Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08/09/2022, 19:39
Static task
static1
Behavioral task
behavioral1
Sample
ff5a1c761c9fef48c031472614a51886.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ff5a1c761c9fef48c031472614a51886.exe
Resource
win10v2004-20220901-en
General
-
Target
ff5a1c761c9fef48c031472614a51886.exe
-
Size
244KB
-
MD5
ff5a1c761c9fef48c031472614a51886
-
SHA1
2d92b56d2c3b5af6b0cadc2092ddcec064a68efc
-
SHA256
b544024ccaf2732cd3aa915b8d8db30ae568758ceabe02bb143bbe506a26fe0c
-
SHA512
5e968e3201586ffb8df317611134a7999750f398c54ed23d5cc2dff109b3eaad97aa88628f936cd83637cf71548adc9f96b3bd382c21cde6ee2607683535a6a7
-
SSDEEP
3072:Ji6ItbhTm5EJBBEDCNVuNwXiNtoU39qzNAjv2bZxglSv1OrSjfXw2ODF:Ji6ItdLjcCLSNmWt2bZQSdOrSjfXw2qF
Malware Config
Signatures
-
GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/1644-56-0x0000000000400000-0x0000000000B4B000-memory.dmp family_gandcrab behavioral1/memory/1644-59-0x0000000000400000-0x0000000000B4B000-memory.dmp family_gandcrab behavioral1/memory/1644-60-0x00000000002C0000-0x00000000002D7000-memory.dmp family_gandcrab behavioral1/memory/1644-67-0x00000000002C0000-0x00000000002D7000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce ff5a1c761c9fef48c031472614a51886.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\uzxtrjzqhfl = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\tduqaq.exe\"" ff5a1c761c9fef48c031472614a51886.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\I: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\W: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\A: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\J: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\K: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\L: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\M: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\N: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\O: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\Q: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\E: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\V: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\Y: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\Z: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\R: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\P: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\T: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\U: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\G: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\H: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\S: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\X: ff5a1c761c9fef48c031472614a51886.exe File opened (read-only) \??\F: ff5a1c761c9fef48c031472614a51886.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win.ini ff5a1c761c9fef48c031472614a51886.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ff5a1c761c9fef48c031472614a51886.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ff5a1c761c9fef48c031472614a51886.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ff5a1c761c9fef48c031472614a51886.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1644 ff5a1c761c9fef48c031472614a51886.exe 1644 ff5a1c761c9fef48c031472614a51886.exe -
Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe Token: SeLoadDriverPrivilege 1644 ff5a1c761c9fef48c031472614a51886.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1644 wrote to memory of 1572 1644 ff5a1c761c9fef48c031472614a51886.exe 28 PID 1644 wrote to memory of 1572 1644 ff5a1c761c9fef48c031472614a51886.exe 28 PID 1644 wrote to memory of 1572 1644 ff5a1c761c9fef48c031472614a51886.exe 28 PID 1644 wrote to memory of 1572 1644 ff5a1c761c9fef48c031472614a51886.exe 28 PID 1644 wrote to memory of 1512 1644 ff5a1c761c9fef48c031472614a51886.exe 30 PID 1644 wrote to memory of 1512 1644 ff5a1c761c9fef48c031472614a51886.exe 30 PID 1644 wrote to memory of 1512 1644 ff5a1c761c9fef48c031472614a51886.exe 30 PID 1644 wrote to memory of 1512 1644 ff5a1c761c9fef48c031472614a51886.exe 30 PID 1644 wrote to memory of 268 1644 ff5a1c761c9fef48c031472614a51886.exe 32 PID 1644 wrote to memory of 268 1644 ff5a1c761c9fef48c031472614a51886.exe 32 PID 1644 wrote to memory of 268 1644 ff5a1c761c9fef48c031472614a51886.exe 32 PID 1644 wrote to memory of 268 1644 ff5a1c761c9fef48c031472614a51886.exe 32 PID 1644 wrote to memory of 1816 1644 ff5a1c761c9fef48c031472614a51886.exe 34 PID 1644 wrote to memory of 1816 1644 ff5a1c761c9fef48c031472614a51886.exe 34 PID 1644 wrote to memory of 1816 1644 ff5a1c761c9fef48c031472614a51886.exe 34 PID 1644 wrote to memory of 1816 1644 ff5a1c761c9fef48c031472614a51886.exe 34 PID 1644 wrote to memory of 876 1644 ff5a1c761c9fef48c031472614a51886.exe 36 PID 1644 wrote to memory of 876 1644 ff5a1c761c9fef48c031472614a51886.exe 36 PID 1644 wrote to memory of 876 1644 ff5a1c761c9fef48c031472614a51886.exe 36 PID 1644 wrote to memory of 876 1644 ff5a1c761c9fef48c031472614a51886.exe 36 PID 1644 wrote to memory of 840 1644 ff5a1c761c9fef48c031472614a51886.exe 38 PID 1644 wrote to memory of 840 1644 ff5a1c761c9fef48c031472614a51886.exe 38 PID 1644 wrote to memory of 840 1644 ff5a1c761c9fef48c031472614a51886.exe 38 PID 1644 wrote to memory of 840 1644 ff5a1c761c9fef48c031472614a51886.exe 38 PID 1644 wrote to memory of 980 1644 ff5a1c761c9fef48c031472614a51886.exe 40 PID 1644 wrote to memory of 980 1644 ff5a1c761c9fef48c031472614a51886.exe 40 PID 1644 wrote to memory of 980 1644 ff5a1c761c9fef48c031472614a51886.exe 40 PID 1644 wrote to memory of 980 1644 ff5a1c761c9fef48c031472614a51886.exe 40 PID 1644 wrote to memory of 112 1644 ff5a1c761c9fef48c031472614a51886.exe 42 PID 1644 wrote to memory of 112 1644 ff5a1c761c9fef48c031472614a51886.exe 42 PID 1644 wrote to memory of 112 1644 ff5a1c761c9fef48c031472614a51886.exe 42 PID 1644 wrote to memory of 112 1644 ff5a1c761c9fef48c031472614a51886.exe 42 PID 1644 wrote to memory of 1172 1644 ff5a1c761c9fef48c031472614a51886.exe 44 PID 1644 wrote to memory of 1172 1644 ff5a1c761c9fef48c031472614a51886.exe 44 PID 1644 wrote to memory of 1172 1644 ff5a1c761c9fef48c031472614a51886.exe 44 PID 1644 wrote to memory of 1172 1644 ff5a1c761c9fef48c031472614a51886.exe 44 PID 1644 wrote to memory of 668 1644 ff5a1c761c9fef48c031472614a51886.exe 46 PID 1644 wrote to memory of 668 1644 ff5a1c761c9fef48c031472614a51886.exe 46 PID 1644 wrote to memory of 668 1644 ff5a1c761c9fef48c031472614a51886.exe 46 PID 1644 wrote to memory of 668 1644 ff5a1c761c9fef48c031472614a51886.exe 46 PID 1644 wrote to memory of 1520 1644 ff5a1c761c9fef48c031472614a51886.exe 48 PID 1644 wrote to memory of 1520 1644 ff5a1c761c9fef48c031472614a51886.exe 48 PID 1644 wrote to memory of 1520 1644 ff5a1c761c9fef48c031472614a51886.exe 48 PID 1644 wrote to memory of 1520 1644 ff5a1c761c9fef48c031472614a51886.exe 48 PID 1644 wrote to memory of 608 1644 ff5a1c761c9fef48c031472614a51886.exe 50 PID 1644 wrote to memory of 608 1644 ff5a1c761c9fef48c031472614a51886.exe 50 PID 1644 wrote to memory of 608 1644 ff5a1c761c9fef48c031472614a51886.exe 50 PID 1644 wrote to memory of 608 1644 ff5a1c761c9fef48c031472614a51886.exe 50 PID 1644 wrote to memory of 1604 1644 ff5a1c761c9fef48c031472614a51886.exe 52 PID 1644 wrote to memory of 1604 1644 ff5a1c761c9fef48c031472614a51886.exe 52 PID 1644 wrote to memory of 1604 1644 ff5a1c761c9fef48c031472614a51886.exe 52 PID 1644 wrote to memory of 1604 1644 ff5a1c761c9fef48c031472614a51886.exe 52 PID 1644 wrote to memory of 572 1644 ff5a1c761c9fef48c031472614a51886.exe 54 PID 1644 wrote to memory of 572 1644 ff5a1c761c9fef48c031472614a51886.exe 54 PID 1644 wrote to memory of 572 1644 ff5a1c761c9fef48c031472614a51886.exe 54 PID 1644 wrote to memory of 572 1644 ff5a1c761c9fef48c031472614a51886.exe 54 PID 1644 wrote to memory of 1596 1644 ff5a1c761c9fef48c031472614a51886.exe 56 PID 1644 wrote to memory of 1596 1644 ff5a1c761c9fef48c031472614a51886.exe 56 PID 1644 wrote to memory of 1596 1644 ff5a1c761c9fef48c031472614a51886.exe 56 PID 1644 wrote to memory of 1596 1644 ff5a1c761c9fef48c031472614a51886.exe 56 PID 1644 wrote to memory of 1768 1644 ff5a1c761c9fef48c031472614a51886.exe 58 PID 1644 wrote to memory of 1768 1644 ff5a1c761c9fef48c031472614a51886.exe 58 PID 1644 wrote to memory of 1768 1644 ff5a1c761c9fef48c031472614a51886.exe 58 PID 1644 wrote to memory of 1768 1644 ff5a1c761c9fef48c031472614a51886.exe 58
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff5a1c761c9fef48c031472614a51886.exe"C:\Users\Admin\AppData\Local\Temp\ff5a1c761c9fef48c031472614a51886.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1572
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1512
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:268
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1816
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:876
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:840
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:980
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:112
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1172
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:668
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1520
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:608
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1604
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:572
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1596
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1768
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:944
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:912
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1928
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1144
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1524
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1840
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:996
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1040
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1256
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1628
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1384
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:960
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1544
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1876
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1496
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1216
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1924
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:784
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:920
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:856
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1308
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:552
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1736
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1128
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1096
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1588
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1704
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:280
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:860
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1168
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:304
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:968
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:908
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1792
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1684
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1740
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:820
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1732
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1304
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1108
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1592
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1412
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1300
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:952
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:576
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1312
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1324
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:924
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1952
-