Static task
static1
Behavioral task
behavioral1
Sample
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe
Resource
win10-en-20211208
General
-
Target
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485
-
Size
164KB
-
MD5
9935b34b16a93eb2ef874cfd4501cb7f
-
SHA1
4871435f17541c2c0cf01092bcd38d4869368a08
-
SHA256
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485
-
SHA512
55391e39d8096a7103851f8ca7de7de99866ceb66138728db736da8840bf17fdfac256638634d02a079beaacce36e0f7d117cef2109094921da2fe0c7f01804e
-
SSDEEP
1536:bs2B7p26CaItF5gNHhKWluLpWmRHICS4AH3o/qTneyW7ZZOBml2uBbKbxoVgAy6:9fg0NBlu9CNTed7/kBazzFbULeZIN
Malware Config
Extracted
sodinokibi
39
708
deduktia.fi
skyscanner.ro
the3-week-diet.net
witraz.pl
dayenne-styling.nl
internestdigital.com
hawthornsretirement.co.uk
bodet150ans.com
tothebackofthemoon.com
line-x.co.uk
fixx-repair.com
walterman.es
campusescalade.com
shrinkingplanet.com
kausette.com
bluemarinefoundation.com
fla.se
dantreranch.com
acumenconsultingcompany.com
bruut.online
innovationgames-brabant.nl
richardkershawwines.co.za
sweetz.fr
luvinsburger.fr
chinowarehousespace.com
jacquesgarcianoto.com
ruggestar.ch
p-ride.live
brannbornfastigheter.se
heuvelland-oaze.nl
goddardleadership.org
mondolandscapes.com
nicksrock.com
baita.ac
tchernia-conseil.fr
pokemonturkiye.com
drbenveniste.com
parseport.com
aktivfriskcenter.se
andreaskildegaard.dk
landgoedspica.nl
customroasts.com
bagaholics.in
wribrazil.com
ceocenters.com
nrgvalue.com
renehartman.nl
espaciopolitica.com
animalfood-online.de
fidelitytitleoregon.com
profiz.com
mazift.dk
edvestors.org
relevantonline.eu
slotenmakerszwijndrecht.nl
sshomme.com
pinthelook.com
ijsselbeton.nl
cincinnatiphotocompany.org
gardenpartner.pl
web865.com
ledyoucan.com
skolaprome.eu
hom-frisor.dk
bjornvanvulpen.nl
fire-space.com
factoriareloj.com
tesisatonarim.com
mbuildinghomes.com
internalresults.com
jimprattmediations.com
bakingismyyoga.com
mundo-pieces-auto.fr
sber-biznes.com
schlagbohrmaschinetests.com
utilisacteur.fr
penumbuhrambutkeiskei.com
professionetata.com
encounter-p.net
santastoy.store
uncensoredhentaigif.com
ronielyn.com
proffteplo.com
easydental.ae
zumrutkuyutemel.com
metriplica.academy
geoweb.software
kvetymichalovce.sk
muni.pe
mazzaropi.com.br
mrmac.com
k-zubki.ru
juergenblaetz.de
chainofhopeeurope.eu
markseymourphotography.co.uk
xn--80abehgab4ak0ddz.xn--p1ai
sprintcoach.com
bayshoreelite.com
bcmets.info
cainlaw-okc.com
chomiksy.net
baptistdistinctives.org
livedeveloper.com
lumturo.academy
lollachiro.com
the5thquestion.com
mayprogulka.ru
dreamvoiceclub.org
parisschool.ru
malevannye.ru
qrs-international.com
renderbox.ch
istantidigitali.com
testitjavertailut.net
rokthetalk.com
purepreprod4.com
aidanpublishing.co.uk
oexebusiness.com
laylavalentine.com
airserviceunlimited.com
global-migrate.com
kombi-dress.com
voetbalhoogeveen.nl
bubbalucious.com
alltagsrassismus-entknoten.de
albcleaner.fr
peppergreenfarmcatering.com.au
angeleyezstripclub.com
creohn.de
catering.com
k-v-f.de
andrealuchesi.it
karelinjames.com
ykobbqchicken.ca
envomask.com
toranjtuition.org
belinda.af
kdbrh.com
brisbaneosteopathic.com.au
sambaglow.com
jmmartinezilustrador.com
interlinkone.com
aciscomputers.com
pajagus.fr
whoopingcrane.com
dinecorp.com
tieronechic.com
awaisghauri.com
mikegoodfellow.co.uk
c-sprop.com
trivselsguide.dk
bertbutter.nl
hepishopping.com
apmollerpension.com
lesyeuxbleus.net
oraweb.net
racefietsenblog.nl
theatre-embellie.fr
irizar.com
awag-blog.de
lapponiasafaris.com
jandhpest.com
nuohous.com
banukumbak.com
logosindustries.com
hostastay.com
cardsandloyalty.com
volta.plus
furland.ru
kuriero.pro
apogeeconseils.fr
polynine.com
topautoinsurers.net
glas-kuck.de
augen-praxisklinik-rostock.de
smartmind.net
advanced-removals.co.uk
mamajenedesigns.com
evsynthacademy.org
zealcon.ae
oro.ae
johnkoen.com
brinkdoepke.eu
richardiv.com
xn--ziinoapte-6ld.ro
metroton.ru
agriturismocastagneto.it
azloans.com
jobscore.com
pilotgreen.com
yournextshoes.com
ziliak.com
focuskontur.com
galaniuklaw.com
agenceassemble.fr
designimage.ae
biketruck.de
fluzfluzrewards.com
computer-place.de
pays-saint-flour.fr
molinum.pt
boyfriendsgoal.site
golfclublandgoednieuwkerk.nl
nevadaruralhousingstudies.org
lattalvor.com
cac2040.com
innervisions-id.com
mahikuchen.com
narca.net
karmeliterviertel.com
forumsittard.nl
spirello.nl
mercadodelrio.com
skinkeeper.li
pharmeko-group.com
eshop.design
skidpiping.de
buerocenter-butzbach-werbemittel.de
mrcar.nl
theboardroomafrica.com
triplettabordeaux.fr
kroophold-sjaelland.dk
rishigangoly.com
rino-gmbh.com
redpebblephotography.com
condormobile.fr
dmlcpa.com
frameshift.it
ygallerysalonsoho.com:443
zaczytana.com
olry-cloisons.fr
bonitabeachassociation.com
ownidentity.com
nieuwsindeklas.be
bg.szczecin.pl
outstandingminialbums.com
limmortelyouth.com
ebible.co
watchsale.biz
arthakapitalforvaltning.dk
leansupremegarcinia.net
ahgarage.com
zuerich-umzug.ch
taulunkartano.fi
cssp-mediation.org
b3b.ch
latableacrepes-meaux.fr
marcandy.com
carsten.sparen-it.de
ciga-france.fr
turing.academy
paprikapod.com
ocduiblog.com
netadultere.fr
kiraribeaute-nani.com
spartamovers.com
arearugcleaningnyc.com
randyabrown.com
explora.nl
site.markkit.com.br
advance-refle.com
altitudeboise.com
lidkopingsnytt.nu
secrets-clubs.co.uk
nationnewsroom.com
perfectgrin.com
motocrosshideout.com
rentingwell.com
atrgroup.it
publicompserver.de
lashandbrowenvy.com
stathmoulis.gr
ufovidmag.com
alcye.com
globalskills.pt
artvark.nl
citydogslife.com
the-cupboard.co.uk
latteswithleslie.com
curtsdiscountguns.com
pankiss.ru
pansionatblago.ru
reputation-medical.online
makingmillionaires.net
bundan.com
bookingwheel.com
speiserei-hannover.de
moira-cristescu.com
teethinadaydentalimplants.com
glennverschueren.be
greenrider.nl
ya-elka.ru
annida.it
tramadolhealth.com
elliemaccreative.wordpress.com
amorbellezaysalud.com
yourcosmicbeing.com
liveyourheartout.co
breakluckrecords.com
valiant-voice.com
thenalpa.com
drbrianhweeks.com
alene.co
maxcube24.com.ua
jaaphoekzema.nl
indiebizadvocates.org
biblica.com
bulyginnikitav.000webhostapp.com
strauchs-wanderlust.info
sarahspics.co.uk
blueridgeheritage.com
clinic-beethovenstrasse-ag.ch
gosouldeep.com
spectamarketingdigital.com.br
buonabitare.com
levelseven.be
specialtyhomeservicesllc.com
wrinstitute.org
physio-lang.de
stagefxinc.com
diverfiestas.com.es
gratiocafeblog.wordpress.com
kryddersnapsen.dk
solidhosting.nl
edrickennedymacfoy.com
simpleitsolutions.ch
paardcentraal.nl
cl0nazepamblog.com
finnergo.eu
goodherbalhealth.com
mike.matthies.de
wirmuessenreden.com
bellesiniacademy.org
daveystownhouse.com
fi-institutionalfunds.com
hvitfeldt.dk
geitoniatonaggelon.gr
fann.ru
linearete.com
oscommunity.de
activeterroristwarningcompany.com
prometeyagro.com.ua
go.labibini.ch
thepixelfairy.com
cesep2019.com
auto-opel.ro
larchwoodmarketing.com
ivancacu.com
smarttourism.academy
kerstliedjeszingen.nl
fskhjalmar.se
bridalcave.com
miscbo.it
jobkiwi.com.ng
theater-lueneburg.de
techybash.com
hotelturbo.de
hutchstyle.co.uk
breathebettertolivebetter.com
cops4causes.org
lyricalduniya.com
michal-s.co.il
bohrlochversicherung.info
sppdstats.com
phoenixcrane.com
kosten-vochtbestrijding.be
5pointpt.com
ingresosextras.online
tastevirginia.com
denhaagfoodie.nl
victorvictoria.com
coachpreneuracademy.com
magnetvisual.com
annenymus.com
imagine-entertainment.com
yuanshenghotel.com
dentallabor-luenen.de
cleanroomequipment.ie
radishallgood.com
teutoradio.de
signededenroth.dk
tradenavigator.ch
efficiencyconsulting.es
cc-experts.de
palema.gr
log-barn.co.uk
singletonfinancial.com
advancedeyecare.com
lookandseen.com
otpusk.zp.ua
molade.nl
slotspinner.com
leopoldineroux.com
premier-iowa.com
pourlabretagne.bzh
baikalflot.ru
sochi-okna23.ru
akwaba-safaris.com
groovedealers.ru
triavlete.com
johnsonweekly.com
inewsstar.com
druktemakersheerenveen.nl
selected-minds.de
towelroot.co
smartworkplaza.com
cuadc.org
airvapourbarrier.com
schulz-moelln.de
autoteamlast.de
akcadagofis.com
myfbateam.com
jayfurnitureco.com
muller.nl
kickittickets.com
elitkeramika-shop.com.ua
rechtenplicht.be
grancanariaregional.com
ilovefullcircle.com
nginx.com
amelielecompte.wordpress.com
kookooo.com
devus.de
phukienbepthanhdat.com
louiedager.com
pisofare.co
abulanov.com
suitesartemis.gr
yayasanprimaunggul.org
hensleymarketing.com
so-sage.fr
mjk.digital
qwikcoach.com
afbudsrejserallinclusive.dk
letsstopsmoking.co.uk
pixelhealth.net
fazagostar.co
cxcompany.com
aslog.fr
baumfinancialservices.com
flossmoordental.com
advesa.com
shortysspices.com
zwemofficial.nl
antesacademy.it
asiaartgallery.jp
loparnille.se
3daywebs.com
modamarfil.com
mangimirossana.it
galatee-couture.com
from02pro.com
finsahome.co.uk
rename.kz
artcase.pl
mursall.de
wasnederland.nl
napisat-pismo-gubernatoru.ru:443
qandmmusiccenter.com
metcalfe.ca
bychowo.pl
boomerslivinglively.com
acb-gruppe.ch
pvandambv.nl
benchbiz.com
die-immo-agentur.de
betterce.com
elex.is
katherinealy.com
smartspeak.com
protoplay.ca
teamsegeln.ch
wineandgo.hu
nutriwell.com.sg
brunoimmobilier.com
ronaldhendriks.nl
onlinemarketingsurgery.co.uk
bendel-partner.de
bavovrienden.nl
test-teleachat.fr
lovcase.com
business-basic.de
g2mediainc.com
rapid5kloan.org
reizenmetkinderen.be
oththukaruva.com
fta-media.com
glende-pflanzenparadies.de
unboxtherapy.site
trevi-vl.ru
rubyaudiology.com
fbmagazine.ru
palmecophilippines.com
cymru.futbol
yourhappyevents.fr
plbinsurance.com
frimec-international.es
eurethicsport.eu
leijstrom.com
fridakids.com
husetsanitas.dk
lovetzuchia.com
sytzedevries.com
universelle.fr
hameghlim.com
pinkxgayvideoawards.com
lexced.com
sachainchiuk.com
birthplacemag.com
tilldeeke.de
thestudio.academy
aheadloftladders.co.uk
jlwilsonbooks.com
opt4cdi.com
a-zpaperwork.eu
magrinya.net
reygroup.pt
levencovka.ru
veggienessa.com
atelierkomon.com
hinotruckwreckers.com.au
janmorgenstern.com
tetameble.pl
sellthewrightway.com
optigas.com
docarefoundation.org
cmeow.com
lifeinbreaths.com
primemarineengineering.com
alabamaroofingllc.com
martha-frets-ceramics.nl
jollity.hu
dieetuniversiteit.nl
cmascd.com
arazi.eus
chatterchatterchatter.com
springfieldplumbermo.com
vedsegaard.dk
etgdogz.de
parentsandkids.com
gbk-tp1.de
silkeight.com
tellthebell.website
eastgrinsteadwingchun.com
deziplan.ru
dinedrinkdetroit.com
ludoil.it
vitoriaecoturismo.com.br
crestgood.com
slideevents.be
aceroprime.com
beauty-traveller.com
webforsites.com
tages-geldvergleich.de
chatberlin.de
alpesiberie.com
broccolisoep.nl
zinnystar.com
silverbird.dk
blucamp.com
expohomes.com
photonag.com
manzel.tn
mgimalta.com
craftstone.co.nz
motocrossplace.co.uk
cascinarosa33.it
harleystreetspineclinic.com
parksideseniorliving.net
initconf.com
descargandoprogramas.com
lassocrm.com
blavait.fr
foerderverein-vatterschule.de
kenmccallum.com
lagschools.ng
iexpert99.com
onlinetvgroup.com
redctei.co
goodboyscustom.com
vitormmcosta.com
charlesfrancis.photos
therapybusinessacademy.com
wyreforest.net
hostaletdelsindians.es
janellrardon.com
trainiumacademy.com
lgiwines.com
keuken-prijs.nl
bratek-immobilien.de
xn--billigafrgpatroner-stb.se
michaelfiegel.com
ncn.nl
hartofurniture.com
der-stempelking.de
collegetennis.info
kompresory-opravy.com
successcolony.com.ng
jag.me
sjtpo.org
adedesign.com
kafkacare.com
startuplive.org
jdscenter.com
projektparkiet.pl
jalkapuu.net
linkbuilding.life
traitware.com
angelsmirrorus.com
lsngroupe.com
iron-mine.ru
naukaip.ru
imajyuku-sozoku.com
clemenfoto.dk
ninjaki.com
mac-computer-support-hamburg.de
citiscapes-art.com
salonlamar.nl
enews-qca.com
thiagoperez.com
nalliasmali.net
legundschiess.de
atma.nl
liverpoolabudhabi.ae
t3brothers.com
tatyanakopieva.ru
dennisverschuur.com
diakonie-weitramsdorf-sesslach.de
biodentify.ai
holocine.de
rolleepollee.com
saint-malo-developpement.fr
medicalsupportco.com
chris-anne.com
jglconsultancy.com
billigeflybilletter.dk
sveneulberg.de
peninggibadan.co.id
unislaw-narty.pl
kryptos72.com
tweedekansenloket.nl
omnicademy.com
cyberpromote.de
theintellect.edu.pk
animation-pro.co.uk
mieleshopping.it
pazarspor.org.tr
funworx.de
oncarrot.com
alexwenzel.de
cookinn.nl
soundseeing.net
solutionshosting.co.uk
worldproskitour.com
stitch-n-bitch.com
stressreliefadvice.com
tecleados.com
ced-elec.com
nepal-pictures.com
saberconcrete.com
prodentalblue.com
skoczynski.eu
duthler.nl
ayudaespiritualtamara.com
quitescorting.com
alharsunindo.com
alattekniksipil.com
happylublog.wordpress.com
dierenambulancealkmaar.nl
premiumweb.com.ua:443
neonodi.be
liepertgrafikweb.at
putzen-reinigen.com
hawaiisteelbuilding.com
drnelsonpediatrics.com
eafx.pro
monstarrsoccer.com
anleggsregisteret.no
wallflowersandrakes.com
2020hindsight.info
jlgraphisme.fr
mariajosediazdemera.com
handyman-silkeborg.dk
factorywizuk.com
rentsportsequip.com
yvesdoin-aquarelles.fr
malzomattalar.com
imaginekithomes.co.nz
bluelakevision.com
zorgboerderijravensbosch.nl
kelsigordon.com
dibli.store
precisetemp.com
texanscan.org
kemtron.fr
subyard.com
basindentistry.com
gatlinburgcottage.com
verbouwingsdouche.nl
myplaywin3.com
xtensifi.com
girlish.ae
suonenjoen.fi
topvijesti.net
direitapernambuco.com
cormanmarketing.com
burg-zelem.de
rs-danmark.dk
gta-jjb.fr
raeoflightmusic.com
transifer.fr
rossomattonecase.it
subquercy.fr
circuit-diagramz.com
haard-totaal.nl
bajova.sk
fotoeditores.com
fascaonline.com
thehovecounsellingpractice.co.uk
gaearoyals.com
greeneyetattoo.com
alaskaremote.com
richardmaybury.co.uk
neolaiamedispa.com
kellengatton.com
rizplakatjaya.com
graygreenbiomedservices.com
jax-interim-and-projectmanagement.com
min-virksomhed.dk
four-ways.com
agora-collectivites.com
speakaudible.com
electricianul.com
dogsunlimitedguide.com
mediogiro.com.ar
fysiotherapierijnmond.nl
rozmata.com
hekecrm.com
xn--80addfr4ahr.dp.ua
insane.agency
buffdaddyblog.com
craftingalegacy.com
agencewho-aixenprovence.fr
111firstdelray.com
smartercashsystem.com
drvoip.com
aquacheck.co.za
fitnessblenderstory.com
ravage-webzine.nl
hnkns.com
nauticmarine.dk
rivermusic.nl
morgansconsult.com
jefersonalessandro.com
livelai.com
lisa-poncon.fr
bringmehope.org
kamin-somnium.de
axisoflove.org:443
signamedia.de
ncjc.ca
affligemsehondenschool.be
1deals.com
pedmanson.com
block-optic.com
beandrivingschool.com.au
nxtstg.org
vapiano.fr
mindsparkescape.com
claudiakilian.de
mslp.org
carolynfriedlander.com
khtrx.com
forextimes.ru
sharonalbrightdds.com
mesajjongeren.nl
gurutechnologies.net
comoserescritor.com
poems-for-the-soul.ch
thesilkroadny.com
tbalp.co.uk
jonnyhooley.com
dnqa.co.uk
kartuindonesia.com
housesofwa.com
tanatek.com
profibersan.com
julielusktherapy.com
corporacionrr.com
energosbit-rp.ru
pureelements.nl
stanleyqualitysystems.com
mind2muscle.nl
operativadigital.com
astrographic.com
production-stills.co.uk
davedavisphotos.com
achetrabalhos.com
altocontatto.net
shortsalemap.com
stage-infirmier.fr
cap29010.it
csaballoons.com
werkzeugtrolley.net
alisodentalcare.com
bcabattoirs.org
dr-vita.de
mustangmarketinggroup.com
buzzneakers.com
dentourage.com
leloupblanc.gr
aoyama.ac
mindfuelers.com
sunsolutions.es
heimdalbygg.no
mediabolmong.com
mariannelemenestrel.com
supercarhire.co.uk
wg-heiligenstadt.de
carmel-york.com
adabible.org
skyboundnutrition.co.uk
riffenmattgarage.ch
chorusconsulting.net
aberdeenartwalk.org
pxsrl.it
osn.ro
wademurray.com
babysitting-hk.helpergo.co
klapanvent.ru
mariamalmahdi.com
saboboxtel.uk
eatyoveges.com
jameswilliamspainting.com
9nar.com
weddingceremonieswithtim.com
floweringsun.org
adaduga.info
mrkluttz.com
uci-france.fr
midwestschool.org
bescomedical.de
innersurrection.com
switch-made.com
brighthillgroup.com
rarefoods.ro
lunoluno.com
eos-horlogerie.com
hoteltantra.com
alnectus.com
angelika-schwarz.com
matthieupetel.fr
laaisterplakky.nl
boloria.de
perceptdecor.com
ramirezprono.com
entdoctor-durban.com
concontactodirecto.com
berdonllp.com
opticahubertruiz.com
tzn.nu
omegamarbella.com
n-newmedia.de
endstarvation.com
skooppi.fi
onesynergyinternational.com
centuryvisionglobal.com
datatri.be
mediahub.co.nz
margaretmcshane.com
azerbaycanas.com
ideamode.com
billyoart.com
oportowebdesign.com
catalyseurdetransformation.com
askstaffing.com
acibademmobil.com.tr
gavelmasters.com
bilius.dk
sbit.ag
frankgoll.com
nykfdyrehospital.dk
enactusnhlstenden.com
cp-bap.de
newonestop.com
auberives-sur-vareze.fr
5thactors.com
distrifresh.com
stoneridgemontessori.com
georgemuncey.com
gazelle-du-web.com
loysonbryan.com
nepressurecleaning.com
mensemetgesigte.co.za
bluetenreich-brilon.de
grafikstudio-visuell.de
rvside.com
devplus.be
stralsund-ansichten.de
scentedlair.com
allinonecampaign.com
keyboardjournal.com
agendatwentytwenty.com
littlesaints.academy
johnstonmingmanning.com
letterscan.de
m2graph.fr
eksperdanismanlik.com
donau-guides.eu
rtc24.com
stringnosis.academy
leadforensics.com
studionumerik.fr
fotoslubna.com
koncept-m.ru
tutvracks.com
rhino-turf.com
jakubrybak.com
sycamoregreenapts.com
schroederschoembs.com
noda.com.ua
ketomealprep.academy
campusce.com
patassociation.com
gsconcretecoatings.com
promus.ca
o90.dk
alwaysdc.com
vipcarrental.ae
marmarabasin.com
hospitalitytrainingsolutions.co.uk
grupoexin10.com
goeppinger-teppichreinigung.de
vdolg24.online
nbva.co.uk
bd2fly.com
agrifarm.dk
invela.dk
circlecitydj.com
hm-com.com
guohedd.com
delegationhub.com
amyandzac.com
look.academy
luvbec.com
leatherjees.com
craftron.com
eyedoctordallas.com
wordpress.idium.no
catchup-mag.com
hotjapaneselesbian.com
arabianmice.com
thegrinningmanmusical.com
unexplored.gr
avisioninthedesert.com
domaine-des-pothiers.com
pubcon.com
spacebel.be
anchelor.com
janasfokus.com
dcc-eu.com
globalcompliancenews.com
avis.mantova.it
powershell.su
orchardbrickwork.com
casinodepositors.com
futurenetworking.com
mneti.ru
humanviruses.org
ilveshistoria.com
jobstomoveamerica.org
billscars.net
ikzoekgod.be
hostingbangladesh.net
patriotcleaning.net
andermattswisswatches.ch
90nguyentuan.com
dentalcircle.com
rattanwarehouse.co.uk
nourella.com
schluesseldienste-hannover.de
acornishstudio.co.uk
licensed-public-adjuster.com
epsondriversforwindows.com
fanuli.com.au
queertube.net
iactechnologies.net
adterium.com
haus-landliebe.de
natturestaurante.com.br
paradigmlandscape.com
directique.com
belofloripa.be
ultimatelifesource.com
sealgrinderpt.com
triplettagaite.fr
xrresources.com
framemyballs.com
palmenhaus-erfurt.de
bourchier.org
cotton-avenue.co.il
nvisionsigns.com
denverwynkoopdentist.com
photographycreativity.co.uk
almamidwifery.com
mollymccarthydesign.com
hypogenforensic.com
ox-home.com
lmmont.sk
greatofficespaces.net
pro-gamer.pl
forskolinslimeffect.net
11.in.ua
happycatering.de
satoblog.org
apiarista.de
masecologicos.com
scholarquotes.com
welovecustomers.fr
nexstagefinancial.com
domilivefurniture.com
soncini.ch
brownswoodblog.com
krishnabrawijaya.com
martinipstudios.com
bumbipdeco.site
jeanmonti.com
limounie.com
vvego.com
stabilisateur.fr
bmw-i-pure-impulse.com
metallbau-hartmann.eu
o2o-academy.com
rsidesigns.com
campinglaforetdetesse.com
endlessrealms.net
christopherhannan.com
banksrl.co.za
hiddensee-buhne11.de
placermonticello.com
ntinasfiloxenia.gr
charlottelhanna.com
maryairbnb.wordpress.com
barbaramcfadyenjewelry.com
ddmgen.com
sololibrerie.it
kristianboennelykke.dk
the-beauty-guides.com
colored-shelves.com
eventosvirtualesexitosos.com
voice2biz.com
scietech.academy
zdrowieszczecin.pl
ikadomus.com
thisprettyhair.com
digitale-elite.de
justaroundthecornerpetsit.com
matteoruzzaofficial.com
piestar.com
itheroes.dk
terraflair.de
epicjapanart.com
memphishealthandwellness.com
thegetawaycollective.com
rhino-storage.co.uk
amco.net.au
avtoboss163.ru:443
scotlandsroute66.co.uk
fsbforsale.com
bodymindchallenger.com
christianscholz.de
egpu.fr
awaitspain.com
-
net
true
-
pid
39
-
prc
agntsvc
encsvc
dbsnmp
sqbcoreservice
infopath
dbeng50
visio
sql
powerpnt
tbirdconfig
mydesktopqos
oracle
thunderbird
wordpa
ocomm
xfssvccon
ocautoupds
isqlplussvc
mspub
thebat
excel
mydesktopservice
firefox
msaccess
synctime
outlook
steam
ocssd
winword
onenote
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
708
-
svc
vss
backup
mepocs
sql
memtas
sophos
veeam
svc$
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi
Files
-
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe windows x86
c88f20b29592f2107a629e815db6afae
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetErrorMode
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.wtq999 Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ