gandcrab | 402bc240efd8c8520a8c1190ef557d568e32df2c2b41de1a9ced3f991094142e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
Size

69KB
MD5

2721c9f935887740aa050dcf415f7478
SHA1

9b03c16035fbfbce65180cef17c70911e2189177
SHA256

402bc240efd8c8520a8c1190ef557d568e32df2c2b41de1a9ced3f991094142e
SHA512

abf3de7802df8e1be747bb6c00dea46d2080b39e366108ea65fd32d7169a5550768f857fce6193ebdf51839ae4e078ba909eea89b57a20b325c74d2bceda4901
SSDEEP

1536:MZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAmMqqU+2bbbAV2/S2Lccu:yBounVyFHjMqqDL2/Lcc

Score

10^/10

gandcrab backdoor persistence ransomware

Malware Config

Signatures

GandCrab payload 1 IoCs

resource	yara_rule
behavioral2/memory/2200-0-0x0000000010000000-0x0000000010016000-memory.dmp	family_gandcrab

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xooqztsdahq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe"	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\Y:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\I:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\J:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\Q:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\S:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\T:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\K:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\P:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\U:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\X:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\Z:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\R:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\V:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\A:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\B:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\G:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\H:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\N:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\E:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\L:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\M:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
File opened (read-only)	\??\O:	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1668	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	82
PID 2200 wrote to memory of 1668	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	82
PID 2200 wrote to memory of 1668	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	82
PID 2200 wrote to memory of 3404	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	84
PID 2200 wrote to memory of 3404	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	84
PID 2200 wrote to memory of 3404	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	84
PID 2200 wrote to memory of 1264	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	86
PID 2200 wrote to memory of 1264	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	86
PID 2200 wrote to memory of 1264	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	86
PID 2200 wrote to memory of 3012	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	88
PID 2200 wrote to memory of 3012	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	88
PID 2200 wrote to memory of 3012	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	88
PID 2200 wrote to memory of 748	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	90
PID 2200 wrote to memory of 748	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	90
PID 2200 wrote to memory of 748	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	90
PID 2200 wrote to memory of 3808	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	92
PID 2200 wrote to memory of 3808	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	92
PID 2200 wrote to memory of 3808	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	92
PID 2200 wrote to memory of 4540	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	94
PID 2200 wrote to memory of 4540	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	94
PID 2200 wrote to memory of 4540	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	94
PID 2200 wrote to memory of 2760	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	96
PID 2200 wrote to memory of 2760	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	96
PID 2200 wrote to memory of 2760	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	96
PID 2200 wrote to memory of 2464	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	98
PID 2200 wrote to memory of 2464	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	98
PID 2200 wrote to memory of 2464	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	98
PID 2200 wrote to memory of 4436	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	100
PID 2200 wrote to memory of 4436	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	100
PID 2200 wrote to memory of 4436	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	100
PID 2200 wrote to memory of 1260	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	102
PID 2200 wrote to memory of 1260	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	102
PID 2200 wrote to memory of 1260	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	102
PID 2200 wrote to memory of 4408	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	104
PID 2200 wrote to memory of 4408	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	104
PID 2200 wrote to memory of 4408	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	104
PID 2200 wrote to memory of 3196	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	106
PID 2200 wrote to memory of 3196	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	106
PID 2200 wrote to memory of 3196	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	106
PID 2200 wrote to memory of 1656	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	108
PID 2200 wrote to memory of 1656	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	108
PID 2200 wrote to memory of 1656	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	108
PID 2200 wrote to memory of 1036	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	110
PID 2200 wrote to memory of 1036	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	110
PID 2200 wrote to memory of 1036	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	110
PID 2200 wrote to memory of 1528	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	112
PID 2200 wrote to memory of 1528	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	112
PID 2200 wrote to memory of 1528	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	112
PID 2200 wrote to memory of 4100	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	114
PID 2200 wrote to memory of 4100	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	114
PID 2200 wrote to memory of 4100	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	114
PID 2200 wrote to memory of 3352	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	116
PID 2200 wrote to memory of 3352	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	116
PID 2200 wrote to memory of 3352	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	116
PID 2200 wrote to memory of 2896	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	118
PID 2200 wrote to memory of 2896	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	118
PID 2200 wrote to memory of 2896	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	118
PID 2200 wrote to memory of 2032	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	120
PID 2200 wrote to memory of 2032	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	120
PID 2200 wrote to memory of 2032	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	120
PID 2200 wrote to memory of 1800	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	122
PID 2200 wrote to memory of 1800	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	122
PID 2200 wrote to memory of 1800	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	122
PID 2200 wrote to memory of 1292	2200	2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe	124

C:\Users\Admin\AppData\Local\Temp\2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2721c9f935887740aa050dcf415f7478_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1668
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3404
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1264
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:3012
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:748
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3808
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4540
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2760
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2464
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4436
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1260
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4408
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3196
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1656
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1036
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1528
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4100
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3352
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2896
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2032
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1800
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1292
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4416
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3984
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2064
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3532
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2820
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:3264
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:8
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2092
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3504
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:344
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:568
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4544
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3312
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4368
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4776
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4124
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3280
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4632
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:220
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3248
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1492
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3704
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2756
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1852
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4420
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:868
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1896
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4848
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2572
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1128
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3036
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:864
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3888
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3788
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3852
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:5064
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:760
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1196
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4080
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1720
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4120
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4328
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3556
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:5004
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1592
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1364
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4484
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:3708
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:5100
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2728
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4136
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1280
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3972
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1224
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3680
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3760
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1584
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:548
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2808
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:884
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:5076
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1404
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2456
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4664
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3496
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1356
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3040
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:448
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2700
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4976
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3356
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1944
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1088
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3428
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4788
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4516
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:560
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1804
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1996
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2344
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3624