General
-
Target
aa10d34cd25ef3f00f049ed7d02fbd8b7461d847a0763426e63fc85336482f2d
-
Size
206KB
-
Sample
220124-bq5a2ahdej
-
MD5
c5fbdd3c69a5e7e499952dbb1343799b
-
SHA1
a4940b3abdbd80b05872b735bf97ec14e7fc6047
-
SHA256
aa10d34cd25ef3f00f049ed7d02fbd8b7461d847a0763426e63fc85336482f2d
-
SHA512
2ed14db992b4c7300b6c50a2ce0ac002282b5702120feabada9177a2558f163fc8b7f2a26eb0b9ca31fc6c1a8ff91ee26005e983b10b9c1107610ed42e3a7ae6
Static task
static1
Behavioral task
behavioral1
Sample
aa10d34cd25ef3f00f049ed7d02fbd8b7461d847a0763426e63fc85336482f2d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
aa10d34cd25ef3f00f049ed7d02fbd8b7461d847a0763426e63fc85336482f2d.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\2lc014-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/459DFFCC649C0432
http://decryptor.cc/459DFFCC649C0432
Extracted
sodinokibi
19
2970
precisetemp.com
pvandambv.nl
kryddersnapsen.dk
jag.me
aidanpublishing.co.uk
fi-institutionalfunds.com
haard-totaal.nl
handyman-silkeborg.dk
salonlamar.nl
broccolisoep.nl
greatofficespaces.net
kvetymichalovce.sk
brinkdoepke.eu
pedmanson.com
noda.com.ua
ciga-france.fr
babysitting-hk.helpergo.co
publicompserver.de
jobkiwi.com.ng
photographycreativity.co.uk
nuohous.com
geoweb.software
ideamode.com
hawaiisteelbuilding.com
airserviceunlimited.com
universelle.fr
olry-cloisons.fr
elitkeramika-shop.com.ua
arearugcleaningnyc.com
specialtyhomeservicesllc.com
log-barn.co.uk
patriotcleaning.net
lassocrm.com
brighthillgroup.com
rvside.com
triplettabordeaux.fr
pinkxgayvideoawards.com
mamajenedesigns.com
paardcentraal.nl
husetsanitas.dk
ddmgen.com
rattanwarehouse.co.uk
campusescalade.com
trainiumacademy.com
malevannye.ru
the-beauty-guides.com
aberdeenartwalk.org
groovedealers.ru
billigeflybilletter.dk
mediabolmong.com
profibersan.com
theboardroomafrica.com
circuit-diagramz.com
jayfurnitureco.com
texanscan.org
sellthewrightway.com
tellthebell.website
vipcarrental.ae
rhino-storage.co.uk
carolynfriedlander.com
onlinemarketingsurgery.co.uk
amelielecompte.wordpress.com
mac-computer-support-hamburg.de
leadforensics.com
natturestaurante.com.br
baikalflot.ru
kellengatton.com
smartmind.net
atrgroup.it
drbenveniste.com
gosouldeep.com
cap29010.it
primemarineengineering.com
jakubrybak.com
alexwenzel.de
cormanmarketing.com
frimec-international.es
beauty-traveller.com
lovetzuchia.com
silkeight.com
linearete.com
agrifarm.dk
dreamvoiceclub.org
thesilkroadny.com
cookinn.nl
lesyeuxbleus.net
satoblog.org
crestgood.com
forumsittard.nl
easydental.ae
the3-week-diet.net
ced-elec.com
signamedia.de
fskhjalmar.se
holocine.de
techybash.com
secrets-clubs.co.uk
b3b.ch
ultimatelifesource.com
tutvracks.com
alcye.com
tramadolhealth.com
basindentistry.com
line-x.co.uk
fotoslubna.com
alltagsrassismus-entknoten.de
xrresources.com
miscbo.it
chorusconsulting.net
jimprattmediations.com
catalyseurdetransformation.com
hoteltantra.com
outstandingminialbums.com
c-sprop.com
terraflair.de
dibli.store
rokthetalk.com
gbk-tp1.de
riffenmattgarage.ch
angelika-schwarz.com
stoneridgemontessori.com
bendel-partner.de
wg-heiligenstadt.de
diverfiestas.com.es
lisa-poncon.fr
sprintcoach.com
krishnabrawijaya.com
apmollerpension.com
gurutechnologies.net
avis.mantova.it
eatyoveges.com
eurethicsport.eu
fridakids.com
catchup-mag.com
dentourage.com
levelseven.be
3daywebs.com
gta-jjb.fr
turing.academy
awaitspain.com
fsbforsale.com
triavlete.com
vitormmcosta.com
adedesign.com
baumfinancialservices.com
alene.co
powershell.su
imaginekithomes.co.nz
stagefxinc.com
nepressurecleaning.com
makingmillionaires.net
avisioninthedesert.com
jollity.hu
datatri.be
lifeinbreaths.com
pureelements.nl
nepal-pictures.com
andrealuchesi.it
advance-refle.com
masecologicos.com
forskolinslimeffect.net
stabilisateur.fr
mundo-pieces-auto.fr
slideevents.be
rapid5kloan.org
flossmoordental.com
leatherjees.com
redctei.co
tastevirginia.com
mike.matthies.de
ijsselbeton.nl
premier-iowa.com
saberconcrete.com
bertbutter.nl
unislaw-narty.pl
alisodentalcare.com
sunsolutions.es
solutionshosting.co.uk
licensed-public-adjuster.com
ncjc.ca
bridalcave.com
muni.pe
modamarfil.com
cp-bap.de
yuanshenghotel.com
kroophold-sjaelland.dk
cmeow.com
laaisterplakky.nl
circlecitydj.com
k-v-f.de
tanatek.com
ox-home.com
photonag.com
ruggestar.ch
ahgarage.com
mangimirossana.it
go.labibini.ch
dentallabor-luenen.de
projektparkiet.pl
housesofwa.com
tzn.nu
n-newmedia.de
nutriwell.com.sg
mslp.org
nexstagefinancial.com
etgdogz.de
rubyaudiology.com
nationnewsroom.com
ivancacu.com
bmw-i-pure-impulse.com
suitesartemis.gr
carsten.sparen-it.de
envomask.com
golfclublandgoednieuwkerk.nl
maxcube24.com.ua
amorbellezaysalud.com
subyard.com
myplaywin3.com
arthakapitalforvaltning.dk
kookooo.com
shortsalemap.com
mgimalta.com
kompresory-opravy.com
mrcar.nl
goodherbalhealth.com
111firstdelray.com
shrinkingplanet.com
internalresults.com
letterscan.de
optigas.com
karelinjames.com
towelroot.co
glende-pflanzenparadies.de
activeterroristwarningcompany.com
richardmaybury.co.uk
motocrosshideout.com
imagine-entertainment.com
lagschools.ng
encounter-p.net
pokemonturkiye.com
mediahub.co.nz
drvoip.com
brunoimmobilier.com
walterman.es
topautoinsurers.net
o2o-academy.com
aheadloftladders.co.uk
testitjavertailut.net
g2mediainc.com
smartercashsystem.com
liverpoolabudhabi.ae
iron-mine.ru
cmascd.com
k-zubki.ru
perceptdecor.com
wyreforest.net
jonnyhooley.com
bookingwheel.com
breakluckrecords.com
taulunkartano.fi
eos-horlogerie.com
buonabitare.com
designimage.ae
wineandgo.hu
cotton-avenue.co.il
web865.com
happycatering.de
galaniuklaw.com
finnergo.eu
thegrinningmanmusical.com
pajagus.fr
paradigmlandscape.com
janellrardon.com
forextimes.ru
memphishealthandwellness.com
billscars.net
switch-made.com
trivselsguide.dk
kosten-vochtbestrijding.be
yournextshoes.com
denverwynkoopdentist.com
kristianboennelykke.dk
jobstomoveamerica.org
ebible.co
fire-space.com
blueridgeheritage.com
ownidentity.com
hekecrm.com
fidelitytitleoregon.com
martha-frets-ceramics.nl
pays-saint-flour.fr
bjornvanvulpen.nl
azerbaycanas.com
dmlcpa.com
goeppinger-teppichreinigung.de
lashandbrowenvy.com
skinkeeper.li
pisofare.co
leijstrom.com
livedeveloper.com
sveneulberg.de
kuriero.pro
goodboyscustom.com
innovationgames-brabant.nl
spartamovers.com
rename.kz
tages-geldvergleich.de
prodentalblue.com
springfieldplumbermo.com
jax-interim-and-projectmanagement.com
eksperdanismanlik.com
xn--80addfr4ahr.dp.ua
tecleados.com
nrgvalue.com
utilisacteur.fr
alharsunindo.com
onesynergyinternational.com
achetrabalhos.com
maryairbnb.wordpress.com
ikadomus.com
rizplakatjaya.com
skyboundnutrition.co.uk
devus.de
ocduiblog.com
vvego.com
die-immo-agentur.de
juergenblaetz.de
jandhpest.com
bourchier.org
cesep2019.com
welovecustomers.fr
relevantonline.eu
cc-experts.de
witraz.pl
lunoluno.com
triplettagaite.fr
sytzedevries.com
rhino-turf.com
limounie.com
phoenixcrane.com
lidkopingsnytt.nu
nvisionsigns.com
entdoctor-durban.com
wallflowersandrakes.com
georgemuncey.com
epicjapanart.com
energosbit-rp.ru
ronaldhendriks.nl
arabianmice.com
concontactodirecto.com
teutoradio.de
clinic-beethovenstrasse-ag.ch
wasnederland.nl
billyoart.com
breathebettertolivebetter.com
andermattswisswatches.ch
angeleyezstripclub.com
mondolandscapes.com
katherinealy.com
scholarquotes.com
mediogiro.com.ar
yourhappyevents.fr
futurenetworking.com
myfbateam.com
ludoil.it
acibademmobil.com.tr
pazarspor.org.tr
tilldeeke.de
afbudsrejserallinclusive.dk
girlish.ae
gratiocafeblog.wordpress.com
interlinkone.com
fysiotherapierijnmond.nl
diakonie-weitramsdorf-sesslach.de
drnelsonpediatrics.com
tweedekansenloket.nl
tradenavigator.ch
site.markkit.com.br
koncept-m.ru
hostastay.com
palema.gr
affligemsehondenschool.be
magnetvisual.com
poems-for-the-soul.ch
wirmuessenreden.com
grafikstudio-visuell.de
boomerslivinglively.com
selected-minds.de
stitch-n-bitch.com
loparnille.se
trevi-vl.ru
global-migrate.com
bd2fly.com
agora-collectivites.com
bilius.dk
loysonbryan.com
buzzneakers.com
ingresosextras.online
citydogslife.com
gardenpartner.pl
shortysspices.com
hvitfeldt.dk
mrmac.com
schluesseldienste-hannover.de
burg-zelem.de
latableacrepes-meaux.fr
auberives-sur-vareze.fr
ziliak.com
eafx.pro
lsngroupe.com
istantidigitali.com
hotelturbo.de
nicksrock.com
hnkns.com
humanviruses.org
1deals.com
campusce.com
craftstone.co.nz
tatyanakopieva.ru
computer-place.de
boloria.de
lyricalduniya.com
kdbrh.com
focuskontur.com
zorgboerderijravensbosch.nl
premiumweb.com.ua:443
julielusktherapy.com
thegetawaycollective.com
proffteplo.com
michal-s.co.il
verbouwingsdouche.nl
ya-elka.ru
scietech.academy
parisschool.ru
nxtstg.org
airvapourbarrier.com
descargandoprogramas.com
efficiencyconsulting.es
sbit.ag
hm-com.com
fla.se
leloupblanc.gr
condormobile.fr
transifer.fr
astrographic.com
espaciopolitica.com
production-stills.co.uk
betterce.com
drbrianhweeks.com
nginx.com
amyandzac.com
docarefoundation.org
metriplica.academy
molade.nl
limmortelyouth.com
oscommunity.de
chatberlin.de
belinda.af
professionetata.com
subquercy.fr
kiraribeaute-nani.com
hostaletdelsindians.es
nauticmarine.dk
parksideseniorliving.net
benchbiz.com
omegamarbella.com
opticahubertruiz.com
wribrazil.com
paprikapod.com
hiddensee-buhne11.de
ygallerysalonsoho.com:443
alpesiberie.com
irizar.com
cl0nazepamblog.com
stathmoulis.gr
banksrl.co.za
edrickennedymacfoy.com
anchelor.com
t3brothers.com
evsynthacademy.org
ilveshistoria.com
spirello.nl
stage-infirmier.fr
palmenhaus-erfurt.de
dieetuniversiteit.nl
medicalsupportco.com
wordpress.idium.no
stressreliefadvice.com
skooppi.fi
voetbalhoogeveen.nl
tetameble.pl
iactechnologies.net
randyabrown.com
mariannelemenestrel.com
tothebackofthemoon.com
fluzfluzrewards.com
brannbornfastigheter.se
kausette.com
barbaramcfadyenjewelry.com
acornishstudio.co.uk
frameshift.it
5pointpt.com
graygreenbiomedservices.com
askstaffing.com
opt4cdi.com
from02pro.com
xtensifi.com
reizenmetkinderen.be
deduktia.fi
strauchs-wanderlust.info
iexpert99.com
globalskills.pt
matthieupetel.fr
denhaagfoodie.nl
narca.net
carmel-york.com
teamsegeln.ch
pinthelook.com
mursall.de
littlesaints.academy
gazelle-du-web.com
greeneyetattoo.com
ncn.nl
metcalfe.ca
logosindustries.com
kombi-dress.com
mjk.digital
artvark.nl
hom-frisor.dk
albcleaner.fr
jlgraphisme.fr
foerderverein-vatterschule.de
lgiwines.com
fascaonline.com
hypogenforensic.com
jacquesgarcianoto.com
apiarista.de
raeoflightmusic.com
peppergreenfarmcatering.com.au
stringnosis.academy
metallbau-hartmann.eu
dcc-eu.com
scotlandsroute66.co.uk
sachainchiuk.com
solidhosting.nl
pankiss.ru
valiant-voice.com
speiserei-hannover.de
eyedoctordallas.com
laylavalentine.com
mind2muscle.nl
glennverschueren.be
digitale-elite.de
atelierkomon.com
putzen-reinigen.com
blucamp.com
kickittickets.com
luvbec.com
hensleymarketing.com
amco.net.au
thestudio.academy
christopherhannan.com
oro.ae
bringmehope.org
rtc24.com
der-stempelking.de
supercarhire.co.uk
internestdigital.com
grancanariaregional.com
aciscomputers.com
victorvictoria.com
webforsites.com
craftingalegacy.com
edvestors.org
parseport.com
hotjapaneselesbian.com
skolaprome.eu
fta-media.com
marcandy.com
qwikcoach.com
dentalcircle.com
leopoldineroux.com
letsstopsmoking.co.uk
artcase.pl
mazzaropi.com.br
zinnystar.com
ayudaespiritualtamara.com
nbva.co.uk
baita.ac
almamidwifery.com
buerocenter-butzbach-werbemittel.de
collegetennis.info
dinecorp.com
sber-biznes.com
chinowarehousespace.com
look.academy
karmeliterviertel.com
guohedd.com
thepixelfairy.com
gatlinburgcottage.com
lapponiasafaris.com
placermonticello.com
smarttourism.academy
janasfokus.com
redpebblephotography.com
unexplored.gr
qandmmusiccenter.com
campinglaforetdetesse.com
qrs-international.com
malzomattalar.com
hameghlim.com
chatterchatterchatter.com
liveyourheartout.co
lexced.com
customroasts.com
spectamarketingdigital.com.br
zaczytana.com
polynine.com
mindsparkescape.com
schulz-moelln.de
markseymourphotography.co.uk
gavelmasters.com
khtrx.com
direitapernambuco.com
linkbuilding.life
jameswilliamspainting.com
antesacademy.it
rechtenplicht.be
jeanmonti.com
nykfdyrehospital.dk
volta.plus
johnkoen.com
axisoflove.org:443
smartworkplaza.com
christianscholz.de
directique.com
2020hindsight.info
smartspeak.com
dogsunlimitedguide.com
metroton.ru
queertube.net
angelsmirrorus.com
duthler.nl
scentedlair.com
dnqa.co.uk
the-cupboard.co.uk
tieronechic.com
indiebizadvocates.org
the5thquestion.com
phukienbepthanhdat.com
hostingbangladesh.net
alnectus.com
aktivfriskcenter.se
latteswithleslie.com
aquacheck.co.za
cyberpromote.de
casinodepositors.com
adterium.com
insane.agency
charlottelhanna.com
harleystreetspineclinic.com
thehovecounsellingpractice.co.uk
traitware.com
thisprettyhair.com
beandrivingschool.com.au
prometeyagro.com.ua
kenmccallum.com
galatee-couture.com
keyboardjournal.com
sharonalbrightdds.com
michaelfiegel.com
domaine-des-pothiers.com
rino-gmbh.com
arazi.eus
clemenfoto.dk
liepertgrafikweb.at
allinonecampaign.com
5thactors.com
cardsandloyalty.com
brisbaneosteopathic.com.au
90nguyentuan.com
livelai.com
sshomme.com
aoyama.ac
bellesiniacademy.org
block-optic.com
piestar.com
bluemarinefoundation.com
nalliasmali.net
zdrowieszczecin.pl
jaaphoekzema.nl
funworx.de
electricianul.com
zwemofficial.nl
otpusk.zp.ua
bagaholics.in
adabible.org
auto-opel.ro
devplus.be
catering.com
akwaba-safaris.com
m2graph.fr
kartuindonesia.com
sololibrerie.it
silverbird.dk
eventosvirtualesexitosos.com
innersurrection.com
vedsegaard.dk
pilotgreen.com
schlagbohrmaschinetests.com
innervisions-id.com
pxsrl.it
kamin-somnium.de
bychowo.pl
motocrossplace.co.uk
bayshoreelite.com
biodentify.ai
p-ride.live
belofloripa.be
speakaudible.com
monstarrsoccer.com
rarefoods.ro
ceocenters.com
expohomes.com
jlwilsonbooks.com
agenceassemble.fr
singletonfinancial.com
xn--ziinoapte-6ld.ro
oexebusiness.com
xn--billigafrgpatroner-stb.se
kafkacare.com
skidpiping.de
jmmartinezilustrador.com
ikzoekgod.be
ykobbqchicken.ca
cops4causes.org
adaduga.info
9nar.com
larchwoodmarketing.com
neolaiamedispa.com
asiaartgallery.jp
sochi-okna23.ru
ntinasfiloxenia.gr
nourella.com
hospitalitytrainingsolutions.co.uk
thiagoperez.com
purepreprod4.com
patassociation.com
bonitabeachassociation.com
agriturismocastagneto.it
parentsandkids.com
watchsale.biz
glas-kuck.de
newonestop.com
louiedager.com
framemyballs.com
luvinsburger.fr
napisat-pismo-gubernatoru.ru:443
sycamoregreenapts.com
curtsdiscountguns.com
pharmeko-group.com
manzel.tn
blavait.fr
therapybusinessacademy.com
enactusnhlstenden.com
profiz.com
dierenambulancealkmaar.nl
andreaskildegaard.dk
pro-gamer.pl
ledyoucan.com
min-virksomhed.dk
lovcase.com
rozmata.com
plbinsurance.com
mindfuelers.com
geitoniatonaggelon.gr
peninggibadan.co.id
augen-praxisklinik-rostock.de
rivermusic.nl
claudiakilian.de
apogeeconseils.fr
advancedeyecare.com
elliemaccreative.wordpress.com
bakingismyyoga.com
annida.it
reygroup.pt
osn.ro
rentsportsequip.com
veggienessa.com
kerstliedjeszingen.nl
mbuildinghomes.com
leansupremegarcinia.net
marmarabasin.com
awaisghauri.com
bohrlochversicherung.info
oncarrot.com
deziplan.ru
lookandseen.com
advanced-removals.co.uk
skoczynski.eu
oththukaruva.com
schroederschoembs.com
dr-vita.de
jdscenter.com
muller.nl
yvesdoin-aquarelles.fr
bavovrienden.nl
teethinadaydentalimplants.com
chris-anne.com
druktemakersheerenveen.nl
mneti.ru
test-teleachat.fr
bluetenreich-brilon.de
lmmont.sk
unboxtherapy.site
centuryvisionglobal.com
davedavisphotos.com
cac2040.com
zealcon.ae
mahikuchen.com
ramirezprono.com
aceroprime.com
dantreranch.com
renderbox.ch
baptistdistinctives.org
cuadc.org
pourlabretagne.bzh
gsconcretecoatings.com
greenrider.nl
chainofhopeeurope.eu
magrinya.net
mazift.dk
cymru.futbol
rentingwell.com
factoriareloj.com
craftron.com
jobscore.com
naukaip.ru
biblica.com
initconf.com
endlessrealms.net
ilovefullcircle.com
saboboxtel.uk
sppdstats.com
signededenroth.dk
nevadaruralhousingstudies.org
inewsstar.com
werkzeugtrolley.net
citiscapes-art.com
birthplacemag.com
altocontatto.net
cainlaw-okc.com
ninjaki.com
avtoboss163.ru:443
keuken-prijs.nl
acb-gruppe.ch
soundseeing.net
grupoexin10.com
factorywizuk.com
distrifresh.com
bundan.com
rishigangoly.com
quitescorting.com
coachpreneuracademy.com
startuplive.org
bodymindchallenger.com
onlinetvgroup.com
gaearoyals.com
four-ways.com
nieuwsindeklas.be
finsahome.co.uk
legundschiess.de
hinotruckwreckers.com.au
palmecophilippines.com
mesajjongeren.nl
so-sage.fr
janmorgenstern.com
martinipstudios.com
wademurray.com
mieleshopping.it
lumturo.academy
csaballoons.com
fitnessblenderstory.com
operativadigital.com
lattalvor.com
toranjtuition.org
creohn.de
theater-lueneburg.de
bajova.sk
eshop.design
soncini.ch
bluelakevision.com
saint-malo-developpement.fr
rsidesigns.com
mrkluttz.com
goddardleadership.org
levencovka.ru
orchardbrickwork.com
colored-shelves.com
sambaglow.com
akcadagofis.com
bratek-immobilien.de
omnicademy.com
animation-pro.co.uk
neonodi.be
matteoruzzaofficial.com
frankgoll.com
lollachiro.com
corporacionrr.com
floweringsun.org
worldproskitour.com
bcabattoirs.org
enews-qca.com
morgansconsult.com
sjtpo.org
hawthornsretirement.co.uk
pubcon.com
alabamaroofingllc.com
donau-guides.eu
ravage-webzine.nl
fazagostar.co
klapanvent.ru
hartofurniture.com
spacebel.be
mollymccarthydesign.com
simpleitsolutions.ch
mercadodelrio.com
abulanov.com
mayprogulka.ru
yayasanprimaunggul.org
bcmets.info
business-basic.de
dinedrinkdetroit.com
endstarvation.com
cxcompany.com
annenymus.com
berdonllp.com
rolleepollee.com
kelsigordon.com
pansionatblago.ru
chomiksy.net
zuerich-umzug.ch
rossomattonecase.it
vitoriaecoturismo.com.br
11.in.ua
furland.ru
eastgrinsteadwingchun.com
daveystownhouse.com
oportowebdesign.com
fanuli.com.au
midwestschool.org
studionumerik.fr
suonenjoen.fi
ronielyn.com
yourcosmicbeing.com
slotspinner.com
fotoeditores.com
cascinarosa33.it
weddingceremonieswithtim.com
sealgrinderpt.com
alwaysdc.com
kryptos72.com
physio-lang.de
xn--80abehgab4ak0ddz.xn--p1ai
thenalpa.com
imajyuku-sozoku.com
cssp-mediation.org
animalfood-online.de
boyfriendsgoal.site
biketruck.de
ketomealprep.academy
cincinnatiphotocompany.org
landgoedspica.nl
jefersonalessandro.com
bruut.online
domilivefurniture.com
moira-cristescu.com
acumenconsultingcompany.com
heuvelland-oaze.nl
o90.dk
molinum.pt
renehartman.nl
skyscanner.ro
autoteamlast.de
altitudeboise.com
dayenne-styling.nl
santastoy.store
mikegoodfellow.co.uk
oraweb.net
bubbalucious.com
fixx-repair.com
uci-france.fr
dennisverschuur.com
mariajosediazdemera.com
stralsund-ansichten.de
tesisatonarim.com
protoplay.ca
ufovidmag.com
pixelhealth.net
banukumbak.com
racefietsenblog.nl
explora.nl
topvijesti.net
comoserescritor.com
bodet150ans.com
jglconsultancy.com
stanleyqualitysystems.com
epsondriversforwindows.com
margaretmcshane.com
jalkapuu.net
elex.is
vapiano.fr
happylublog.wordpress.com
zumrutkuyutemel.com
kemtron.fr
uncensoredhentaigif.com
advesa.com
johnsonweekly.com
awag-blog.de
bg.szczecin.pl
alattekniksipil.com
mariamalmahdi.com
atma.nl
netadultere.fr
perfectgrin.com
globalcompliancenews.com
theatre-embellie.fr
richardiv.com
bescomedical.de
alaskaremote.com
hutchstyle.co.uk
wrinstitute.org
heimdalbygg.no
invela.dk
delegationhub.com
sweetz.fr
sarahspics.co.uk
agendatwentytwenty.com
tbalp.co.uk
cleanroomequipment.ie
bumbipdeco.site
richardkershawwines.co.za
azloans.com
penumbuhrambutkeiskei.com
promus.ca
voice2biz.com
reputation-medical.online
hepishopping.com
tchernia-conseil.fr
fann.ru
justaroundthecornerpetsit.com
mustangmarketinggroup.com
anleggsregisteret.no
a-zpaperwork.eu
egpu.fr
bulyginnikitav.000webhostapp.com
fbmagazine.ru
buffdaddyblog.com
agencewho-aixenprovence.fr
aslog.fr
mensemetgesigte.co.za
vdolg24.online
rs-danmark.dk
haus-landliebe.de
charlesfrancis.photos
successcolony.com.ng
slotenmakerszwijndrecht.nl
whoopingcrane.com
theintellect.edu.pk
johnstonmingmanning.com
radishallgood.com
itheroes.dk
brownswoodblog.com
-
net
true
-
pid
19
-
prc
tbirdconfig
agntsvc
oracle
mydesktopservice
firefox
dbeng50
msaccess
mspub
winword
infopath
synctime
encsvc
steam
onenote
dbsnmp
outlook
powerpnt
thebat
thunderbird
isqlplussvc
xfssvccon
sql
excel
ocomm
mydesktopqos
visio
wordpad
ocautoupds
sqbcoreservice
ocssd
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
2970
-
svc
sql
veeam
sophos
mepocs
vss
backup
memtas
svc$
Extracted
C:\rc55b8e-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D45BB03998EA6DAB
http://decryptor.cc/D45BB03998EA6DAB
Targets
-
-
Target
aa10d34cd25ef3f00f049ed7d02fbd8b7461d847a0763426e63fc85336482f2d
-
Size
206KB
-
MD5
c5fbdd3c69a5e7e499952dbb1343799b
-
SHA1
a4940b3abdbd80b05872b735bf97ec14e7fc6047
-
SHA256
aa10d34cd25ef3f00f049ed7d02fbd8b7461d847a0763426e63fc85336482f2d
-
SHA512
2ed14db992b4c7300b6c50a2ce0ac002282b5702120feabada9177a2558f163fc8b7f2a26eb0b9ca31fc6c1a8ff91ee26005e983b10b9c1107610ed42e3a7ae6
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-