Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2024, 23:27
Static task
static1
Behavioral task
behavioral1
Sample
74c9ce44e6b4e50bd7715d109b14a6ff82622e61a1830a57990daee03eb4b61e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
74c9ce44e6b4e50bd7715d109b14a6ff82622e61a1830a57990daee03eb4b61e.exe
Resource
win10v2004-20241007-en
General
-
Target
74c9ce44e6b4e50bd7715d109b14a6ff82622e61a1830a57990daee03eb4b61e.exe
-
Size
130KB
-
MD5
11cdaea450e29f1afc219951a64518fb
-
SHA1
147c030ead5a6ef04d9732f86ffba8deb89f1911
-
SHA256
74c9ce44e6b4e50bd7715d109b14a6ff82622e61a1830a57990daee03eb4b61e
-
SHA512
69b0fd72c7835bc6a7179a099bf74d852eadf00d694a47a9b04d6342ce13b4301caf389db19288f34fb414d3847d69bf4537d2095c5a5148b2c67cfca1d8904e
-
SSDEEP
3072:6rWpcsHEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsprWpcsHw:tse
Malware Config
Signatures
-
Renames multiple (4738) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 2136 Zombie.exe 4208 _MS.ONENOTE.16.1033.hxn.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 74c9ce44e6b4e50bd7715d109b14a6ff82622e61a1830a57990daee03eb4b61e.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 74c9ce44e6b4e50bd7715d109b14a6ff82622e61a1830a57990daee03eb4b61e.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp _MS.ONENOTE.16.1033.hxn.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp _MS.ONENOTE.16.1033.hxn.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp _MS.ONENOTE.16.1033.hxn.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nl.pak.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms.tmp _MS.ONENOTE.16.1033.hxn.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Internet Explorer\images\bing.ico.tmp Zombie.exe File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.exe.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp Zombie.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp _MS.ONENOTE.16.1033.hxn.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp Zombie.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp _MS.ONENOTE.16.1033.hxn.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\Microsoft.VisualBasic.Forms.resources.dll.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp _MS.ONENOTE.16.1033.hxn.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationTypes.resources.dll.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp _MS.ONENOTE.16.1033.hxn.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.exe.tmp _MS.ONENOTE.16.1033.hxn.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp Zombie.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp _MS.ONENOTE.16.1033.hxn.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp _MS.ONENOTE.16.1033.hxn.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.tmp _MS.ONENOTE.16.1033.hxn.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp _MS.ONENOTE.16.1033.hxn.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp _MS.ONENOTE.16.1033.hxn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp _MS.ONENOTE.16.1033.hxn.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp Zombie.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74c9ce44e6b4e50bd7715d109b14a6ff82622e61a1830a57990daee03eb4b61e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _MS.ONENOTE.16.1033.hxn.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3324 wrote to memory of 4208 3324 74c9ce44e6b4e50bd7715d109b14a6ff82622e61a1830a57990daee03eb4b61e.exe 84 PID 3324 wrote to memory of 4208 3324 74c9ce44e6b4e50bd7715d109b14a6ff82622e61a1830a57990daee03eb4b61e.exe 84 PID 3324 wrote to memory of 4208 3324 74c9ce44e6b4e50bd7715d109b14a6ff82622e61a1830a57990daee03eb4b61e.exe 84 PID 3324 wrote to memory of 2136 3324 74c9ce44e6b4e50bd7715d109b14a6ff82622e61a1830a57990daee03eb4b61e.exe 85 PID 3324 wrote to memory of 2136 3324 74c9ce44e6b4e50bd7715d109b14a6ff82622e61a1830a57990daee03eb4b61e.exe 85 PID 3324 wrote to memory of 2136 3324 74c9ce44e6b4e50bd7715d109b14a6ff82622e61a1830a57990daee03eb4b61e.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\74c9ce44e6b4e50bd7715d109b14a6ff82622e61a1830a57990daee03eb4b61e.exe"C:\Users\Admin\AppData\Local\Temp\74c9ce44e6b4e50bd7715d109b14a6ff82622e61a1830a57990daee03eb4b61e.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\_MS.ONENOTE.16.1033.hxn.exe"_MS.ONENOTE.16.1033.hxn.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4208
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD531de8d9cfbf8f417cfb73f78d576741f
SHA180914d1fcade004a887b3873476587b52e8fb11b
SHA2564fbf684d53e4e2d59ade63186c70f4caab7a5c54709fbc9b05cd388156405c7e
SHA512da665b2ac28b13d72be51a540d34d8986a7de9a985d3a0dbc121b9f6b5840251064f1b60c30a3f176ee4209e5116ae62ee6a9de279db8f4390ce55d07b1c5091
-
Filesize
130KB
MD5cf3bd8271e21f02f24f00941f8ef9a2e
SHA113407bcb6ff0376ebcff2ccab57fdcd8f2d9bcd7
SHA256aec61ba5eb91c8a5cca0e7476c3943c3fa65f0d68908674ed4f9238e9c1c2c58
SHA512d669abd94941b4f24fb611888b8be12a2d1523050a163ac556bbcf24aec5862cf1025cd98820fb7b3eeea2f8071ccad67072399b81acf5a48f375dec86516d48
-
Filesize
177KB
MD5c3403ef5ce58e2b6fd00f4bd731363a2
SHA1849f116f7d87dfa2b9e8ec4c2abf97c8feff3cd1
SHA256c86934832aecf1399df7763cae679adcc830dd405a24ac1fa2f8dec09c9b71f8
SHA512659c0514923a6cee22341b565a529fe292890866032757b065f457579b690d7d97f717d91e7174bdb2f1801354e7dc734432beb2fcee537b9c79c7e68173d95d
-
Filesize
164KB
MD5c00effe43b84833264b43d20c4ed524d
SHA18b8318173039fb63fcda76e8d2c58c3a558e22c2
SHA25685f739cf83256ef7e9ccdf6c19e486bace49bc9eee354c597227d12e49f7bbc8
SHA512008b254475358fe185dafe68984c196745247f6298325a83f5ec3b57696b4093e1d063f3e240a2ff4be7529f352699c036e69136c2917158b7537feb6a5cca23
-
Filesize
130KB
MD55c1608d68deb7248f9289e0d5e30a4c9
SHA1e24837b38c7913f86c02b6ce713c9540d3f8cf0a
SHA256b7335ef5a11e9aa47bd0d0ac00c70a8c1c9473aca9705f263469685e2b561dcf
SHA512c10273df7c0bae5bca9472300c50691526046ea3aa68d486b7a42ae09f995f0f7dd043c94e407c4f152cb1a6ec6b0f5d93023fed3e46465b0ca7dba1a8a6a0af
-
Filesize
1.8MB
MD5237e1f2f1927caa7cde5c08fb637e9ce
SHA1e8a768ae7b115eba65cd37499379accc00a6db6b
SHA2568cad02cc75653fe5ec930435b24d63ebfcc09d41d104057c5ee0adbe121f6ac0
SHA51292639583933b91d2b6c06b3ae480a3287a12a09b79a34e51a80d6136c69becc65c34fff5b4ab017b4e186547d002806620bd481536bc1e5a5c9ed343a7f786fc
-
Filesize
609KB
MD56c773de7551924975dcc480e3ff03ba1
SHA1f0aa42bfc890821131437a2704a0660bf3e66eff
SHA256825ae9d458763d5b59b8f355d806f00afb134835e377f15eeec80d1161ee4eac
SHA512876890d36228c3be23daba2af0c8a227203f7447f9ea2f49bc3bed7e1cd290efea00f40c69219bbb4b5e1230fbbcc24da89f4401ca49903b3949ab7c2f60908d
-
Filesize
64KB
MD550929fe2b832d2c4d8e15ee85c8c7b4d
SHA192cc7ea910d693c14ce8e751496c763d44fee7c9
SHA25608d7ccf9bc033d6bce82ed8a44d5a7050d0c8559828f6c85aef8ce00f841d368
SHA5127de4de4574baf2ccda7d2f0965a1cc84a9dd0545c158d89a052a2f7b6e1e7f4d5274cd141c1a97beedc6d741ce39f73074eeaa9408343d4d9c0d7971ac47eeb6
-
Filesize
254KB
MD5116d0d6f07a6f647bf3b5a6af62dd585
SHA1cc44c692a1d8def99567f5115bec5c2cd7c0e1bd
SHA256cb4df9ca0e06443398e7f779db27169012e2181545947125446fa20a150a619f
SHA512877421980791a403f5db9aefe4764f69124d58ff836e7361b5343d6ebd974a66e1b64f8363347c3cdcbee56455e3c9e7e908c8b0507654c07ffc71de8f6758e6
-
Filesize
996KB
MD56beb590afc969b2710c704fd44fbf541
SHA1bf34f0a4bd31be03dc9eb1cefca2beb3bd992a46
SHA2567af6353f05ef3e1b629c4cb39c3d3b8368a9ad03c524530bed7b58e14c8ed791
SHA5122de77ee566bcea9b709a883822e0fd3a52db0a59090141d90053f3171bee3d4383ca076980cd4f00e4d60814b5c0d924ed94eb971a6b11b5755064b8e844d367
-
Filesize
749KB
MD5a97c3399bc4334a55e349b4342c2d282
SHA159b7abe05c7eef96d27b9ac14ea3e204e42d41cf
SHA256a70d6d7c897f9c6a70f98c1cc1c10916266772bd69f139debf0d20de88ab8c53
SHA51290c98130ced41a7ef6b50af649f09909db14fa1aa42ca5a0ccf890edd3405036897e2e36069606142d4fe650875941753530adce610f56d876bf81a11a9593bd
-
Filesize
75KB
MD5853787273c37515dc4de23c70d6a40c3
SHA118d1976f2ca88b2af220496ba153fccc62478a38
SHA256d6ae4737fd595164c198ef832fa8b9e6a28f64df931aba04946578f9efdbbc60
SHA51254326bff8094637872b1fe049af341e2e4b692c95b6a6c3f3afef629758b51adccbf90c55e9dcd2c29b9f28559aeba049d004c11b8c3ca6f23995e80ba31550d
-
Filesize
73KB
MD525b330d8a1b840a09e97fa7f008199bc
SHA1752ae19f8d9064454756ce0f31b546c69106f75c
SHA2568a54c153c7eafeac3d4d289090b39daba400f92f79da7e4c8bdeef772cf8b1fb
SHA512368eee04667653f142441abdd3b3f3e7bc2cbbc91c3a56190d4131fe59ed0566ac30655c8834cbfd76da5304d5f883d6950be5116c7a30fb167af0fd079f45db
-
Filesize
65KB
MD5dcae26b7d3a56ee8f28635d6b9cebbe3
SHA171d3e4da7b4bbada793eb734d1c7e7aba972f539
SHA2560bc32c1ce4cd44960cc6bf0817112d9ccb79a1bcb33c630cf8eb50f0915b0058
SHA5123a9a784749b0b87bd1066f28488fd8f4e19c3cb24061d525ca3c0f0615f915008da7ca0fd70f90296a4c4a555023378be5c713a64bf998cb9b0870574c26cc4f
-
Filesize
74KB
MD5663961b986d6a36efc8933ac6968b1e3
SHA117b28783827c4099354df6bdc36bc758c9d8df4f
SHA256cc26508fd49a280bd34083b49e95d88828a5f5c5cb25bd699e198348055f9344
SHA51237b8f800dc94c46b9aee9353424634bf19521fe872ba110d1fb293f0e9785654f3022f5d089e32813e9a7b6e7c1a46252f69b4be7037d1952691406e512a55e3
-
Filesize
76KB
MD50ac78f86b0ea2f7d2d51907e40c71b04
SHA18b5e00d8fd40804f882e4b0c9b688c46bdec4f39
SHA256474038475e0c7eaf60d6bbd51d1533108d46608139ebf2579785b719c7ca4975
SHA512fe015e5f395a1dd9757232b99bf5096e450cd7c56587696ee4da33e57589d67cdaa2e93143bf28460f2340913a48b309e717e5cc530f28066a2b3034a72f6df1
-
Filesize
77KB
MD591bb02d8102479932a509b9aec51b66f
SHA1bc08832fd2a7d59c626216f23e09546d5c9bf0cb
SHA25684346112c06063ff621a20e48b701381426ef7ca7f60e88366db6d7e833dc054
SHA51237dddd2b2112d1054b36fbc82055c1a2d7f3489c6e570f8c70e49d5613ecbdd64c43426f7e8e47eaa1e0e48ee6de00309d29347770446f5384b2eb16259f9c29
-
Filesize
77KB
MD5bea14252cb5a18348b1ab41211d1643f
SHA189a8a67b427ee40d4e1a0d19b7031a5cfe50009d
SHA2569c406ed3327f7c42364ba558a6b6739c871bd37d3e6e6d69a2b0eba5489705dd
SHA512ce2e735e12ba41385c5f84b10324fa2dc61b0b64bd752c7eedcf7426806d335065de845eb8e6f6d99978b5d3b90e55f30ee459bab8606f3c9b7f0ae5b7ce24e4
-
Filesize
70KB
MD589862c2a4627bd07d930574f863fd9b1
SHA1ef293420d8ad2b37c3d2673ec31206599c654ef7
SHA2562e2afaafe3b8c8ff7b4c96c33a573cf3cbc1c354553393f10cd332af8c871722
SHA512e4af1eaeb379c0d15b6f17d14eff829a8178ff07efe2ed6c2b0bbf8bcae178611564b9f54be1199eeeb86062cc3af1cdfcc6584e502cd510a3ec08bdbfee1942
-
Filesize
73KB
MD58e1c18618eabe5da7de346188d93a023
SHA195d948b81406815c759cef051426096f6e5e3a27
SHA256d9702b881f69baa28d24abf0717a56413dac7e988df8fdc01c5ab80a3cf4aa9b
SHA5129dc88eb0f810b02e6536cd158dec5943429928e32ace3a2c79924b275037715b0f8c0f4aacf526643768af39529b2c41fa0a65704b021afe5fd5123f0be1943d
-
Filesize
74KB
MD507ab482aa33d7625f6ccaeab15c35f2a
SHA14a31e84bf72c1a04a75206ad3cfb0a4bf683dbe2
SHA25626c5a3f73eedc99b31d9a597c69880062e1788b07f2f6cee3abf7e081650852a
SHA512b601e176612ed53587580b958526359ce3ab27172fc490031cc82278e3dff1651e30c2728d31e85e02ccd72b495aae17633285424d9b23e8a0130a3516413f64
-
Filesize
81KB
MD572afa117f2b7cc0a4ab162e86ce577aa
SHA12a79a240d279b77227e263f3908b396fd8f03e51
SHA25625118606f66d97948bedcabbd9a990a75173a4c1922959fc2b67d152bf81af15
SHA5121c1b061c306b130c4d7372c4235c4f0c931223a35bf94c2d0aa1970c6fdbed30c9d3567cf2efb58d77972b0e757adacc5517b7959b246aa7b11e11fa6db018ad
-
Filesize
73KB
MD591d750dba171b81f7b5d6b1391c53a42
SHA1952d19a4fff2a0cae94b7cf48204b5a62779cc03
SHA256dd422654fa51683379d152f1a5c6d9aca562151a747fb35c69b3daaf0eceeac0
SHA5127a28a176c18b64345eaceec34c7aad065b6fc32a2bae15298986a49203d8b468376b2292673e78a7122bcea38b6e6c2b16948a0eb2d870fc3eff8972c0ef9975
-
Filesize
74KB
MD566aa6a8dde87d74817b58f6c931b6f8d
SHA1719ea93bce6ba201795ef167dc4c02a0538a12cc
SHA2562934d9df736802fba79ced640e2eb7142b055370fcd323ec3f0c4402400ffdf6
SHA5126da63e243b908a7cc3c44debdcee8cf6472d74baa32ec44d5532b0abde9d44d1ff1b72c0aa7de674daf0fbcf192897b2c2adcb43ba596e38dcde3db71f36672f
-
Filesize
72KB
MD52bf66339a6a45f6c202ca113ed9442cc
SHA13af3c07b1e5e3a8cdd34c137ef99d9de86115a2f
SHA256eae674d600155147be0748dbdd221b9562f2c3b851db4c9054b64e013072faeb
SHA512b4d064c32f86b88c68c8ebc8fce57448b084be4e8b6c125fe40fa0bead819ef2c077687fa8c1e0c91817afb32872b8bd33de5e0aa8929a75c70d1ac8d818779c
-
Filesize
73KB
MD5f941f3f4be217b1cf001da70a632fb43
SHA1da12ed8f23734895617c7f7085f8770dc9276ea3
SHA2567848af40889f7aa96ce2b952163d72defe5cfda84a69d7bb8dbbf97fc572ea66
SHA51266718a01e3856c1a5af65bcabe7a2e2733b447165906055af0077541ea0bb19bffbb36f131ab789b61cfa40ab9900117b3260df5dba83a0e64735515a334a0aa
-
Filesize
73KB
MD5d78b53ac4e262724842ed722cf6ab322
SHA1f8c4eee5a09b9d60aa3e289fc049d0b5b10a1af3
SHA25631cccd1e6d2a5f2c65ba980e9589a85a294cb282605a4bf9d3d53802db826299
SHA51294479ffe0821c21336122ae0ec1ffa634e42fe1ca753a90ceeefee8f2a0f5bfa44407dfdf83182faa74cd4f4afebfcd61570ca3efe7e9a6d0629bf82311ec2aa
-
Filesize
82KB
MD57f6a2de2dd87066e05288eed2503af0d
SHA14e60b865d3548f8fa51685966314a9a9d372720e
SHA256fef445bf59ff1c6b1897d9ec08b5402cf65c2ae3c4938820ae9a15ba063bee46
SHA512833ac513ac993eeee1dd3895004c57834ae696e1ad3252bc33fc4e349b7325d65d3b3b3008ebbb73a00e78eb215b0f52dc6be6ceaf8738d6fcadbb7fdd5fe796
-
Filesize
75KB
MD54ea9af7e17ecfc141a847ff9b4b0992e
SHA16e5ce8ebad3ddb914b9d1dcf8732e8eb5c5e5747
SHA256c03a8e6c4a4056aa1f546720f71e47c4233a194eede05268d46cd0644c8e7ef3
SHA5125d115fc0023bca043e9fbeb1c413568f60184513b7b4ac56f176bd94e022b3c6a2f6ce43a5bc07d48f1901f4237dd153a77ae9c82c384998425d6d63529f8730
-
Filesize
82KB
MD5ff96a0ee97a0d30cb8704e9ed8fb993c
SHA1b525d874c43ac875288876cde662d033c4f5a2f5
SHA256682874d72f94c16faa6fdb5855d15a659430e6e855a478e939fb85439020ac9e
SHA5121f96a9fcbc9878c66b1692f6c69b7208e9d497b421a0b9b4070558d6d5bd2af657079087bb81968b5b683633b5ce3ddb04b70ce2edca44319236638720166f6a
-
Filesize
75KB
MD5b039ded2942247b8c5d85dd7621f0b76
SHA199b8ca943959c6b76479f21117e0769b21ace4d8
SHA25665cd03eea713d803e115668890ca270d97a2d671da87c8b7d2617aa549dc4f91
SHA512dec2937bac27b292b3a46e7309e0e0ae3d342330dd33604cd64df79f12a60415da70d032ecbaf2b1ae155b489d3c03f093504eb1664da24d4d231684d2f88d47
-
Filesize
79KB
MD5e7400eb2b98fc8a950cd84c5451ed1bb
SHA136de58ea716222fd918a4c4a103ea707b502c19f
SHA256c995349e34610c377dbe68b38dc520466890ee84da80fa6a1ceefdb548e9e96d
SHA512fb667792081c3797b9a6ae9bb14f3e3c42c896ca38797c713bf8d83c82d379e2f66070c61242f71201b833c76a9ffa1661f331d1558ca0cfb5417cf9ff9906be
-
Filesize
75KB
MD5ee4667c675e9b1e49cb30e819b6feb58
SHA12d76bea96108bfb987b3082bf1640d31c16a0934
SHA256d19224cd002513d754d440ff407dfe76f54d6463dfbd203ba03e459b0a832fbc
SHA512f1994158e1ca30b298eeb34e518cae6308b0260819db8afbb706abb8257b4c0a1151a0f7a00028954c86358d75d9f1021f6db08b372ffef42fd94b58fe7a40e4
-
Filesize
74KB
MD56c0051693a01bddb9f3b9ac655a75dab
SHA153688c01276ad292a40ce690bc21356e20e9e747
SHA256b2df0f2f82626c878d7cf968aaab06a744f3487993bf84ed72e065d8d110a761
SHA51283aea555e4ca2fcc4472ba5860e2de76a3b867dadc27f3b4c562cdff7f5ac1011762c1c81ba3e430e58b83e82d86f2bf224ac898347b9c33e59815c4fb3b58df
-
Filesize
75KB
MD55f69a7dea9e44ac029113732b2e9affa
SHA164b26cdc8d97057cbd9e182cc69294d54574a4b6
SHA256191ff58de30f4f989ce777f80d0fa2b4d2125a9aa96276039d35b2cf87839765
SHA512d324b5890d9c05a02ea7b9d6ed0772d0cc80add590e59dbe370df3d433c5d209f39a9120fbb72d11d6597a4c9db29eb784438ef713214219727b7d7d80d244cb
-
Filesize
77KB
MD5c9e67565761abaec43272a0e249aa4df
SHA1dfd17dd9f9738e70c2136d8be711cdb1c44c9cec
SHA2566cda8283d62a148960283f55b2c68b46f9a1d8acb3a6bd9923eb67e55f0a3ff9
SHA512db8d3f52b8a28f20e4b0d9d5759521e60b8bb527283a0e77eb8f4bd5cce4089121c00e01ca2c46a0498c7c8f25c3ae3e2fa1771c31d52b4be3472ac8ed62cfba
-
Filesize
73KB
MD552e2af67d1438fa284453bc02fea1b09
SHA1c3ac5292d6ad92941ec3889331571824564841d9
SHA256ddb4da3bd6b3484771fe20031a2f18e99c4841d158222cb155503b3564304401
SHA5129ed38a7923297348ae82d9a3494dd1c8b135ed06f76dd33b17bada3d865d926f60f1d9eecb0be8e4f09a49e90aab1e075407342e16771ce497631578ef9c2883
-
Filesize
75KB
MD59ed59b2fe3092eb2071bab2d85b51e33
SHA17097ffccbe084d1ee9243e258cac013ed16b3ad6
SHA25695333ac7bc98c0d24cff01e66e0d168d8c9e1a108805ea75399546f762739cd4
SHA5128aebe9dabffe34ef47a9613156ee1ef4b8455e1d054e85795df03f8229959aeea13b94ac27e89e87c7aaf869b538a7751d51cbac378ee5fc728283fc44d0268d
-
Filesize
71KB
MD55226c1ebb3e5a3dba34467a5c8d6953c
SHA1808e840b7a89e965f5d3e09580b7476033be522c
SHA2565beb3c95d9b86f11a7e94fec45c8e79c86be16106f88be83a78da0586cccb101
SHA512581e9f9c7572b29da6db43f3f4decef15c913c43d6d7f5b2e1dffb1a716e193c6c089f03f5860c4c145893ee6b3bfa0e2e5933ced30e1d742b46ebeb148837df
-
Filesize
77KB
MD5fd1620044fde9f70937c038948e6edd4
SHA1af488e73e5192a51efc2da2300f66936288ba898
SHA256fbb2b2c27e5c8ea4bcd43b1fd2cbeb569b64a06cb1b35a1ab6185d8e2981ce46
SHA5129c475f2b72882631fba6a665234ba6aa34b6e96fc7d6d31b716fcd26b9ce004a8d7d765486fb22815824302aaee1af240678d7435a74475fc8e23082e0ff7f58
-
Filesize
73KB
MD5cce68b929bbd92aee5b4e6a114bfad22
SHA125d426e77a758c72f81ed66aee045dc6c62e24f6
SHA256f78415cd73c86a9864093fb335b27947c951ffb46ad2eb0952e9c1e44cf80357
SHA512899bc478f62ef11f122657cf87876a0cfa2ef281e75ef446d528bd3a98aae7e06e47611b400070f2b38d2df80314a588332636230dd08b4b0c890022dd859e68
-
Filesize
74KB
MD5d8460a3b71063ec802d5eb879e6170fa
SHA13bbab1bbbba91b9d4daeb838256a8f90e624db40
SHA2567901f628d63861687691a81aa19ba25d73d8e80d6c7741bec53673f3c4e527cf
SHA512be19e5c29139c0a996bc7abf9ed12ddbcb3da37d3da14749e91e22e9863a3c0377c0c992c4e4422a520e0c2353883e6356fd7e95ae452cd6f7407e3983b663b4
-
Filesize
73KB
MD5502302b27c7db22345a1287bf0217161
SHA1e624613fdcca400ed9a1a005f10be75272c267d8
SHA256236de0073d3955262915509ad611de31df7b1409c71742cecd9c9a3ffd812d57
SHA512de4dbd6666b4a8ea558fca5dbf86740bb00d33b265026ef5c702c0975dec116a2f0b478c58d4f663b75d2eb052e1b2f88b0bfb95b61fb3bb1a1da8757793f63f
-
Filesize
65KB
MD59de7afe0cd7512fbda33f28877907bd3
SHA1d1f99ecc5fb3b4fcd4c32c77e0bed76f4b19e9e1
SHA2564ccd2e68d8ca1e4edd4ef2471be2e7a6bbb2de3ad0f6159e20da384d00d02ab7
SHA5120db4022f491cf2df398912c7a9883c0e2b39e0582a7ef270127ddcd75e814e0491db4fbb70fd5578b85e00831a496382955ae427628b5a4dd4fb70d415cbfae4
-
Filesize
85KB
MD589b5cb81dd46df8ea4571e6a7da357e9
SHA150718741851278c1a5712349c5e92b38a5ad0012
SHA256ee4d689629c900a17e40eaabb9c5f5dd12344520519ffcf1174465cb0d867843
SHA512388a491b133083edf25f7bb361add961f5350e05c32719aacfe7022acf2991f0afe562e9b3250eb48d4ae00c026c95cfa9b52538d8997e14244f2c20033881ca
-
Filesize
65KB
MD529fc837378f077d40a1dd47d0ed5ad21
SHA1945c8c3696fcb675e8049a9278a9c4fe7896f438
SHA25670a68c42530862dc513fb7837257f5032877b43ee31ab3b835bfa239655cd6f4
SHA5128e2e9ce979ea521eb509afa94e0463e78467410a82597300674feffa6a691cfb671d4714aea3dad1b4b17bbfb67ff7957256c8d799b0942ed51e3d914e87bf02
-
Filesize
71KB
MD51252c3d0e3f38c8fd3e5f6a84c2d292d
SHA1dcfc5f6655934ead398c4e90ca8250ee7c182d45
SHA25634b24d5b95c2c890130aef330b20d3c14515d2cb7bc6b63f8cdc3a53135d97e5
SHA512b7999f57c0bfedb58174b914cc2b9791dd72e148be5a17f7dd323c2ccfec6d712f93a829a215223f7506d095cce20fba9e97fb13c4f9cf9a06cf0b9aaff58e54
-
Filesize
74KB
MD517269e9e3208795406db3d2da34cc05a
SHA181d9f2aaa22a92dc2d189c2f8751652418d47885
SHA25629490e49352804c57a907e798a76259a551ec1da5912179bcafa33988e60f7f1
SHA512a428a4d6f1318138ec0a87c1d506ec8af1e31f8e13ec707760d85968891f15bdd7c7519adc377d5b1f7a838732138a99858cfe9046c977c7ed1ac2189e8b1765
-
Filesize
79KB
MD580c9059356e8f3eca0c526033a53bfa7
SHA190cd951d7626a11aebce03d82abe474ebf602c99
SHA256070ce89f0ae7908766ba6f2410f6d4feb33a537dd36af9d73ebdadab635191d0
SHA5120c49eca3a6ed746a7f00d73aedebffb24d5dc9c0ea4c0031472fc03bf67b029bf4fd082ea3472f66dba67143c6a81ac8791315e4c4be9d489d931d0c785b22df
-
Filesize
75KB
MD519c6625fdc4d93ff81cb620fb6a70ff5
SHA1894669f366d4f76bbbfd373750e290df5f54a08c
SHA25639e3c8cc25141be596d79127b8b0035bfae95b59ef9574b80addf03e1ed11f9e
SHA5127d9ce5484b1ef14f7ddea0eb1d5feae86f76537afa0f56a3ff80578ef11c904eb127505af85040e7bc25bc54a10aa59f4497f4483df2b5f8b814de70fef39e0c
-
Filesize
73KB
MD5485bc9c2f8a2ea0cf0014c4dea8e159e
SHA173b010d7c5b2c68ee7b03b15ab7f0b4bd880f97c
SHA25627dc2c805865ab9a16a611e89617205aaabcc82257eb834705d7048e179b6c43
SHA512f14e6a44e15357f3a966a8a0c61ff8cdd899a407f2fd9e7f1da9efe6c4433825c535440709d9b06ec318e64fcee20b6b564e2de42159d89465c0ca25d126fde3
-
Filesize
75KB
MD5140992aa33ed06bc545eb1a9c680d6a8
SHA1ad711ac72ba7988451c4bed1e77da96b9a6120e0
SHA25617be51658287f2f00d16df90813c80c555a3014987e0f6b66a2247f211bf1146
SHA512dbc822f90b579b6317c3d24b921062464ea0c746bb7cdab4097c391cd41887a3875f5ec0a0715365efacde710d9c28e7c3eb3de9068275136e9a328adbfda4e3
-
Filesize
72KB
MD5ef971f2a0befe5c51e0d6a70c5d7e640
SHA10545d683cb341f80cc66bf2fefe3303999165521
SHA2561c04a82774c921fe235568264777dd0fd5adc335f05a6e2f6702ba4ecb47c147
SHA512518a39b05374faac7c60a5238abc8614749a19f1071f0121dba3c0b65112a7659f19f9c7cdf290bf4043d37be04da3c991f99d38d5624943fac6d48bfe7e7f8e
-
Filesize
80KB
MD5820c3b9dd3f84f27dea0771be37a8e7f
SHA119e8d3bd18aee444a8fc2d2c22772edfac07fb02
SHA2562a41bcea6c604f96df130b9328fbdb89a385336ddce4ec593ec0a91b5ccd9c06
SHA512448a0b7869c8b2e24dbb1470e6866413dae84b8afa674bf4ce226675fafbab44da011b808741cb75c18c90a9f9ad84fd7d11d982629bfe02685108cb4aa8cb56
-
Filesize
84KB
MD5688c0e26334304cbcc813aebcf982d07
SHA1af3232b13182c3f32a474388c28b34b5b65e5e52
SHA256a8b3fe4b58eb739a3c914d5563dcb4b03b34f2926086ce2bb8bdd9ed8a1a4282
SHA512a9ba68f287151d3b4d98080cb1cfc0a47d936d5e15d28a6af7a6cca9632b6ed522075c19afe2d16e1a6c3b66110c50850ed9450922dce9cddb188103c30ad43c
-
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp
Filesize83KB
MD5718acde2b8c58c5d1d56a6e2c0958454
SHA1ec35b2f9f3bd13f9a4bcdf9e4b5a67a0e871d039
SHA2566e8764d4cb37998f80b25b2c1aa841ca4e75a24c07ba3952b0ee973799f37599
SHA512076be95510902a92be47c5f42376530dc9d87b768b9f901f71b0fa8c79190cb1eabb65bbf609449157753997e390e55e6264bbc734e9e7d1d57f97ddb91e7c14
-
Filesize
65KB
MD5110decc1ef4a6ee1f9b6ff5aa09b11e8
SHA1ec19171b3f8c57eb435160cb5384371fa41beab2
SHA256c98bf4878e95453677d406a2777a31bf21090252ee5835c753025543c6cf7175
SHA512061fd6d735f3caca70f85916ea839a217d9236fc07876852255524dbec85e8802d2de5f3c0307e527344fde852a92a2c9f921b2143a5399e09e74f95b4a0c90a
-
Filesize
64KB
MD5a43b67eacf72d967bb965e553f405a7e
SHA14247dd4afa00fa7692503048235ce1a7bcbb2ef8
SHA2567296cb56a8c221c6376796eebf55e0d9a7be4890ba69681f1a3f92187dfc1ffa
SHA512cfef03f6ac6777cc4dd2889de8f0d07ef5635bb6ea586fc6d4cc51f27b0dfb381cb70084e32c6a33185ca196bf9ab4780e0171d7f51fdd4a12ef34e45b6ec697