Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
02-03-2021 16:10
Static task
static1
Behavioral task
behavioral1
Sample
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe
Resource
win10v20201028
General
-
Target
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe
-
Size
69KB
-
MD5
32656e45fea54cdec24e8c9206135c3a
-
SHA1
a45fef2a50c4eeeb97dd657e3679edf59276974e
-
SHA256
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3
-
SHA512
60aef31deebeabdf422983b355799e70b808fafa2e0a4af0528e2277100c55cceb55b6f07874a1519610e3ac5d1cec2dbd68f1012460768396dbdeaa5f2f6073
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nwxaalttbdp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe" 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exedescription ioc process File opened (read-only) \??\G: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\I: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\J: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\K: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\P: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\W: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\A: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\B: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\S: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\T: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\U: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\V: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\X: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\Y: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\L: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\O: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\Q: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\R: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\Z: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\E: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\M: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\N: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\F: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe File opened (read-only) \??\H: 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exepid process 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exedescription pid process target process PID 64 wrote to memory of 2388 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2388 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2388 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 1096 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 1096 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 1096 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3520 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3520 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3520 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2136 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2136 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2136 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3880 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3880 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3880 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2288 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2288 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2288 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 844 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 844 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 844 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2292 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2292 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2292 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2852 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2852 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2852 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 1688 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 1688 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 1688 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3296 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3296 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3296 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3876 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3876 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3876 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 1784 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 1784 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 1784 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 1768 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 1768 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 1768 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2176 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2176 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2176 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2076 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2076 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2076 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2832 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2832 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2832 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3488 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3488 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3488 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 1008 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 1008 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 1008 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 692 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 692 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 692 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3928 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3928 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 3928 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe PID 64 wrote to memory of 2296 64 9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe"C:\Users\Admin\AppData\Local\Temp\9b908b006d12e553d636e69e54ee1bbdf630199c02c56c2be8edddc5a66e69a3.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/204-33-0x0000000000000000-mapping.dmp
-
memory/488-28-0x0000000000000000-mapping.dmp
-
memory/584-38-0x0000000000000000-mapping.dmp
-
memory/588-63-0x0000000000000000-mapping.dmp
-
memory/616-65-0x0000000000000000-mapping.dmp
-
memory/636-58-0x0000000000000000-mapping.dmp
-
memory/640-37-0x0000000000000000-mapping.dmp
-
memory/692-21-0x0000000000000000-mapping.dmp
-
memory/792-30-0x0000000000000000-mapping.dmp
-
memory/808-39-0x0000000000000000-mapping.dmp
-
memory/812-56-0x0000000000000000-mapping.dmp
-
memory/844-8-0x0000000000000000-mapping.dmp
-
memory/932-46-0x0000000000000000-mapping.dmp
-
memory/992-44-0x0000000000000000-mapping.dmp
-
memory/1008-20-0x0000000000000000-mapping.dmp
-
memory/1096-3-0x0000000000000000-mapping.dmp
-
memory/1176-27-0x0000000000000000-mapping.dmp
-
memory/1204-51-0x0000000000000000-mapping.dmp
-
memory/1520-60-0x0000000000000000-mapping.dmp
-
memory/1548-40-0x0000000000000000-mapping.dmp
-
memory/1600-29-0x0000000000000000-mapping.dmp
-
memory/1688-11-0x0000000000000000-mapping.dmp
-
memory/1768-15-0x0000000000000000-mapping.dmp
-
memory/1776-55-0x0000000000000000-mapping.dmp
-
memory/1784-14-0x0000000000000000-mapping.dmp
-
memory/1792-57-0x0000000000000000-mapping.dmp
-
memory/2076-17-0x0000000000000000-mapping.dmp
-
memory/2128-52-0x0000000000000000-mapping.dmp
-
memory/2136-5-0x0000000000000000-mapping.dmp
-
memory/2176-16-0x0000000000000000-mapping.dmp
-
memory/2192-34-0x0000000000000000-mapping.dmp
-
memory/2288-7-0x0000000000000000-mapping.dmp
-
memory/2292-9-0x0000000000000000-mapping.dmp
-
memory/2296-23-0x0000000000000000-mapping.dmp
-
memory/2372-32-0x0000000000000000-mapping.dmp
-
memory/2388-2-0x0000000000000000-mapping.dmp
-
memory/2596-24-0x0000000000000000-mapping.dmp
-
memory/2604-64-0x0000000000000000-mapping.dmp
-
memory/2612-50-0x0000000000000000-mapping.dmp
-
memory/2816-36-0x0000000000000000-mapping.dmp
-
memory/2832-18-0x0000000000000000-mapping.dmp
-
memory/2852-10-0x0000000000000000-mapping.dmp
-
memory/2980-49-0x0000000000000000-mapping.dmp
-
memory/3180-35-0x0000000000000000-mapping.dmp
-
memory/3200-43-0x0000000000000000-mapping.dmp
-
memory/3244-26-0x0000000000000000-mapping.dmp
-
memory/3296-12-0x0000000000000000-mapping.dmp
-
memory/3480-41-0x0000000000000000-mapping.dmp
-
memory/3488-19-0x0000000000000000-mapping.dmp
-
memory/3508-25-0x0000000000000000-mapping.dmp
-
memory/3520-4-0x0000000000000000-mapping.dmp
-
memory/3616-61-0x0000000000000000-mapping.dmp
-
memory/3712-45-0x0000000000000000-mapping.dmp
-
memory/3732-42-0x0000000000000000-mapping.dmp
-
memory/3792-62-0x0000000000000000-mapping.dmp
-
memory/3868-48-0x0000000000000000-mapping.dmp
-
memory/3872-47-0x0000000000000000-mapping.dmp
-
memory/3876-13-0x0000000000000000-mapping.dmp
-
memory/3880-6-0x0000000000000000-mapping.dmp
-
memory/3896-54-0x0000000000000000-mapping.dmp
-
memory/3928-22-0x0000000000000000-mapping.dmp
-
memory/3956-53-0x0000000000000000-mapping.dmp
-
memory/4028-31-0x0000000000000000-mapping.dmp
-
memory/4056-59-0x0000000000000000-mapping.dmp