Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2024, 02:51
Behavioral task
behavioral1
Sample
85b6bf428db16fd5ea4da91d7a219aa96fbd1f11fb3dde80d9b8b49532fbc734N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
85b6bf428db16fd5ea4da91d7a219aa96fbd1f11fb3dde80d9b8b49532fbc734N.exe
Resource
win10v2004-20241007-en
General
-
Target
85b6bf428db16fd5ea4da91d7a219aa96fbd1f11fb3dde80d9b8b49532fbc734N.exe
-
Size
77KB
-
MD5
458570a43139c0ae455e9d2329933820
-
SHA1
a972d2d3107e511c0534725c8f1f6b16abd3480d
-
SHA256
85b6bf428db16fd5ea4da91d7a219aa96fbd1f11fb3dde80d9b8b49532fbc734
-
SHA512
1b60720826d75f3100c531e92a6b08a1e75953841c87516bd7ac0317689631bfa1369da6b647f98c846e5a9516267803821701ff17b5ee772a39b0ad903a914f
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti0oj1O4ixJIfoj1O4ixJIUBT7:CTW7JJ7TTQoQ/IMTW7JJ7TTQoQ/IC
Malware Config
Signatures
-
Renames multiple (4698) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 4988 _Adobe Acrobat.lnk.exe 2216 Zombie.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 85b6bf428db16fd5ea4da91d7a219aa96fbd1f11fb3dde80d9b8b49532fbc734N.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 85b6bf428db16fd5ea4da91d7a219aa96fbd1f11fb3dde80d9b8b49532fbc734N.exe -
resource yara_rule behavioral2/memory/4704-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000c000000023b10-8.dat upx behavioral2/files/0x000b000000023b69-9.dat upx behavioral2/files/0x000a000000023b6d-12.dat upx behavioral2/files/0x000600000001e51e-16.dat upx behavioral2/files/0x000a000000023b6e-20.dat upx behavioral2/files/0x0014000000022905-21.dat upx behavioral2/files/0x000300000002298e-25.dat upx behavioral2/files/0x000b000000023b6d-31.dat upx behavioral2/files/0x0003000000022990-32.dat upx behavioral2/files/0x0003000000022991-36.dat upx behavioral2/files/0x0003000000022992-40.dat upx behavioral2/files/0x0003000000022993-44.dat upx behavioral2/files/0x0003000000022994-48.dat upx behavioral2/files/0x000300000002290d-56.dat upx behavioral2/files/0x000300000002292b-62.dat upx behavioral2/files/0x000300000002292d-68.dat upx behavioral2/files/0x000400000002292b-72.dat upx behavioral2/files/0x000400000002292d-79.dat upx behavioral2/files/0x000400000002292d-82.dat upx behavioral2/files/0x000600000002292d-87.dat upx behavioral2/files/0x000300000002292f-91.dat upx behavioral2/files/0x0003000000022930-97.dat upx behavioral2/files/0x0004000000022930-102.dat upx behavioral2/files/0x0003000000022931-105.dat upx behavioral2/files/0x0003000000022937-121.dat upx behavioral2/files/0x0003000000022938-125.dat upx behavioral2/files/0x0004000000022937-129.dat upx behavioral2/files/0x0004000000022938-133.dat upx behavioral2/files/0x0005000000022937-140.dat upx behavioral2/files/0x000300000002293c-151.dat upx behavioral2/files/0x000c00000002293d-155.dat upx behavioral2/files/0x000300000002293e-160.dat upx behavioral2/files/0x000d00000002293d-166.dat upx behavioral2/files/0x000300000002293f-167.dat upx behavioral2/files/0x000400000002293f-173.dat upx behavioral2/files/0x0003000000022941-178.dat upx behavioral2/files/0x0003000000022943-183.dat upx behavioral2/files/0x0004000000022944-192.dat upx behavioral2/files/0x0005000000022944-195.dat upx behavioral2/files/0x0003000000022945-199.dat upx behavioral2/files/0x0003000000022947-203.dat upx behavioral2/files/0x0004000000022947-210.dat upx behavioral2/files/0x0003000000022948-216.dat upx behavioral2/files/0x0003000000022949-220.dat upx behavioral2/files/0x0004000000022948-226.dat upx behavioral2/files/0x0004000000022949-229.dat upx behavioral2/files/0x000300000002294a-230.dat upx behavioral2/files/0x000300000002294b-234.dat upx behavioral2/files/0x000400000002294a-238.dat upx behavioral2/files/0x000400000002294b-242.dat upx behavioral2/files/0x000300000002294c-246.dat upx behavioral2/files/0x000300000002294c-249.dat upx behavioral2/files/0x000300000002294d-250.dat upx behavioral2/memory/4704-959-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000300000001ef9e-3727.dat upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp _Adobe Acrobat.lnk.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART6.BDR.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp _Adobe Acrobat.lnk.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp _Adobe Acrobat.lnk.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp _Adobe Acrobat.lnk.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Primitives.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp _Adobe Acrobat.lnk.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll.tmp _Adobe Acrobat.lnk.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationProvider.resources.dll.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\net.properties.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp _Adobe Acrobat.lnk.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.123.manifest.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp _Adobe Acrobat.lnk.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp Zombie.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_200_percent.pak.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms.tmp _Adobe Acrobat.lnk.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationCore.resources.dll.tmp _Adobe Acrobat.lnk.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp _Adobe Acrobat.lnk.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp _Adobe Acrobat.lnk.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp Zombie.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85b6bf428db16fd5ea4da91d7a219aa96fbd1f11fb3dde80d9b8b49532fbc734N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _Adobe Acrobat.lnk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4704 wrote to memory of 4988 4704 85b6bf428db16fd5ea4da91d7a219aa96fbd1f11fb3dde80d9b8b49532fbc734N.exe 84 PID 4704 wrote to memory of 4988 4704 85b6bf428db16fd5ea4da91d7a219aa96fbd1f11fb3dde80d9b8b49532fbc734N.exe 84 PID 4704 wrote to memory of 4988 4704 85b6bf428db16fd5ea4da91d7a219aa96fbd1f11fb3dde80d9b8b49532fbc734N.exe 84 PID 4704 wrote to memory of 2216 4704 85b6bf428db16fd5ea4da91d7a219aa96fbd1f11fb3dde80d9b8b49532fbc734N.exe 85 PID 4704 wrote to memory of 2216 4704 85b6bf428db16fd5ea4da91d7a219aa96fbd1f11fb3dde80d9b8b49532fbc734N.exe 85 PID 4704 wrote to memory of 2216 4704 85b6bf428db16fd5ea4da91d7a219aa96fbd1f11fb3dde80d9b8b49532fbc734N.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\85b6bf428db16fd5ea4da91d7a219aa96fbd1f11fb3dde80d9b8b49532fbc734N.exe"C:\Users\Admin\AppData\Local\Temp\85b6bf428db16fd5ea4da91d7a219aa96fbd1f11fb3dde80d9b8b49532fbc734N.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\_Adobe Acrobat.lnk.exe"_Adobe Acrobat.lnk.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4988
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD508fc90c12ec13615d6854cb49aeb4cc5
SHA137d2f358c4e0655677b8371eb185312f2d368b32
SHA256179c8423a4f8505abdac421a753d80460df98bb8247bfab7790cd1e3b0069732
SHA512e2b7788c0bbc3c612346e65fb11197dba16e948484281c94473a8688b6b318b21b4efd0431930ce982759a26effa238d9f9cc0e3525a6a6d3bc4c6a41d0fe771
-
Filesize
36KB
MD539958e964f706b10c313ffc74bcce5a8
SHA19c1eb7799f4c3da6c86dbe71c8a0413b50fb02fc
SHA256ff2b7ad0f93ee2feeea0ec97f3473b3d4cbb02b78c3107df4f18ba69778be69b
SHA512abc30103b5503f1d59c828beab9303776f977b5b2810887aafd78aa02c5186ecd5b03e4618bc9d1ee1736f075441ccdfc605b2bb2eb41434ab20f6903824c80f
-
Filesize
149KB
MD5eb752b7232fefd66e2e1bc4f8131b62e
SHA1071cbf8886770fd41c1f09e1a41bb5407548efe5
SHA25697e08deb6a5f2fd2a460424cd55b2f25af9abc15c293f0c1ec92cc0b9fa9195f
SHA51283d0bcded8d79d4162a8c983422b7755d74e03bc13bf2f7a4d42adc2c03c9c01623384bba89234d29d29cb06adba65d9eb06562d350da87ce7384b6ab1fa63bd
-
Filesize
139KB
MD5d536eabb933d569cd9c1107bb2bb91b8
SHA1c31bdf993d9973c9cb421488085da47f17030c92
SHA25608a2f6fca0bd692ebceea033096c1cdda66ab27878adff5007da5af43c490808
SHA5126fbff2b4c3aa45fc7cf523cc9e89f00f786b6f392135de2b52d77e312e52dbf72793c62876b9e6417ef230389c7b7778e610dcc1e190f78c850040c3fadc8064
-
Filesize
105KB
MD5b52406828546fab2487c5008cc9ddded
SHA1059889ca7028d08d9aaa2d72b38310a1808f4e03
SHA256bd9fe9f7ed8903dd4feabad4f9b74d2af5b0f55d6185724f24e2b8be304102d1
SHA512196a66e4677d49e2c31d8c72ec4f3f381573a81eb586f9f543497aa013c8b458eea865a4a0dcafb18800f78100f3b2a583b28b0ced4f7cc2049b1fa7f7a67923
-
Filesize
1.8MB
MD5f26d91d8b5862810565ad4774d95aa23
SHA1b81068992f7a3b0cc61c67191b189692acb796ed
SHA2567f2acf608415ed54b7123a5e0ebd26354b13615e12d1a71b9a9e59f05064f287
SHA512bc98f45cf53a493a1384760348bf192897b9170e66209e2235c76bf1704ac95f053dea0ded211c94d1ecb5e22ad4f2fd4c1e1b0c9f0bdcc4589cfb09d0253d38
-
Filesize
584KB
MD57a4f2085acfabf080b6741159fbbc25c
SHA16d488da3b6888863c19e25c182cb267a9117612d
SHA256d0ec4bee49314fa61dc0854e58789db85cc62d85f094bcbbf2398d501b3f3b30
SHA512903664de7698e182e095486a53698168d4349a9c345d7aaed9b805017b60963090673e23a0d52248c4d18e5513e4e42f08c26ff9018b268c44dc57281a8dbdc6
-
Filesize
250KB
MD5765239c9e68877d1661f4b9c59ca6688
SHA130d01468b694fd3d4a5afbad43d2e9d1b5632c7b
SHA256496c0db4d25d3dc2a8b754bf55347e545dbed7decd25632586563c84c8f2767d
SHA5127b551a2073b5ab6952a1134c7391d73fb29fec179909a27e6fd208660f9920bdd40922e75ca0741b63e0f2b09835cf6dfeddb71e46be72a28e3d0015e20488d0
-
Filesize
229KB
MD5f0d7b1002895c55db898927f214e3a01
SHA14270efd5be8867ae9a6b09f1bb5033ee909387bd
SHA2567070b98fcc81aabb11e214f4062f1d57bda0ddf0bcf5ead9587a4e18e1687e7e
SHA512f41baeab82644d31dcef23ef47be1cd2234092cf267c3d17f304d97467f1360595a8762c27b6ed70898c51adbba0c2c188122855ec8f473fe8d348f8517cda2d
-
Filesize
952KB
MD5fda15644f1c19d33a2f7275d05ce1909
SHA13b43e922ef884448e031eaf1a771e350b0faab6f
SHA256d66a57e9781f4a3d5f298230e67ba13dd3cd6863bc6a83d7dc417499d1ae508a
SHA512eb975a521c025e2546d11940effe6dcf34197fb6a1106a3c572b93042787763f519a694ebe308898d25523df7b2a2a93d610b1a5df73ad9422dfe187cddd3d34
-
Filesize
724KB
MD5b0eff7f9aaff68e830ed82b4d92c1d12
SHA1d3934fd2dce85b7646b74b7bfe7a6e86b553cdd7
SHA256f38886f1fbf51ca3fbcebe901a0b4e099ff2d4348b8f868fec67cf0f55db28ec
SHA512d5750b9648b2787319107a1290a6d414daa8bcd3eafa9b0413346839095a466ba8f125e39bdd302394d10ebb2cc220fc93ec5bc47bf2ac23d20dbd4a8af84c2d
-
Filesize
50KB
MD523d2baf5e3c2895fcaecaa1f3cbb7a43
SHA1dd15eba2fa9e206e3f1e6ddc270631d57b167355
SHA256ff7c28344b127d208a254376d359f9b820e7c15003c4e880bf8476b81a55c40c
SHA5127efc860b97ab2a61b90b1971247008632e427e955538c38e89ebe3ba7789dfb13dfd7bb91f5d7981ef5f592f6ac0b7ea7fd0d826a61829200006de0d29f3a846
-
Filesize
53KB
MD572d36fe35ff20a2887821238905d973d
SHA11d1d254e25963e97d02c69dd24f3b428bc2ac43f
SHA256283b99f9182b51659ecaeeb4ff966d950474bb3c3a20c4e9a460d373455b2209
SHA512bf3673d465eb776f55357a43486e2b2b95d3eab03d5af0e648c1fb5175a5c126bebc5ed9333237c1e6d3c3a51bc28fbf5e32a95ca0eaca760d738bfef27ce562
-
Filesize
46KB
MD5c52c80c6eaff5e29fa48d99fd9dc5786
SHA1a7d990719ee46334299637d69729b193e3bdae1f
SHA256500e3dddeb2c39cd27bd34ed4aca128b0e0aa7e06d096ff6e7b8aa9932fb31ef
SHA5126e029a3745f6ca0a277e47b88b0deb872edc355102671a77ca1f507923539be702b654c44dc652e3d922cfc253a02274a1fed25abf3e26211ddfba420cc367c6
-
Filesize
47KB
MD5169d738e5746952be96a270615f62a21
SHA18b6bd49480e7d82b66bc804bbb6bbbf4cf7755b1
SHA25680ce51d6e08e9da22f34695c346426b2afbbd41672db5296eff4c4c5a0f9258f
SHA5124eca9d9df510036f715b1c40aec249b30988010af2b22ffc0dde6e7d1afca65a4bf85fb539cdc5b93a82deab9f48194b866072c41781cf39e00dd054fc00c27f
-
Filesize
49KB
MD5fe19b40dadc8c2dd56d76b6e33876d02
SHA18120ff4e2e21cecef5e79100d421ffd9420875a0
SHA256ff225e7ee5cf3fd17112e4295788853aff33a3f535ba139d38d48ed3b0984745
SHA512d8098057aa714d97c1318565c70855e83de673015da25ed66c72f2d2959bef31d087f36459f171e90ff2d95d45c7021dab639672c61d4430ef6a6da6f262c2bb
-
Filesize
49KB
MD579f4399442dfec175c5028e03572ea89
SHA117a7ce1df155a8a002f490c2b241112b1578d6b1
SHA256d5e2b0991573c43e8d2e68b561f6903ccd6e6538afabe4aa0a94165a5b9a5ecd
SHA512938b39756ca89f5b94ff9ebdec27db8cd638c4e7e5e1e5fb736929e3520e4bea71016b52590f0e68de62874c45cd529b0b993c6377b79c866c37cd559297113d
-
Filesize
36KB
MD54b14323f69b22674c37eac41feb3775f
SHA1bfe6a9ddd71c27e037d0e1263ea511085246ee43
SHA2566e40f2e8829833542109948bc9e920e092e0542eb5e91a2a12cec490f3108b6e
SHA512c359f602e6566a175940c6231cae5e21f78b5868301782a6342cb428dd79dca644fdca3aecc3d9ed331902b5f92cffc4cfb30349597667cb679f7e1b4cacb9c4
-
Filesize
49KB
MD5c729ea7f84737fb583df83c8eff112f1
SHA1a31e72fdbcee6572bffb31c31cb0456a0f31bc77
SHA2569f1ac139ed842cd4e1bab4794c0f22285786431dd72693086c7dd38a5ac3d88c
SHA512069a87d28c465310f54e841b3a021ad70517d5cd90618bcd77e2e79f2a6f6f61e850fe6be6e45513d1126000073cca7280d33b9257a4b1d8f35e120a8ee64770
-
Filesize
45KB
MD5cfadaf00ec3a85aaceeaba63e1bde675
SHA1a86fc1a3b21e20233163ce52ba99d97f3a01053d
SHA256cd4c8a1f6804f455ef2dcbca30475103ae31f2618c5606bfbb24053d01c06471
SHA5126f62fd952dd577e826f55cd9c4b0dc6a1bba9a8e8cdf8ab99b7ef3458941a90bdb2d56745a10e08444774a3e95e9d4109aa7bb8df87aeb445cd8a8bb961efcda
-
Filesize
40KB
MD5e96d1df62312c99ef1cdd5b0920fde58
SHA16cc8c136febb03c6a6d14403c728192988dc4797
SHA256b7f69d122a449300daf3784b1397863fd3b95248327628e2f3a6e17415c08cdb
SHA512fb05d499a9118dd6a9f191588ac47aae4da0f67fae137011c059e51c26478a0793d2d68d7519b1c01ed3ed405c69fd886a2e1728db56da47df45fb28e1479727
-
Filesize
48KB
MD56d0d874a40e55f9def5acc6e982964d6
SHA1d17e334d5d920d9b008d48d517d430e56a3a1244
SHA2560737fdeb6fdda9174e00eaef62bca7934c565257ffc9a1489738daae2fd0bf2b
SHA512cbd9ca06b3036a8e2142894f5ce4b7d90eb2f269a49ef3bfb6fd98a340adf6444834030b0c8d11ee8239299bdef0df9fd6576b1fbaa92757480b354bc8a939cd
-
Filesize
43KB
MD518067a5a5aa5890180d09c23c1dcf1b9
SHA15361e491bcd02101b4fe91e52bae1e279836b758
SHA2561c635147e8dc670bca989931213bd649a0753eb82f562fcd8c867f80a77277b0
SHA512a6d3b04ffb24b3c95e628e789a7a5589a245bd11929c52035dd9fbde46a88424997bc6bb4bfac5bb74d698204499afbbda8e45e1c4dfd2d8049b9d767612d452
-
Filesize
45KB
MD5b9a5d5681d08662aef05eb8bb47b6148
SHA155ef8ca45bc5a7a95de836b8abe68ef7a5e83632
SHA25609f38ab6308c7d2cd7772caed96a150f037be835d56057add9e964ab8302a2e3
SHA512df68fccc9e663d94cf046cafbac95ba38af041615bce4cefc750da0818a79f9a76be1120881e4ff6cbc19420cc70a4bc71433a339735bdf304e1aab0d3161a08
-
Filesize
48KB
MD5ae28e80f8eb15f6003a6063fcdda6468
SHA168df00b8371a58f879057cad68296626c561e290
SHA256a92ac5ceb5fead8513851f8e1f22c1f8a5f5120ecb8c7fee21c43a204a336584
SHA51210b9da3b47ae02d9634f100253c0a6594d2532b2505a31b697043ff6e90c0071db7ceba745663ff850c99b36c577deaa2d4a4b8f533d6daacc6cda58c2271c41
-
Filesize
54KB
MD55548eea0366d867336ca803a61b12bbc
SHA12fbfb4f6a1d990b9a250f39571a6410a90392a54
SHA2566f4158de58b65ac7230aa78a48074811bd2ee3e5de77b24988d06d5cc13d3304
SHA512ad36a062681042652e2bcb55ab0a2605c2c5506c5bcd2c95313ba0d7e28ca4fc88bc182a492b3798968a5ef7ace940b3a6813b7cf8d27ee8e1a186d32482a408
-
Filesize
49KB
MD578d10fdfcb4e31e81a6a3cdd199676ed
SHA148eb13582ea0bfb2a7538f64336d455113809ead
SHA25608ffc5e3743bf84dca7bf112095294486859141f24342fea046986753ae345dd
SHA512d8626526a1a1833be33ec4ddd7ef8bce7b5f80efff0c06eabdaf484a0db17fb60e77da0d4e8499b3ddd4738c6eb9a4ec0f791b9b73d83ce876a5402185dcbbe2
-
Filesize
48KB
MD53080358e8bd47db1e71d91ca7c1ee78e
SHA10ca7ffce864d0e6edcdbee7fd4c9696d9862209d
SHA25619589209250d6573fd9e563b0675253b8d38857b1904ed1691036a736d3be1a5
SHA5126200f25639311010fccb03431edfc4b4f168c68d360f82ad6e4f5a65edab6732453e23ec3a20be3170837c15ba1e132ca9171200d1c0653452d5a1956bbbe4a1
-
Filesize
50KB
MD529efd09211498947c2fd6455aa0ad84c
SHA1dfcaa8af0aaa851a88ac62982726662257ad357e
SHA25699956e09077b4ff1a6927048bce9482fd72da2c2a6e94663af1fbfd209aabab9
SHA512ede823168709bd26322e83c4cebf223c584c8a5d6077789271bc289b1a26c46ffa7b9b8abd6656f49040924de0fd4a78048080bdb0d8003f84f669860431478a
-
Filesize
58KB
MD56825f6b2a56de8af737939b603432aee
SHA1bcf577cc542fb57b4f6246662ca047d14cea44a7
SHA2567b04fc98783118c6b43d5d8a6374938c27c1228b532b0b3eff79d26a32b6a384
SHA5128018cedb2520ab88c0263c6f14cf18bb30cbeebf33c6d69c7af02848216cb7fb38b65f9033786d077022ed363af945591b5cb0737709a69c6bd3f781c2702c15
-
Filesize
40KB
MD54b9f85a6e9a70c16d31db663f7c1345d
SHA13189bac262cdee1cc5c3d959f640935606a9a082
SHA2563a3168e75647e0521f4a1528cc94c2b0ff880e6cedaddd32b5b94a50e5f2f493
SHA51246722f449618163338cfe513bfa5db9586560e59fce4ff154b65e75377e653fb7ed201c3e4f0320514fdb277f32d83265a530e9c1830ccbdd1d97a0c74dab856
-
Filesize
58KB
MD5d2c1cca96bc644d3c6d11fb2b34cbb70
SHA1fbcd326e1e301b0dabcaa561128d4e867a1821b8
SHA25646c8f9608a2e2a508f62164c1dd67e505d742cb34c668e512f015ba0686ce538
SHA51257b320648da3abc75bfe5688b696509551cb84c3f51f9bdee7b273e5bf43b2172c71013817742039890a20f54e82abdad016c85a4e27640097607d5f790a143d
-
Filesize
49KB
MD5f4d98287de5e761405c9b8b24173f3ed
SHA1ae8ca0076467b26ab9d5650545100e841f43c0e8
SHA256c6853db3792299ae4400c9bc32b10614f9ba6c5e7089d16e1fb02484dabdcf97
SHA51282757de7d76995825f12e955f15df570f3042f7757fe497254231c7406757300f1f160f6a8eeabc3441b2b36be31ace08a600413a6824e3752d20ab1d25ba29c
-
Filesize
54KB
MD5686c237bd8e8d6ebdf09a7d389ebd36e
SHA1f1913912bc067bc90c384cbc3a321d97827e02b8
SHA256c7af60bc2ac7d45c82f611f617eb26985ab9183f6eb38764493d6f96d6e228a2
SHA512d5c57a9ea4e0bbc53e0d40434be3e8c620ded0c82c454b6b96b4ca764e9aada329e4047423f799750a4ad2f94a20e37e4d588f90d3e195548353531da85ac588
-
Filesize
36KB
MD5af196dcfc4a8749c196035a87c1b55f9
SHA127f4bcb0a7cf4b9902115043702e765c8f3a1980
SHA25689168658d1d55818c5d8a6291e800b64562f3dcd493b503248e40e0cf433ec1d
SHA512eaeff9cdc0d64d04add28fc1b48ae2af5c2516ac5cc4aefb3cf33657eb2610bc40ad542aa7dc64b253652ebbf0cac9a4b288ddde69780fb1e02c3175b9c0c649
-
Filesize
49KB
MD576b62bfde51e3ef0bd89197b7f40b952
SHA16feb34cc2fdef5d7d3323c7017534f2a5d13f28a
SHA256d37749b0e90901fe70d3e1c42d8b590a1c291047ddcaf45482bf77afd9aed7ff
SHA5125c6b3f0f8a19ebeb170a3f4f5921bc04e421fae9525e01a7eb9e14662f4d51a6fb8a3c2bbc0f9d3b4a581838488ef05861d5ceea51c5d357d5325fb90eeac278
-
Filesize
36KB
MD567b08d8286d4545b6484c8355587cfdc
SHA1824825430bd1015f218899d3c7285fd63eca8cb3
SHA256ae32c8edf9e67e62106aa4e3b7baef1dd224e1805a151b1c0a4e424b471517ec
SHA5125b4373e683bd10459c06022e2aa168d92ffdb0a88b7d3b3c04941e478d80712a7f24fcbd9ce480bbd0d42d4c5d9f4f8e87b2e45fee6585115289f340b88c6b5b
-
Filesize
54KB
MD59e4441b52fbf14123cab6bc1fb9b75a8
SHA1ad8b03e41ed500e3de31aa49a0d2caad34f52bb8
SHA25619ce0e848d528e531bc61313daa32773ed20a1cdae43643f88ce151545518a7f
SHA512cf1c30e7f4a3e426f96373f579e15a618eea9dfedfcf941c7f06443c477bc48cbfd8982c0bb9cfdb6c62cb0fedf05327253a9b5939ee4396ff0d1e452251649d
-
Filesize
44KB
MD558f60ef68bd0153f68ce4580168add46
SHA1a69b490839a976e51e46a97676d52311855cdfe8
SHA256abd90a28d67fd34ee26a70b99dec085821dd9357d2acfe48572eb67e4e446f37
SHA512bc47e9d0df57e539c4586b19a13a9735129e20d7acbde164b3191adbfed5c95d4b279084c98e254501ec1ccdc61e6549327d0277223522ebcdfbbfdd88924d86
-
Filesize
45KB
MD5693c85412674b88b2d27ad3ba9e8bc29
SHA19ea9ec1533bcd6cf8e67c5c1279c92cefe22b6e1
SHA2564b2e40942d52f3fa741c3ec3b40e41e39a5c5cb6a498d0d1a60ddc5200d290a5
SHA5127bf1b5da21e3a0550afbcfeef2075572767de9c8beb74c83c9a66c1c1881a6711aecc1666e7b44ee915ce6eac552533b4de8e46b8bff77bbc96d1977a232c771
-
Filesize
50KB
MD5497007cc6de69e4f0b6e095eccdff951
SHA1838b406bacde9c2fda17e07c533efb230f190eda
SHA256aeaf31b4aef4eb4425a6f59093c74cc04423a498b41004adca74c8c330767f1c
SHA512477f18a90badae3f498bd6a84e05eb694c9385ca1440eee7493c8a6efc5f74e6a9731f68908122cb22c8fb7b85df8fad7ac56a3152ada048e684f3dd8915ad8f
-
Filesize
42KB
MD5c478e0de9f28195caf3f1e92da4c78a7
SHA13264b28d83a5bc4b0bd960a37832eb9c515aecb7
SHA25603291338b76791a7bb65f75f5327b32bdcf907e029ef0376f249b9f5f5066a51
SHA5127155515152eec6c2bb74fb1a176167909108dc3c88ea22d62781d5cd06122bd35e4ad927d14296b5cd12edaf706e11fa5a52a1bb21129b173cb14fed57657ebe
-
Filesize
48KB
MD56df66e598d5b580c29c4acd7db7e7f02
SHA13539dcee89ffeb00c5d2b080635ebf52cc130ca5
SHA256d36c7d3c9a6737ba6e3f39930759dc639e7e06c4210f4b52834d9e85872e91b5
SHA512281fd654624395126fa4859df04987441c84dc2439dacf7ba9ad6018774a2477ea724e2b051c297f90c5b7cc3b77f2621e7ec88d902f81eeb8424f995acb69b0
-
Filesize
48KB
MD55990dca9293416bb5094f10132b0a076
SHA1ae820df25be2fe631c551d6715c00939367febbe
SHA2561edb754ecca69653fb6afc67f3819cb6355db9e9816a91f25a2a6e8ef89d06d5
SHA5127aa7448fcd41da81ef5dc751a4e3a9f2361420429f030e17dc6b48fb3ebb0d93d3da04e672ca1225b4c8842f716e632d2e25664c5f7198fd9372f59fc37a01d8
-
Filesize
50KB
MD543af9a7a5cb7745bfe5c7314fa724b49
SHA1240533bdb9d5dc1d02eca1e28c706c741f51ec1e
SHA256b86099ca61962899871a03ac8030428868cfc34e8c5125282d517a8f001d30dc
SHA512cdd2a403f39fd5d7c8ec8ad3656ac9cf3969e828dd97a6ef46abeafeaa7f8589e853eac2723f1bbec05617ef88bf1b94b0078e6dd8a1c1a2fb9bc1a86dcf2ac2
-
Filesize
46KB
MD522a1d7bdf289653b24e58e7a44f3c41f
SHA10f90932c345948f2c043d451c7e70494bea7563b
SHA256f48b164f23c5d08ede7d4f3efb732f99eee3510c694b49bbb49dc1b20ddad300
SHA512ad1877384d4d09e218128dd50f081dc638a395ccb231b564aa763a46857f2411d75777aa69d50bdfdb6238f110db729b8de41c5eea967f0fa6eda273b97f8960
-
Filesize
49KB
MD5eec8eb14d2e75cae5dad8e65562c10d1
SHA15dd5e6581013f37713f86365509bda15ea4f4c38
SHA2560da4f0d6478b2dbeee8b2f2db778f448fd0a3de6d446910462d94afc3355e33d
SHA51229a4a03c787e49ea12ac80f6e3da6298cce9230ab9af14867976b0d45855f5f7fc7d3d9a6a61f74ffbcba75a75c83707c21f255451907ada9798b2d9b06ce84f
-
Filesize
40KB
MD5c6f0581a0c627b56528a4d80fa6e76c8
SHA18ba2cf1137a5de17969196789f51a0b39eca13cd
SHA2564d2d925e2cfc7bbe3bbb3769d1acc0f09e05fac06b63a9459a21a1c2f03faaac
SHA512c562548d68c7d098c6f305eb0ce620d18adbee1ef12a4f1c7e86feba8fa223d77a3416bd17ea1ee230fc34cd6ccea556bd084a5731012a63b5c1c3cefdfbcb03
-
Filesize
60KB
MD519038a648cc055a90dc5715ab2de4f71
SHA18a2fc1b71f84b75f6cb5d2638348912e6eebea93
SHA25664f934aa05bd3c958a6681b864eac498c7d32bcc1ab99c64f668c8eb0f64dfab
SHA512305385153945f7d6e5b05ef75f1bde8133df31c93373f08de3b39c493054a7dd3c8c47d6355c9fca6ca79dec3074912ad0b504174ff6be84bee6ddcbda902df0
-
Filesize
44KB
MD57a76d45d27d8c43c740c8f5473050829
SHA1cded87715e50412a11a446171e5fed106ee896cb
SHA256a273d7c9775173f62f93e3e5c69c36532aeb2ec4800da9c0eeba585040edcdd3
SHA5125dd3adfb8ee1f81c7467c0e8c2400148aa3d563a438e602fa495306b8e3d8d0fa671f4748388426559a76c655e1f52c15e3a60a8281b12d4b6651e29eee0cb32
-
Filesize
61KB
MD539003aeb994f1db942d1f336faade623
SHA1802a2e6e0a273b5249a24be5b3c657377003892e
SHA2568ec903e787eda5031410630cc76d1a48b41a3d28be1b3da5d003b31f97917865
SHA5121bcfaa6c1f57fbf18381f04fdbc96d17fdfa7d854870328e109e69ed393503851d1d3de839a2cde1755dfc9bddf37b558ed20e966c499f4a8f78c4fe5accc377
-
Filesize
51KB
MD518baf45c1afb461f8d1a423c44b239ab
SHA1edd2e536ad575b9bd4e9d4ba739a3fa3ebba08fd
SHA25620a23ab33c8dfcef10fba9145686061bec935e1cc935c41ff18aa91294f64a04
SHA512197b36862f862057ee777e4095c2aa5a81f3543aec45868c099b6052633ef3aac6112fc1c1ed87b2598671970248aced6938bbe82bec9ad334e1b03f909710d9
-
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp
Filesize55KB
MD507fb7fab001b089e7f148adb1f3594e5
SHA1f0c359bd69fcea49a14835b0aee5955d4b2f6f1e
SHA2569d94e7f33f8441313fe52d50ab9e48dfce9eeea629adf629f4fe234520e829e2
SHA5123751274fce975bd9e4f0136e1b44ff1b69a37571f67f20f04bee025405c86ad92237201ac40be68c28a0cf095d4839b852ef0e9f9deafec4520941378362671a
-
Filesize
40KB
MD5b1a269792d8d85226b407e6507498ae0
SHA1190916cbc7220e8190b432f0b538412d602b8957
SHA25634a690297a6bca89a7f93f4971b4d2c48fc2993f5d37c534b3dff5a376f38a49
SHA512cd3e965cf3a9f35318ccb98bedbff8f80144f39e0895110da3212fa83b716f4401c56b779d45a99f8441eda1ce45de29fde83da826f084a678c8ebd8541ee262
-
Filesize
36KB
MD57bd453fa38c8fc04400d3ff2171b5250
SHA140abebd090bab3ad353741deabd7edddf31cac8b
SHA2566682613e6de95f5fdb208de140e19afa38333738ba22e04e75166a51ed6e0e0a
SHA512939b933cdab712dd76b3c0ce2d72832fbef2896cc18838c9b79c7cf005154d44eec0cadf0cbf7c9169d80fedc8769c7964ad55810424f3976917b873e8dc8cb1