bb991fca7c49a462e444ca4beea52b7efcdc2ceaa3fa8e675ee55984ac221ee0

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
Size

69KB
MD5

76b8ac4e354950ae184aad3ce40a3db7
SHA1

c1a2b09436bce3b7eb15cb7e0810410f8efdd865
SHA256

bb991fca7c49a462e444ca4beea52b7efcdc2ceaa3fa8e675ee55984ac221ee0
SHA512

13f4356a85d190783aaf901643e87a6f1387d78b21ea8ec70ea7ef307946041c9a2c58728112b9cc03885f556b087388431c86604fa3f298aaf5c098e47f2588
SSDEEP

1536:PZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAwfMqqU+2bbbAV2/S2Lkvd9:nBounVyFHpfMqqDL2/Lkvd

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqnxwgdmqqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe"	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\M:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\Q:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\G:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\H:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\K:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\T:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\I:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\O:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\R:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\V:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\X:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\Y:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\Z:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\B:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\P:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\S:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\N:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\U:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\W:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\A:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\E:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\J:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2860	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	28
PID 1364 wrote to memory of 2860	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	28
PID 1364 wrote to memory of 2860	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	28
PID 1364 wrote to memory of 2860	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	28
PID 1364 wrote to memory of 2916	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	30
PID 1364 wrote to memory of 2916	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	30
PID 1364 wrote to memory of 2916	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	30
PID 1364 wrote to memory of 2916	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	30
PID 1364 wrote to memory of 2664	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	33
PID 1364 wrote to memory of 2664	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	33
PID 1364 wrote to memory of 2664	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	33
PID 1364 wrote to memory of 2664	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	33
PID 1364 wrote to memory of 2576	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	35
PID 1364 wrote to memory of 2576	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	35
PID 1364 wrote to memory of 2576	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	35
PID 1364 wrote to memory of 2576	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	35
PID 1364 wrote to memory of 2592	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	37
PID 1364 wrote to memory of 2592	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	37
PID 1364 wrote to memory of 2592	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	37
PID 1364 wrote to memory of 2592	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	37
PID 1364 wrote to memory of 2520	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	39
PID 1364 wrote to memory of 2520	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	39
PID 1364 wrote to memory of 2520	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	39
PID 1364 wrote to memory of 2520	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	39
PID 1364 wrote to memory of 2624	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	41
PID 1364 wrote to memory of 2624	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	41
PID 1364 wrote to memory of 2624	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	41
PID 1364 wrote to memory of 2624	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	41
PID 1364 wrote to memory of 2432	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	43
PID 1364 wrote to memory of 2432	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	43
PID 1364 wrote to memory of 2432	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	43
PID 1364 wrote to memory of 2432	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	43
PID 1364 wrote to memory of 2496	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	45
PID 1364 wrote to memory of 2496	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	45
PID 1364 wrote to memory of 2496	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	45
PID 1364 wrote to memory of 2496	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	45
PID 1364 wrote to memory of 2892	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	47
PID 1364 wrote to memory of 2892	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	47
PID 1364 wrote to memory of 2892	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	47
PID 1364 wrote to memory of 2892	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	47
PID 1364 wrote to memory of 1896	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	49
PID 1364 wrote to memory of 1896	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	49
PID 1364 wrote to memory of 1896	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	49
PID 1364 wrote to memory of 1896	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	49
PID 1364 wrote to memory of 1768	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	51
PID 1364 wrote to memory of 1768	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	51
PID 1364 wrote to memory of 1768	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	51
PID 1364 wrote to memory of 1768	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	51
PID 1364 wrote to memory of 1200	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	53
PID 1364 wrote to memory of 1200	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	53
PID 1364 wrote to memory of 1200	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	53
PID 1364 wrote to memory of 1200	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	53
PID 1364 wrote to memory of 1912	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	55
PID 1364 wrote to memory of 1912	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	55
PID 1364 wrote to memory of 1912	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	55
PID 1364 wrote to memory of 1912	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	55
PID 1364 wrote to memory of 1900	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	57
PID 1364 wrote to memory of 1900	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	57
PID 1364 wrote to memory of 1900	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	57
PID 1364 wrote to memory of 1900	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	57
PID 1364 wrote to memory of 948	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	59
PID 1364 wrote to memory of 948	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	59
PID 1364 wrote to memory of 948	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	59
PID 1364 wrote to memory of 948	1364	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	59

C:\Users\Admin\AppData\Local\Temp\76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2860
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2916
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2664
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2576
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2592
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2520
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2624
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2432
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2496
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2892
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1896
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1768
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1200
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1912
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1900
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:948
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2152
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1856
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1284
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1572
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1568
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2876
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2728
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2060
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1212
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1428
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:268
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1472
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:840
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2308
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2272
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3032
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1884
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1812
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1888
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2064
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1116
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3044
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2232
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1740
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2972
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1596
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2516
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2856
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2820
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2564
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2696
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2616
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2632
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2476
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2156
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2504
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3004
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2288
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1560
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2000
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2012
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2212
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2344
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:808
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1668
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1628
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2776
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2720
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1872
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2108
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:704
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2120
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1984
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1296
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1040
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2940
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1124
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1816
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1892
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:3036
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2412
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2832
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1956
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2072
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2968
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2872
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2924
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2812
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2280
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1684
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2440
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2700
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2644
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2544
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2428
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1848
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1644
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:804
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2500
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1204
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2028
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:852