a07e011265b4edbd193c56c8d1dde9759339e1f86d088e201c992a12e6ca295c

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2023 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
Size

69KB
MD5

78c30a3a6acca50c03522ef1eee7658a
SHA1

3101630f5a3db61b25f7502d73a6041c050ef4dd
SHA256

a07e011265b4edbd193c56c8d1dde9759339e1f86d088e201c992a12e6ca295c
SHA512

f22c4c610715aa6a93a43ec44a812f04d6709b879a62b93d3840ed9366666a19d6aa79c2b5682c184a627da8948b21144bc71f4d5183a7847557ed6a9ad0b4be
SSDEEP

1536:lZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAwfMqqU+2bbbAV2/S2Lkvd9:5BounVyFHpfMqqDL2/Lkvd

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vpizvzahims = "C:\\Users\\Admin\\AppData\\Local\\Temp\\78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe"	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\L:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\P:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\Q:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\T:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\A:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\G:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\H:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\K:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\M:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\W:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\Y:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\X:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\B:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\I:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\J:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\O:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\R:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\N:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\S:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\U:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\V:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
File opened (read-only)	\??\Z:	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 4092	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	82
PID 2860 wrote to memory of 4092	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	82
PID 2860 wrote to memory of 4092	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	82
PID 2860 wrote to memory of 4372	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	86
PID 2860 wrote to memory of 4372	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	86
PID 2860 wrote to memory of 4372	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	86
PID 2860 wrote to memory of 4916	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	90
PID 2860 wrote to memory of 4916	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	90
PID 2860 wrote to memory of 4916	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	90
PID 2860 wrote to memory of 3992	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	92
PID 2860 wrote to memory of 3992	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	92
PID 2860 wrote to memory of 3992	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	92
PID 2860 wrote to memory of 4764	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	95
PID 2860 wrote to memory of 4764	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	95
PID 2860 wrote to memory of 4764	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	95
PID 2860 wrote to memory of 964	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	97
PID 2860 wrote to memory of 964	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	97
PID 2860 wrote to memory of 964	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	97
PID 2860 wrote to memory of 2004	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	99
PID 2860 wrote to memory of 2004	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	99
PID 2860 wrote to memory of 2004	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	99
PID 2860 wrote to memory of 1600	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	103
PID 2860 wrote to memory of 1600	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	103
PID 2860 wrote to memory of 1600	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	103
PID 2860 wrote to memory of 4960	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	105
PID 2860 wrote to memory of 4960	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	105
PID 2860 wrote to memory of 4960	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	105
PID 2860 wrote to memory of 4732	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	107
PID 2860 wrote to memory of 4732	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	107
PID 2860 wrote to memory of 4732	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	107
PID 2860 wrote to memory of 1428	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	109
PID 2860 wrote to memory of 1428	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	109
PID 2860 wrote to memory of 1428	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	109
PID 2860 wrote to memory of 868	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	111
PID 2860 wrote to memory of 868	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	111
PID 2860 wrote to memory of 868	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	111
PID 2860 wrote to memory of 1932	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	113
PID 2860 wrote to memory of 1932	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	113
PID 2860 wrote to memory of 1932	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	113
PID 2860 wrote to memory of 4756	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	115
PID 2860 wrote to memory of 4756	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	115
PID 2860 wrote to memory of 4756	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	115
PID 2860 wrote to memory of 2888	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	117
PID 2860 wrote to memory of 2888	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	117
PID 2860 wrote to memory of 2888	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	117
PID 2860 wrote to memory of 3720	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	119
PID 2860 wrote to memory of 3720	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	119
PID 2860 wrote to memory of 3720	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	119
PID 2860 wrote to memory of 2484	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	121
PID 2860 wrote to memory of 2484	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	121
PID 2860 wrote to memory of 2484	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	121
PID 2860 wrote to memory of 1904	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	123
PID 2860 wrote to memory of 1904	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	123
PID 2860 wrote to memory of 1904	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	123
PID 2860 wrote to memory of 4008	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	125
PID 2860 wrote to memory of 4008	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	125
PID 2860 wrote to memory of 4008	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	125
PID 2860 wrote to memory of 3376	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	127
PID 2860 wrote to memory of 3376	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	127
PID 2860 wrote to memory of 3376	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	127
PID 2860 wrote to memory of 4568	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	129
PID 2860 wrote to memory of 4568	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	129
PID 2860 wrote to memory of 4568	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	129
PID 2860 wrote to memory of 760	2860	78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe	132

C:\Users\Admin\AppData\Local\Temp\78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe
"C:\Users\Admin\AppData\Local\Temp\78c30a3a6acca50c03522ef1eee7658a_gandcrab_JC.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4092
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4372
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4916
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:3992
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4764
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:964
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2004
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1600
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4960
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4732
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1428
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:868
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1932
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4756
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2888
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:3720
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2484
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1904
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4008
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3376
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4568
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:760
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3624
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2604
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4708
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1696
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4704
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4892
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4184
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:5052
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1832
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4528
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2940
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1824
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2448
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4188
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:996
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4780
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1092
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4296
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1412
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:624
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1556
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1400
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3420
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2140
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3944
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3908
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:688
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4908
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:5056
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4244
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3240
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3416
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4340
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4104
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1072
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1680
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2732
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4748
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2488
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1352
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2812
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1144
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4412
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4400
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:5080
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1724
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4268
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:3152
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3892
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4672
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1748
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:804
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4652
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4068
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1916
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4548
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1620
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4820
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2400
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:712
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3940
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4504
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1228
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1444
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1588
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1684
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3952
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4272
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4968
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2176
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2948
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1492
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4996
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4304
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2648
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3752
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1248
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1472
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4496
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3176
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4604
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1152
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2728
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2080
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3956
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3792
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:932
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4608
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4564