Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
02-03-2021 16:10
Static task
static1
Behavioral task
behavioral1
Sample
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe
Resource
win10v20201028
General
-
Target
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe
-
Size
69KB
-
MD5
32656e45fea54cdec24e8c9206135c3a
-
SHA1
a45fef2a50c4eeeb97dd657e3679edf59276974e
-
SHA256
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3
-
SHA512
60aef31deebeabdf422983b355799e70b808fafa2e0a4af0528e2277100c55cceb55b6f07874a1519610e3ac5d1cec2dbd68f1012460768396dbdeaa5f2f6073
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\whodltomqog = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe" 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exedescription ioc process File opened (read-only) \??\M: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\P: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\Q: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\R: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\S: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\T: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\E: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\L: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\V: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\X: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\J: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\U: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\A: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\G: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\W: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\H: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\K: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\I: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\N: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\O: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\Y: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\Z: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\B: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\F: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exepid process 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exedescription pid process target process PID 384 wrote to memory of 756 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 756 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 756 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 756 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 888 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 888 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 888 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 888 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1496 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1496 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1496 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1496 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1536 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1536 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1536 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1536 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 808 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 808 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 808 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 808 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 916 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 916 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 916 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 916 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1304 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1304 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1304 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1304 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1684 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1684 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1684 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1684 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1620 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1620 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1620 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1620 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1984 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1984 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1984 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1984 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1248 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1248 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1248 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1248 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1744 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1744 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1744 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1744 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1560 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1560 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1560 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1560 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 760 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 760 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 760 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 760 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 836 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 836 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 836 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 836 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1128 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1128 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1128 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 384 wrote to memory of 1128 384 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe"C:\Users\Admin\AppData\Local\Temp\9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/288-38-0x0000000000000000-mapping.dmp
-
memory/300-32-0x0000000000000000-mapping.dmp
-
memory/316-29-0x0000000000000000-mapping.dmp
-
memory/384-2-0x0000000076241000-0x0000000076243000-memory.dmpFilesize
8KB
-
memory/432-54-0x0000000000000000-mapping.dmp
-
memory/512-64-0x0000000000000000-mapping.dmp
-
memory/520-24-0x0000000000000000-mapping.dmp
-
memory/608-47-0x0000000000000000-mapping.dmp
-
memory/632-26-0x0000000000000000-mapping.dmp
-
memory/728-35-0x0000000000000000-mapping.dmp
-
memory/736-27-0x0000000000000000-mapping.dmp
-
memory/756-4-0x0000000000000000-mapping.dmp
-
memory/760-17-0x0000000000000000-mapping.dmp
-
memory/784-36-0x0000000000000000-mapping.dmp
-
memory/788-25-0x0000000000000000-mapping.dmp
-
memory/808-8-0x0000000000000000-mapping.dmp
-
memory/836-18-0x0000000000000000-mapping.dmp
-
memory/864-66-0x0000000000000000-mapping.dmp
-
memory/888-5-0x0000000000000000-mapping.dmp
-
memory/892-61-0x0000000000000000-mapping.dmp
-
memory/908-56-0x0000000000000000-mapping.dmp
-
memory/916-9-0x0000000000000000-mapping.dmp
-
memory/1044-63-0x0000000000000000-mapping.dmp
-
memory/1084-40-0x0000000000000000-mapping.dmp
-
memory/1116-31-0x0000000000000000-mapping.dmp
-
memory/1128-19-0x0000000000000000-mapping.dmp
-
memory/1192-30-0x0000000000000000-mapping.dmp
-
memory/1228-37-0x0000000000000000-mapping.dmp
-
memory/1248-14-0x0000000000000000-mapping.dmp
-
memory/1256-67-0x0000000000000000-mapping.dmp
-
memory/1288-48-0x0000000000000000-mapping.dmp
-
memory/1304-10-0x0000000000000000-mapping.dmp
-
memory/1376-52-0x0000000000000000-mapping.dmp
-
memory/1396-33-0x0000000000000000-mapping.dmp
-
memory/1468-41-0x0000000000000000-mapping.dmp
-
memory/1484-50-0x0000000000000000-mapping.dmp
-
memory/1488-46-0x0000000000000000-mapping.dmp
-
memory/1496-6-0x0000000000000000-mapping.dmp
-
memory/1516-28-0x0000000000000000-mapping.dmp
-
memory/1524-3-0x000007FEF7300000-0x000007FEF757A000-memory.dmpFilesize
2.5MB
-
memory/1532-55-0x0000000000000000-mapping.dmp
-
memory/1536-7-0x0000000000000000-mapping.dmp
-
memory/1544-22-0x0000000000000000-mapping.dmp
-
memory/1556-60-0x0000000000000000-mapping.dmp
-
memory/1560-16-0x0000000000000000-mapping.dmp
-
memory/1568-39-0x0000000000000000-mapping.dmp
-
memory/1576-45-0x0000000000000000-mapping.dmp
-
memory/1596-44-0x0000000000000000-mapping.dmp
-
memory/1600-53-0x0000000000000000-mapping.dmp
-
memory/1604-23-0x0000000000000000-mapping.dmp
-
memory/1620-12-0x0000000000000000-mapping.dmp
-
memory/1624-49-0x0000000000000000-mapping.dmp
-
memory/1636-20-0x0000000000000000-mapping.dmp
-
memory/1684-11-0x0000000000000000-mapping.dmp
-
memory/1700-42-0x0000000000000000-mapping.dmp
-
memory/1744-15-0x0000000000000000-mapping.dmp
-
memory/1812-65-0x0000000000000000-mapping.dmp
-
memory/1824-51-0x0000000000000000-mapping.dmp
-
memory/1852-62-0x0000000000000000-mapping.dmp
-
memory/1864-34-0x0000000000000000-mapping.dmp
-
memory/1868-43-0x0000000000000000-mapping.dmp
-
memory/1900-59-0x0000000000000000-mapping.dmp
-
memory/1940-58-0x0000000000000000-mapping.dmp
-
memory/1984-13-0x0000000000000000-mapping.dmp
-
memory/1996-21-0x0000000000000000-mapping.dmp
-
memory/2016-57-0x0000000000000000-mapping.dmp