Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230824-en -
resource tags
arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system -
submitted
31/08/2023, 18:07
Static task
static1
Behavioral task
behavioral1
Sample
fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe
-
Size
300KB
-
MD5
fa261aff7ab7d7243bb35160c6a793fa
-
SHA1
30559207d159581aacd8e697e974dd7a7099a8be
-
SHA256
f0ead13e044a331f8b41f2e4e43d14ea319cee3881d65627815d58b9316af6cf
-
SHA512
11d8bc48f2a64a607a9d1ea86c4a5ff7913e24937ca20ec0435e539754bf4cb7cdcd3aa893f9babb57f93de95727c9df2638fa8a8238c07c7153cab1c77253a0
-
SSDEEP
6144:tvEANMO1UnseVgkV0xwvfxnhLTiusLe1740B:euM0Unsna5mut40B
Malware Config
Signatures
-
GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/2608-1-0x0000000000400000-0x0000000003B9B000-memory.dmp family_gandcrab behavioral1/memory/2608-3-0x0000000003D30000-0x0000000003D47000-memory.dmp family_gandcrab behavioral1/memory/2608-11-0x0000000000400000-0x0000000003B9B000-memory.dmp family_gandcrab behavioral1/memory/2608-12-0x0000000003D30000-0x0000000003D47000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 Destination IP 104.155.138.21 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\uxaimdybels = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\qvreik.exe\"" fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\K: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\V: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\Y: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\L: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\M: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\R: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\W: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\A: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\G: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\H: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\J: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\N: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\O: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\P: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\S: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\T: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\U: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\X: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\B: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\I: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\Q: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe File opened (read-only) \??\Z: fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe -
Suspicious use of SetWindowsHookAW 64 IoCs
pid Process 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2608 wrote to memory of 1844 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 29 PID 2608 wrote to memory of 1844 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 29 PID 2608 wrote to memory of 1844 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 29 PID 2608 wrote to memory of 1844 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 29 PID 2608 wrote to memory of 2748 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 31 PID 2608 wrote to memory of 2748 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 31 PID 2608 wrote to memory of 2748 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 31 PID 2608 wrote to memory of 2748 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 31 PID 2608 wrote to memory of 2444 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 33 PID 2608 wrote to memory of 2444 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 33 PID 2608 wrote to memory of 2444 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 33 PID 2608 wrote to memory of 2444 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 33 PID 2608 wrote to memory of 2556 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 35 PID 2608 wrote to memory of 2556 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 35 PID 2608 wrote to memory of 2556 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 35 PID 2608 wrote to memory of 2556 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 35 PID 2608 wrote to memory of 2420 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 37 PID 2608 wrote to memory of 2420 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 37 PID 2608 wrote to memory of 2420 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 37 PID 2608 wrote to memory of 2420 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 37 PID 2608 wrote to memory of 2484 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 39 PID 2608 wrote to memory of 2484 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 39 PID 2608 wrote to memory of 2484 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 39 PID 2608 wrote to memory of 2484 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 39 PID 2608 wrote to memory of 2200 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 41 PID 2608 wrote to memory of 2200 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 41 PID 2608 wrote to memory of 2200 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 41 PID 2608 wrote to memory of 2200 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 41 PID 2608 wrote to memory of 2844 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 43 PID 2608 wrote to memory of 2844 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 43 PID 2608 wrote to memory of 2844 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 43 PID 2608 wrote to memory of 2844 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 43 PID 2608 wrote to memory of 896 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 45 PID 2608 wrote to memory of 896 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 45 PID 2608 wrote to memory of 896 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 45 PID 2608 wrote to memory of 896 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 45 PID 2608 wrote to memory of 1656 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 47 PID 2608 wrote to memory of 1656 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 47 PID 2608 wrote to memory of 1656 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 47 PID 2608 wrote to memory of 1656 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 47 PID 2608 wrote to memory of 1444 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 49 PID 2608 wrote to memory of 1444 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 49 PID 2608 wrote to memory of 1444 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 49 PID 2608 wrote to memory of 1444 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 49 PID 2608 wrote to memory of 2040 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 51 PID 2608 wrote to memory of 2040 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 51 PID 2608 wrote to memory of 2040 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 51 PID 2608 wrote to memory of 2040 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 51 PID 2608 wrote to memory of 1212 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 53 PID 2608 wrote to memory of 1212 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 53 PID 2608 wrote to memory of 1212 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 53 PID 2608 wrote to memory of 1212 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 53 PID 2608 wrote to memory of 592 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 55 PID 2608 wrote to memory of 592 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 55 PID 2608 wrote to memory of 592 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 55 PID 2608 wrote to memory of 592 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 55 PID 2608 wrote to memory of 952 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 57 PID 2608 wrote to memory of 952 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 57 PID 2608 wrote to memory of 952 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 57 PID 2608 wrote to memory of 952 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 57 PID 2608 wrote to memory of 1260 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 59 PID 2608 wrote to memory of 1260 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 59 PID 2608 wrote to memory of 1260 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 59 PID 2608 wrote to memory of 1260 2608 fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe 59
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\fa261aff7ab7d7243bb35160c6a793fa_mafia_JC.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookAW
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1844
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2748
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2444
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2556
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2420
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2484
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2200
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2844
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:896
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1656
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1444
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2040
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1212
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:592
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:952
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1260
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1120
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2360
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2356
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1960
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2236
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1692
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1664
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1748
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2768
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:3064
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:3052
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1060
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2088
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:3040
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1620
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1276
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1076
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:280
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:388
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2516
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:580
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1956
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2260
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1812
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1624
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:824
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2864
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:3004
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2180
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2812
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2804
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:812
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1612
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2700
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1788
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2144
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2648
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2636
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2672
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:584
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2412
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2268
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:3024
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1396
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1700
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2324
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2020
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:800
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1696
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1020
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2080
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2344
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1228
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:436
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1728
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1808
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:1996
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1792
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2604
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2912
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2980
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2248
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2956
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:1204
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2308
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:588
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:680
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2292
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:644
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:1932
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:636
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2116
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:2800
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:3060
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:1596
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2960
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns1.wowservers.ru2⤵PID:704
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns2.wowservers.ru2⤵PID:2204
-
-
C:\Windows\SysWOW64\nslookup.exenslookup carder.bit ns2.wowservers.ru2⤵PID:2744
-
-
C:\Windows\SysWOW64\nslookup.exenslookup ransomware.bit ns1.wowservers.ru2⤵PID:2384
-