bb991fca7c49a462e444ca4beea52b7efcdc2ceaa3fa8e675ee55984ac221ee0

Analysis

max time kernel
153s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
Size

69KB
MD5

76b8ac4e354950ae184aad3ce40a3db7
SHA1

c1a2b09436bce3b7eb15cb7e0810410f8efdd865
SHA256

bb991fca7c49a462e444ca4beea52b7efcdc2ceaa3fa8e675ee55984ac221ee0
SHA512

13f4356a85d190783aaf901643e87a6f1387d78b21ea8ec70ea7ef307946041c9a2c58728112b9cc03885f556b087388431c86604fa3f298aaf5c098e47f2588
SSDEEP

1536:PZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAwfMqqU+2bbbAV2/S2Lkvd9:nBounVyFHpfMqqDL2/Lkvd

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hamafaammel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe"	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\P:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\T:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\Z:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\G:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\I:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\L:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\J:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\M:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\U:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\V:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\A:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\B:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\H:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\K:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\R:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\X:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\S:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\W:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\Y:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\E:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\O:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
File opened (read-only)	\??\Q:	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 568	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	90
PID 5108 wrote to memory of 568	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	90
PID 5108 wrote to memory of 568	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	90
PID 5108 wrote to memory of 1592	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	92
PID 5108 wrote to memory of 1592	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	92
PID 5108 wrote to memory of 1592	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	92
PID 5108 wrote to memory of 3984	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	94
PID 5108 wrote to memory of 3984	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	94
PID 5108 wrote to memory of 3984	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	94
PID 5108 wrote to memory of 464	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	96
PID 5108 wrote to memory of 464	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	96
PID 5108 wrote to memory of 464	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	96
PID 5108 wrote to memory of 368	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	98
PID 5108 wrote to memory of 368	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	98
PID 5108 wrote to memory of 368	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	98
PID 5108 wrote to memory of 1436	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	102
PID 5108 wrote to memory of 1436	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	102
PID 5108 wrote to memory of 1436	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	102
PID 5108 wrote to memory of 1412	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	106
PID 5108 wrote to memory of 1412	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	106
PID 5108 wrote to memory of 1412	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	106
PID 5108 wrote to memory of 3812	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	108
PID 5108 wrote to memory of 3812	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	108
PID 5108 wrote to memory of 3812	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	108
PID 5108 wrote to memory of 1984	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	111
PID 5108 wrote to memory of 1984	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	111
PID 5108 wrote to memory of 1984	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	111
PID 5108 wrote to memory of 3428	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	113
PID 5108 wrote to memory of 3428	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	113
PID 5108 wrote to memory of 3428	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	113
PID 5108 wrote to memory of 2756	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	117
PID 5108 wrote to memory of 2756	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	117
PID 5108 wrote to memory of 2756	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	117
PID 5108 wrote to memory of 3600	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	119
PID 5108 wrote to memory of 3600	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	119
PID 5108 wrote to memory of 3600	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	119
PID 5108 wrote to memory of 2440	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	122
PID 5108 wrote to memory of 2440	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	122
PID 5108 wrote to memory of 2440	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	122
PID 5108 wrote to memory of 4912	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	124
PID 5108 wrote to memory of 4912	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	124
PID 5108 wrote to memory of 4912	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	124
PID 5108 wrote to memory of 560	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	126
PID 5108 wrote to memory of 560	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	126
PID 5108 wrote to memory of 560	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	126
PID 5108 wrote to memory of 1152	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	128
PID 5108 wrote to memory of 1152	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	128
PID 5108 wrote to memory of 1152	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	128
PID 5108 wrote to memory of 4312	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	130
PID 5108 wrote to memory of 4312	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	130
PID 5108 wrote to memory of 4312	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	130
PID 5108 wrote to memory of 2760	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	132
PID 5108 wrote to memory of 2760	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	132
PID 5108 wrote to memory of 2760	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	132
PID 5108 wrote to memory of 4680	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	134
PID 5108 wrote to memory of 4680	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	134
PID 5108 wrote to memory of 4680	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	134
PID 5108 wrote to memory of 3768	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	136
PID 5108 wrote to memory of 3768	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	136
PID 5108 wrote to memory of 3768	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	136
PID 5108 wrote to memory of 2268	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	138
PID 5108 wrote to memory of 2268	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	138
PID 5108 wrote to memory of 2268	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	138
PID 5108 wrote to memory of 4420	5108	76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe	140

C:\Users\Admin\AppData\Local\Temp\76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\76b8ac4e354950ae184aad3ce40a3db7_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:568
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1592
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3984
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:464
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:368
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1436
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1412
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3812
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1984
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:3428
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2756
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3600
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2440
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4912
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:560
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1152
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4312
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:2760
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4680
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3768
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2268
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4420
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2508
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3688
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:5032
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4672
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:5116
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2604
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4120
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4592
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4688
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4560
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2816
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1060
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:412
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:440
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2068
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1236
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1752
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4608
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1420
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4948
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:2284
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4244
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3188
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4412
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4540
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1292
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4260
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3664
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1792
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2632
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2244
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:572
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4928
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3796
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4508
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4404
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:4864
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1640
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4428
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:736
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2776
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4192
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2808
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1452
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3344
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2928
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1568
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1676
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:2436
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:1744
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3532
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:2592
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2984
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:1464
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3724
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:3472
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4104
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:4544
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3288
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2880
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:1556