fff353e606e24df45624a828b3ab2d298e3663f6d091900747dc0237cbd041e5

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Size 69KB
Sample260823-kwp8qsvejf
SHA256 fff353e606e24df45624a828b3ab2d298e3663f6d091900747dc0237cbd041e5
MD5 4957d06ee6ee61353e535d84b77a13c6
SHA1 bb1224935868fe19f623cc0118426228d382b6d1
SHA512 732546a0b000d66bae510716c0a0e004dda3ba00a7745e203cb95ab0bb1808865294efda08a8397bb423211240494431b54292528ee3f0679a61bf472c1aeeee
SSDEEP 1536:vZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAwfMqqU+2bbbAV2/S2Lkvd9:HBounVyFHpfMqqDL2/Lkvd
TLSH
T102636A0EA2E1A193E1F357B9FA757E65446E3D203B289BDB099359852D630F0793B303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jlbwjzztykz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe"	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\U:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\D:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\G:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\K:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\N:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\O:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\P:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\S:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\V:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\J:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\R:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\W:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\X:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\Y:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\H:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\Z:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\A:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\B:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\I:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\L:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\M:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
File opened (read-only)	\??\Q:	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
Token: SeDebugPrivilege	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 5928	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	92
PID 4376 wrote to memory of 4564	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	94
PID 4376 wrote to memory of 4452	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	96
PID 4376 wrote to memory of 1332	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	98
PID 4376 wrote to memory of 2392	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	100
PID 4376 wrote to memory of 4240	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	102
PID 4376 wrote to memory of 1032	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	104
PID 4376 wrote to memory of 1840	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	106
PID 4376 wrote to memory of 4448	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	108
PID 4376 wrote to memory of 4408	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	110
PID 4376 wrote to memory of 2444	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	112
PID 4376 wrote to memory of 5696	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	114
PID 4376 wrote to memory of 1532	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	116
PID 4376 wrote to memory of 1908	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	118
PID 4376 wrote to memory of 4916	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	120
PID 4376 wrote to memory of 5072	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	122
PID 4376 wrote to memory of 3296	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	124
PID 4376 wrote to memory of 1136	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	127
PID 4376 wrote to memory of 4152	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	129
PID 4376 wrote to memory of 3576	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	131
PID 4376 wrote to memory of 2396	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	133
PID 4376 wrote to memory of 5960	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	135
PID 4376 wrote to memory of 5316	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	137
PID 4376 wrote to memory of 4956	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	139
PID 4376 wrote to memory of 1248	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	141
PID 4376 wrote to memory of 5128	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	143
PID 4376 wrote to memory of 2496	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	145
PID 4376 wrote to memory of 4752	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	147
PID 4376 wrote to memory of 404	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	149
PID 4376 wrote to memory of 2476	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	151
PID 4376 wrote to memory of 2796	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	153
PID 4376 wrote to memory of 5408	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	155
PID 4376 wrote to memory of 2696	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	157
PID 4376 wrote to memory of 5908	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	159
PID 4376 wrote to memory of 5656	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	161
PID 4376 wrote to memory of 2700	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	163
PID 4376 wrote to memory of 4948	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	165
PID 4376 wrote to memory of 5840	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	167
PID 4376 wrote to memory of 4852	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	169
PID 4376 wrote to memory of 4140	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	171
PID 4376 wrote to memory of 1380	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	173
PID 4376 wrote to memory of 5804	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	175
PID 4376 wrote to memory of 872	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	177
PID 4376 wrote to memory of 996	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	179
PID 4376 wrote to memory of 1132	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	181
PID 4376 wrote to memory of 2004	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	183
PID 4376 wrote to memory of 2916	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	185
PID 4376 wrote to memory of 6072	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	187
PID 4376 wrote to memory of 5516	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	189
PID 4376 wrote to memory of 3444	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	191
PID 4376 wrote to memory of 2788	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	193
PID 4376 wrote to memory of 2704	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	195
PID 4376 wrote to memory of 5600	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	197
PID 4376 wrote to memory of 4984	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	199
PID 4376 wrote to memory of 3612	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	201
PID 4376 wrote to memory of 1964	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	203
PID 4376 wrote to memory of 1624	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	205
PID 4376 wrote to memory of 1472	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	207
PID 4376 wrote to memory of 1784	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	209
PID 4376 wrote to memory of 4356	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	211
PID 4376 wrote to memory of 5332	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	213
PID 4376 wrote to memory of 3116	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	215
PID 4376 wrote to memory of 2952	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	217
PID 4376 wrote to memory of 4876	4376	2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe	219

C:\Users\Admin\AppData\Local\Temp\2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5928
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4564
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4452
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1332
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2392
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4240
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:1032
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1840
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4448
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4408
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2444
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5696
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1532
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1908
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4916
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:5072
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3296
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1136
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4152
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3576
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2396
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5960
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:5316
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4956
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1248
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5128
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2496
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4752
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:404
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2476
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2796
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5408
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2696
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5908
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5656
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2700
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:4948
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:5840
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:4852
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:4140
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:1380
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5804
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:872
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:996
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1132
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2004
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2916
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6072
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5516
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3444
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2788
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:2704
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5600
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4984
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3612
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1964
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1624
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1472
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1784
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4356
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5332
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3116
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:2952
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4876
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5508
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4856
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3468
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:3820
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1812
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4844
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4328
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  PID:4796
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3000
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:1600
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:1060
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1932
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5668
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4896
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2668
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2340
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4664
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  PID:5724
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:3568
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3868
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1880
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  PID:5740
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1260
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns2.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4120
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns2.soprodns.ru
  2⤵
  PID:5956
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2792
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.coin dns1.soprodns.ru
  2⤵
  PID:3180
- C:\Windows\SysWOW64\nslookup.exe
  nslookup nomoreransom.bit dns1.soprodns.ru
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5812
- C:\Windows\SysWOW64\nslookup.exe
  nslookup gandcrab.bit dns2.soprodns.ru
  2⤵
  PID:3224

C:\Users\Admin\AppData\Local\Temp\2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-22_4957d06ee6ee61353e535d84b77a13c6_elex_gandcrab.exe
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:4980