Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 19:16
Behavioral task
behavioral1
Sample
1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe
Resource
win10v2004-20240319-en
General
-
Target
1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe
-
Size
400KB
-
MD5
36d853f24b792a3f001764aca709ffbf
-
SHA1
f59b2a48e08a471a866d4f7b419da04197436b73
-
SHA256
1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41
-
SHA512
03d82cd684eebb96537d9acb8e1cef368fb8b54e6af98f39f2745771cdf6f76e33dae1b96759f9adf28f455e0fe9281202c56e350000cb3141c16798f51b593f
-
SSDEEP
3072:uDxELd9sXbq+FziQ5foIY8RdMyFqhVw09wF3AbuXijGVB60Enddmzwh2HNw7XR:axELvswQloIY2vcVT9IwciKHEDmzKy+
Malware Config
Signatures
-
GandCrab payload 4 IoCs
resource yara_rule behavioral1/memory/1916-2-0x0000000000400000-0x0000000000464000-memory.dmp family_gandcrab behavioral1/memory/1916-5-0x0000000000230000-0x0000000000246000-memory.dmp family_gandcrab behavioral1/memory/1916-11-0x0000000000400000-0x0000000000464000-memory.dmp family_gandcrab behavioral1/memory/1916-14-0x0000000000230000-0x0000000000246000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Detects Reflective DLL injection artifacts 4 IoCs
resource yara_rule behavioral1/memory/1916-2-0x0000000000400000-0x0000000000464000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/1916-5-0x0000000000230000-0x0000000000246000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/1916-11-0x0000000000400000-0x0000000000464000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral1/memory/1916-14-0x0000000000230000-0x0000000000246000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader -
Detects ransomware indicator 4 IoCs
resource yara_rule behavioral1/memory/1916-2-0x0000000000400000-0x0000000000464000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 behavioral1/memory/1916-5-0x0000000000230000-0x0000000000246000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 behavioral1/memory/1916-11-0x0000000000400000-0x0000000000464000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 behavioral1/memory/1916-14-0x0000000000230000-0x0000000000246000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 -
Gandcrab Payload 4 IoCs
resource yara_rule behavioral1/memory/1916-2-0x0000000000400000-0x0000000000464000-memory.dmp Gandcrab behavioral1/memory/1916-5-0x0000000000230000-0x0000000000246000-memory.dmp Gandcrab behavioral1/memory/1916-11-0x0000000000400000-0x0000000000464000-memory.dmp Gandcrab behavioral1/memory/1916-14-0x0000000000230000-0x0000000000246000-memory.dmp Gandcrab -
UPX dump on OEP (original entry point) 3 IoCs
resource yara_rule behavioral1/memory/1916-0-0x0000000000400000-0x0000000000464000-memory.dmp UPX behavioral1/memory/1916-2-0x0000000000400000-0x0000000000464000-memory.dmp UPX behavioral1/memory/1916-11-0x0000000000400000-0x0000000000464000-memory.dmp UPX -
resource yara_rule behavioral1/memory/1916-0-0x0000000000400000-0x0000000000464000-memory.dmp upx -
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 Destination IP 185.105.226.109 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ebjlieqjrmi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe" 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\O: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\R: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\T: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\V: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\W: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\B: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\E: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\G: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\K: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\Y: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\Z: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\I: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\J: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\P: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\S: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\Q: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\U: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\X: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\A: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\H: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\L: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe File opened (read-only) \??\M: 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2560 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 28 PID 1916 wrote to memory of 2560 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 28 PID 1916 wrote to memory of 2560 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 28 PID 1916 wrote to memory of 2560 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 28 PID 1916 wrote to memory of 2860 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 30 PID 1916 wrote to memory of 2860 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 30 PID 1916 wrote to memory of 2860 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 30 PID 1916 wrote to memory of 2860 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 30 PID 1916 wrote to memory of 2276 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 32 PID 1916 wrote to memory of 2276 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 32 PID 1916 wrote to memory of 2276 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 32 PID 1916 wrote to memory of 2276 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 32 PID 1916 wrote to memory of 2600 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 35 PID 1916 wrote to memory of 2600 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 35 PID 1916 wrote to memory of 2600 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 35 PID 1916 wrote to memory of 2600 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 35 PID 1916 wrote to memory of 2612 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 37 PID 1916 wrote to memory of 2612 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 37 PID 1916 wrote to memory of 2612 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 37 PID 1916 wrote to memory of 2612 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 37 PID 1916 wrote to memory of 2492 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 39 PID 1916 wrote to memory of 2492 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 39 PID 1916 wrote to memory of 2492 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 39 PID 1916 wrote to memory of 2492 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 39 PID 1916 wrote to memory of 2920 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 41 PID 1916 wrote to memory of 2920 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 41 PID 1916 wrote to memory of 2920 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 41 PID 1916 wrote to memory of 2920 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 41 PID 1916 wrote to memory of 2396 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 43 PID 1916 wrote to memory of 2396 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 43 PID 1916 wrote to memory of 2396 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 43 PID 1916 wrote to memory of 2396 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 43 PID 1916 wrote to memory of 2756 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 45 PID 1916 wrote to memory of 2756 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 45 PID 1916 wrote to memory of 2756 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 45 PID 1916 wrote to memory of 2756 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 45 PID 1916 wrote to memory of 2804 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 47 PID 1916 wrote to memory of 2804 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 47 PID 1916 wrote to memory of 2804 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 47 PID 1916 wrote to memory of 2804 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 47 PID 1916 wrote to memory of 1708 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 49 PID 1916 wrote to memory of 1708 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 49 PID 1916 wrote to memory of 1708 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 49 PID 1916 wrote to memory of 1708 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 49 PID 1916 wrote to memory of 824 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 51 PID 1916 wrote to memory of 824 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 51 PID 1916 wrote to memory of 824 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 51 PID 1916 wrote to memory of 824 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 51 PID 1916 wrote to memory of 2672 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 53 PID 1916 wrote to memory of 2672 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 53 PID 1916 wrote to memory of 2672 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 53 PID 1916 wrote to memory of 2672 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 53 PID 1916 wrote to memory of 1120 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 55 PID 1916 wrote to memory of 1120 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 55 PID 1916 wrote to memory of 1120 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 55 PID 1916 wrote to memory of 1120 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 55 PID 1916 wrote to memory of 2692 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 59 PID 1916 wrote to memory of 2692 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 59 PID 1916 wrote to memory of 2692 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 59 PID 1916 wrote to memory of 2692 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 59 PID 1916 wrote to memory of 940 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 61 PID 1916 wrote to memory of 940 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 61 PID 1916 wrote to memory of 940 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 61 PID 1916 wrote to memory of 940 1916 1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe 61
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe"C:\Users\Admin\AppData\Local\Temp\1d2725e005ff437ed228626d81477212840fd841a25bdeea21e0a533e9704d41.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:2560
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:2860
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2276
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:2600
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:2612
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:2492
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:2920
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:2396
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2756
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:2804
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:1708
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:824
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:2672
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:1120
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2692
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:940
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:612
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:1760
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:2252
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:2008
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2980
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:2872
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:556
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:2392
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:1036
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:1680
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:956
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:1088
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:1108
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:1692
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:1872
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:240
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:1484
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:2292
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:1616
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:2092
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:2544
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:2532
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2464
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:1728
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:2436
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:2924
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:1736
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:2736
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2516
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:2904
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns2.virmach.ru2⤵PID:828
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns1.virmach.ru2⤵PID:1552
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns1.virmach.ru2⤵PID:748
-
-
C:\Windows\SysWOW64\nslookup.exenslookup malwarehunterteam.bit ns1.virmach.ru2⤵PID:2664
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gdcb.bit ns2.virmach.ru2⤵PID:2660
-
-
C:\Windows\SysWOW64\nslookup.exenslookup politiaromana.bit ns2.virmach.ru2⤵PID:1900
-