Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
28/08/2023, 19:15
Static task
static1
Behavioral task
behavioral1
Sample
c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe
-
Size
323KB
-
MD5
c8f8b4e7f389aceae11304073ce40c73
-
SHA1
c8314d68306649c399396f9c230ec7e6e0615d92
-
SHA256
ed2b7c5112597ab8758923e6ab1f27aa35d8945b6ca4cf6854f15d0a44c64704
-
SHA512
59e4f80238eb1893e9a95fdfd7cbe322530edda4fddfb319b2d7491e0af45993b5d35eea67275031b26070ccb06d3129c84ff8b4d07b7f1823c877772864fac9
-
SSDEEP
6144:qyTS+VPGFG9AQuVFhZKNS3qRQ9SXelDI7tb:qypVPGzFBqi9SXel8x
Malware Config
Signatures
-
GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/2532-3-0x0000000000400000-0x00000000012D5000-memory.dmp family_gandcrab behavioral1/memory/2532-4-0x0000000000220000-0x0000000000237000-memory.dmp family_gandcrab behavioral1/memory/2532-12-0x0000000000400000-0x00000000012D5000-memory.dmp family_gandcrab behavioral1/memory/2532-14-0x0000000000220000-0x0000000000237000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 107.178.223.183 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qisduotyabb = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\qvfqsd.exe\"" c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\I: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\T: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\V: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\X: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\Y: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\A: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\E: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\P: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\B: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\N: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\W: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\Z: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\H: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\O: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\L: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\M: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\Q: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\R: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\S: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\U: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\J: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe File opened (read-only) \??\K: c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 3004 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 28 PID 2532 wrote to memory of 3004 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 28 PID 2532 wrote to memory of 3004 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 28 PID 2532 wrote to memory of 3004 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 28 PID 2532 wrote to memory of 3052 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 30 PID 2532 wrote to memory of 3052 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 30 PID 2532 wrote to memory of 3052 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 30 PID 2532 wrote to memory of 3052 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 30 PID 2532 wrote to memory of 3048 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 32 PID 2532 wrote to memory of 3048 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 32 PID 2532 wrote to memory of 3048 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 32 PID 2532 wrote to memory of 3048 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 32 PID 2532 wrote to memory of 2144 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 34 PID 2532 wrote to memory of 2144 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 34 PID 2532 wrote to memory of 2144 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 34 PID 2532 wrote to memory of 2144 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 34 PID 2532 wrote to memory of 1956 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 36 PID 2532 wrote to memory of 1956 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 36 PID 2532 wrote to memory of 1956 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 36 PID 2532 wrote to memory of 1956 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 36 PID 2532 wrote to memory of 2776 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 38 PID 2532 wrote to memory of 2776 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 38 PID 2532 wrote to memory of 2776 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 38 PID 2532 wrote to memory of 2776 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 38 PID 2532 wrote to memory of 2740 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 40 PID 2532 wrote to memory of 2740 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 40 PID 2532 wrote to memory of 2740 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 40 PID 2532 wrote to memory of 2740 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 40 PID 2532 wrote to memory of 2420 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 42 PID 2532 wrote to memory of 2420 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 42 PID 2532 wrote to memory of 2420 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 42 PID 2532 wrote to memory of 2420 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 42 PID 2532 wrote to memory of 2356 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 44 PID 2532 wrote to memory of 2356 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 44 PID 2532 wrote to memory of 2356 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 44 PID 2532 wrote to memory of 2356 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 44 PID 2532 wrote to memory of 644 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 48 PID 2532 wrote to memory of 644 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 48 PID 2532 wrote to memory of 644 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 48 PID 2532 wrote to memory of 644 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 48 PID 2532 wrote to memory of 2376 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 50 PID 2532 wrote to memory of 2376 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 50 PID 2532 wrote to memory of 2376 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 50 PID 2532 wrote to memory of 2376 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 50 PID 2532 wrote to memory of 2760 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 52 PID 2532 wrote to memory of 2760 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 52 PID 2532 wrote to memory of 2760 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 52 PID 2532 wrote to memory of 2760 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 52 PID 2532 wrote to memory of 2184 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 54 PID 2532 wrote to memory of 2184 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 54 PID 2532 wrote to memory of 2184 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 54 PID 2532 wrote to memory of 2184 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 54 PID 2532 wrote to memory of 1804 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 56 PID 2532 wrote to memory of 1804 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 56 PID 2532 wrote to memory of 1804 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 56 PID 2532 wrote to memory of 1804 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 56 PID 2532 wrote to memory of 2064 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 58 PID 2532 wrote to memory of 2064 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 58 PID 2532 wrote to memory of 2064 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 58 PID 2532 wrote to memory of 2064 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 58 PID 2532 wrote to memory of 1308 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 60 PID 2532 wrote to memory of 1308 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 60 PID 2532 wrote to memory of 1308 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 60 PID 2532 wrote to memory of 1308 2532 c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe 60
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\c8f8b4e7f389aceae11304073ce40c73_mafia_JC.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:3004
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:3052
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:3048
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2144
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1956
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2776
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2740
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2420
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2356
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:644
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2376
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2760
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2184
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1804
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2064
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1308
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1016
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1316
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:3064
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:3060
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2908
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:760
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1208
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2000
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2112
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1584
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2292
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:784
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1040
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1284
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1008
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1648
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1916
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2920
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1376
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1636
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1676
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2644
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:916
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2576
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:988
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2632
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:556
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1408
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:888
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2248
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1576
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2072
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2812
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2408
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1988
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2824
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2728
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2748
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2892
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2832
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2732
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1572
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1824
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1928
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2468
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2348
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1668
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1912
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1960
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1340
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2896
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2964
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1528
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1684
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1228
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2036
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2028
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1972
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2548
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:712
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2324
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:392
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2192
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1644
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:856
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1256
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:816
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1640
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1724
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1448
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1132
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2224
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2692
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:296
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1968
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2212
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2116
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2068
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2528
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2580
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:3024
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2524
-