Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 15:47
Behavioral task
behavioral1
Sample
2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe
-
Size
147KB
-
MD5
b9cdd427a4f6b44e19cfdf85fbdf5820
-
SHA1
1dbedf3118e87c1a77de8aa807b51e5d2c3e938e
-
SHA256
2934f2415bd25a562d6185c49588e559b4fa6862ee6bb4d8bd04ad3a9937c545
-
SHA512
9e6939868024373db20557bb95f29500159ef25519f35e66688cfb474e9fd1533d8fa0178f21b287ec77e6bbacc31f06fde3219bda51659e9b035b5bc39c92a9
-
SSDEEP
3072:xBounVyFHFMqqDL2/LgHkc2U6FiPZ8aewZ2ql5f2J9lj:xqxHmqqDL6EHl2U6CbeOl5f2Fj
Malware Config
Signatures
-
GandCrab payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2528-0-0x000000000FF80000-0x000000000FFA8000-memory.dmp family_gandcrab behavioral1/memory/2528-4-0x000000000FF80000-0x000000000FFA8000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Detects Reflective DLL injection artifacts 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2528-0-0x000000000FF80000-0x000000000FFA8000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/2528-4-0x000000000FF80000-0x000000000FFA8000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader -
Detects ransomware indicator 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2528-0-0x000000000FF80000-0x000000000FFA8000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 behavioral1/memory/2528-4-0x000000000FF80000-0x000000000FFA8000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 -
Gandcrab Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2528-0-0x000000000FF80000-0x000000000FFA8000-memory.dmp Gandcrab behavioral1/memory/2528-4-0x000000000FF80000-0x000000000FFA8000-memory.dmp Gandcrab -
UPX dump on OEP (original entry point) 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2528-0-0x000000000FF80000-0x000000000FFA8000-memory.dmp UPX behavioral1/memory/2528-4-0x000000000FF80000-0x000000000FFA8000-memory.dmp UPX -
Processes:
resource yara_rule behavioral1/memory/2528-0-0x000000000FF80000-0x000000000FFA8000-memory.dmp upx behavioral1/memory/2528-4-0x000000000FF80000-0x000000000FFA8000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nkwurcmecep = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe" 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exedescription ioc process File opened (read-only) \??\K: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\M: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\O: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\Z: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\Y: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\E: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\R: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\S: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\U: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\N: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\P: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\Q: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\V: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\G: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\H: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\J: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\L: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\X: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\W: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\A: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\B: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\I: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe File opened (read-only) \??\T: 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exepid process 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exedescription pid process target process PID 2528 wrote to memory of 2724 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2724 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2724 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2724 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2740 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2740 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2740 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2740 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2616 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2616 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2616 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2616 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 3012 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 3012 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 3012 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 3012 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2644 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2644 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2644 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2644 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2600 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2600 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2600 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2600 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2704 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2704 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2704 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2704 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2404 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2404 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2404 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2404 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 1304 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 1304 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 1304 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 1304 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2928 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2928 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2928 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2928 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2956 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2956 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2956 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2956 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2968 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2968 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2968 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2968 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 3016 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 3016 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 3016 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 3016 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 1992 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 1992 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 1992 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 1992 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 292 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 292 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 292 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 292 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2496 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2496 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2496 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe PID 2528 wrote to memory of 2496 2528 2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_b9cdd427a4f6b44e19cfdf85fbdf5820_gandcrab.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2724
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2740
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:2616
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:3012
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2644
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2600
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2704
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2404
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1304
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2928
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2956
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2968
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:3016
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1992
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:292
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2496
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2632
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:700
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2828
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1500
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:952
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:1616
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1604
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2080
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:1196
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:3064
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:2388
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2176
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1684
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2480
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:784
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1548
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1612
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:1608
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1640
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2044
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:1728
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1736
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:2332
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:1516
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1316
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:1588
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2664
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2728
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:2688
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2884
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2556
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2628
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2932
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2592
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:2304
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:1740
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2800
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2988
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:3024
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1572
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1912
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2232
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:800
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2808
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2900
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2896
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1032
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:1664
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2052
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2072
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2224
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2104
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:2096
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2340
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2620
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:288
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:1328
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1864
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1624
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:896
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1248
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:580
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:1384
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1244
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1976
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:1716
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1960
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2852
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2980
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:2604
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:2748
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:756
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2216
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2276
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:1696
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:484
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:3068
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2532
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2964
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2136
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:1648
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1908
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1704
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2804
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:2924
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:1492
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:1620
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1540
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1360
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:2112
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1264
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:548
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru2⤵PID:2400
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1352
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru2⤵PID:1660
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru2⤵PID:1772
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru2⤵PID:1816