dbf0b7ed54f95802d589b2642b3d2cc7ae2e7f0a702480d49afaad1afae4042b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
Size

69KB
MD5

654d4156385fbca5136e8634898d471c
SHA1

5577919248a30be225bd54924b516fe19ecee9ca
SHA256

dbf0b7ed54f95802d589b2642b3d2cc7ae2e7f0a702480d49afaad1afae4042b
SHA512

88052d23cb15c01c339df87c50c71a668135be731d0526291347a4758ccf30e31d1bbf0e0b6e3ac674d70b53188c89eedd5f0d440775a9bbad44354800570c04
SSDEEP

1536:4ZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAwfMqqU+2bbbAV2/S2Lkvd9:2BounVyFHpfMqqDL2/Lkvd

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

654d4156385fbca5136e8634898d471c_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vyzhcevfsql = "C:\\Users\\Admin\\AppData\\Local\\Temp\\654d4156385fbca5136e8634898d471c_JaffaCakes118.exe"	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

654d4156385fbca5136e8634898d471c_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\W:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\Z:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\K:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\Q:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\U:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\L:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\M:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\N:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\O:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\P:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\B:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\G:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\I:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\R:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\S:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\Y:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\X:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\E:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\J:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\V:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\A:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\H:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
File opened (read-only)	\??\T:	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

654d4156385fbca5136e8634898d471c_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

654d4156385fbca5136e8634898d471c_JaffaCakes118.exe

pid process

2204 654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
2204 654d4156385fbca5136e8634898d471c_JaffaCakes118.exe

pid	process
2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

654d4156385fbca5136e8634898d471c_JaffaCakes118.exe

description	pid	process	target process
PID 2204 wrote to memory of 2376	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2376	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2376	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2376	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 1608	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 1608	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 1608	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 1608	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2120	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2120	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2120	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2120	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2684	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2684	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2684	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2684	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2620	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2620	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2620	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2620	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2600	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2600	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2600	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2600	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2880	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2880	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2880	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2880	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2848	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2848	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2848	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2848	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2632	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2632	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2632	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2632	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2464	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2464	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2464	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2464	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2508	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2508	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2508	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2508	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2964	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2964	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2964	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2964	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 1668	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 1668	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 1668	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 1668	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 1444	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 1444	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 1444	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 1444	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2156	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2156	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2156	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2156	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2148	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2148	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2148	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe
PID 2204 wrote to memory of 2148	2204	654d4156385fbca5136e8634898d471c_JaffaCakes118.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\654d4156385fbca5136e8634898d471c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\654d4156385fbca5136e8634898d471c_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2376
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1608
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2120
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2684
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2620
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2600
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2880
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2848
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2632
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2464
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2508
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2964
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1668
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1444
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2156
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2148
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1560
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1724
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1788
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2112
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2536
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1248
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2744
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2728
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2820
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2504
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2808
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:784
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1420
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1680
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1776
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1968
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:704
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2000
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:868
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1596
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1544
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2348
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2208
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1200
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1212
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:884
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1892
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2420
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2424
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1852
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2668
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2772
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2888
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2472
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2616
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:3052
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2512
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2476
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2524
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3012
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1080
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1612
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1356
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2144
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2176
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1456
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1240
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:860
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2644
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2656
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1952
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3068
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:536
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:564
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:584
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1092
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:908
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:832
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1208
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:612
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1256
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2320
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:992
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3016
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2212
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1704
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2196
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1644
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1980
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:324
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2868
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1876
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2784
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2884
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2008
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2416
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2364
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2840
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2580
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2496
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2968
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1988
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2104
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2356
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:296
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:548
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1452
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:844
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:848
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2804
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1848
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:668
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1152
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:484
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:984
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:300