ac6245d85f33e8073cacfa30f823e625a798b661780045571eb807ba3d66528f

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
03/08/2023, 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
Size

69KB
MD5

48c122bf92de3af2b37818f812c20a49
SHA1

1c4435c1aacd5b90f3912cecb8c9c2587ac4e4dc
SHA256

ac6245d85f33e8073cacfa30f823e625a798b661780045571eb807ba3d66528f
SHA512

b76685bb2f8b9500f7999729ba31b2aa3d652147c4fa78f071032f898e8675b0827562dcfb728ab591ab037327afb0fa13df2b9c9152347063811d1db21179ae
SSDEEP

1536:DZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAwfMqqU+2bbbAV2/S2Lkvd9:TBounVyFHpfMqqDL2/Lkvd

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\drjyathgdpi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe"	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\J:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\P:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\U:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\V:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\L:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\N:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\O:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\Q:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\X:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\Z:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\G:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\I:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\S:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\W:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\Y:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\R:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\T:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\A:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\B:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\E:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\K:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
File opened (read-only)	\??\M:	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2932	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	28
PID 2216 wrote to memory of 2932	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	28
PID 2216 wrote to memory of 2932	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	28
PID 2216 wrote to memory of 2932	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	28
PID 2216 wrote to memory of 3000	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	30
PID 2216 wrote to memory of 3000	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	30
PID 2216 wrote to memory of 3000	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	30
PID 2216 wrote to memory of 3000	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	30
PID 2216 wrote to memory of 2472	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	33
PID 2216 wrote to memory of 2472	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	33
PID 2216 wrote to memory of 2472	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	33
PID 2216 wrote to memory of 2472	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	33
PID 2216 wrote to memory of 2868	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	35
PID 2216 wrote to memory of 2868	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	35
PID 2216 wrote to memory of 2868	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	35
PID 2216 wrote to memory of 2868	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	35
PID 2216 wrote to memory of 2816	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	37
PID 2216 wrote to memory of 2816	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	37
PID 2216 wrote to memory of 2816	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	37
PID 2216 wrote to memory of 2816	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	37
PID 2216 wrote to memory of 2724	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	39
PID 2216 wrote to memory of 2724	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	39
PID 2216 wrote to memory of 2724	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	39
PID 2216 wrote to memory of 2724	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	39
PID 2216 wrote to memory of 2044	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	41
PID 2216 wrote to memory of 2044	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	41
PID 2216 wrote to memory of 2044	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	41
PID 2216 wrote to memory of 2044	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	41
PID 2216 wrote to memory of 2900	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	43
PID 2216 wrote to memory of 2900	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	43
PID 2216 wrote to memory of 2900	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	43
PID 2216 wrote to memory of 2900	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	43
PID 2216 wrote to memory of 564	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	45
PID 2216 wrote to memory of 564	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	45
PID 2216 wrote to memory of 564	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	45
PID 2216 wrote to memory of 564	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	45
PID 2216 wrote to memory of 784	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	47
PID 2216 wrote to memory of 784	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	47
PID 2216 wrote to memory of 784	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	47
PID 2216 wrote to memory of 784	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	47
PID 2216 wrote to memory of 572	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	49
PID 2216 wrote to memory of 572	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	49
PID 2216 wrote to memory of 572	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	49
PID 2216 wrote to memory of 572	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	49
PID 2216 wrote to memory of 1484	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	51
PID 2216 wrote to memory of 1484	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	51
PID 2216 wrote to memory of 1484	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	51
PID 2216 wrote to memory of 1484	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	51
PID 2216 wrote to memory of 1640	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	53
PID 2216 wrote to memory of 1640	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	53
PID 2216 wrote to memory of 1640	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	53
PID 2216 wrote to memory of 1640	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	53
PID 2216 wrote to memory of 2304	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	55
PID 2216 wrote to memory of 2304	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	55
PID 2216 wrote to memory of 2304	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	55
PID 2216 wrote to memory of 2304	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	55
PID 2216 wrote to memory of 3056	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	57
PID 2216 wrote to memory of 3056	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	57
PID 2216 wrote to memory of 3056	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	57
PID 2216 wrote to memory of 3056	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	57
PID 2216 wrote to memory of 2496	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	59
PID 2216 wrote to memory of 2496	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	59
PID 2216 wrote to memory of 2496	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	59
PID 2216 wrote to memory of 2496	2216	48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe	59

C:\Users\Admin\AppData\Local\Temp\48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe
"C:\Users\Admin\AppData\Local\Temp\48c122bf92de3af2b37818f812c20a49_gandcrab_JC.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2932
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3000
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2472
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2868
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2816
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2724
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2044
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2900
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:564
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:784
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:572
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1484
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1640
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2304
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3056
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2496
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2120
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2072
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2208
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1988
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2060
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1648
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1072
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:368
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1016
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1956
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2520
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2888
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2608
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1584
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:800
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:396
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2040
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1360
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1020
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1756
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1548
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1456
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1788
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2548
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1656
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1968
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1616
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2084
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1236
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1752
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1932
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2368
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2656
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1544
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2856
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2728
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2748
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2892
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2768
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2740
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2528
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2124
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:472
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:992
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1496
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1488
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1864
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2200
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2308
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2604
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2908
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2268
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1804
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1672
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1144
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:532
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2560
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1252
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3028
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2076
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2092
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2476
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2500
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1008
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1304
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1740
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1368
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1872
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1536
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1704
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:900
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2444
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2112
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2672
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1196
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2568
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2364
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1596
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2384
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2440
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2828
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2916
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2720
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2280
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2780
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2172
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:876
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:548
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1036
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:364
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1860
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2792
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2448
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2332
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2108
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2764
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2180
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3064
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1000
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1048