fc0fd4c67817dbfa54e7373e8021ecce7a557cd39c9e0081a0ea34925c266c9c

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
Size

69KB
MD5

761bd61eb7e66e8cf748ccb5192b5a00
SHA1

c7761fa60c36677590cc62a4f94153475e9c4928
SHA256

fc0fd4c67817dbfa54e7373e8021ecce7a557cd39c9e0081a0ea34925c266c9c
SHA512

96e4095610c993949f6b027a471ffb2c72fddfa1b65c7b3ee1c4941b620cca8db0e2a9367a69b4781a035b5ab7f3b01344f11532292f2e43898a4bb84fbaba9b
SSDEEP

1536:zZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAwfMqqU+2bbbAV2/S2Lkvd9:DBounVyFHpfMqqDL2/Lkvd

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pbcsaijdxls = "C:\\Users\\Admin\\AppData\\Local\\Temp\\761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe"	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\G:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\K:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\P:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\T:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\U:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\X:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\B:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\Y:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\O:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\S:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\W:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\Z:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\M:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\I:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\L:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\N:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\Q:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\V:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\H:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\J:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\R:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
File opened (read-only)	\??\A:	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 2372	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	89
PID 4064 wrote to memory of 2372	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	89
PID 4064 wrote to memory of 2372	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	89
PID 4064 wrote to memory of 3896	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	91
PID 4064 wrote to memory of 3896	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	91
PID 4064 wrote to memory of 3896	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	91
PID 4064 wrote to memory of 2424	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	93
PID 4064 wrote to memory of 2424	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	93
PID 4064 wrote to memory of 2424	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	93
PID 4064 wrote to memory of 5108	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	95
PID 4064 wrote to memory of 5108	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	95
PID 4064 wrote to memory of 5108	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	95
PID 4064 wrote to memory of 4660	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	97
PID 4064 wrote to memory of 4660	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	97
PID 4064 wrote to memory of 4660	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	97
PID 4064 wrote to memory of 2236	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	101
PID 4064 wrote to memory of 2236	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	101
PID 4064 wrote to memory of 2236	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	101
PID 4064 wrote to memory of 392	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	105
PID 4064 wrote to memory of 392	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	105
PID 4064 wrote to memory of 392	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	105
PID 4064 wrote to memory of 2228	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	108
PID 4064 wrote to memory of 2228	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	108
PID 4064 wrote to memory of 2228	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	108
PID 4064 wrote to memory of 1392	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	110
PID 4064 wrote to memory of 1392	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	110
PID 4064 wrote to memory of 1392	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	110
PID 4064 wrote to memory of 2288	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	112
PID 4064 wrote to memory of 2288	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	112
PID 4064 wrote to memory of 2288	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	112
PID 4064 wrote to memory of 3332	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	114
PID 4064 wrote to memory of 3332	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	114
PID 4064 wrote to memory of 3332	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	114
PID 4064 wrote to memory of 4620	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	118
PID 4064 wrote to memory of 4620	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	118
PID 4064 wrote to memory of 4620	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	118
PID 4064 wrote to memory of 1820	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	120
PID 4064 wrote to memory of 1820	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	120
PID 4064 wrote to memory of 1820	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	120
PID 4064 wrote to memory of 3912	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	123
PID 4064 wrote to memory of 3912	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	123
PID 4064 wrote to memory of 3912	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	123
PID 4064 wrote to memory of 3712	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	125
PID 4064 wrote to memory of 3712	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	125
PID 4064 wrote to memory of 3712	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	125
PID 4064 wrote to memory of 1456	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	127
PID 4064 wrote to memory of 1456	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	127
PID 4064 wrote to memory of 1456	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	127
PID 4064 wrote to memory of 1660	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	129
PID 4064 wrote to memory of 1660	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	129
PID 4064 wrote to memory of 1660	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	129
PID 4064 wrote to memory of 2232	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	131
PID 4064 wrote to memory of 2232	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	131
PID 4064 wrote to memory of 2232	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	131
PID 4064 wrote to memory of 2788	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	133
PID 4064 wrote to memory of 2788	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	133
PID 4064 wrote to memory of 2788	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	133
PID 4064 wrote to memory of 4576	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	135
PID 4064 wrote to memory of 4576	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	135
PID 4064 wrote to memory of 4576	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	135
PID 4064 wrote to memory of 4052	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	137
PID 4064 wrote to memory of 4052	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	137
PID 4064 wrote to memory of 4052	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	137
PID 4064 wrote to memory of 3156	4064	761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe	139

C:\Users\Admin\AppData\Local\Temp\761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\761bd61eb7e66e8cf748ccb5192b5a00_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2372
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3896
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2424
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:5108
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4660
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2236
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:392
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2228
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1392
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2288
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3332
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4620
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1820
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3912
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3712
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1456
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1660
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2232
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2788
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4576
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4052
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:3156
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2964
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:5024
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:696
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4920
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4480
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4928
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4568
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3660
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1156
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3932
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2864
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1980
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3572
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1304
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2832
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4320
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4836
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:3884
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4524
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4488
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1712
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1372
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2356
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2256
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4780
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:436
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3576
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1624
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1988
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4244
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4508
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1416
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4960
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4100
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2936
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:884
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3968
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1436
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1796
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3580
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2348
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1628
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4792
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1468
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:852
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4396
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:5012
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1596
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3676
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:676
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3196
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2428
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3176
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2444
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1772
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3456
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1080
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2540
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3316
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2404
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2164
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:932
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3588
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1780
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3632
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1812
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2012
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3116
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3112
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:4212