Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 05:43
Static task
static1
Behavioral task
behavioral1
Sample
a6cd0bc9e65e58ace57f347241d13c3d2d8fd7b597a4f3de9ed19506a8250ec2N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a6cd0bc9e65e58ace57f347241d13c3d2d8fd7b597a4f3de9ed19506a8250ec2N.exe
Resource
win10v2004-20240910-en
General
-
Target
a6cd0bc9e65e58ace57f347241d13c3d2d8fd7b597a4f3de9ed19506a8250ec2N.exe
-
Size
179KB
-
MD5
0e7f8494d80e71b11fa4a65f025e52f0
-
SHA1
2666ab5b527e8fe19b4604b622803bc61e9bccdd
-
SHA256
a6cd0bc9e65e58ace57f347241d13c3d2d8fd7b597a4f3de9ed19506a8250ec2
-
SHA512
0bc14d7d65ac0405116b7c9d2fe8846ce5f51651dbdd150f5cb4c4df2bfdf58e9ec0477478eca5fb2c69406908bed1103b0df91c43358c311da8dd8a623906b8
-
SSDEEP
3072:6e7WpMaxeb0CYJ97lEYNR73e+eBSW6e7WpMaxeb0CYJ97lEYNR73e+eBSW5XYXR:RqKvb0CYJ973e+eBSuqKvb0CYJ973e+1
Malware Config
Signatures
-
Renames multiple (4899) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 4060 Zombie.exe 4136 _PowerPoint 2016.lnk.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe a6cd0bc9e65e58ace57f347241d13c3d2d8fd7b597a4f3de9ed19506a8250ec2N.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe a6cd0bc9e65e58ace57f347241d13c3d2d8fd7b597a4f3de9ed19506a8250ec2N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp _PowerPoint 2016.lnk.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationTypes.resources.dll.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp _PowerPoint 2016.lnk.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp _PowerPoint 2016.lnk.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp _PowerPoint 2016.lnk.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp _PowerPoint 2016.lnk.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp _PowerPoint 2016.lnk.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.winforms.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlDocument.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\te.pak.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL078.XML.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-US.pak.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp Zombie.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp _PowerPoint 2016.lnk.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp _PowerPoint 2016.lnk.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp _PowerPoint 2016.lnk.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp _PowerPoint 2016.lnk.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp _PowerPoint 2016.lnk.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.DLL.tmp _PowerPoint 2016.lnk.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Primitives.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp _PowerPoint 2016.lnk.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp _PowerPoint 2016.lnk.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png.tmp _PowerPoint 2016.lnk.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp _PowerPoint 2016.lnk.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp _PowerPoint 2016.lnk.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a6cd0bc9e65e58ace57f347241d13c3d2d8fd7b597a4f3de9ed19506a8250ec2N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _PowerPoint 2016.lnk.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 964 wrote to memory of 4060 964 a6cd0bc9e65e58ace57f347241d13c3d2d8fd7b597a4f3de9ed19506a8250ec2N.exe 85 PID 964 wrote to memory of 4060 964 a6cd0bc9e65e58ace57f347241d13c3d2d8fd7b597a4f3de9ed19506a8250ec2N.exe 85 PID 964 wrote to memory of 4060 964 a6cd0bc9e65e58ace57f347241d13c3d2d8fd7b597a4f3de9ed19506a8250ec2N.exe 85 PID 964 wrote to memory of 4136 964 a6cd0bc9e65e58ace57f347241d13c3d2d8fd7b597a4f3de9ed19506a8250ec2N.exe 84 PID 964 wrote to memory of 4136 964 a6cd0bc9e65e58ace57f347241d13c3d2d8fd7b597a4f3de9ed19506a8250ec2N.exe 84 PID 964 wrote to memory of 4136 964 a6cd0bc9e65e58ace57f347241d13c3d2d8fd7b597a4f3de9ed19506a8250ec2N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6cd0bc9e65e58ace57f347241d13c3d2d8fd7b597a4f3de9ed19506a8250ec2N.exe"C:\Users\Admin\AppData\Local\Temp\a6cd0bc9e65e58ace57f347241d13c3d2d8fd7b597a4f3de9ed19506a8250ec2N.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\_PowerPoint 2016.lnk.exe"_PowerPoint 2016.lnk.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4136
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179KB
MD566a17a93aad67546d9b1ad928057e0d0
SHA1533cd62ad9cfc961a2da3aad0bfa1ad5c55706c8
SHA256700ebb53cddd2c96349a5b9ea194cb6f317720985f8464848da1237a299387c4
SHA512c0985f1244c111b607633f4eddeb659ea215c7138f74e3cbfc3681fbba256fb1ff63c4527c4c8723a73f7a9c45ca589b6451bd31f3bbac497fe017cfc0adc1bd
-
Filesize
87KB
MD57b71371e83da9c4f7fbfb18d2b62d448
SHA1a207c67f154b1fb587e45584f2d5ed5473c0b094
SHA2565b3d7bf2b89bdcac3fd5d08a4a716b466045ecb0602fd1ca976a3a9bb06ca26a
SHA5120ffa5e39a48eb88bc385549647ba451a7e409ac11a238dddadd9945c58dffaa6779567ce6182d1ce5a793542398c423b1ca0d399c3cc3dbb1f416404ef69b461
-
Filesize
199KB
MD5c9e6b9a8586eb433ef9775f568ac5292
SHA14f4aa145d1ef98a7e994425a4b20ea60796968e5
SHA25656a8b0e5688ac5b3bce9b8c8f7980c437e11fc5fcc39d31ddc5f4c7b5be0d2c1
SHA5120831d3bd46eb2f6370eadc01826a00b029fd688ad99a5904bccf70573425d9bd9b154323329914daf9b307126566aa6a0389485c1675b1ea373b6163d9357e0d
-
Filesize
185KB
MD5d44dd28a0dc419d113a946d77c5aa9a9
SHA1729be021d3b2a9d2d283437b9e9bf5e754f0fd27
SHA25677f2bc80f38c70341ae5d07d746311a1d1d2e46629475a5342af442a85b23dba
SHA512b0f975e33e8e5abfcaa975622f1c1930f73542c0ae2c643e1a55d20ee6260445767d2e6f37ef2c3ecf0e47940922dd650f0f4ac61892a9a8daabc536ee549388
-
Filesize
1.8MB
MD5fa80be2ea865915e1601dba5b5efdc0f
SHA17fc5eb311dad88f5f0e35882c6b99efaaaf016d9
SHA256781d91630d13dd47437659a09c82e40f5950a4bb12001ba60174938f5df50fa5
SHA51229486860d2d03a6de983be4dc1ad0c4ba464c51e29c132602a65b218d19fee9026f1f5ed848f7c85bda159948edb70fd66304f8f3c9b813e764837e38e19e278
-
Filesize
630KB
MD5867d7afa6ce0c2c7e1f24b9c349a68df
SHA1eb6efde47fb5312db1ef4a171dfa301635c697d9
SHA256b1e0e01e86e541e2c5786e26ccf96ef6a17f0a63b8e6f813188b846d65986a47
SHA512337b55758f24d8352cc30a43fbef6f26401989b87241b0c523fd8f1fea841bbe5f06a407e29def6f5723acf46c525a20c17fe010161ac69d27e7b05f73fb9ce1
-
Filesize
301KB
MD56fffcb88b43e5810dc6f4383a7c69091
SHA1734c1737d2da07682dda4fc98570743236e0a902
SHA256cebcc2f6f06c841ac8eca06765e876e913f9c1ccfbe851a1265ad0e7f133bb4b
SHA5125355588be22d5526f1070b9c4e6305968e30f9155cf3ff6c052d30c7d0c0cd1b945bc3fb5a02e93c23dae9fd3513dec9e1e18973a0bbd65f55a02a2107497296
-
Filesize
280KB
MD53a62b649eb1a4955ffdf8da689157902
SHA16747db2c3a5bef6af55ff339cfcd006b7753abc7
SHA256d39018b53cfb2b258819ad035652a2b27f98a910d65f7f374a1eae8abb8bbb2d
SHA512c233573f85e2133e33d94c7af2621126a8c0e6039a8ce010bac1d0e8fd8a433945b06e48a6ba9b2f512b08be81e8ff04879fb1236a427d7e3c7ed928e4ae7cee
-
Filesize
1022KB
MD57884b8ad105f01bb6f1824a5cb8268cd
SHA19476ac0df3c8a629a4f888f91ece279d3473ded5
SHA256c7baf302071e7e58a7ba01192404fb769c2461f41776a9d353904829b825196d
SHA51256c92ad8ab5836dbf439e7d05ebaf6b8dd1106bcfacef982b4ba491bab8e2ce6dbe07db567c86191ffb9ceb13f8c9fae3548cbb28d71933a8b4495d0e92ccd16
-
Filesize
776KB
MD5bd1cb14b223062bd0b156499a376abd4
SHA16d0730cb89be8cfe7e398577b26ec72e29e22871
SHA256f31efb8c12a96812e19178c449f2cb501fbe78db5c11c22ea9132a01164c3ce9
SHA5122de2aeb1f48b91e54a76084b9edbb2e510fb1866c6ab33c0c6a695cbecba2daedda19aac6976397eaf9c1edd7054c83b87844e4621c966889feae4e1ab4a76dc
-
Filesize
143KB
MD5dee106801b551f55110d1d5c519783fa
SHA1e134ea898043e8939dfc7dd71b006ed4405032a9
SHA256dd98877ca3f553206e85eb439bc4979d8bfd56e94cf02ffa19a21d5ef17a3158
SHA512828b6fc81e5797bb80ce92c0c5b2f030852972a0bc7e171a8dc53d39b8df33c4a3fd999951fa570fdf9e889814acec5b4e349ebdfa4cf75d731119337184c9ff
-
Filesize
99KB
MD5a11679aa0461639ddbfd9d66c6887ddc
SHA1e70c9a84aa5f47458d1648357dc9125097e281b1
SHA25615c2fc8bad815037dec89f15864925fd4c835d72045121857193e95fc0e32531
SHA512650d932a118fd0849efce3debec1063a04988a8ec8633cad9daa4792249d730d8fc3ef412b621427f6180f8f9e3a6acdde13c16b28d5fad681a43fb9b3825e42
-
Filesize
104KB
MD50ebb134c704a7c49815e8a29282a7da2
SHA11d7edbbaa775b24fdff73163a3c6cf2caf88e48a
SHA256713f3205ff93b6cc2b04570a73f5dd2058c9827fac2764873b34aa230e0883bb
SHA5122a5ece0b1e1817a93884261e6a8a1b8c027358b6eb053a464c94bb3277525a5152067083e6487520b7ff13f4516d3ae31f9466bc6dce24b338caf43860bdd8bb
-
Filesize
86KB
MD5ec9c76c0079f5f490e8e8fcccfc07084
SHA1fcbc9f701841d8f4e9da52da372f4d5fd4264c4f
SHA2565e2d802156dafb396077a61cb33067fafc708bb3ac04a88f069df9cada37f781
SHA512883b2ace8ef002895f55c414fdf82bb1f14446d7b7639e3447ae886456b7e21ce682bc389f673f94987f4d8bd6cdeedb071037f88e777662c68b5cbc4528d3ef
-
Filesize
103KB
MD5e12dd8d3b6730a0c089c31eacf943829
SHA1ce13e59458d0e2e01afc9053ad5470ee281b951f
SHA2564f35d123e78a1dc80120333635401d4884c2c042d717a0dcd79ff6be1defa89e
SHA512cea80bfc2b079f76de1f4cea03455386b8efebc4e81c540e58ca60cf4cd9bdf5a1b8a2c88c01e14ff242bf24d591c67cd7605f09950fb634d37b3a9e1e487cc4
-
Filesize
104KB
MD57aa09a6b1f89b7f8f69f3cd09bfe4012
SHA108f20ed8be3d5f985abcd534afa74d7ce42db3d0
SHA25617b899a480f8177359adb191361f25fa443b5c81a41f6019a8345214e794bc0f
SHA512d3303e40af9452940b10c5a05e41c3a0644fd6cf1a8501da92a0e8e7be96ad894d8b156ab8095bc86542c638a983dde571e511f971a22874480d3bc9a939621a
-
Filesize
101KB
MD5cc26fca41e192d2bac00d09956019a6b
SHA11501998a57ca6d22d83f2b360bc2ad40c43d251a
SHA256cf59cccbb0f8a57ec9dcfc42b51b9b5350918959040b4b22ef7bacb8b53a302f
SHA5128ba876632fe8551a98404f410f8ce0ad03303f69ea51eb479f920d4a647bd4231ece72005757d1b37b243df4ee3f198ca2ae127a547e060de3ae737919b7bafc
-
Filesize
97KB
MD52090a15310d8067f3faf8b47557869dc
SHA156c583c2faec5d8d87ec4d888aa32d154a88f792
SHA25696a2cf29d7296d8cf1125a308b49a71ee9255265c4f33a79abd2d679ae919d67
SHA5123c8afd487b9aeae8b6360372f7b632649cf74a746135c71336f603750f69b2b5cf19b4682dad822a1235156eee1e66efa9350357d17e582ecacc8819a46f3287
-
Filesize
95KB
MD585ecb91bec0c62f872861f37a49a6372
SHA1e728e166b474382f9619e87986e42f1fb93bbc08
SHA256b8e5ecfc88319d0fad73a1fb30f8150c44488b005c576b4d381f6f0ce2ceb1bb
SHA5120653260cd79e69c84593624b6dd00934bc3cb59933e5bbe2f6ea0755b4413086dd40e5ed1c778087b06f781bbdc5f19979d489a55e1e40ced456bd89e6fb53f5
-
Filesize
96KB
MD549404d3fa6db0ce94b33acdf5226391c
SHA11b6003cd29969a9a2f433e93b0f1fe0979fee290
SHA256a8049b37715f2ad32e79f02bb5b60903c5501ee804a81b093f4b358347ffdf06
SHA512e444921f9966a3d8b69964df39cfef7c87bb9ca2aafcd6d1646d0ace9fdce15d2d72b6ca7c2d4cc753dc15fdc1615a1c5d66ca1c96b60bb361c10fd58525f9fc
-
Filesize
93KB
MD52aa6bfde98202dca9243a9269230205f
SHA157ff35f70f343ec39d1745393dd0b3d50f749cb2
SHA25669fc958a8f13b4fdc47808a754536fa389408a09747688951d3874dab2e74762
SHA512ac9bf357f8192e25c023099bc8b4a133c5d527407dd552910cc110d22b206c8910295e7f4b61844303f5117b8823e77c1e3d5884192a73df176599591ac123dd
-
Filesize
95KB
MD553d5f9a8f564ded23d38fad360e02cc0
SHA1569c1a01fa829c1baf8432a5f43ffc6fa7e0ef5e
SHA256d6ab38264d3eb4bb3f98cdd1515503a269428ccc73d654fb9970bbd5e188d096
SHA512a091cbc299d3ac05aa4e2f47fa0eece03cc9f698a46d29e014549b8c666ca09341c628ce3a264f3b2414121b9cdf276d20f11439f7cea9b6aa956beae940c185
-
Filesize
92KB
MD5fc2d4c9671f2632bcc6549304ffede9c
SHA12808b7f23aef3bfb95e6c13fa780c00b11f0273a
SHA256a26d88976883b8b17ba57f6a8da1021f208019f5386c6336958103729f42d19c
SHA51210e235afae40ca114e40faabff42d5ab344783a666d9afaed734f2bf64d97006b676cbfada1a71bf955b957337311f9ba49a989446d49c5f2b6dd17dcb56db34
-
Filesize
96KB
MD50093b7fd93edf9dd72f8740a274d483b
SHA1f07930ee10267dce07d38abac55b263b5d0e406f
SHA256ba5e93339d1905c210af9e35362be54456d3f0d329590af430f605514b287542
SHA5120d4daa2b7dfb304ee39e370115972a04628a3cc58800ab6b6456fcad5d10649acd0117fea6f56b96f7219e8217c2623930d927f6c580fc8846c76eab0e12c090
-
Filesize
101KB
MD54b89ec3de7a0a75979544b7c30d995cf
SHA143113789255ef2b2dd27798145b377b2b6ebd3e0
SHA2562aab799750a63254287b6bd81e271417b28879c730a78d05e84006b566f3ddc5
SHA51214ca973330ada360e1983588165023b36ece0762a89db692a828b008daa77fe9e67b147b5484e2fad63c95b29894d2e3b8053bb4f63cfd9cdb9c00053988084b
-
Filesize
101KB
MD551c491028271d318b3799e2e3afbfe95
SHA100b7771d3f10b681787c939f8ec32c377d5d4731
SHA256c47bf9cb7a0bb2571e53e50cd2d13405a67f2bd03e0abd75b816e146d81a79af
SHA5122c42572e6d8b894c842a34607b708c96eb935b98ccc955af8b9159e941bee5e8e8619334f03c8b7b4d3198bf450c9040c27744e9c9d46b8c7e1ea816f03af71e
-
Filesize
99KB
MD599ad6d347f46d836c8ae7687e825e4ba
SHA199ade38e2a54d2d121c32d433106c94206acf3b2
SHA256cb2c43018b227b4269c922ba62c82113e22e5f5f403692c958c9293447bc9ef0
SHA5126649dfc751cb4968e33f10d08c3377247c6d68b202e0a7bb9ee3e74109c59e59f6096fa7e680fb095acdf3d2dc576ed8f8fe329b3a3a2edcf1f293e5d4a0ff1f
-
Filesize
98KB
MD52dbe051a358b2439d73ab4d5352107da
SHA1b2d29fb15a3b1d4791d0b210fe878ece21f1f7db
SHA25663ca32c2e7240113778f67ab5ade7e2891e509c92afdef31f74f965d482f4431
SHA512e4ff26c4e9208d46e0ce13e75cedacab60d2cb6132852c963d82127966d46c2b0c4a8050f141e1206a30c10629c0b82eaad7949653b130cbdb0f72fa2f938fa3
-
Filesize
100KB
MD5d18a703fa4c1f364ed275ba8f00054ec
SHA1c75e274d2b18c466d153b9265c9006640370b49b
SHA256b4b6258cd73b3da429bf43ff06607a0c8e4e37e88a1595c707588b2a35fc039e
SHA51215fc689f6aa439a986e9c475ea78888be6dd72aa179c21e7d06b68cba2d37874bd15fe864add43a2c94ce63c40b89784995f674b6489ead371d96b3f318ab701
-
Filesize
101KB
MD54f8992390fe12376973dd6b289d89741
SHA117a5e6f1feedcb481bd889ad9b949d4f6bc7369c
SHA25600d980866d0edff503df1280ed609bf57c943dacd425dd2ea04987dce1dbfff2
SHA51200158898639fa2c29202f6607312e00c961767f090ad6d09c405a39a26e8d4b34268c894d5b487d40df6d3e89655f43a2e0b193cb16966887bb7dce5cfede573
-
Filesize
109KB
MD50733f7c86e8a48f35d5c5b916bc34bdc
SHA16925713ede07e64c8604db8cc386eef16112ee6a
SHA2568a7037edd104eb29002b043cc8a199e080245662a3c1f1adb895fd51f3a19ea0
SHA5125458b0742622a3ca1851298440d668729b6302181a359b0cade0c84dbb43e466d8176fd5fb6d9b9a5b60cb4077bf32937b722d8360579037a66b96439a2dfbca
-
Filesize
103KB
MD538951133cc3196dc3c5cff53811437c0
SHA1e84560e425d9cdd1046876290438bafc33e4b87c
SHA25677dc0f4f7fb48673af8b7414ff85a963ca97f7352da94cc5b8456f5fa73bf8ad
SHA5122ef9b3e14cb39f41bd29f298230bf4847347494464e9a125a88743ca3dad26ba1e323a01b021e0dcb341a2585c94927da366e43d2efdb185389d220d05fc8600
-
Filesize
104KB
MD5ee371aa4e32676e76f2f3cac82b8cdaa
SHA1bfe275512a0fc2fae971be9fd5e2b41f8c5a2729
SHA256c7e4a682abb55fc1b1e5c42fb7a02db57981173de45eae604c38a32aba38a107
SHA512ca99a70f893b393a056ae6d9c028a812fa539f9e2b7b475fec0cea1620af6aee01cde5f6e659d22fc1901a5e77a5e6153a4e57b5be332858b32d3262d3977a41
-
Filesize
95KB
MD58a077430c2821c90e80ecbfebcd269af
SHA10eb55c1c997d64dc7851213569eb750afb8e95c9
SHA2566d6b1ba3b724619d470f532d0046b703ba4b0da54b102b860ef21d90e2f44014
SHA51257538c479585d6c7f21fae96977d04731cb68de078364d0cc1011bd9245514dc0a986e60401b6fe274e7b75d6a4e344e9fe6b3e49a959e18edc3d1a354341a64
-
Filesize
92KB
MD5d2008d299a5a72a6dc277f8e122f6d63
SHA17d686d94a49f4a265770032cc8553c554773b995
SHA256d5cc6fb673a2c96502e11d6aa1006f55ab6b472c567b77e844a8e6f24627643f
SHA512bde880567952dcbda265aafeea25d52e01be5f81fac0fcd3c81475809fdb9a1175435ce286000802f47090f00eeaeee965c357a348b0641643e59f95565d3306
-
Filesize
100KB
MD519ebfac0f4b7bedf92f907c9be776fbb
SHA1e33846910d2fdb87a8ce48a6b82038acf94027fe
SHA256be2f4b176b9387fbd9b914f4d1fbe01a26985f9d87a43bb4336d14618da8a25a
SHA512b15b9af93874d3c31e8c8276e5bcc396298cc2759c217c0795b678ef2c470fe8c1cb6efda9ef35cff41619b31815e3c96cc0d6cfab8f40048587e8c27d92733c
-
Filesize
95KB
MD5a8bfdd1c6cc993cc37ea881a1b2b37e7
SHA16f293a315e88419c5f4a37089932038778831cee
SHA25607640aeb5098f76856560af0410576c15ce0f599016c662c6ecb2c421ba0112c
SHA512f0bae717c3243a183ea94b2379e06208d7768bb8c69c593b857b7da363513020aaabaea6b3b69b8888509a1bff39ddfc773194ddf8ca8264b14b6a495cf7a208
-
Filesize
96KB
MD5de023cd82a88bfb43a6b2479098f8b9f
SHA1de00b80bd7ca421b5669538039154e1573bc977d
SHA2561c9e912051e04469916c327bab82f81fd67fbeff869fee53cf1ea5dc29924076
SHA51258f63dc6fa98f7dbc9a294be47a0ffcea836b7fced1f5cb2ac11aed64073a4094159db23f54711014be36cdf7c76e4e1476989acc86eb9e865847b5b495a2904
-
Filesize
100KB
MD5265e2cac8c10bec948ea9f07cd1c7a37
SHA103ad8039b18060a1fdbe715226fb4b2f7c688997
SHA2567f9c79d558edef4b0ce26c745e0098ac92dbfa5d1addcbe8d52104823252b7c9
SHA5124c7e67d1bb40f90cd59959c55cbae43a0a5cff24a8d1eccdc8faa521d205cfca7ffd500dd2fb0c5b46ec3394e99b01a317b10a974cf3f79a0623e61929556bc9
-
Filesize
104KB
MD5a8793a2fbadf019a65fbc645a193f145
SHA1f04e7a435accdaebefe8125e9f9999b73724479f
SHA256e4aafd2c5268e9f80ca7b0b7ddf9584531064aab2e016d4af67988b1d735df6d
SHA512c0ee933876122394e206e508af0ead7e32a08cdd15d691f55a0714017f69b4949d0d97ab8df3f282ac863daecbe9b947cddd4fb7cb97f9ad4d59de97435938c8
-
Filesize
86KB
MD56f1242bda721a33105d44ab4be4a05c4
SHA1aabb7b6e06b8308e4313592a18a4b3c459465362
SHA256d2f2f955e007cf5215faa3525c77bf3635cf85290b4d21743327d3eab6e38ca7
SHA5128587287d2f0103b469ac26580364ac99266f93fa7e59ec3e28e4198b62b6d4218d5dba436bebdb01d68cc51c220c6ee715a0292dde55960febce2895beab5ee2
-
Filesize
100KB
MD53168399a4bb07ecfe82157b84800ab58
SHA15842973e24177fef318a08ff1576cdb36b4ca175
SHA2561610c1ad9fc70f4925be51c8949c02b3686d5bd21dc9c9d277a7ee39134979f6
SHA5128eba274bcd855bcc00c500c17a976fcce98a8f4af3b6a1afa03134d2180e8e05e0a3675a27d9185a6d77730caff35e9830e45b7b645808921744f6d86d73436a
-
Filesize
99KB
MD55ea5ed980fc4e05df19cad85c145da3e
SHA1df428a4a8497036aa8f6139cf92af782285aeabe
SHA256c8a0e87c2ad8a3139c9842d02eff0fbd753fa6a88c6c0e945d38ec5980739f4b
SHA5124d237c1c79bc5352b8c3c1cf791495da17fb94890a5e5a6e15164e09c14a448a52a103aa57cbc28031b612ca3b9305fe0e82f24a6fa1b2d562e362f4e81b6381
-
Filesize
99KB
MD50aa7d4f0c45ca9097c06d2ef1915cd70
SHA15807b795b89f99b1c8edda195c20eedf191b3ee3
SHA25615b4194444b37bbd0784f726a163ad710eda6411cbcf6a81c548825db1e6adf1
SHA512d76df4c6260ba5022845a89b902ace77afd1b701d9b2fb03c65a5d64ff7103c1f5825aa0f2fb6ea82222908a6b40acf4c9e08d400d355e3802aeb38e66169f52
-
Filesize
94KB
MD53b8cb17cbb87c2fce6924d506d62ab74
SHA1fc51863e0469db2245f3e860d95d2c4bbb48cf4c
SHA2567e24e71d28508a7012e6bfabf428824ccbed7ff8b630f4e22f699e02e0c30e71
SHA51249907093288fa1c37b0f1f55816a5b2c784a121502ea1a5bd5daa4f658fe11b91a32842a858485fc619f1402c1dcdd155fcf3f2bb0bbb848902e80ad43f3615d
-
Filesize
96KB
MD590a28d68e3a3ef669475f18b4803ea91
SHA1b1f664efb9cb683639e0d74c4815cd72dbbaf59c
SHA256b8532fbb023de2e525c213119886b0ff513e2f2814012ffbddf9659dca119e22
SHA512950adb586609b57f8f790791181b976ad5e533099116b5c6988a62e50dd2bafb498f89fc10375a23aab7f09cd895d5f14e05a75724b007758e36d9d4f204e564
-
Filesize
92KB
MD5ea84f24b9f557bc9cbcb66e0e4aa1121
SHA198826f13a3026ce2b5bbff1dbd6a33a00a580882
SHA2565ca5de361a858bc692129d967b9aea0833bb9a8c5e89c0707ba47d90f8238282
SHA5120741512465dffd80ed3f852670e543725096a70cadb0fe7f21f96bc894d6c29f59659fd59df517bc20931eae59d323eded4f02c8d5edaf1403ccbd37b3515210
-
Filesize
111KB
MD5dcfd6b52f22712d4279303887ea06546
SHA1fe96b58c5768a3dad465d3410dbcbf85f909c259
SHA2561f7f1b69a8adf6799ecc719bf7750386175531c17794b5b6a08412f8d4a1733a
SHA512b1c111897adf2a790a4b2b04d7875640867797f18f0c482e45e7a071a174d39745cc5803e7c2e9891f08d4a5f54ee1d70b62591317fb792df3acb8abe2892eed
-
Filesize
113KB
MD548ffbf94b84133eb985f80f4cd842c3d
SHA1d1dcd5a752e07a6cd539427ba51e6409867e1d6c
SHA256f2a1265e03266f351fdcb187b562a963bcb35b7e34ac567f87713ef9161e0d4e
SHA512e3047a1eaf5b15b29b33eb51e9569680a058e5ff43fb566a6cf70282cbdd462d39d1b6c809e8680b9f29d22c1583b7dd27c34e2fd4e209ff0f6d3b6130e9da8c
-
Filesize
102KB
MD575128b4a775d6b16b85a6739b3414057
SHA16dc81168cb886479b75a533e8a1522a64724c5d6
SHA25690e6d03b962c3f84134ef99e26fee3ec441c5688d612e3466f4538bcedfb637b
SHA51200c62433429fe133fa7997cc13d9ef030b93a3ec431a72faca8b277fa1bbb004d2c8cd5c669293be4cc92671b593e28b00a28c9be42d26fad8bab3b0fd51dffb
-
Filesize
97KB
MD587b971a3ff3a9777b070bb7d9fbe065f
SHA1a54a4b3919221bbe2e73db2ac5587ed1ca4c8436
SHA256c005fbc312d670c120005cbd86e654c9a2c1060cae95281a61c5237cca569c7f
SHA512d88c09438d66e79cf885921ad1b414a1616ac276ab988091b9807f41f34a3b447565c573740be7036f2e4b700d0d875c099d625c439b2b01ebf2ec7f2a034285
-
Filesize
92KB
MD5b0d713271488651164a5130108cb5619
SHA1bdca3f98de76bae41e912860a7c965c70abe9298
SHA256f63af53e9702c0ad614a463eeddc2f787d873fe3e8c61b5b5c7991cd9fd918a9
SHA512609042ec5f36a1b717dac464d5ecbadc22ec0bc0e84c23ad4ab6320d8c9a955957dedaebe368466fbb91f16617c9e5a371a476a846c5920b1fef2ac575f4a48c
-
Filesize
96KB
MD5c439867b7840ed7ef21a2b04f0053f0f
SHA14576f8fdfb4a1b474a0b233e61911bc83131e069
SHA256ca79fba2b87de470e5853ca6ac0e26a1e09f384893e1f6d2259dae38c3768f47
SHA512f8d163f23ae52f0104cb2c3900ba825bc0b045ae530c84a28d59e1c4cc71abf0796be35a4030b6bf74367e46e7a699856fedfe6738acbcdbbe9fba84d2d45c5c
-
Filesize
92KB
MD545168ca5a4112f72f1a9bfa432e5f209
SHA1f02ecbf7870bf19182f53d2ba5a10172cb272219
SHA2569d748ef98f39bced94b99ca7efcabc3711a4971760fbe00fbb551d179557c750
SHA512e9a915228727cc403d47957704af2f1d40ca5d3a9d2762e6a310ee1a2eb814f4cddbb481e7d386aa58e17f9ed94fea676f4fc04d94f547c05f3697321438128f
-
Filesize
101KB
MD5f53d2c4ed97d7c58371222696580dbfb
SHA1ca95746ce9c80683123570bbafbdff5bc9675f1b
SHA256e7f52c3bac914d388f811fa3423998081c0f30bbd08fde281f079c59ceace67d
SHA512c927d43f592d4ea94ab6d4b20de07c5d6ed8745bd4828f5936f4a49112a6947f823fb5566d8b978439f1506d6e66baf22836105e5d19a99e2a911ae0d3fb65dc
-
Filesize
96KB
MD5e900b654e2c3d8f48d98259bef4c3644
SHA1a15ddfcc95fb0e9ac82e7c49b5c74afdc74db8a1
SHA256e3b702ecaf37c753a4ef37b73c0afa810c9a737a6fbf7ba738abf199603d18cd
SHA512ffccb8f3246d793dc68d6cc96ec0152a23b2245e92bb5a44f5a84eed51d2ef89b37899bad5f59a6ed6412c7c818bbb67811be3ec5c95cc6043f26192a5b680ae
-
Filesize
92KB
MD5234eb1aeca815286278b4bd9ca19d4b1
SHA1f73035951ad0af09d42fe75851be918ef88b17de
SHA256b27e54bf37ec3e51befdec594aaa507b5d660a9c311361ec02b6ac96b62238ae
SHA5121f188873201d4f18bb6fe72f4c2259ef673abb24b084203691fd746aab383cfd1e0181837d18508a9a441b7b12b62cf7fd2efcaaaf63ca85990c94c97369a965
-
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Input.Manipulations.resources.dll.tmp
Filesize108KB
MD598d4b3be34055a602c3f5cc36e2d3f13
SHA1d34b64cf7f22d63ab11578792e5170b26d83b9a5
SHA2568eeb592774bbb7f04842c9028a24c27f5c747a3435b8e5e78e46b53c0734f2e3
SHA5126cfc649abe3a569c33607b56eb5f12e1f8cefb89d8bd29265be78f2e092375a8040c5a61586f531cbd8cfafdd24453e5b938c2f619041b235053f7380cf91c5d
-
Filesize
92KB
MD5192789f5c330b48e484ca731dddb4a12
SHA113bad5bf1496a287b37c66aff5e826b0a1f7f3cf
SHA256cef8f1fe1408b07c09a2420e955d39fa7a573ddbede15e3dd2386a8ef1ce18e7
SHA512a62591eb1b11ce0746bc82bc3babf49bcfc5625c705b61a8e88f554e2350c9c30f988de1f4be566e0e062db393a896b2d306eb72b4a57e27bb48732bb51de12a
-
Filesize
86KB
MD5957761a39658155c4c8820e06890f0fb
SHA168398729bef906998641d495792d4eb00b697199
SHA2567583374a0188d09dca0d1913e295018189510dcb02a6431d537d6b72ebf05079
SHA5127d9fb4dd5126f8423d0c2835c4ca3bb17a5ffaf4f82b53e88a47b246f0aeac986220cf3cd8909fb938d6e561eb452c2c3da1b37212e1702e0b9f3c8365956017