab8ab5aa3065a9c5fcbabab3b576035751c05a4bc2c83ac8
        • MD5 SHA1 SHA512 SSDEEP

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui
        • Size 54KB
        • SHA256 9505449fbc3215fad1e628ac16413cdc3c3392cf3b7ff99a3726cabb99f0aa86
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui
        • Size 47KB
        • SHA256 16ec9ff2137ea279e28feaa8d01d7db0df4cdff9608d6e02e50e6f47cd400273
        • MD5 SHA1 SHA512 SSDEEP

        oledb32r.dll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui
        • Size 32KB
        • SHA256 006f803657a5610c3fc27a98e8613ce63d53c22218ef18af6e1f776a7964ab32
        • MD5 SHA1 SHA512 SSDEEP

        sqloledb.rll.mui

        • Path C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui
        • Size 37KB
        • SHA256 2a51213de021db6235bfd93dcb7c3fec04efd5a20a190eb97d6e23b3741c6c8f
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui
        • Size 20KB
        • SHA256 f046870c7190527545f4450509c91c4782a78dcfa6a6cb7d8c61a8bd418aebe1
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui
        • Size 17KB
        • SHA256 e5abc4f36904a682e4ad652f9d354d4b6039f10d4a6da6e76944a4c9d945a150
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui
        • Size 19KB
        • SHA256 f1e5cde725f4ce92ec24f0155bc55f33e0d02616ded7d263fd914a8a908d692d
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui
        • Size 20KB
        • SHA256 77e616562e561f443d1655284995a87956696628913cd6fc6c323a573b20defa
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui
        • Size 19KB
        • SHA256 d373f8388bd174ee02e4b210b760d8b8cf2d95ef50eb8294b5d679039107aa3e
        • MD5 SHA1 SHA512 SSDEEP

        msader15.dll.mui

        • Path C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui
        • Size 11KB
        • SHA256 9de5155e66a18a5dcd234cbff964a49b09c2324e9b981125af99c40d3b22ee02
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui
        • Size 102KB
        • SHA256 fc4696f7467750d6d0e2bc349acf9f488f526663104789b3e799788ee25ea72e
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\en-US\wab32res.dll.mui
        • Size 92KB
        • SHA256 da929137345129152f91d0465a59d632096e23007c6a1d313c92172614fef14d
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui
        • Size 102KB
        • SHA256 518db3753c94bc146bc289056f8ffac1c1a2a4c827a14c1815ff04242cc3e164
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui
        • Size 104KB
        • SHA256 e5160092cce2f2a3f656d39177341592b50580e42822aeee4df16444ea82ba1d
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui
        • Size 97KB
        • SHA256 603b16fc653242b64f45c963c6839ac7a3b5b089e6c6ef9d4de4253119621e30
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui
        • Size 69KB
        • SHA256 f4275398eb62064a6743f80f84b4ef093c5349b18f87c117091f917501155df8
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui
        • Size 12KB
        • SHA256 d03c5736d2789a2f13dde7d14c47602936d475d8ce511b956b4f1a3a2b70a2bf
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui
        • Size 9KB
        • SHA256 143aa28a5495d92d6b392a91dd3c421b84a3f4c388c0495913defc741fc152a3
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui
        • Size 10KB
        • SHA256 d7f669f3b9797d8e26296613ec940bb92f4cc033da8141d8e276e67c851cf1a5
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui
        • Size 7KB
        • SHA256 c76db032be116a080149c981fc26d9d987a8f23b80280d7fb116fc5baf1cc5c1
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui
        • Size 11KB
        • SHA256 bb3fe4575e470e30323e0dbc46f206de52fc224be9fa3332c266b135be420ce2
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui
        • Size 8KB
        • SHA256 6e806095457c7410c7026b28e79b987c9ccab5cf91f1d8904ad56cf2a0da7dbb
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui
        • Size 12KB
        • SHA256 9918ecfa9cbe2e99a0d883cb5443ddf6da5591dec763c5ef3f0a915bc48df1e7
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui
        • Size 9KB
        • SHA256 d9a9c8f81ca3c0b0937c8bb5c0a4b27f6953c3e0d277a79b075da5c5b95c743e
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui
        • Size 11KB
        • SHA256 883e4576211ea6c922324423b18456e8a22aa88be5a3fb4fad96c14c98128039
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui
        • Size 9KB
        • SHA256 985f2461ce2bab4e0c99fb21d715a30afdd5767a930d896a08983ca88daec217
        • MD5 SHA1 SHA512 SSDEEP

        msadcer.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui
        • Size 6KB
        • SHA256 87af7204f0fc737e81707a1e46c7b8bcdb6bb036a965868fddd412fbafbf5259
        • MD5 SHA1 SHA512 SSDEEP

        msdaprsr.dll.mui

        • Path C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui
        • Size 6KB
        • SHA256 e4b2d900277c04f2fc6d3655a11bd263b19d21dde750e87c72cbf181414602f3
        • MD5 SHA1 SHA512 SSDEEP

        wab32res.dll.mui

        • Path C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui
        • Size 94KB
        • SHA256 2ce5533d4d59c29348e8444660cafe8eda87dba03ec2251cc9f6d19993f793c3
        • MD5 SHA1 SHA512 SSDEEP

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui
        • Size 5KB
        • SHA256 db0556724d2614483591108c2d4acaf1b529d0a2f9364e09d31aa98c9500a05b
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui
        • Size 27KB
        • SHA256 951742108eded972e5928ee80b6263e2c2d39f235ce2e9af9ad046eb69a6423e
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui
        • Size 3KB
        • SHA256 fe0f33218bddf5586c18fc5c8e0816647d718c5ffdadc8dcfd6e8085dc05a4c7
        • MD5 SHA1 SHA512

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui
        • Size 3KB
        • SHA256 30a0606892471aa6f62526e56cb72d90b351efe48486ce4bb8fa9429affe2fc6
        • MD5 SHA1 SHA512

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui
        • Size 5KB
        • SHA256 7742f593dcf4e889de54d831d8ef4d57a83cb33257007771e1aea9b0bfde61e3
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui
        • Size 24KB
        • SHA256 91f28abfbd35df3d611e7a72ef2a6a9c511461da8f64fe894fbe8afe5ab5f5f5
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui
        • Size 3KB
        • SHA256 3bd8dff628025785a2576c71a2a211c858312ac096ad5b9e2e03316941485603
        • MD5 SHA1 SHA512

        micaut.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui
        • Size 9KB
        • SHA256 c0d2e360ffa0dfab301961a3565428583064262f9ce437e51356b47a7749828d
        • MD5 SHA1 SHA512 SSDEEP

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui
        • Size 3KB
        • SHA256 3390cc9a2b48a382536b4891f5678983a14660a55b682a6566ba07c39309c123
        • MD5 SHA1 SHA512

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui
        • Size 5KB
        • SHA256 7eb5f6b29d82ddc7fbb21e2569ee85f7b88f0dec762b4bf7839963d4a05c6758
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui
        • Size 27KB
        • SHA256 a447b11c9165c7c15f0521961ed111786ebd00690bc7baa9bb7d02f5b117bebc
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui
        • Size 3KB
        • SHA256 c1c8f0ea5c46a90a25614870a2ed9751e88f41e7db71c81d098849e575fd5f56
        • MD5 SHA1 SHA512

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui
        • Size 3KB
        • SHA256 2867a03d8283df700d4423abc1920e07419cdd8f62beabfd6b716f143dcd5542
        • MD5 SHA1 SHA512

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui
        • Size 5KB
        • SHA256 de896cc47d518ac43ecc1b0275d29c02096913b96423623645009f9a9f2b6dc3
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui
        • Size 27KB
        • SHA256 9560b53ef7afc63d6460f8b92a0f2966757a24422e33c095df4733a20e0a718a
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui
        • Size 3KB
        • SHA256 91922fd129b08ac495daa09235d67aa73887cc725262f3ec43c266cf12aa5149
        • MD5 SHA1 SHA512

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui
        • Size 3KB
        • SHA256 b8d29123252afaf38730b9dcda5d458c2167efead71bd97b4173f66307a2ab91
        • MD5 SHA1 SHA512

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui
        • Size 5KB
        • SHA256 141bfce6febc9994e820879bf1550a26fd57a547bc49ab9ebf513a1b7f457125
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui
        • Size 27KB
        • SHA256 4b1093e1cdad246732722858069a8369de0e4ebcfcb164045df69853fb92d6c0
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui
        • Size 3KB
        • SHA256 3a2071d83c729aab13bbed9213586cee7591d8a4ef88b81790336ef2a6df9b78
        • MD5 SHA1 SHA512

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui
        • Size 3KB
        • SHA256 793a1b6db235b907583a286f3cb28e1b133bf1bfa95952448516a7a4b895b1f2
        • MD5 SHA1 SHA512

        InkObj.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui
        • Size 4KB
        • SHA256 d88aa14e739b2f1739d7457fefa0873f2b45dd1d8000a2c3bad4d5be150f4ce4
        • MD5 SHA1 SHA512 SSDEEP

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui
        • Size 16KB
        • SHA256 401b2e817100b781dca33c5efac34816cd06c6f2196de228b8279d2677ba3ccc
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui
        • Size 3KB
        • SHA256 326ef3f071b756b44e5dfa8641be4cb499c6532a946de3c27100052942937c6b
        • MD5 SHA1 SHA512

        rtscom.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui
        • Size 3KB
        • SHA256 4f90200a3eca8db162f5e7dfcc1b9c95435d7e168650ab59f3463c7522f10940
        • MD5 SHA1 SHA512

        TipRes.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui
        • Size 26KB
        • SHA256 96e4d87ec2594042a5b483e6d28d61341649262db2be58e1ec7e2f22934780f1
        • MD5 SHA1 SHA512 SSDEEP

        TipTsf.dll.mui

        • Path C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui
        • Size 3KB
        • SHA256 f014c3703661752f42bc6cb9198aa546ec454eff743d1f64788267eb4c5c2771
        • MD5 SHA1 SHA512

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui
        • Size 6KB
        • SHA256 213886d760dd3a39ffbf616d64aae4acddba8c320514fd1cc4f2b5490b57fe3e
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
        • Size 5KB
        • SHA256 8a636f8a43fc2b29075362f6600bc4f5b043f09e90a7c24bbf1a686f97888325
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui
        • Size 6KB
        • SHA256 a8d0d1c6f98e08359c98f003fb12e1b000197db80a48c04a079fe68011ed9b00
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui
        • Size 6KB
        • SHA256 aafed667e61ef4a370515f02db794dc773c2fa70e06e922dfd40880464c942f8
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui
        • Size 6KB
        • SHA256 fe8a9f987838a6dc8cb843dd19816c6f949d70adfa6a662f2499c8962c3e2e96
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui
        • Size 5KB
        • SHA256 fd06c524e16339191aad861eec748a53c762e8ec48d2811d486b97993bc17a8a
        • MD5 SHA1 SHA512 SSDEEP

        iexplore.exe.mui

        • Path C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui
        • Size 6KB
        • SHA256 7cbf2392a7d6ef7cb0117942e78deff67df315f58d73b91a292c17b629ce6e59
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui
        • Size 2KB
        • SHA256 7ac812c97ae7dc5aefc97850f9b1333454de22997b753c3207953e44b04a8e47
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui
        • Size 60KB
        • SHA256 2f898d7d66541eb2d2f429e3073501982624265f57f26729f6af953427be1001
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui
        • Size 3KB
        • SHA256 ca03c5b033193a2ede58d1fb128e0923ff48be87b36e3a093da26cd944d25ab8
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui
        • Size 58KB
        • SHA256 d92cc794f18aca969d224247fc18c6f5380ff566f37836a32dd486fe60d1781c
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui
        • Size 3KB
        • SHA256 992f5d76f2c2e25314a601ce3141552a042dcf91384092a01c77c3b85ec02587
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui
        • Size 61KB
        • SHA256 668e6b9579965fcba2ae7e71b61bc71b393e706023a050fbea7973d1718a2388
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui
        • Size 2KB
        • SHA256 85ff512d4ed6dcd52c2ad9c7f106b59f10a006680f9e6876d0ba751f29ecfb5f
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui
        • Size 57KB
        • SHA256 bd555a63525c53f59724f52480f4841e13513aa81b1791328a4ba48e3c1af057
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui
        • Size 2KB
        • SHA256 f6713ae3b35ee15394a245a7a6052b11fd26d874c1d38329f5409a798ede8f90
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui
        • Size 31KB
        • SHA256 84ee3cfb81836707240b5b6f6844160d60fe146b16dbb6a6c152c4bcb84e6719
        • MD5 SHA1 SHA512 SSDEEP

        EppManifest.dll.mui

        • Path C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui
        • Size 3KB
        • SHA256 3ffba9424c26ca6997f0896e70b6737edd995b419493380f5d6004f5c7902dc5
        • MD5 SHA1 SHA512

        MpAsDesc.dll.mui

        • Path C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui
        • Size 56KB
        • SHA256 8a1780fe4072cfed3af26ed2aa4fac6cbcd7f0d662599745464974d1b9ffccc9
        • MD5 SHA1 SHA512 SSDEEP

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 39238fb47ed62268bfdb893a9a4d59584e15cfadd6fca8bda8e9a5bb65c0f483
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui
        • Size 3KB
        • SHA256 a75a68ba6fcfe2f058424bae8a7b0e437bb227349d9023ee2b265b8ca34ec747
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui
        • Size 61KB
        • SHA256 4c8406fc16ca30cd2ea8eabf95f34faed6132101cbbd6ff0183f370c30eba536
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 8263a257fea6ee6fab2103f38e742d6b32db6930aeba1d94aa051c9de51ff1ad
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui
        • Size 3KB
        • SHA256 ae8c58de9779970e8deec5226824ba0f9ba7a7595750b71942bcf5831c3fcd8b
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 baca950bc54f5e43cc1d92ae17506d456493015e391b3b9df56ca43725f562b2
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\de-DE\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 a21f7ffbd988d880ba4fd4f8de41ba97292deaaafa69b93eba92165be1419ca4
        • MD5 SHA1 SHA512

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 93490143b54d34f703f1ea2bd80e4ed6998d8de1965843cc070ae80c64384719
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui
        • Size 3KB
        • SHA256 afd652cc287843cafaca3eb805a4021d8d9ca4406fb5b8c0fb23ce46747f698d
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui
        • Size 53KB
        • SHA256 601bd91bc8f5e2c9a2a945516c534af5629c3c0f99ed8d2c164f3afd5444ead1
        • MD5 SHA1 SHA512 SSDEEP

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui
        • Size 3KB
        • SHA256 cc2e0ad5062f6c11cb8591d260095daaf8c42c224add9ff8c040f09d3165d32d
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 0468a8d6b8ad853802dcf5f41853eb497c43c8ad8730c84a1f0b9b8ca83028a9
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 5f8e897b46ac3906e587c6e15faa73f714fce656f5d9eea603e11cf1b5d6a3a9
        • MD5 SHA1 SHA512

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 bce8c90af515cbc3d955c8f0c985823119c6da2b522aadd411e2babf70e9af99
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui
        • Size 3KB
        • SHA256 c46c95f3b11a86a2a6f124a16de6f18cb12e92389521ee74bac675f1792f6bd8
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui
        • Size 62KB
        • SHA256 e2ac41e30dc3bec219cfe27868544e448ca5b27e3ecc09529a0f5faf6eeb8843
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 bcc49a1021cf0612cfee8ea1e68576cc4b01fbe0bac4fe67de2dc1214a563c2b
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui
        • Size 3KB
        • SHA256 57108844cc0672fdd2c2616e094a71c32970ac0c3cf1be6c40eb878b6544fc19
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 138144f8131901210e4221ac4622d0799f30fbf416c2a45e493ffe6eac7f35bc
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 1ca88a1c3f84d0099ae66516ee2a10b46c274c72a2739d2801f4795f27d7d4ca
        • MD5 SHA1 SHA512

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 ba7e10a25d3efac08216c1c4ea82d5b46b6c7d450ee4a5f39cb5321ca35c0f91
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui
        • Size 3KB
        • SHA256 12f059d7e555c6edbea378583b16313d9e21ffb73cb91b79d2c48dfa7e615443
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui
        • Size 63KB
        • SHA256 05efd293d03aaf3ae01d0b00528abee21e2cc2c8219e0d735081e31a6d4175fa
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 2275485d00268872ad31a288ffa0f4ddc7cebac80259335d3ce0287745a035fe
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui
        • Size 3KB
        • SHA256 33403fefd595242e1e8fa2fcceebb07f2c62a1341feabfa1655e5efae5624b85
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 7cb6793538317447121d1b6a91428124cc609591d298826f2eadb673927312b1
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 5a92bdd394315174244db294f3e41c112baa392048add04b3b4ad0315b75ee11
        • MD5 SHA1 SHA512

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 56735f7d4f4c4356b98210068273cb13d6b88147fca520ad42bdb5f303a97a17
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui
        • Size 3KB
        • SHA256 354f7c6c6b4cc555411a96d4c5225298682c5447f2275f760cf9a50e6be1128e
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui
        • Size 61KB
        • SHA256 e38bede638eb39d23f7623680e322c3993e94318910a17965472d658cf08ead6
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 207431abfea028bc06be577418bc7f4984cd31f7cde97737f33c692430699849
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui
        • Size 3KB
        • SHA256 6e7488763541fd1921dd3aa7e8df3021021960ff0bfac74bfb7b6c213795cfd2
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 729d0dd071e3e5aa42c997df168efec07541ff86d51a158af392150d4bee3797
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 9cabd7b4e2f7feacba14d84b1ec442ea89e813e583b6d73acaa97e372aa0fe82
        • MD5 SHA1 SHA512

        WMPMediaSharing.dll.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui
        • Size 3KB
        • SHA256 975e325dd25bbf1921828b5d0ed7066ce2238d11afceb24a90cb7efa97992cf3
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui
        • Size 3KB
        • SHA256 b274648e8c9470fa3837493891d4b41a40f85a793978d0af659c04f06d99ed6b
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui
        • Size 40KB
        • SHA256 a61d1e7dd2685b7e29c22abb03464e9ce51ba4624f86d117da223276b9fd33ae
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 078ca9b8f3b14e013accc7dda7576995562da3c91fd9bd43ba5bc0f2fea84359
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui
        • Size 3KB
        • SHA256 e2c05ee62b37a2a780617c614368b2fb57289783a7d682c48ea9490ebbe65087
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 77bbc91b67e07306b9643a8c38d970e37edce51b5f1ab618a8d15bfa35962c34
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 3aec1b599abed815c6f34e3c299cba428a50a973b6d001f28b4feeffc67bb848
        • MD5 SHA1 SHA512

        mpvis.dll.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui
        • Size 3KB
        • SHA256 39dc7fab7c90d7530fe49033a660b6cdefb1feca734fd0ac2177d7ef88129794
        • MD5 SHA1 SHA512

        setup_wm.exe.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui
        • Size 56KB
        • SHA256 39b7611127e62f81438d14aa83c3859ef2c8b2a5005748cd730bcf70108fa9be
        • MD5 SHA1 SHA512 SSDEEP

        wmlaunch.exe.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\wmlaunch.exe.mui
        • Size 2KB
        • SHA256 6454f322f40d1fa85734ff659c2af700ed010a0f1afff0bc7abaefd77b873b64
        • MD5 SHA1 SHA512

        wmplayer.exe.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\wmplayer.exe.mui
        • Size 3KB
        • SHA256 d334522ca68ee01498b12455f0dff538eb88f9f0aa221e4ebca37f49e896cd0b
        • MD5 SHA1 SHA512

        wmpnssci.dll.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\wmpnssci.dll.mui
        • Size 4KB
        • SHA256 a55613792aa645ae75158a9b9b92d226326cf84f688550c2ee8bbf83b5ad4787
        • MD5 SHA1 SHA512 SSDEEP

        wmpnssui.dll.mui

        • Path C:\Program Files\Windows Media Player\uk-UA\wmpnssui.dll.mui
        • Size 3KB
        • SHA256 226cc589265f9f29723cd5aacfe1e5e60aa0bab34912ec0c33fac6012ffb125c
        • MD5 SHA1 SHA512

        wordpad.exe.mui

        • Path C:\Program Files\Windows NT\Accessories\de-DE\wordpad.exe.mui
        • Size 163KB
        • SHA256 a934bd4f35101feed2ba5633b90389fcf69dcbc3a949a429e1d01a74dca3d536
        • MD5 SHA1 SHA512 SSDEEP

        wordpad.exe.mui

        • Path C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui
        • Size 49KB
        • SHA256 97259a65de788f88ea11e7e6d4181825e17245a718b7bae1bfd34d0a808079d4
        • MD5 SHA1 SHA512 SSDEEP

        wordpad.exe.mui

        • Path C:\Program Files\Windows NT\Accessories\es-ES\wordpad.exe.mui
        • Size 163KB
        • SHA256 17b1e084f6e7249c0a4138400d2c05a909f26445995a0b14de0e3f4434833c69
        • MD5 SHA1 SHA512 SSDEEP

        wordpad.exe.mui

        • Path C:\Program Files\Windows NT\Accessories\fr-FR\wordpad.exe.mui
        • Size 164KB
        • SHA256 10b993d5c2255c1b027ffc40e54526d809bf9a41573e312c45de7844a6008dd6
        • MD5 SHA1 SHA512 SSDEEP

        wordpad.exe.mui

        • Path C:\Program Files\Windows NT\Accessories\it-IT\wordpad.exe.mui
        • Size 163KB
        • SHA256 fa22dad4badc0ba1e4453ccedd2ec296dd0753f07a270b9119d236adee3f9b9d
        • MD5 SHA1 SHA512 SSDEEP

        wordpad.exe.mui

        • Path C:\Program Files\Windows NT\Accessories\ja-JP\wordpad.exe.mui
        • Size 150KB
        • SHA256 b06d6318e88ff8ef40c245a0c79e16e0950841c87e8a1fac62ec50a2ca0fa2a9
        • MD5 SHA1 SHA512 SSDEEP

        wordpad.exe.mui

        • Path C:\Program Files\Windows NT\Accessories\uk-UA\wordpad.exe.mui
        • Size 53KB
        • SHA256 6efea0a71c05d9dcebf05db139b10dd11ea168ff2631f83280fcdc6e2e0b8cb4
        • MD5 SHA1 SHA512 SSDEEP

        TableTextService.dll.mui

        • Path C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui
        • Size 8KB
        • SHA256 544e80120184d3a0e8f3b25716fdb7066e2c582c7b3005f930b4b96f0d966bfe
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui
        • Size 18KB
        • SHA256 7c4c755c5f88de8093629480fdde2d7560aebb2e87053eb7a46206ebefbf7344
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui
        • Size 16KB
        • SHA256 66ec1697565be113098b5c147020c2fb06669f48b95376c45efebdd9d48602e9
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui
        • Size 18KB
        • SHA256 6a5ada491fd31d50fba5ea888fff5d5a2723cef3bc1c24034e36d8c120eb2c9c
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui
        • Size 19KB
        • SHA256 53c2c83f3d55dd02cf0787241a2e43909e92e3758de36b9d09dc87dd13a0dc5d
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui
        • Size 18KB
        • SHA256 35a95e802846886ec3b65ea40e694bd62f529f5ebdd60eae6d51ca294b001154
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui
        • Size 11KB
        • SHA256 daab3c28855af46b2217d364b84800b3226e03cc92059898402562990e8b55d1
        • MD5 SHA1 SHA512 SSDEEP

        PhotoViewer.dll.mui

        • Path C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui
        • Size 17KB
        • SHA256 e0d9bd78fcea2d7ee68652e789e15ea603d63143be1602fa671c5f64d28ac32e
        • MD5 SHA1 SHA512 SSDEEP

        88.tmp

        • Path C:\ProgramData\88.tmp
        • Size 14KB
        • SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
        • MD5 SHA1 SHA512 SSDEEP

        DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

        • Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
        • Size 147KB
        • SHA256 9c74ba1dba22cb95f75bfd1b8c634487bb70b34005e32bde6732ecc2f88340ab
        • MD5 SHA1 SHA512 SSDEEP

        ZWgvlAMeS.README.txt

        • Path C:\ZWgvlAMeS.README.txt
        • Size 1KB
        • SHA256 968dc4d550e01fc12a1c53b5c320361fa62716e296436c78757c546d616df7ed
        • MD5 SHA1 SHA512

        DDDDDDDDDDD

        • Path F:\$RECYCLE.BIN\S-1-5-21-330179853-1108322181-418488014-1000\DDDDDDDDDDD
        • Size 129B
        • SHA256 9b19b1be45d798c24cba48becbe28611d1ab13be976153f7dff5f75b8f51d603
        • MD5 SHA1 SHA512

        memory/4988-19953-0x000000007FE50000-0x000000007FE51000-memory.dmp

        memory/4988-19948-0x000000007FE10000-0x000000007FE11000-memory.dmp

        memory/4988-19949-0x000000007FE30000-0x000000007FE31000-memory.dmp

        memory/4988-19950-0x000000007FE70000-0x000000007FE71000-memory.dmp

        memory/4988-19951-0x00000000024B0000-0x00000000024C0000-memory.dmp

        memory/4988-19952-0x00000000024B0000-0x00000000024C0000-memory.dmp

        memory/4988-19954-0x000000007FDF0000-0x000000007FDF1000-memory.dmp

        memory/5296-7672-0x0000000002EA0000-0x0000000002EB0000-memory.dmp

        memory/5296-2-0x0000000002EA0000-0x0000000002EB0000-memory.dmp

        memory/5296-1-0x0000000002EA0000-0x0000000002EB0000-memory.dmp

        memory/5296-0-0x0000000002EA0000-0x0000000002EB0000-memory.dmp

        memory/5296-8792-0x0000000002EA0000-0x0000000002EB0000-memory.dmp

        memory/5296-9946-0x0000000002EA0000-0x0000000002EB0000-memory.dmp