Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 15:49
Behavioral task
behavioral1
Sample
9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe
-
Size
90KB
-
MD5
9e6f174b10a6c1d04b78cd77eac43650
-
SHA1
de78ec06da3b0333e000fdcb1c1fa1c78cc99fba
-
SHA256
f643cc23d331615e933a5dd250ce70676a54a6f8dfcc6c4e4cfad8bad8485995
-
SHA512
3ff5cad8d7db600a9edf60d8aa59e00104aa80b555971933a4a57d38eb75557ca3a6553cd816a4043d5b112d216bc8ae6ba1dabe738ca076d7840826ca4f980e
-
SSDEEP
1536:CTWn1++PJHJXA/OsIZfzc3/Q8ITWn1++PJHJXA/OsIZfzc3/Q8S:KQSoDQSol
Malware Config
Signatures
-
Renames multiple (5308) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 1684 _desktop.ini.exe 532 Zombie.exe -
resource yara_rule behavioral2/memory/3936-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000800000002342d-5.dat upx behavioral2/files/0x000800000002342a-9.dat upx behavioral2/memory/1684-10-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0007000000023431-15.dat upx behavioral2/files/0x000200000001e584-17.dat upx behavioral2/files/0x0007000000023432-21.dat upx behavioral2/files/0x0008000000023431-22.dat upx behavioral2/files/0x0002000000022abf-28.dat upx behavioral2/files/0x0002000000022abf-31.dat upx behavioral2/files/0x0002000000022ac0-32.dat upx behavioral2/files/0x0002000000022ac3-40.dat upx behavioral2/files/0x0002000000022ac3-43.dat upx behavioral2/files/0x0002000000022ac4-44.dat upx behavioral2/files/0x0004000000022981-58.dat upx behavioral2/files/0x0004000000022985-70.dat upx behavioral2/files/0x0004000000022989-77.dat upx behavioral2/files/0x000300000002298b-83.dat upx behavioral2/files/0x000300000002298c-87.dat upx behavioral2/files/0x000300000002298e-99.dat upx behavioral2/files/0x0004000000022992-117.dat upx behavioral2/files/0x0003000000022994-120.dat upx behavioral2/files/0x0003000000022996-126.dat upx behavioral2/files/0x0004000000022994-130.dat upx behavioral2/files/0x0005000000022994-141.dat upx behavioral2/files/0x0005000000022996-142.dat upx behavioral2/files/0x0006000000022994-147.dat upx behavioral2/files/0x00030000000229a1-162.dat upx behavioral2/files/0x000400000002299c-166.dat upx behavioral2/files/0x000500000002299c-174.dat upx behavioral2/files/0x00030000000229a3-181.dat upx behavioral2/files/0x00030000000229a4-185.dat upx behavioral2/files/0x00040000000229a4-192.dat upx behavioral2/files/0x00040000000229a7-207.dat upx behavioral2/files/0x00040000000229a7-210.dat upx behavioral2/files/0x00030000000229a8-211.dat upx behavioral2/files/0x00030000000229a9-215.dat upx behavioral2/files/0x00030000000229aa-219.dat upx behavioral2/files/0x00050000000229a9-229.dat upx behavioral2/files/0x00040000000229aa-230.dat upx behavioral2/files/0x00030000000229ab-234.dat upx behavioral2/files/0x00050000000229aa-238.dat upx behavioral2/files/0x00060000000229aa-247.dat upx behavioral2/files/0x00050000000229ab-250.dat upx behavioral2/files/0x00080000000229aa-259.dat upx behavioral2/files/0x00030000000229b0-268.dat upx behavioral2/files/0x00170000000229b1-272.dat upx behavioral2/files/0x00030000000229b2-278.dat upx behavioral2/files/0x00180000000229b1-282.dat upx behavioral2/files/0x00180000000229b1-285.dat upx behavioral2/files/0x00030000000229b4-290.dat upx behavioral2/files/0x00030000000229b5-296.dat upx behavioral2/files/0x00030000000229b6-300.dat upx behavioral2/files/0x00040000000229b6-309.dat upx behavioral2/files/0x00030000000229b8-313.dat upx behavioral2/files/0x00050000000229b6-314.dat upx behavioral2/files/0x00030000000229b9-318.dat upx behavioral2/files/0x000300000001eff7-3894.dat upx -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Zombie.exe 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Zombie.exe 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.tmp _desktop.ini.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms.tmp _desktop.ini.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.tree.dat.tmp _desktop.ini.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp _desktop.ini.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp _desktop.ini.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.tmp _desktop.ini.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnIE.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp _desktop.ini.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp _desktop.ini.exe File created C:\Program Files\Internet Explorer\IEShims.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp _desktop.ini.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.png.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOS.TTF.tmp _desktop.ini.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\hostpolicy.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp _desktop.ini.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp Zombie.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\sspi_bridge.dll.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.tmp _desktop.ini.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png.tmp Zombie.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp _desktop.ini.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll.tmp _desktop.ini.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms.tmp _desktop.ini.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalResume.dotx.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Controls.Ribbon.resources.dll.tmp _desktop.ini.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp _desktop.ini.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp _desktop.ini.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp Zombie.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\tr.pak.tmp _desktop.ini.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp _desktop.ini.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\et.pak.tmp _desktop.ini.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll.tmp _desktop.ini.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp _desktop.ini.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub.tmp _desktop.ini.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp _desktop.ini.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3936 wrote to memory of 1684 3936 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 84 PID 3936 wrote to memory of 1684 3936 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 84 PID 3936 wrote to memory of 1684 3936 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 84 PID 3936 wrote to memory of 532 3936 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 85 PID 3936 wrote to memory of 532 3936 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 85 PID 3936 wrote to memory of 532 3936 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe"_desktop.ini.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1684
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:532
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD575cee8aa423d8c6dc6cddd487cf55b75
SHA1bc5d36c38496d3c8f32d43e7dba354b256d2fefb
SHA2569692fcd84776fc26361be81311b55fe6124b343571bbec958d5084563bc4cc63
SHA5120951349a7d76545ee92b1b16f8d985bc889a3e4ea235fc8d166401475625b0964bc404552e7fd49bc1dee12a892d7c2df2b8c9dd561c731e637f69204bfe589e
-
Filesize
90KB
MD5171758ebef492e9dd8fef08f584fc090
SHA19116196dea79791af88ee31ed0afd1ac210af7ec
SHA2566691cd1846415ec194d51b731e6141b3c3bbd22aac98742cc1d90f3d78cb0344
SHA512d823c06a262ce191e17ef6f489e32f6bf4faf09b66b3bd886d781d9dde50a1bb4e979e653f106eecb70da31338e7e7b4fce235608abca06a160aa4a83c043519
-
Filesize
157KB
MD515e051170731bb8533d6c4ea9a4c6262
SHA1a0f0a98b5158b825fd5e17ab9513532d3092da7c
SHA25648d69bd0cd72eebac0662fc9383015feb165d667213d9cb091e3c81b82f3885d
SHA51200c425076f450c8c5ab4012a8ccf0d647630d24ddf4c2092a635cb19cf43494dee34db568959124cacfb4603456ef2eeaa8e9883e828ed8e8777d4008603dc27
-
Filesize
144KB
MD5f853c0b767d0a479dd310e8b63fa6ae3
SHA1968804b3ba2fb8a885bd50a57415e4c61b375c1e
SHA2567e8c59703ca8eaa944c8cae717dde93429d542000b637c5f36b24a0796c29243
SHA512c1c67d099ef61a3ecf24622d17ea361662abbe4a40ea677a41dcebe99462920b00e8d9f8ae1e0b41d6a3d64d8593569d3333bc374d439b553ac361415c13a17e
-
Filesize
792KB
MD57726b26f904ecce64ddadfb2eed81526
SHA159145c70f26e6e915927c0588b0abcdeb3de43dc
SHA25684aa074d986b8319a21cdbdbc5dc0b926113b4853ec2dc07b46f0e0589f908b0
SHA51207457ef045492590f1bfdfc3a5a090834d4ed0d975c22dd2b77c2c0f1986b284d8c8bc56091fd787acbd2d2732391a7617dbb648285f1189317f06682e0d657e
-
Filesize
1.8MB
MD5102d45c846cc9557ae30e73ec3815cec
SHA1fe80e69629dc4c0b0f018eed5c29ac4e73668b97
SHA2565bc36710a6e1bf0e3896bbe3eb468a8c3b498f1a035518c6f84ec7fb468c54f8
SHA51264b2ba1ef27c82ad96a756f9a3f17dee57364aa5ee4c27e566991b9aa076cc8e2e2b6a0b24fefdc676284d56f2f522ba5512f41f25324e156ea61fe9e48f15df
-
Filesize
589KB
MD5cd8c6f4f1f87ac0a5f9858631624eaa1
SHA123f6a7eb7a7e2d90c3bc8a1e4a27044695de9343
SHA2566ec7c0b9ce8f4a752820be39823e14730fed6852e25b6df0a1cfb2700c7a612f
SHA512f76e9dcfdd4c2ff1c8b663a8305fedf0775d85962c5a9e15ca43abccd00c4fd05227d76987a43dcef09fb347fe53a25d96a4029aee7aac61a876a1e21e93b3a9
-
Filesize
975KB
MD5697e8e0d70e44a4286c04bc9bf0bf512
SHA1a826fb51287e66d4f7b96b778bade89edb9dc8ec
SHA25693fa03c38b662e2824eeb816498e82eb3bc92c97e94f3e9af30c7ea8ecd487c0
SHA5127c7129e87ae133c1973392c83f5754149dc574fcb1e12b1b83cc26c2ce79a2ed6bbdbcd8e29a787ea09b3bd5c2b72772caa7c66d70ebceeaa28a578812ed99fd
-
Filesize
975KB
MD5d6caa0d5b2e572de921f1558e6c2dfc9
SHA1ab6e6b6aac53f4e7cb37fd79ec1211ac1ae4c983
SHA2564f6cd954939d642fefb62d3083a18f13c561a9896141fa7a9bb386bf72c9bdc5
SHA512a6060d5147197ad238c7c89a5bf134f153d0a3bf0f79cd3d9d8461632787a93945360856625916c39047079cb7cef116f0d390b4ff6110f95071e75578956aae
-
Filesize
729KB
MD5ec5be4c52ab37eb76b084bbe82a7bd9a
SHA16aaa716cbc1084c27fbb2ba041960d5d1eb80fa7
SHA2569a941586673658ae3b2ef2597088186e088312fe96b61f7469d0109edfafb4e1
SHA512e70a6b7ba0b866e631d6cdbc69a685b0a4e9dec7a187335fe9b8b327994151046748ed4b2e636f77faa13b3e4a9ba6289f90d30eeaf6d13a1e0a7081db8b1f0f
-
Filesize
44KB
MD5ade9597aa0eadfcbc90cbf20e338cead
SHA1a9c35cf1e17a643d85eb7c59755f15e44923f1e9
SHA2568c4ad943db8bf880007cfe7faada934d2ca46958adb76ef2bf585b11a130a920
SHA512238061f17c5c93951b3b4f80bbce8f79138696e10d8fd2d23aa0996e28297994a30eec200726f505e14d9c723a5900bf8d238477251803350842807e51934e00
-
Filesize
56KB
MD5c519ba4c9d56db1ab400998d7fe272bb
SHA1a6c4be1e1538aa5d7a48fef41c81c66e71b0edf6
SHA256822798135f6e54ab63ef3563446b26a667a017fa2b9137e24cbab89e020b31b5
SHA5127e6b7a1c46d4449f3ce3a6eb392d7586fb3b90aec6e99ccd39022a1d4ed2396b467c094a2216f31d1f8fb2d5b91cd9655593c3c547c67542b555f840c662ca3c
-
Filesize
58KB
MD58b3d35de6274fd87a290c40bd94b4fbb
SHA1b3fa7c7be2538c717cb89f4927d67226c393087b
SHA256736f9ae8418ef0a47797951761a042c25adf4e0039af4d8b997a33682f9fa6ab
SHA512976ac8afa7bc25f3d8d2ce38dc38e0a3f76c22779b6ade4366840d714f6edc8f806b6e8e297c5ea966a8d90c6204cde9eceaa4ce3d596f634fd5365e17931aa9
-
Filesize
45KB
MD5b56b0890d36d11f39c2756335469db09
SHA1af3c7a96bce2ecce40781e1bdda9e0e0ef8b993a
SHA256cd04f31a5f307d3bd19864cb4dead011a42ba5d1fb91edf2072db1f61d8fffa3
SHA5125f5de2ef9a6b7f858f4715ce33cf45063c45d2961aacd5508b56ab5d6a22ba34d15be829c47567e7cecb193b649142f389ef1498758422b9493ac79bf22d587f
-
Filesize
54KB
MD5e8ec05bb99ab27856889430e294b5310
SHA1fae855296e1780cee8ddb1a4ea81f3e5a622b770
SHA2565fe84805922bfa13e9abf45032207e5093f91a0d4a564b47fdfc95a20e613d65
SHA51297b6c5f61e17bf009826517cb2571dbb1927234deacc1824fbb2988feb5568ca7c49759716d19e877452e1ebef400e6a7c8921b53a601b8976c5a305c27ff9b3
-
Filesize
53KB
MD53076c85f47dbd0ae804b13bc5e9bc357
SHA1e4cd94fb57a759fb940977ce1a1a887ecc870923
SHA2569010abe5f66df066d24a9c87b4572c2a14367c7bb8a7484b625e180218b40646
SHA5126937edab436081f8967fc80fda78ec1a96c06a1b706043d96b1310ef59c7dfba6b2687c70bd80433745bb666529a8e0cc57ad06038088ad86d0629955462484c
-
Filesize
55KB
MD5b00103a80d05d0b2a723ca780542fc7e
SHA179e003366adcf0bc243b476ff27bd30850bcecad
SHA2569696a72bbd3caac41a0987114a1847ec94c920beceacd90f1a2477aa0372fa07
SHA51259b8acf877192b2f3fd900cddd80e7ccb25e8e0963d05abf296b89aed9bb966daf7301e8286fde1d0933840446c786801a4d150b9b763b609d4c68a42ff17559
-
Filesize
54KB
MD52d7b7c3d5fb8fb565cdc5445aff8b814
SHA157778ebc369988f1a6fe19ff4a16ce65c9aabb8f
SHA256ed8f3b05edf5242c9add317555507e8165e5a08f4e07f70bd3a71601f2228557
SHA5122e582934959de73759744be425138c18efe4b300561932c7f09dfddf81da960683fa6705061b9443d56d47e16ae99fb734afe91a15ffb608361f9e26283ec37e
-
Filesize
58KB
MD56adaa42e72f069f642d3ec2282573e4b
SHA148b9d36c849650bc7371e93cd7e9f2e6bf39bd78
SHA2563a59f3abede8dcd165084a6706b43a718fcc2bfc6a9e6c8acd833b598acfb797
SHA5127a2fd20ebeb7b10835b9b06acd2de12d7bdfaee7e01aef88c26a42aedb9994464dcab06000ae2957ba2e0b9f065b54f01f6555307394c9375fe2edb2c1f46db2
-
Filesize
54KB
MD5650f1719bb849bef9cfac8d81d6835d1
SHA13fddbe7667f5c74faecfb4b89650616927f629c8
SHA2569515c60b810742f4cc39a851b2a95630d9004a5f9b7aaa2d3c1c08d4b44247c1
SHA5127da1d36b7cd42b0ae94f4ef330aabadf64530b90922d649c1e0f26832020da181cedf8da215e82f788b3a0b4cfbab4abee9e56a580f09d39ffc625b731a199d5
-
Filesize
51KB
MD5f98789eae70b4e32be3251404c86ea13
SHA109d979f2234df0565f886ec4544d2e5758f6ca8e
SHA25631e0e06de08284324a7a59d69ebff71b014e0d2eb556dcab834d4780a61e6c41
SHA5126b6381668857df024ab2ec2cfbb3f8fd5aed32b7f1fac6a4a1979789ea857cab83fdd4d364e4b49b2303b9791e633e336f5dce9920f98ce032791f53429162ae
-
Filesize
53KB
MD5fee753dfae398af4f1758a28d74c257c
SHA1611c4594e073dfc0ed84a1ffae0c046755435af4
SHA25621ca9124efe0f9c3754f5c45415b496fe7044fbaab70b3e44c4c0976aa522a13
SHA5125013e6a5a42b612f0b85781ab0696db30a76860875be6a46331ca097cfbdbd101c59ffb5ece154caa4877df7d1b7b4a6fab74352b18d62b293c094ee0a932395
-
Filesize
45KB
MD559e2488ac02a4f74f101177544749693
SHA1a4fd59463833d26538e6ceeda8c9fdc85f9ddc6c
SHA2566204e95b29f71def8fa99485c935701398db3a62cbaaf841001b1a37bf772f1e
SHA5124a3da94f694462ba53256e136e639cd2d0b88911b13c2eed017869ecf5a23ef5df36553024467bcae3ba38c46cf39b6a3ded6653d44bd77e98bdfc5371742612
-
Filesize
55KB
MD582caea1f58dc9101946fee7305843141
SHA1bfe213149f8e6b896e4021d1f4463d5d0bfae1fe
SHA2569c2071899a8d9b431af8d692424c83aa37c27937d71f2d1ea08599dfd58769d9
SHA5124c95286a672fbb1beabd03f5344d3b87a9347e2675cde0640033d548b887534e44a30135d3e61f6e3a68ea349a43877a7e101061236c2aacf9844175033549cd
-
Filesize
59KB
MD5e137be6b509aae22db8780daf8f11cfa
SHA1ef48d1c232be3b00aa98a36e7c2293b289985723
SHA256d5ad5a12a2ad92b686fb6ecb4a4d355c7c3e9127d4df4f8d402df6df82b6f0f7
SHA512d6bcb4d9e530ad0832d005012088d6d0e24f608f528d2ac9a34eba7093aa10ff33736c715e5339b4bc3926062a5fadf59788b50e5ac437239494d440330a13af
-
Filesize
53KB
MD54391ff30218f112a863df4b82377ff83
SHA19eb3ac2491a77fcca7570a18d2b999da008506da
SHA256638c73b6b2720d79443087acbd2a20e06188ac84d516e0bdefcad7e73268e1a2
SHA512c2881a420c0105be121c64a8b2fc26be26d4ca4e498c54a4120452b6a60807002b54fd8ee0ba555127ba70cd3467484bb9810fbcbee67437486f9b29b99ef5bf
-
Filesize
57KB
MD53edf18f41672af043519ebb3438e386f
SHA1bd2e9013d71ba6d353faa88cc5fc80f172aa903f
SHA256a545074a75a799ce486801183f6e24021e179194be4aa2ba348ac32ea330a28d
SHA5126751dcb0b5aa080b3e6e277a52671ac83586d83fbe1a3021e2cf79ccf75d7a9412faa91993456f2c780a6284eb7f52dd9673d117ae07210baf47bfe3a7316745
-
Filesize
63KB
MD585cb3cccc9b70ae79942c62d7f185c6a
SHA11204ae1201791f7aca645f553cc161a5ef9c2e90
SHA256ad9d3903e3dcf8f318931d95ea5c61c0b03d53fb8e10e53822d80f2cbed6dc28
SHA5122809c84499e770f16bd6ae5f86ad7f8cb89be7b47726aa6d0383fe81d9f3212d419fbd1d6bc0ab2f17140a07118191bf6fc7a9ba2e04010807958d60e2f571d0
-
Filesize
45KB
MD5c315a743ed0e2ab3985b50c9dcc56d46
SHA16429e9e75d55a35958119a8903f972bbeed9fc4a
SHA256f0ddc5eeef17bf82fb37e50838079fe80b6977cff680aa8de31704359286fe91
SHA5123047d6aa1fe2c2146a346ea826a8baeffa15b2fa332a7fd90c6c01738f2c37401fda22bdad4b6408590582d0a639af87e494c4fda3964a9cf98d8dbd8b22822c
-
Filesize
57KB
MD5231692936e3de0e29f1f32572926abfa
SHA10354ba8a3382de03d22a7dfac60690e7821bd35b
SHA2560b05d96644ce141e5eb521a90558cf35bd72b49fa1498a4319c339375b607a45
SHA512c4eee333e68550fb321a415efa05ec0dea7bdc99ab4ffeca9e1e4cd1f96d3108a6402255fc28aabcc1d10e6ed13bc2f42b52e08efdd2bdd14e0e2c5e91f81f62
-
Filesize
57KB
MD5a29f67acc6c6a9a316aa0ca388dddce5
SHA1fd02b4ae500e8783ddf07d2475296486aa2dab95
SHA256b802a788de5d745cc9f8b85802d4f467616365bf4709fb6b1b031576e72cdbe3
SHA512f46fd76a1756f0a2c2da25cb5e16921f6eb6e554eb29701e94acab763bb983ed5902862e7e14a694efe227cc660a4d82f25d37e68f7a458f677eeaffae5ade8c
-
Filesize
53KB
MD58dd162746789cf84951c50a0364d687d
SHA11015f13c8f9d8c0777989c438ab0935b0b69d128
SHA2560e3755cd5871a308105cd5892463d23169341f297f5c7cd92ed38b11b7e255e7
SHA51273829980ca39f296f58dec224e7605c7128996c6870b4b214a2e29e4710d85bc4c2aa137dce24c95cab3e135eb32dc4d6a4c83d411347016319c256bba61457e
-
Filesize
54KB
MD59002300942490afb6693f082bb291e92
SHA1d16c36e42a5eb5731c9e2856e208b22fab34666a
SHA25654e013d2759bfeb411393876369b24130a83ef9ff1d1c45e5931b25ce7d01641
SHA512af47219d29c145b470531c2a6476235fb990398f79c75c0de356ab8fb54359e5f5dc8f15f2055e646aab21d67729181b2a755a03a3c815aec9952eef0504753d
-
Filesize
50KB
MD5f103cee27aca78bc832ff27f11066156
SHA1f642bfcc3cf81b3152956bb5914c9303a09ae6b6
SHA2566b012fd94d568df5a015f40ddef8fe495fb07d6e65410ff923c49363dff8c5c4
SHA512e262451588f403c89029bf12d2c8bf820f05638530bd40ec428447979367f0d9e911bab1bbbbb8cf3205e8c87b33bf2fa6d72021b0f9adfc00e9b037f3af773c
-
Filesize
53KB
MD56926ff2e7949040640037c8959197162
SHA190b15dd12fca92da9ad2d0263a44964a2b7022dd
SHA2568367bf5e83661041ad8e0bbee87480d8cc833eed961414133d6be4793c8a3fc9
SHA512ffab72f26dc9b4ce51473acf2dab67a9a7076eb7087c8e24e84d054fa61fce21d4dadd88bcfa12fcaecf5f07c88b65a1b3cf1c7b5a4b9f080a6868fcdda1fe3e
-
Filesize
53KB
MD582d755edc7a6d3a197ef45514cdddb29
SHA1ebf062b5a8365c39420700f5319f0b3316d75772
SHA256489d2d5386de9fa70bcc3bfee61cc23c0bab7be24286de289251f856ae0875ca
SHA512170d5c4cf531bacfca7afd4a04004aa42a1a3a260f93f5936e4e0e90a1e19327bcb320463577cf28560ec931e82cda39f1875d41e583d0f8e691750446518a32
-
Filesize
65KB
MD50eecabdbd2c64f6c522b48dcbb050fc7
SHA16cee9371fa0a4595a452638ee156a605d7a74964
SHA2563f101e534d6a41b3da0608f1558d16db7debe8855c70c17befe0b2209b17a4f4
SHA512f22057959635fd2c187919167d1df856edc6f41966c8a3d5073c9a0587844efe832f8d10b73d50d9da1741ca8e2b855e16a2d900385ec79d919bfad98ea9b556
-
Filesize
66KB
MD52e29cb1c64e39634d2b2a1924ffbf047
SHA185c49de8bfd7b87ac63d6e6c9190159e3f8d09af
SHA2565a9faee583205e5c1915ffb057b8f6d23d3467c0884c8e55bbf1c480c3e9dbbb
SHA51270b4f5d4d08c90a84208120929fe73829becb09a87e00127a8cb4f7a9e869fe99debb400e11a51a55f07e4e20aedc93763b690961c140b6cdce9fb4d8da0e60b
-
Filesize
55KB
MD58d803c4a691dc8141f5cc7c377c271c5
SHA1b9084a5a8273218dd2cf1651fa5408c7f4844fd7
SHA256a2b17dd6740cd67f8fdaaf0aba00e176822396bf4dc2c90f1ed0048e06faa458
SHA512527236637303296e1efda3cfc9e5cb896eb27ec79d68f3a19447def4d687ed21606e2a078afdfc0955694572ce60daf07b6002426cf9445e4d1a9c87e7afc7a9
-
Filesize
45KB
MD5af5ac10d278deaa45eb38cb1316fe526
SHA165ad0b6b7b86bc842b377446c049f0e5be097468
SHA2568b876ee169577ea2cbc9deb5a06936761dc9db6c7cd4aafd62569123529a2165
SHA5125a1ca770d72a20c8c3dee2f766ae70cd8015ffae7e6215626c49e129ffca4d744980261bcd828ba39ca1636d1267a6e17116ad1be78b22fa9dd8ff043957d138
-
Filesize
58KB
MD50d5a1011d052c6d7ce4ebaf19187559a
SHA1faf0a2f734dd465e44554d1624ec7b491952a870
SHA2560976801c1d44ca2dbb91c1eb53aae0c2884b9d0025f982ee8e1eb678f5669b52
SHA51219932a1c75060ed7ad14eaad5087745a51effd939434423d515e308c578f36feb40b0b11ba8be0e0418065e0e1bd89af76150b46719266008d96c9dbf07bc3ea
-
Filesize
45KB
MD5673656462a590de2da66bd06fcfb0fac
SHA128e01b92b40944c5d1deb85b8db91e67b92d9d0e
SHA2564c4a16abbf39622f87ae356c9f203ceec84f73b046f90af677c0e996d1da6b82
SHA512e5cf03a655a1bbc5861eee688e139e9252fc96cd2c537b8f8d4c7ab3a243c2463aee950b50a457289b29886fa0da4dc2dabbf628270695a7ae1c43c3b59c00dc
-
Filesize
55KB
MD517c46579b78400fa5f9c936c38858c34
SHA1523fed6bc2ee651da8090c015627647e9e6de2a1
SHA2566831beff89303858c2d00e34d3c5730ecea8f4203e98e5c227f817d1187bbe0a
SHA5122cdae51f9ca8a1a5b38572ac6443c86c19ac8e7f3220f9eeb0ef6dfefda3fb6c9651ba413994cf822bef59d70d5ad1c7d3ca09dd8f155af3a56ecc327a786f20
-
Filesize
54KB
MD5743e7d67f06754e5dd37b29917095fbd
SHA17a3ef0b9e8632dac556ef1bf89d32cb92b0e14f2
SHA256aa42f28465f815202344a274e75c3cfed9b3b04a6b7845cca1a1b8b43a1d94cb
SHA51297933dde908e00be686fcc7bdc6108596fb4f697b605d8f0d1960bd72302806db03144f595b480c690bbcb82c8e01b47e2f1271e43a8fedfff3ea5737dabc43d
-
Filesize
60KB
MD591b4d8392ba49a05afcee2da1e8a5d26
SHA1e05971db0cb1d76d9976de6e5b21e200d88c261b
SHA25643555c6ca9eb08fcfd833775629c16aaec246586c2bad2d38017ae9bb64120ba
SHA512c732564e91a1b5fba228832ce2b6a85738707c5a2574698462c3c4175168ff92f61ce53be7c99c9473c3c4f2477cbfeef233be4409681badfa3b870eb94f9cfb
-
Filesize
64KB
MD58ee95dca60285d6bd101575dcab1cb5f
SHA11809ccb1557c955aa5f5c57b2a89a4813ce30416
SHA256ccf14e24b9864079727196436f952814372da658d4469ccc1be0416c499bac78
SHA512f68d9763bd3887f2a23d6486dda60505c3abb54e648de0cbcba1c1786bb5c84224da64765627380002a8032e52a134c402719f1f771011a43fb687137e2189a6
-
Filesize
64KB
MD5a540265b26c36b09fd7bd9e270a5e74b
SHA1418c4eae1b49857c569fdcc11e2aa040d741b50d
SHA256887dd8d9f3a4d80226d92c93ee6465a53ac8562ba0ca66715d4d6e8b0ab32506
SHA51278750f633e35a93b04770793d812acb004657ea67565fdbeb5d0fbdece78b45e9512ed87112b893d26b3815c007085f423b56bb4ebc8fea5618f524499a991b3
-
Filesize
54KB
MD51d9242018539ac5e81c2658e0bfd6256
SHA105fb62c1b41ec8b5145992a22c4bff6b1e160ec5
SHA256d174a52a3ebe881aec4d2bc8e808722f8153593c1c1fde040a789ce28876a834
SHA512ec783829579d6e5b9d09385093f0ecc102af3ce6eba4d343d03ff618709b23b95409031f745c4f3ac69cdcf753ea53b7a41daf53b6e4bad7b80b105bf96653ea
-
Filesize
51KB
MD541239761c0ef9529cd01173bf5cffcfa
SHA12471880565d5c3d56957c157c4d97ff0d88a5a3c
SHA2566eed7a07bf3526ca0112867ba2a7034f6de8b11202b63c629bb53acfba775301
SHA5123610c2edf323e3c472066e552498dad3e63c8bca41a006ace120bfe37deaef28d2065166ecd36097fefde9852039077bf8bfa4a474aaf70c7d522578ad48ff36
-
Filesize
57KB
MD599af9f9a957c932a714a5a61d75c6ac0
SHA13e20448dad6adb174cb55719054570bb4d7520e8
SHA256f25d45c2b1931173762db07427ce756d46bbd9d86b973724ba2fed916ebd3301
SHA512df90e2547268367c6715d53d75c123eeb8fdbe7bbe4d40c0321f69a15cc282562e00c08e7d56010e500cfd0eb92c1512a4fcf90c8d0f87b64a424dbb9e0ea958
-
Filesize
54KB
MD593287c5d71700f3cc62359e785c86c0d
SHA146c4502ad3a90c586cce2245324a2f3015e61c21
SHA2566141dfabf6444a49b2f129723a90d1019374990e6e0ac61b05f9a29fad7046b9
SHA512df85ff986c27661ac1bb5ab426a28d51cb497f7b2c54c9e1894c61f09271478c233a44d37cce859d5c306561db786137004e19d5b359ad5de84a09725403ddd1
-
Filesize
53KB
MD59f68f71205bfe4ee2c811562c83937f7
SHA1d680aaf70aa0051e968810c2355de62eee49cf7f
SHA2562d159b1ca71c288dfecb94abf6e888699909580052f22b2b9ffc272f4b50ced6
SHA512b7f8893b2dd713bf44bf56ea6db291ef65377f9d8b95e277ebcbb6535779ef57d18e3ea9b854b679f51288adfb1c09580f9ce4128cd60d89a8c5f539ff54865b
-
Filesize
57KB
MD5d661e3bb6b866c5df43fa0b8b447ed62
SHA189654920341ea08ef01e3e188ae24362abec9d67
SHA256ae05f3e8d240408caecf62103b634f2dddec7bde4f8c617839708535f7bccfe6
SHA5124527619912557a1821ede5de4ec303a5546e899721a6cadca57aa66710421d9a673927e7365791c26bfcd44a7eee55d202d0fe83883b50496cea6d52005e0079
-
Filesize
60KB
MD5ac90342cbb5d7472fc072f3a0197f288
SHA1add2fdc66fd645b2a3ae74e659ef9e9150f48e2f
SHA256806852a386a55987a6ab3e300be9043039632a9f656901b6dc7d37711da15b3b
SHA5121b41a264ea4ed8ed6e11c3bcb6f75857a5f22f4628145be7292fb3836842552d6e9c56a2bf597b48d8b84a24930a21c49bdfe3ccd399a9ad317a10a5fec5ab09
-
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp
Filesize63KB
MD58e50dc82a2d11014f340247c3cbe3986
SHA193c76bc3bc6cb9a5b52ec8c8dba779721c9f3097
SHA25680f865f9109cd855d37eecbd2ac216e369ecdac722b9f360de7fb4a36137d957
SHA512d9f4047b04b83d7cfc4a48b7895c3fa5677eb6b8349e482b239d7ecf0b237fa635d913a0336d862fd6f3d54bb99be6263c72a30250b6f0ad2a28f6aa52d56c7c
-
Filesize
45KB
MD5b2194e9780f3f2004e5c10e330f1cb57
SHA17d2cd68ebf9da33366d54b4e7173a636a6bcfc48
SHA25648002c3a7fcba159b09997a4ea1f3dffba21821ce9f46ab437a41bbf72a2fdc7
SHA5121842d913cafc88dbcff448babd00c1fe107bde78b08d429f5a9f2d0bd5c0c2d77013b2c29eee8789b20c70d03ef977c12f7741734f2b66efb5f2ac7a8180af9d
-
Filesize
45KB
MD59671984104a0c857bf56a303aec142c0
SHA1a414c5af094936c38312fe1eaddddbed51ba9bb9
SHA25623b8cc1e22f8a473123de0b91312ee77c9e3e033fcba91912b4cb08588b15c17
SHA5123e21a2b683c83e4ba64f1ff5a72a036e4263e88b9b35eebe0a8035dbed451423365bbc00b5afcfc9a8af4c20c60a7cc560a6808afbf36299f465d05ef91d7ce0