Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
08/02/2023, 04:17
230208-ewg98shb88 108/02/2023, 04:10
230208-ervprsge81 702/02/2023, 17:55
230202-whhsaagf32 10Analysis
-
max time kernel
128s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
08/02/2023, 04:10
Static task
static1
Behavioral task
behavioral1
Sample
WinTroyBuilder.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
WinTroyBuilder.exe
Resource
win10v2004-20220812-en
General
-
Target
WinTroyBuilder.exe
-
Size
2.8MB
-
MD5
3d46955ab2275455a983c1c327835366
-
SHA1
c18655daaaa564c2f4f2932f561f885cb1aff36b
-
SHA256
9bf03a8f81f0c51e9f1a9cd6016ecccf7443c1559e4e4b44547b8a13521b152a
-
SHA512
8d28dbc134d78b3ae21bf125a1eab81e6c9ab7d57c5148b3e0ac10dd40b76fe24b6846131f0224fb13d84cb0fe16f8d88cc5c97c5bbea5ec9e00960205c04332
-
SSDEEP
49152:fOPSa4ZImzdAxZmKLEb+T+VY07d7AidLAbbtwSjugkKNJxeWsoDjLX:fraitzdAfBEa0AiLAbbO0ugk8V
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1780 b2e.exe 1100 GoRC.exe 1600 GoLink.exe 992 WinTryo.exe 1488 git.exe 1028 invrun.exe 1356 WinTroy.exe -
Loads dropped DLL 5 IoCs
pid Process 1124 WinTroyBuilder.exe 1124 WinTroyBuilder.exe 1780 b2e.exe 1488 git.exe 1028 invrun.exe -
resource yara_rule behavioral1/files/0x0007000000013a0e-59.dat upx behavioral1/files/0x0007000000013a0e-60.dat upx behavioral1/files/0x0007000000013a0e-62.dat upx behavioral1/memory/1780-69-0x0000000140000000-0x00000001403EB000-memory.dmp upx behavioral1/memory/1780-82-0x0000000140000000-0x00000001403EB000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe WinTroyBuilder.exe File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe WinTroyBuilder.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 1588 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4AA4D3F1-A76F-11ED-9F99-D2F8C2B78FDE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4AA4D3F3-A76F-11ED-9F99-D2F8C2B78FDE}.dat = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" WinTroyBuilder.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff WinTroyBuilder.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg WinTroyBuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" WinTroyBuilder.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 4c003100000000006b55428c100041646d696e00380008000400efbe6b55027d6b55428c2a00000031000000000003000000000000000000000000000000410064006d0069006e00000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg WinTroyBuilder.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6" WinTroyBuilder.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" WinTroyBuilder.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7a003100000000004856822911004465736b746f7000640008000400efbe6b55027d485682292a000000ea0100000000020000000000000000003a00000000004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "4" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257" WinTroyBuilder.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "3" WinTroyBuilder.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" WinTroyBuilder.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 WinTroyBuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" WinTroyBuilder.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" WinTroyBuilder.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_Classes\Local Settings explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 WinTroyBuilder.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 WinTroyBuilder.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" WinTroyBuilder.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell WinTroyBuilder.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" WinTroyBuilder.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 74003100000000006b55027d1100557365727300600008000400efbeee3a851a6b55027d2a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders WinTroyBuilder.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 WinTroyBuilder.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000 WinTroyBuilder.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 WinTroyBuilder.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 WinTroyBuilder.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" WinTroyBuilder.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 WinTroyBuilder.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff WinTroyBuilder.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags WinTroyBuilder.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} WinTroyBuilder.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16" WinTroyBuilder.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 WinTroyBuilder.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 git.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde git.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
pid Process 1488 git.exe 1028 invrun.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1124 WinTroyBuilder.exe Token: SeDebugPrivilege 1588 taskkill.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1124 WinTroyBuilder.exe 1616 iexplore.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1124 WinTroyBuilder.exe 1616 iexplore.exe 1616 iexplore.exe 1948 IEXPLORE.EXE 1948 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 1124 wrote to memory of 1780 1124 WinTroyBuilder.exe 31 PID 1124 wrote to memory of 1780 1124 WinTroyBuilder.exe 31 PID 1124 wrote to memory of 1780 1124 WinTroyBuilder.exe 31 PID 1124 wrote to memory of 1312 1124 WinTroyBuilder.exe 32 PID 1124 wrote to memory of 1312 1124 WinTroyBuilder.exe 32 PID 1124 wrote to memory of 1312 1124 WinTroyBuilder.exe 32 PID 1780 wrote to memory of 1100 1780 b2e.exe 35 PID 1780 wrote to memory of 1100 1780 b2e.exe 35 PID 1780 wrote to memory of 1100 1780 b2e.exe 35 PID 1780 wrote to memory of 1100 1780 b2e.exe 35 PID 1780 wrote to memory of 1600 1780 b2e.exe 37 PID 1780 wrote to memory of 1600 1780 b2e.exe 37 PID 1780 wrote to memory of 1600 1780 b2e.exe 37 PID 1780 wrote to memory of 1600 1780 b2e.exe 37 PID 992 wrote to memory of 928 992 WinTryo.exe 40 PID 992 wrote to memory of 928 992 WinTryo.exe 40 PID 992 wrote to memory of 928 992 WinTryo.exe 40 PID 992 wrote to memory of 928 992 WinTryo.exe 40 PID 928 wrote to memory of 1488 928 cmd.exe 42 PID 928 wrote to memory of 1488 928 cmd.exe 42 PID 928 wrote to memory of 1488 928 cmd.exe 42 PID 928 wrote to memory of 1488 928 cmd.exe 42 PID 1488 wrote to memory of 1588 1488 git.exe 44 PID 1488 wrote to memory of 1588 1488 git.exe 44 PID 1488 wrote to memory of 1588 1488 git.exe 44 PID 1488 wrote to memory of 1588 1488 git.exe 44 PID 928 wrote to memory of 1092 928 cmd.exe 47 PID 928 wrote to memory of 1092 928 cmd.exe 47 PID 928 wrote to memory of 1092 928 cmd.exe 47 PID 928 wrote to memory of 1800 928 cmd.exe 48 PID 928 wrote to memory of 1800 928 cmd.exe 48 PID 928 wrote to memory of 1800 928 cmd.exe 48 PID 928 wrote to memory of 1028 928 cmd.exe 49 PID 928 wrote to memory of 1028 928 cmd.exe 49 PID 928 wrote to memory of 1028 928 cmd.exe 49 PID 928 wrote to memory of 1028 928 cmd.exe 49 PID 1356 wrote to memory of 1616 1356 WinTroy.exe 52 PID 1356 wrote to memory of 1616 1356 WinTroy.exe 52 PID 1356 wrote to memory of 1616 1356 WinTroy.exe 52 PID 1616 wrote to memory of 1948 1616 iexplore.exe 54 PID 1616 wrote to memory of 1948 1616 iexplore.exe 54 PID 1616 wrote to memory of 1948 1616 iexplore.exe 54 PID 1616 wrote to memory of 1948 1616 iexplore.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinTroyBuilder.exe"C:\Users\Admin\AppData\Local\Temp\WinTroyBuilder.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\Resources\b2e.exe"C:\Users\Admin\AppData\Local\Temp\Resources\b2e.exe" /bat C:\Users\Admin\AppData\Local\Temp\Resources\inst.bat /exe C:\Users\Admin\Desktop\WinTryo.exe /overwrite /invisible /icon "" /fileversion 1.0.0.0 /description "Made with WinTroyBuilder v1.3" /originalfilename "FreeVBucks.html" /copyright "Copyright © 2023" /productname "WinTroy" /productversion 1.0.0.0 /include "C:\Users\Admin\AppData\Local\Temp\Resources\\git"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Roaming\Bat To Exe Converter\GoRC.exe"C:\Users\Admin\AppData\Roaming\Bat To Exe Converter\GoRC.exe" /r resource.rc3⤵
- Executes dropped EXE
PID:1100
-
-
C:\Users\Admin\AppData\Roaming\Bat To Exe Converter\GoLink.exe"C:\Users\Admin\AppData\Roaming\Bat To Exe Converter\GoLink.exe" resource.res3⤵
- Executes dropped EXE
PID:1600
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\Desktop2⤵PID:1312
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1048
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1648
-
C:\Users\Admin\Desktop\WinTryo.exe"C:\Users\Admin\Desktop\WinTryo.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D569.tmp\D56A.tmp\D56B.bat C:\Users\Admin\Desktop\WinTryo.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\Desktop\git\git.exegit.exe C:\Users\Admin\AppData\Roaming/WINT\3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im git.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
-
C:\Windows\system32\reg.exereg.exe ADD HKEY_CURRENT_USER\SOFTWARE\Wint /v inst /t REG_SZ /d C:\Users\Admin\Desktop\WinTryo.exe /f3⤵PID:1092
-
-
C:\Windows\system32\reg.exereg.exe ADD HKEY_CURRENT_USER\SOFTWARE\Wint /v dcbt /t REG_SZ /d wUF+EPAgre4= /f3⤵PID:1800
-
-
C:\Users\Admin\AppData\Roaming\WINT\invrun.exeC:\Users\Admin\AppData\Roaming/WINT\invrun.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1028 -
C:\Users\Admin\AppData\Roaming\WINT\WinTroy.exe"C:\Users\Admin\AppData\Roaming\WINT\WinTroy.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.8&processName=WinTroy.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.05⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1948
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51af34cb75d0d5b5d4e74451848ae1970
SHA18850e575e39e5906560f941e2c0114ab495e5777
SHA2566c9e9ebd0dd809c4dfd4fc79609d3f33f94380496a2bebd9d82cce63323a48c8
SHA5120f4562e23e59c044f9913dff023fdf6ae3d8d54b2b5187c1524f5a7ea59196ecadb670e04942c427bd91c4b174a70e660b664960c690e5d0aec974d9e646871c
-
Filesize
1KB
MD5aba402635f108196a7799b8b803b4f70
SHA132be7c62a6aea256629408a6c975f4ff004e1d96
SHA2565e35634e1f5610087b46d291db42e7ca391d07203e7f154a13d12abedc94fad7
SHA5124bd60dd17bd558e58e4893f8b3f7a50b94c117ef65afc3d850fffdf3dd58425251031ab31ac0c2f397e719618b947a46bc65de7fd15e1c8be071a727d5f33bc2
-
Filesize
676B
MD5f23b20b1d7ae577e2ca9915da2617362
SHA11a4acd32ffb7e1c19e2e49b39846013702f7babb
SHA256d88d18bafa364b10963ec58c57e2881d3993a1a53f2cb47016d4f46c9146bfd8
SHA51236a960715ef9550cab8744cd5f4f48707abcea1ff42bdb6ffd4eeef05148794e46cb63b2f968b61ad7cb9af93f40d4def88da0cc532623fa44fe109bf7973090
-
Filesize
332B
MD5d210300d1a9cafb44e30bc87468c4d5f
SHA17f837d9027a3a21afed2949e2d1271612162f244
SHA25698464a41bdddc06dba9bb9586b4bf080290e51ebed84eb5ac2c51b3f6eca706f
SHA5121d0aa41b79ab5ab8b7dd67c9c9a75897cde8d922a80e389ec86931439626a7db9cbd8cf9105d160109d5089e2406c7c479e84d3fe9cee5bd0fa34dcc5c14663a
-
Filesize
2.0MB
MD5e3d6b93e861feefa47cceeae03e99094
SHA194ac369ea396c6a4c23ddcfb41cfdfe81ce0b3da
SHA25655df60e09826469e543c090198ac6a12e1269047a88ed698e25e6e62d83ff4c7
SHA5122c00287925dcb22b4babd7c49e9035ccb92b895f123791ef361ff495b08d74fe1e9add54c1fcabd4de3cd396faafeccbae0c750913d911dba6531f51ab126402
-
Filesize
268KB
MD5f47adb7404aa61efe87cd1fd3a003161
SHA156a605b594a5e480afd3fa06f57b5e31e612ad17
SHA256ea3282590067b5b803e5658a54234fb8597471a675e7d86a2fd0d099774f81a0
SHA5129af1827103b334b82c11a6f50c34cf84bc29955572499b6ffe7ff7ea1cd99c4f0aa55ac742d91040d1eac06c06fd4c8f941cce35bb6d5ecaacb9670c8d0df83a
-
Filesize
918KB
MD51e96035a0fdd3783414000b12a0c4515
SHA1368bda48b76c08f26a3d7c3521b3a9e8ebb17ed2
SHA2561237de47ec7149ebc8f7e9edc4589a8940a29f39d23f1337b9ed87a96677d6ab
SHA512884040892e89b2d874ffa436fefd6d6a4f998ca4f3044720b638703319b97533329e25fe222d5eb2e757ec12fd574d9d7b5018d54678c403f5fb46bf47283c30
-
Filesize
321B
MD5c0db1da7bfd074462f57611714c91ffb
SHA138dd66e17eb054da69b82207b9a4630761b7b1cf
SHA2566c28b511d5cbed46ffbf9c0868a2827f332456da367d99664f3c9c20429b45ce
SHA512bd30893911f684ea9375b41b287b55090f4cdde5548c027513f9f5feb0bd9e114083a02c0fcffe6a66a670ded5f7aa140a82a58a1dc3fbd1ff6d6593b9d1692d
-
Filesize
46KB
MD5cafc4eec8a4f05b8dfee4067fb5b9076
SHA138f4c66246636e187fe4bf2aa8cb1d9b2502a14c
SHA2561fa554d18490cb5e56d624cd97069f42e63800688136c6cf3c521e4ef6e83e28
SHA5123c3e7c874e6b182aef812a1b593c3b1a3ea6efd5ae99792b88009cb6e6e0cee13c46fc26a1dbb7d73899a2ed01f73779c06d85246fd23edc6bf04fe41e0e133b
-
Filesize
53KB
MD5f69b0e5f35b5dae1b11b950cff157fb3
SHA1f582f77d036c362f1ec5a0ab11707143cb0c9220
SHA256ed010c50a7ceb43b9666e7fbca13d8377d30b79203207bad77004a890adeea17
SHA512f0ac0b51a80d20148d069a231d50a581e6580ea45adc2d15c15182c9551363e204e119daac544c37ac6d9e93b75ab73e90e9947e7bf3cf86707a5c5645e2750c
-
Filesize
409KB
MD5f4d31e85d3f360dbe53c3ab8f8eecf7b
SHA1a9ee07a7cbbb7247b85e8abbf68afa854b603558
SHA25628983cc240a6ef392358b52aea7447cb1ee74966cc77a9248cbfd94c7c08ad70
SHA512c219e345446a3e575ee07700ae07fc33c597a1c0af186d79d9383c0915d35d3f2c38c27f17cf2cd815225816f08f1df8a7bc32d42d66d3fa7eb8be77a5fa111c
-
Filesize
1KB
MD59666cb460cdd044561b698c4ffaf7b4e
SHA1f76bdbb3bf4badede4030ccd57fdc054cf4d2757
SHA2568ce2d6a2f5857064267f11c82f9ef87ed6ae84d11968291ed209fdf880328089
SHA51245a278118830c6652a0fcaa695a52b344c132faeaff5d3515e689abba9cf69477c1b3ad5134471886b54f7758f855ab02b7dcbf23e1bbeb02f13ac18cd67db79
-
Filesize
9KB
MD5a28632fcacd4181d170f7eb27a4ae38b
SHA1b66de23dffa88a3d7263a179ee554f6ccaafb928
SHA2562be6375194f84adeec9668366e6a21271336527d1f8ac053947b880a4a9f5659
SHA51232597891d585492fc7bdc9582cb128affd98de20cabb1dc3832e336dee100a5d2a11c5d6681f07a11fe9cbda0b6f47040df4970b25c02355d6ef83b2fb2e2612
-
Filesize
9KB
MD5a28632fcacd4181d170f7eb27a4ae38b
SHA1b66de23dffa88a3d7263a179ee554f6ccaafb928
SHA2562be6375194f84adeec9668366e6a21271336527d1f8ac053947b880a4a9f5659
SHA51232597891d585492fc7bdc9582cb128affd98de20cabb1dc3832e336dee100a5d2a11c5d6681f07a11fe9cbda0b6f47040df4970b25c02355d6ef83b2fb2e2612
-
Filesize
828KB
MD5e33bf1034ad3edaf08d6732f449be96a
SHA109116e29da02fd0dc20773f91a2979291e3fe6dc
SHA25669c515c134dc7de1ebf3c1e9f278a84f929a126854adec8d7cd50f8445bb3996
SHA512cfd7b1047f1f4a0dc77102b01332f74ec58a7987468b91a46a2db153f29bcf64f7391a25972716271abf006922b2d14e6e7f7ebacdabed7adf7125b9941b3662
-
Filesize
268KB
MD5f47adb7404aa61efe87cd1fd3a003161
SHA156a605b594a5e480afd3fa06f57b5e31e612ad17
SHA256ea3282590067b5b803e5658a54234fb8597471a675e7d86a2fd0d099774f81a0
SHA5129af1827103b334b82c11a6f50c34cf84bc29955572499b6ffe7ff7ea1cd99c4f0aa55ac742d91040d1eac06c06fd4c8f941cce35bb6d5ecaacb9670c8d0df83a
-
Filesize
268KB
MD5f47adb7404aa61efe87cd1fd3a003161
SHA156a605b594a5e480afd3fa06f57b5e31e612ad17
SHA256ea3282590067b5b803e5658a54234fb8597471a675e7d86a2fd0d099774f81a0
SHA5129af1827103b334b82c11a6f50c34cf84bc29955572499b6ffe7ff7ea1cd99c4f0aa55ac742d91040d1eac06c06fd4c8f941cce35bb6d5ecaacb9670c8d0df83a
-
Filesize
918KB
MD51e96035a0fdd3783414000b12a0c4515
SHA1368bda48b76c08f26a3d7c3521b3a9e8ebb17ed2
SHA2561237de47ec7149ebc8f7e9edc4589a8940a29f39d23f1337b9ed87a96677d6ab
SHA512884040892e89b2d874ffa436fefd6d6a4f998ca4f3044720b638703319b97533329e25fe222d5eb2e757ec12fd574d9d7b5018d54678c403f5fb46bf47283c30
-
Filesize
1KB
MD5aba402635f108196a7799b8b803b4f70
SHA132be7c62a6aea256629408a6c975f4ff004e1d96
SHA2565e35634e1f5610087b46d291db42e7ca391d07203e7f154a13d12abedc94fad7
SHA5124bd60dd17bd558e58e4893f8b3f7a50b94c117ef65afc3d850fffdf3dd58425251031ab31ac0c2f397e719618b947a46bc65de7fd15e1c8be071a727d5f33bc2
-
Filesize
2.0MB
MD5e3d6b93e861feefa47cceeae03e99094
SHA194ac369ea396c6a4c23ddcfb41cfdfe81ce0b3da
SHA25655df60e09826469e543c090198ac6a12e1269047a88ed698e25e6e62d83ff4c7
SHA5122c00287925dcb22b4babd7c49e9035ccb92b895f123791ef361ff495b08d74fe1e9add54c1fcabd4de3cd396faafeccbae0c750913d911dba6531f51ab126402
-
Filesize
2.0MB
MD5e3d6b93e861feefa47cceeae03e99094
SHA194ac369ea396c6a4c23ddcfb41cfdfe81ce0b3da
SHA25655df60e09826469e543c090198ac6a12e1269047a88ed698e25e6e62d83ff4c7
SHA5122c00287925dcb22b4babd7c49e9035ccb92b895f123791ef361ff495b08d74fe1e9add54c1fcabd4de3cd396faafeccbae0c750913d911dba6531f51ab126402
-
Filesize
409KB
MD5f4d31e85d3f360dbe53c3ab8f8eecf7b
SHA1a9ee07a7cbbb7247b85e8abbf68afa854b603558
SHA25628983cc240a6ef392358b52aea7447cb1ee74966cc77a9248cbfd94c7c08ad70
SHA512c219e345446a3e575ee07700ae07fc33c597a1c0af186d79d9383c0915d35d3f2c38c27f17cf2cd815225816f08f1df8a7bc32d42d66d3fa7eb8be77a5fa111c
-
Filesize
918KB
MD51e96035a0fdd3783414000b12a0c4515
SHA1368bda48b76c08f26a3d7c3521b3a9e8ebb17ed2
SHA2561237de47ec7149ebc8f7e9edc4589a8940a29f39d23f1337b9ed87a96677d6ab
SHA512884040892e89b2d874ffa436fefd6d6a4f998ca4f3044720b638703319b97533329e25fe222d5eb2e757ec12fd574d9d7b5018d54678c403f5fb46bf47283c30