Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2022, 21:32
Behavioral task
behavioral1
Sample
af4067531a9b76905a2961548729b46f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
af4067531a9b76905a2961548729b46f.exe
Resource
win10v2004-20220901-en
General
-
Target
af4067531a9b76905a2961548729b46f.exe
-
Size
69KB
-
MD5
af4067531a9b76905a2961548729b46f
-
SHA1
f4e0a6f82d1508512b2714668cd729025cebce5a
-
SHA256
aa6fdea0adf914c28d318110ce5eb7cf3a0660a6fdbcdb78af2e34be669109e0
-
SHA512
fa559087fa627bfe8a7cc3a36ed9d50095dd9d2a6060616f62c8323baf1a43e9c0a1490605da34642c56da21a0749a8c99773aa8b9ef8adfd110decb0bd2e7cb
-
SSDEEP
1536:CZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAwfMqqU+2bbbAV2/S2Lkvd9:kBounVyFHpfMqqDL2/Lkvd
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce af4067531a9b76905a2961548729b46f.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wnbzeizcvki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\af4067531a9b76905a2961548729b46f.exe" af4067531a9b76905a2961548729b46f.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\T: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\X: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\A: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\G: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\H: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\O: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\W: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\Y: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\B: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\E: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\I: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\J: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\R: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\U: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\V: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\F: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\K: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\M: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\P: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\L: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\N: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\S: af4067531a9b76905a2961548729b46f.exe File opened (read-only) \??\Z: af4067531a9b76905a2961548729b46f.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 af4067531a9b76905a2961548729b46f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString af4067531a9b76905a2961548729b46f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier af4067531a9b76905a2961548729b46f.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2024 af4067531a9b76905a2961548729b46f.exe 2024 af4067531a9b76905a2961548729b46f.exe 2024 af4067531a9b76905a2961548729b46f.exe 2024 af4067531a9b76905a2961548729b46f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2972 2024 af4067531a9b76905a2961548729b46f.exe 85 PID 2024 wrote to memory of 2972 2024 af4067531a9b76905a2961548729b46f.exe 85 PID 2024 wrote to memory of 2972 2024 af4067531a9b76905a2961548729b46f.exe 85 PID 2024 wrote to memory of 3484 2024 af4067531a9b76905a2961548729b46f.exe 87 PID 2024 wrote to memory of 3484 2024 af4067531a9b76905a2961548729b46f.exe 87 PID 2024 wrote to memory of 3484 2024 af4067531a9b76905a2961548729b46f.exe 87 PID 2024 wrote to memory of 236 2024 af4067531a9b76905a2961548729b46f.exe 89 PID 2024 wrote to memory of 236 2024 af4067531a9b76905a2961548729b46f.exe 89 PID 2024 wrote to memory of 236 2024 af4067531a9b76905a2961548729b46f.exe 89 PID 2024 wrote to memory of 4872 2024 af4067531a9b76905a2961548729b46f.exe 91 PID 2024 wrote to memory of 4872 2024 af4067531a9b76905a2961548729b46f.exe 91 PID 2024 wrote to memory of 4872 2024 af4067531a9b76905a2961548729b46f.exe 91 PID 2024 wrote to memory of 552 2024 af4067531a9b76905a2961548729b46f.exe 93 PID 2024 wrote to memory of 552 2024 af4067531a9b76905a2961548729b46f.exe 93 PID 2024 wrote to memory of 552 2024 af4067531a9b76905a2961548729b46f.exe 93 PID 2024 wrote to memory of 1504 2024 af4067531a9b76905a2961548729b46f.exe 95 PID 2024 wrote to memory of 1504 2024 af4067531a9b76905a2961548729b46f.exe 95 PID 2024 wrote to memory of 1504 2024 af4067531a9b76905a2961548729b46f.exe 95 PID 2024 wrote to memory of 3852 2024 af4067531a9b76905a2961548729b46f.exe 97 PID 2024 wrote to memory of 3852 2024 af4067531a9b76905a2961548729b46f.exe 97 PID 2024 wrote to memory of 3852 2024 af4067531a9b76905a2961548729b46f.exe 97 PID 2024 wrote to memory of 4732 2024 af4067531a9b76905a2961548729b46f.exe 99 PID 2024 wrote to memory of 4732 2024 af4067531a9b76905a2961548729b46f.exe 99 PID 2024 wrote to memory of 4732 2024 af4067531a9b76905a2961548729b46f.exe 99 PID 2024 wrote to memory of 5088 2024 af4067531a9b76905a2961548729b46f.exe 101 PID 2024 wrote to memory of 5088 2024 af4067531a9b76905a2961548729b46f.exe 101 PID 2024 wrote to memory of 5088 2024 af4067531a9b76905a2961548729b46f.exe 101 PID 2024 wrote to memory of 4588 2024 af4067531a9b76905a2961548729b46f.exe 103 PID 2024 wrote to memory of 4588 2024 af4067531a9b76905a2961548729b46f.exe 103 PID 2024 wrote to memory of 4588 2024 af4067531a9b76905a2961548729b46f.exe 103 PID 2024 wrote to memory of 5028 2024 af4067531a9b76905a2961548729b46f.exe 105 PID 2024 wrote to memory of 5028 2024 af4067531a9b76905a2961548729b46f.exe 105 PID 2024 wrote to memory of 5028 2024 af4067531a9b76905a2961548729b46f.exe 105 PID 2024 wrote to memory of 4728 2024 af4067531a9b76905a2961548729b46f.exe 107 PID 2024 wrote to memory of 4728 2024 af4067531a9b76905a2961548729b46f.exe 107 PID 2024 wrote to memory of 4728 2024 af4067531a9b76905a2961548729b46f.exe 107 PID 2024 wrote to memory of 4876 2024 af4067531a9b76905a2961548729b46f.exe 109 PID 2024 wrote to memory of 4876 2024 af4067531a9b76905a2961548729b46f.exe 109 PID 2024 wrote to memory of 4876 2024 af4067531a9b76905a2961548729b46f.exe 109 PID 2024 wrote to memory of 3844 2024 af4067531a9b76905a2961548729b46f.exe 111 PID 2024 wrote to memory of 3844 2024 af4067531a9b76905a2961548729b46f.exe 111 PID 2024 wrote to memory of 3844 2024 af4067531a9b76905a2961548729b46f.exe 111 PID 2024 wrote to memory of 532 2024 af4067531a9b76905a2961548729b46f.exe 113 PID 2024 wrote to memory of 532 2024 af4067531a9b76905a2961548729b46f.exe 113 PID 2024 wrote to memory of 532 2024 af4067531a9b76905a2961548729b46f.exe 113 PID 2024 wrote to memory of 60 2024 af4067531a9b76905a2961548729b46f.exe 115 PID 2024 wrote to memory of 60 2024 af4067531a9b76905a2961548729b46f.exe 115 PID 2024 wrote to memory of 60 2024 af4067531a9b76905a2961548729b46f.exe 115 PID 2024 wrote to memory of 4368 2024 af4067531a9b76905a2961548729b46f.exe 118 PID 2024 wrote to memory of 4368 2024 af4067531a9b76905a2961548729b46f.exe 118 PID 2024 wrote to memory of 4368 2024 af4067531a9b76905a2961548729b46f.exe 118 PID 2024 wrote to memory of 2816 2024 af4067531a9b76905a2961548729b46f.exe 121 PID 2024 wrote to memory of 2816 2024 af4067531a9b76905a2961548729b46f.exe 121 PID 2024 wrote to memory of 2816 2024 af4067531a9b76905a2961548729b46f.exe 121 PID 2024 wrote to memory of 4644 2024 af4067531a9b76905a2961548729b46f.exe 123 PID 2024 wrote to memory of 4644 2024 af4067531a9b76905a2961548729b46f.exe 123 PID 2024 wrote to memory of 4644 2024 af4067531a9b76905a2961548729b46f.exe 123 PID 2024 wrote to memory of 1676 2024 af4067531a9b76905a2961548729b46f.exe 125 PID 2024 wrote to memory of 1676 2024 af4067531a9b76905a2961548729b46f.exe 125 PID 2024 wrote to memory of 1676 2024 af4067531a9b76905a2961548729b46f.exe 125 PID 2024 wrote to memory of 3932 2024 af4067531a9b76905a2961548729b46f.exe 128 PID 2024 wrote to memory of 3932 2024 af4067531a9b76905a2961548729b46f.exe 128 PID 2024 wrote to memory of 3932 2024 af4067531a9b76905a2961548729b46f.exe 128 PID 2024 wrote to memory of 1128 2024 af4067531a9b76905a2961548729b46f.exe 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\af4067531a9b76905a2961548729b46f.exe"C:\Users\Admin\AppData\Local\Temp\af4067531a9b76905a2961548729b46f.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2972
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:3484
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:236
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:4872
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:552
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:1504
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:3852
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:4732
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:5088
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:4588
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:5028
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4728
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:4876
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:3844
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:532
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:60
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:4368
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2816
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:4644
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1676
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:3932
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:1128
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:3048
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:204
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:3980
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:4028
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1372
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2280
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1412
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:3592
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:4200
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:4720
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:5012
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2448
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1112
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:504
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:3384
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:3296
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1036
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:3216
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1176
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4316
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:4020
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1840
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1832
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:3404
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1844
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4388
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:1976
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:4352
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:4196
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:916
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1932
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4000
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2052
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2440
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:5060
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:1080
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:4308
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4648
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:3772
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:3576
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:4548
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:3488
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:868
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:3720
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:5024
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:3124
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:4544
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:5000
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:3492
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2260
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:224
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:276
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:2100
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:3976
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:4680
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:1356
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:1988
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:4740
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1476
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:840
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1880
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:1320
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:416
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2064
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:4888
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:1248
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:844
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:3544
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:892
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1644
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:3916
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:4004
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:4460
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:4976
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:3516
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1580
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:232
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:1868
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:3432
-