cryptolocker | hxxps://github[.]com/madhanmaaz/blackpanther

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/madhanmaaz/blackpanther

Score

10^/10

cryptolocker execution persistence ransomware

Malware Config

Signatures

CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
5876	CryptoLocker.exe
5164	{34184A33-0407-212E-3320-09040709E2C2}.exe
4492	{34184A33-0407-212E-3320-09040709E2C2}.exe
5616	CryptoLocker.exe
2016	CryptoLocker.exe
5560	CryptoLocker.exe
1128	CryptoLocker.exe
4008	CryptoLocker.exe
3128	CryptoLocker.exe
4908	CryptoLocker.exe
5860	CryptoLocker.exe
1148	CryptoLocker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
40	raw.githubusercontent.com
122	raw.githubusercontent.com
36	raw.githubusercontent.com
37	raw.githubusercontent.com
38	raw.githubusercontent.com
39	raw.githubusercontent.com

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2990742725-2267136959-192470804-1000\{0823CD1B-2F71-4A14-BC2E-A64092852E69}	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 623486.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 388900.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe\:SmartScreen:$DATA	CryptoLocker.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2496	msedge.exe
2496	msedge.exe
1728	msedge.exe
1728	msedge.exe
1880	identity_helper.exe
1880	identity_helper.exe
3468	msedge.exe
3468	msedge.exe
3744	msedge.exe
3744	msedge.exe
2016	msedge.exe
2016	msedge.exe
684	msedge.exe
684	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 384	1728	msedge.exe	84
PID 1728 wrote to memory of 384	1728	msedge.exe	84
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 4888	1728	msedge.exe	86
PID 1728 wrote to memory of 2496	1728	msedge.exe	87
PID 1728 wrote to memory of 2496	1728	msedge.exe	87
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88
PID 1728 wrote to memory of 5092	1728	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/madhanmaaz/blackpanther
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e56746f8,0x7ff9e5674708,0x7ff9e5674718
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1828 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:5748
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  PID:5876
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:5164
  - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
      "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w0000021C
      4⤵
      Executes dropped EXE
      PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:684
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  PID:5616
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  PID:5560
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2272,1810451743383680320,311109780123816032,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2500

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5312

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_blackpanther-master.zip\blackpanther-master\server.js"
1⤵
PID:5420

C:\Users\Admin\Downloads\CryptoLocker.exe
"C:\Users\Admin\Downloads\CryptoLocker.exe"
1⤵
- Executes dropped EXE
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2f842025e22e522658c640cfc7edc529

SHA1
4c2b24b02709acdd159f1b9bbeb396e52af27033

SHA256
1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e

SHA512
6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54aadd2d8ec66e446f1edb466b99ba8d

SHA1
a94f02b035dc918d8d9a46e6886413f15be5bff0

SHA256
1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e

SHA512
7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5f4d5cbb-0f4b-40a4-b445-67fc4b5f77db.tmp

Filesize
7KB

MD5
a746c13feeabf292ef54abb5fdec2f58

SHA1
2f6ce378757852f7671548583b1df24233f0877a

SHA256
bc4c240a77c33d63ec7d0066415b692a69dbb7d9f43a584a8163c1d9ad657cec

SHA512
9178ca1bdbf63e82654cf9169b114c2ec752494e05ac2c65c9cc777005dfe60c4175ef36aacb47bcef8be793ecbf36274ff4e249fdc1010e61fd9ecf052dba71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6c931c886f4abbe4a4470c45bb703cb6

SHA1
480330d0f88aad4651fe7563dbb2b1d1a4596ca3

SHA256
7447b99ebd9907980f106f87492862c3bb33cbfcf850c939795d78ba3ea8c721

SHA512
a755672550d804fd9bdb5cb3cb80c5a2498a21ff225c527379ecbbe84995411cb5fbd05e78fcaefd6adc9fc0091be07ffba4e77ea980f1f0521b3df61330ca44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
f178c07b345c4b5badd72d9b9dbe2913

SHA1
8bfd48bc31254b23482febdb42f9c4e88b80dbdc

SHA256
1f6a4e4215d67835ea93add68e0a62b889f97f27111e8a7abca2199a61d00eb1

SHA512
4656e430d83d08e83664e1172f1da23556fe050c82ff46135a07e19c68fe0dbd76453af9540ed6265f895e5edc50ebd1475beca418132f8c9d3fc2ba19158726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
939B

MD5
0e71d11ce2eb702f81f177a30a7e0f1e

SHA1
e5dc51401c2d1f77396e0c3a9de96e24e4a61054

SHA256
2e28773792f6771fcb58887c50e8029469efef2b7ac3a2732b51134da51da209

SHA512
6a48f4e6a0fb0455e55d7e6b6f9eb9454e460b7e8777deb622ce529a0b6f99bbbbca54846eb6f6c38786325e27e72ae26adcf0bc88bca4271372df475a728755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0dc0c8d16fb1f6d45a4c50305bdc3e3c

SHA1
360d328c4aa0c1901a00990ef2a0b7e14d3427ef

SHA256
1e93db257541691172d472f780943928c4ca1c286e47934026770f0c717a9bd2

SHA512
bf31c2501fa0a611a0db7233b2453d9a5db3db2bfb93f801f01ffea2609431e1896a4c7a70ecfe2c12c5e9a9a54ddcd3f837d9b180a58f3536a10660053ed895

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bceb6ffbae981cf49293a904854a2d47

SHA1
a5eb1ad5efd697c30d44a2b32518c353f6fa5b85

SHA256
48e14fbbdd60391099dfca345257a6ccdaea7f93fd9cd3e1a4237276b6dc8a7c

SHA512
01868545e058c08348e4d22df7402f2e51a6503a780e338c50909299c399a2107e31e08cbf7734249a1b35f1fc77d529b47d167a70c99c3502b994fb1c1c6fa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca45806853cad2de4eb3cef18aeb0cd7

SHA1
30f1bc312f336d9db8648bec614b907058ac2151

SHA256
578146d010d367a0eefc164b5bcd5f467765cc767877f08ae244c57532dfb6c0

SHA512
a1cfaa3665ae0087da4c4049d9a7d0d9afa9258f6bf84eff55aa0f450481659c4e8ec80882f8b02cf802a10857342653789ddffd6e9d0d22459a7423d8d4c436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3990b228c4d7b953d0e0e5e6a9608b25

SHA1
fb5d66a51db959a0229850b73273a22e475cadbf

SHA256
bc07b9654a32f12d2da7a4e6ad08646eed491b913c68bd45cb3e88416fe43a35

SHA512
f242d3e86761cbb90446e7695c6e61259489f1f3aad5cee45624cee47c88c1a25ab95fde9b9c9ad728459f353b28b4988e56c81572408aa67f9290b91f6fd9e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
14fc97b9992677bbb47ace6c792ff2e7

SHA1
0912c06b75c1a07ebf48dfdaa206918332a4d279

SHA256
e4b205946818698e7844c853465c63db02f6f9e27b7b178c2dc21aae053b1a0b

SHA512
f7ecf5da1dbd3d7444eb1568e0ba2ce198be89e7cca1f0bb475b96c8a2a536a9ef9123ab58b20adb055514e4d488f4e59c7c9105e49eb078087a3fba464325ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1ae425824a7971245be7e3d8f8e09cda

SHA1
0125e4e72f761ab892f6cd7c2911ececb4a9af14

SHA256
80098c2fb263a3adc57c6fcab1bd03f7fc13db5dd2c66df3b978145f18bf1cba

SHA512
c2dd82bb5f4072d62764230d7de8c3c7fa2bf30078ef4df15492fb82d2579a6130711a31ddb05c5cdc9c9c9a55d8aa4318a519fe3fa959b8dacc910180faaeee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
614ca446567bdb607a0b62f852f1ce65

SHA1
1147177d03b1c6d2f63190a442ce0abb34e949f4

SHA256
75bd5b5925fedd9ab60150c78c8d425fa5d810ae97c28d849a5b63fadd4ed059

SHA512
ad8c4ee60347c0e2aa61063b1bc5706cc0044d9e4f54e853616e172402047569eb30413f1992ebb4c89866c12c8740abccae0432f3d74c808ab3bfb0b661afa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a0e2b9a515762550612b23dd38a1bdd4

SHA1
16879034ee34876467da0b57cc3c67a621eed7c5

SHA256
449e699fc5e8adbe66c9d45b4811115d251e7d3406a7986bb235f8c9d3d38dba

SHA512
65a5bc961b68fcb56af0172960f62dd20c2e245cc8535ece238b53fc1e85e28376098a8df4b83fd8f24a4a15236cba177c8b786987a8f1b56b267ce0c41507ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d1da4fac201aa86fc689909262962f0d

SHA1
e0f3e2d3bf691e62e1d65d8f78c988923a5ab75c

SHA256
a50b0f946cf4615e05ef9c1173b99c4518e69ca7c8a6e6cca987192a5f56fc0d

SHA512
0802ed1b3964854df0048684ca0bdb78ad64ad6f3f548191edcd32a2c037cd63a377b6bb44a2481946bcac286cc6776e874c71561c8c4f0b2a4b86a3bd261953

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
396ff2b94bbaca78c73c7eef954749cf

SHA1
336faff6ef379823bdae1f5fdf62a1267165585e

SHA256
ade6e0316b1fdad27ace5b934dddcdd3e58611f8e810745f087fa27cffff439a

SHA512
607d523a450251b343f734c3b8535a86deb92df8bc6bd8adfda5fa0ee2084c1a138153afb728f64b43c50598fa19be8dceae48794d12506ceda7624c6c796d45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
76f137f687b24d985cce3fe2ee7ef75b

SHA1
190f9b82518e5a21aac2567306fb7b9a1b19160c

SHA256
83852bd400cea7446f0212da39a94ad8c2ea4c7b93c58593b0ba5e15cc4dbf88

SHA512
139a66ae83f4460c08d5bcb62b9ac5ac82febdc2a94468de296b0512f570d1b1c5611a8b0381b62694914d190199dd0dbef991fbe424c037e804cb128a6e6b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585a9e.TMP

Filesize
1KB

MD5
074145fe548981205c093d8e82c443ef

SHA1
e3b952ab8b258fd296d5f35eba6f238323d0dc5e

SHA256
f7977db644c923166cec026769274f1b6b753bfc7a59cb706da2aa25b0b0024c

SHA512
5ce2e8c81ffe215d8f58fe4d2bcf60825ed0889b989aee30854e58ae1fd0f6960126157cdab049c2ff2c1f339f3afc989fe6fef94bf78741b02e18c03f0353a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9db697b700683f2eeb47710c61ff2011

SHA1
e12de64fd8ebca6e30461a493557a285cde53f47

SHA256
4a85b56589528310c810701026601178f0ae9478c89854faedd3f900a3e55e38

SHA512
aee7518b23703789da7fd8ae0daa7ec4625d4a8f7f71d4d1b81127b6917ae09041bf84e094c99ad44394ca9b406df2762d452b9a7a7a6370e2453c44a379f010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
168c340a13368348e894c8e64c593631

SHA1
83ace8eb1ca8a2c9a5f876e8fd323b99ca772af9

SHA256
7bf3a5ec067da47b272af7d12785472e1f7d946c45a77f962df53d668a85fce3

SHA512
51a3f93391aa0302a3669af84082219831f18e676c4ce7d719b23b723e8b9236391a809a71427868a1fab390fe7b2600b89aec44c945cf5f6c393f5bcfe083bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
47b727a57f0014eaa1dd3b96b0512daa

SHA1
d67c1ab7128fccfba0ec6cfe8769887643e7e9ae

SHA256
df0601a0d4bcada6c44c744a820e9327f1b4783722b307ca6e48063b4ec78a9a

SHA512
f8fda0966a4a20a713863df2cf37e7cf652c1782a4250a20bca79d836549a0532985925e0d5c46b2b20fa259c48aa2d853ec1b41d940db9f2935393fbf9a76ea

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 388900.crdownload

Filesize
338KB

MD5
04fb36199787f2e3e2135611a38321eb

SHA1
65559245709fe98052eb284577f1fd61c01ad20d

SHA256
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

SHA512
533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

Download Submit
C:\Users\Admin\Downloads\blackpanther-master.zip

Filesize
857KB

MD5
68ad1c10f4d92d62db6b4655cf285a94

SHA1
def1ca6a5e9dc6115b3af30e75c37bb689432aa1

SHA256
9a50248ed16b95f0946e034f7bbfc7f2b295c53830223abb926a2a9c24f88d0c

SHA512
3b63573fa22cbd7b1821747ab7057aaf4b1c9060dd162000b851a881c935842d1829b68b20e9f25ec28d5319cf532777c2f73031c5a6d9e892b3ce4d488a72f4

Download Submit