General
-
Target
6c76a26ece2888f8254e03a8de26d351cf20a8de4bc4083fdd36ea84cc37fc96
-
Size
220KB
-
Sample
220124-caw56ahhbp
-
MD5
ff60a4c11e7fbab1d3a014241ab16dad
-
SHA1
0a3ebc85854bb2f9202a030091e96f8235f77b6c
-
SHA256
6c76a26ece2888f8254e03a8de26d351cf20a8de4bc4083fdd36ea84cc37fc96
-
SHA512
f147fd0bfc90fc7c081e2a9bb1a3b9523082a3fce458683a3ded64770859289dc3915fa2bef3a3ea869949cd331a045eb94829b9cb848993521bca0289e1e35a
Static task
static1
Behavioral task
behavioral1
Sample
6c76a26ece2888f8254e03a8de26d351cf20a8de4bc4083fdd36ea84cc37fc96.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
6c76a26ece2888f8254e03a8de26d351cf20a8de4bc4083fdd36ea84cc37fc96.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\473n3y-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0ECCBCFA348A1C36
http://decryptor.top/0ECCBCFA348A1C36
Extracted
sodinokibi
19
1428
alpesiberie.com
lagschools.ng
stage-infirmier.fr
cymru.futbol
hm-com.com
randyabrown.com
billigeflybilletter.dk
bridalcave.com
arabianmice.com
agencewho-aixenprovence.fr
bd2fly.com
itheroes.dk
ronielyn.com
carolynfriedlander.com
catchup-mag.com
logosindustries.com
solutionshosting.co.uk
greeneyetattoo.com
global-migrate.com
skinkeeper.li
banukumbak.com
wrinstitute.org
gbk-tp1.de
universelle.fr
glende-pflanzenparadies.de
reizenmetkinderen.be
druktemakersheerenveen.nl
domaine-des-pothiers.com
framemyballs.com
fotoeditores.com
campinglaforetdetesse.com
jobkiwi.com.ng
ninjaki.com
humanviruses.org
plbinsurance.com
egpu.fr
profiz.com
mariamalmahdi.com
jandhpest.com
graygreenbiomedservices.com
janasfokus.com
pourlabretagne.bzh
relevantonline.eu
galaniuklaw.com
cmascd.com
secrets-clubs.co.uk
geoweb.software
chatberlin.de
bruut.online
belinda.af
iactechnologies.net
condormobile.fr
shrinkingplanet.com
futurenetworking.com
augen-praxisklinik-rostock.de
pinkxgayvideoawards.com
lovetzuchia.com
greatofficespaces.net
advanced-removals.co.uk
watchsale.biz
dayenne-styling.nl
trivselsguide.dk
grupoexin10.com
iexpert99.com
cl0nazepamblog.com
jalkapuu.net
barbaramcfadyenjewelry.com
pedmanson.com
fanuli.com.au
coachpreneuracademy.com
tramadolhealth.com
keuken-prijs.nl
blueridgeheritage.com
andermattswisswatches.ch
k-zubki.ru
entdoctor-durban.com
the-beauty-guides.com
broccolisoep.nl
computer-place.de
beandrivingschool.com.au
amorbellezaysalud.com
cotton-avenue.co.il
dinedrinkdetroit.com
tellthebell.website
curtsdiscountguns.com
jacquesgarcianoto.com
trevi-vl.ru
smartspeak.com
bourchier.org
margaretmcshane.com
pro-gamer.pl
nepressurecleaning.com
bookingwheel.com
handyman-silkeborg.dk
metriplica.academy
zwemofficial.nl
protoplay.ca
queertube.net
aoyama.ac
mariannelemenestrel.com
cops4causes.org
oncarrot.com
premier-iowa.com
jameswilliamspainting.com
lollachiro.com
chinowarehousespace.com
leijstrom.com
vipcarrental.ae
kdbrh.com
stringnosis.academy
epsondriversforwindows.com
xrresources.com
hameghlim.com
ya-elka.ru
vitoriaecoturismo.com.br
jakubrybak.com
globalskills.pt
eafx.pro
suonenjoen.fi
log-barn.co.uk
hawthornsretirement.co.uk
billyoart.com
guohedd.com
factorywizuk.com
precisetemp.com
successcolony.com.ng
latteswithleslie.com
ludoil.it
ocduiblog.com
memphishealthandwellness.com
switch-made.com
cp-bap.de
topvijesti.net
furland.ru
werkzeugtrolley.net
markseymourphotography.co.uk
imaginekithomes.co.nz
rentsportsequip.com
pansionatblago.ru
endlessrealms.net
boyfriendsgoal.site
martinipstudios.com
patassociation.com
mundo-pieces-auto.fr
letterscan.de
jeanmonti.com
eshop.design
tecleados.com
maryairbnb.wordpress.com
tilldeeke.de
tradenavigator.ch
parksideseniorliving.net
hotjapaneselesbian.com
acumenconsultingcompany.com
naukaip.ru
achetrabalhos.com
akwaba-safaris.com
lattalvor.com
hvitfeldt.dk
limmortelyouth.com
harleystreetspineclinic.com
web865.com
neonodi.be
reygroup.pt
so-sage.fr
kosten-vochtbestrijding.be
ufovidmag.com
mediabolmong.com
wirmuessenreden.com
mediogiro.com.ar
fire-space.com
netadultere.fr
mahikuchen.com
rvside.com
liveyourheartout.co
chatterchatterchatter.com
agora-collectivites.com
k-v-f.de
davedavisphotos.com
cap29010.it
texanscan.org
biketruck.de
reputation-medical.online
focuskontur.com
gardenpartner.pl
hawaiisteelbuilding.com
mbuildinghomes.com
uncensoredhentaigif.com
thenalpa.com
benchbiz.com
3daywebs.com
yvesdoin-aquarelles.fr
lookandseen.com
metroton.ru
kellengatton.com
awag-blog.de
tetameble.pl
breakluckrecords.com
fla.se
bluetenreich-brilon.de
latableacrepes-meaux.fr
scietech.academy
nutriwell.com.sg
haard-totaal.nl
interlinkone.com
activeterroristwarningcompany.com
phoenixcrane.com
angeleyezstripclub.com
bagaholics.in
rizplakatjaya.com
pokemonturkiye.com
from02pro.com
lashandbrowenvy.com
arazi.eus
whoopingcrane.com
dogsunlimitedguide.com
sellthewrightway.com
mac-computer-support-hamburg.de
ledyoucan.com
atelierkomon.com
natturestaurante.com.br
tastevirginia.com
anchelor.com
primemarineengineering.com
bavovrienden.nl
subquercy.fr
matteoruzzaofficial.com
die-immo-agentur.de
smartmind.net
motocrossplace.co.uk
omnicademy.com
internalresults.com
drbenveniste.com
ncn.nl
sppdstats.com
narca.net
ciga-france.fr
kamin-somnium.de
brunoimmobilier.com
bescomedical.de
towelroot.co
girlish.ae
four-ways.com
gaearoyals.com
bonitabeachassociation.com
belofloripa.be
kompresory-opravy.com
wyreforest.net
bulyginnikitav.000webhostapp.com
dnqa.co.uk
monstarrsoccer.com
cssp-mediation.org
justaroundthecornerpetsit.com
bg.szczecin.pl
weddingceremonieswithtim.com
adterium.com
jobstomoveamerica.org
dentallabor-luenen.de
elex.is
kafkacare.com
strauchs-wanderlust.info
mursall.de
tanatek.com
endstarvation.com
jag.me
aberdeenartwalk.org
hutchstyle.co.uk
111firstdelray.com
qandmmusiccenter.com
saint-malo-developpement.fr
spirello.nl
initconf.com
bmw-i-pure-impulse.com
domilivefurniture.com
golfclublandgoednieuwkerk.nl
ivancacu.com
ygallerysalonsoho.com:443
fixx-repair.com
schroederschoembs.com
mrkluttz.com
5pointpt.com
ziliak.com
tieronechic.com
artvark.nl
mslp.org
bendel-partner.de
amyandzac.com
matthieupetel.fr
aidanpublishing.co.uk
dantreranch.com
wallflowersandrakes.com
spartamovers.com
pisofare.co
prodentalblue.com
distrifresh.com
wordpress.idium.no
antesacademy.it
oscommunity.de
n-newmedia.de
speiserei-hannover.de
directique.com
awaitspain.com
rtc24.com
mindfuelers.com
digitale-elite.de
janmorgenstern.com
nationnewsroom.com
foerderverein-vatterschule.de
opt4cdi.com
voice2biz.com
aheadloftladders.co.uk
bajova.sk
bayshoreelite.com
mondolandscapes.com
sololibrerie.it
thesilkroadny.com
sshomme.com
housesofwa.com
charlesfrancis.photos
scholarquotes.com
circlecitydj.com
buffdaddyblog.com
innovationgames-brabant.nl
claudiakilian.de
craftron.com
fta-media.com
finnergo.eu
xn--ziinoapte-6ld.ro
cc-experts.de
angelsmirrorus.com
professionetata.com
gurutechnologies.net
juergenblaetz.de
kiraribeaute-nani.com
marcandy.com
funworx.de
redctei.co
lumturo.academy
affligemsehondenschool.be
finsahome.co.uk
kemtron.fr
molinum.pt
5thactors.com
renderbox.ch
alisodentalcare.com
fluzfluzrewards.com
innervisions-id.com
ncjc.ca
zealcon.ae
teutoradio.de
astrographic.com
stabilisateur.fr
b3b.ch
photonag.com
customroasts.com
animation-pro.co.uk
altocontatto.net
tages-geldvergleich.de
molade.nl
innersurrection.com
onesynergyinternational.com
sachainchiuk.com
georgemuncey.com
chorusconsulting.net
uci-france.fr
volta.plus
cleanroomequipment.ie
fsbforsale.com
gta-jjb.fr
theintellect.edu.pk
gosouldeep.com
martha-frets-ceramics.nl
promus.ca
alaskaremote.com
vapiano.fr
nicksrock.com
axisoflove.org:443
scentedlair.com
palmecophilippines.com
rapid5kloan.org
kryptos72.com
clemenfoto.dk
karmeliterviertel.com
kenmccallum.com
cxcompany.com
devplus.be
phukienbepthanhdat.com
annenymus.com
sber-biznes.com
hostastay.com
burg-zelem.de
pays-saint-flour.fr
avisioninthedesert.com
energosbit-rp.ru
jonnyhooley.com
insane.agency
yourcosmicbeing.com
crestgood.com
pharmeko-group.com
dentourage.com
1deals.com
arthakapitalforvaltning.dk
fskhjalmar.se
edrickennedymacfoy.com
simpleitsolutions.ch
veggienessa.com
yayasanprimaunggul.org
heuvelland-oaze.nl
bertbutter.nl
richardkershawwines.co.za
cardsandloyalty.com
fi-institutionalfunds.com
betterce.com
ilovefullcircle.com
lgiwines.com
zumrutkuyutemel.com
vdolg24.online
drvoip.com
askstaffing.com
cormanmarketing.com
business-basic.de
descargandoprogramas.com
subyard.com
lsngroupe.com
levelseven.be
goodboyscustom.com
bilius.dk
stressreliefadvice.com
hom-frisor.dk
ebible.co
efficiencyconsulting.es
kelsigordon.com
ntinasfiloxenia.gr
hoteltantra.com
drbrianhweeks.com
cincinnatiphotocompany.org
production-stills.co.uk
alene.co
lovcase.com
brannbornfastigheter.se
jlgraphisme.fr
glas-kuck.de
webforsites.com
ravage-webzine.nl
envomask.com
sytzedevries.com
enactusnhlstenden.com
saberconcrete.com
eatyoveges.com
cuadc.org
piestar.com
devus.de
krishnabrawijaya.com
encounter-p.net
linkbuilding.life
look.academy
bodet150ans.com
collegetennis.info
powershell.su
hnkns.com
rishigangoly.com
linearete.com
operativadigital.com
docarefoundation.org
alnectus.com
citydogslife.com
leadforensics.com
haus-landliebe.de
artcase.pl
smartworkplaza.com
ddmgen.com
elitkeramika-shop.com.ua
theatre-embellie.fr
groovedealers.ru
thiagoperez.com
thepixelfairy.com
thegetawaycollective.com
annida.it
radishallgood.com
johnkoen.com
vvego.com
gavelmasters.com
g2mediainc.com
renehartman.nl
purepreprod4.com
signededenroth.dk
zaczytana.com
happycatering.de
atrgroup.it
t3brothers.com
rokthetalk.com
ruggestar.ch
m2graph.fr
trainiumacademy.com
p-ride.live
concontactodirecto.com
profibersan.com
solidhosting.nl
biblica.com
azerbaycanas.com
perfectgrin.com
bratek-immobilien.de
theboardroomafrica.com
lexced.com
taulunkartano.fi
frimec-international.es
forumsittard.nl
explora.nl
nourella.com
baptistdistinctives.org
livelai.com
grancanariaregional.com
yuanshenghotel.com
ykobbqchicken.ca
landgoedspica.nl
nexstagefinancial.com
startuplive.org
sycamoregreenapts.com
carsten.sparen-it.de
floweringsun.org
metcalfe.ca
dierenambulancealkmaar.nl
dentalcircle.com
rarefoods.ro
altitudeboise.com
dieetuniversiteit.nl
pvandambv.nl
khtrx.com
rossomattonecase.it
pureelements.nl
raeoflightmusic.com
mgimalta.com
min-virksomhed.dk
blavait.fr
aciscomputers.com
citiscapes-art.com
studionumerik.fr
irizar.com
rentingwell.com
hotelturbo.de
avtoboss163.ru:443
kryddersnapsen.dk
almamidwifery.com
turing.academy
abulanov.com
mediahub.co.nz
jaaphoekzema.nl
shortysspices.com
imajyuku-sozoku.com
amelielecompte.wordpress.com
tutvracks.com
ikadomus.com
letsstopsmoking.co.uk
nxtstg.org
mollymccarthydesign.com
jax-interim-and-projectmanagement.com
rhino-storage.co.uk
baumfinancialservices.com
baita.ac
nuohous.com
leatherjees.com
valiant-voice.com
skoczynski.eu
bellesiniacademy.org
mike.matthies.de
verbouwingsdouche.nl
acornishstudio.co.uk
alcye.com
kvetymichalovce.sk
chomiksy.net
lunoluno.com
delegationhub.com
peppergreenfarmcatering.com.au
pilotgreen.com
charlottelhanna.com
mindsparkescape.com
skolaprome.eu
testitjavertailut.net
vitormmcosta.com
santastoy.store
bluelakevision.com
wg-heiligenstadt.de
myfbateam.com
malzomattalar.com
diakonie-weitramsdorf-sesslach.de
oportowebdesign.com
smarttourism.academy
drnelsonpediatrics.com
baikalflot.ru
etgdogz.de
pubcon.com
kickittickets.com
campusescalade.com
racefietsenblog.nl
tatyanakopieva.ru
alharsunindo.com
theater-lueneburg.de
wademurray.com
qrs-international.com
thegrinningmanmusical.com
legundschiess.de
gatlinburgcottage.com
kombi-dress.com
opticahubertruiz.com
makingmillionaires.net
awaisghauri.com
paardcentraal.nl
teethinadaydentalimplants.com
transifer.fr
oexebusiness.com
mjk.digital
carmel-york.com
mangimirossana.it
morgansconsult.com
miscbo.it
moira-cristescu.com
tzn.nu
creohn.de
christianscholz.de
schulz-moelln.de
buzzneakers.com
kerstliedjeszingen.nl
zdrowieszczecin.pl
dreamvoiceclub.org
fann.ru
aktivfriskcenter.se
oraweb.net
allinonecampaign.com
sunsolutions.es
diverfiestas.com.es
slotspinner.com
auto-opel.ro
lifeinbreaths.com
brinkdoepke.eu
mind2muscle.nl
2020hindsight.info
block-optic.com
silverbird.dk
nieuwsindeklas.be
dr-vita.de
90nguyentuan.com
fazagostar.co
hypogenforensic.com
klapanvent.ru
bluemarinefoundation.com
hensleymarketing.com
circuit-diagramz.com
napisat-pismo-gubernatoru.ru:443
parentsandkids.com
cmeow.com
greenrider.nl
andrealuchesi.it
rattanwarehouse.co.uk
luvinsburger.fr
masecologicos.com
katherinealy.com
brisbaneosteopathic.com.au
oro.ae
aslog.fr
mazift.dk
specialtyhomeservicesllc.com
the5thquestion.com
sambaglow.com
mazzaropi.com.br
catering.com
banksrl.co.za
onlinemarketingsurgery.co.uk
inewsstar.com
azloans.com
cac2040.com
unboxtherapy.site
holocine.de
paprikapod.com
espaciopolitica.com
omegamarbella.com
nginx.com
springfieldplumbermo.com
xn--80addfr4ahr.dp.ua
skyboundnutrition.co.uk
goodherbalhealth.com
boloria.de
stoneridgemontessori.com
bychowo.pl
ramirezprono.com
keyboardjournal.com
buerocenter-butzbach-werbemittel.de
loysonbryan.com
nepal-pictures.com
schlagbohrmaschinetests.com
der-stempelking.de
alltagsrassismus-entknoten.de
mensemetgesigte.co.za
magrinya.net
internestdigital.com
ahgarage.com
hepishopping.com
ced-elec.com
happylublog.wordpress.com
husetsanitas.dk
littlesaints.academy
animalfood-online.de
spacebel.be
a-zpaperwork.eu
glennverschueren.be
patriotcleaning.net
agrifarm.dk
rs-danmark.dk
indiebizadvocates.org
liverpoolabudhabi.ae
qwikcoach.com
grafikstudio-visuell.de
billscars.net
zuerich-umzug.ch
nauticmarine.dk
slideevents.be
istantidigitali.com
kroophold-sjaelland.dk
birthplacemag.com
berdonllp.com
alattekniksipil.com
bjornvanvulpen.nl
myplaywin3.com
newonestop.com
johnsonweekly.com
putzen-reinigen.com
yourhappyevents.fr
voetbalhoogeveen.nl
chainofhopeeurope.eu
mrcar.nl
duthler.nl
sprintcoach.com
parseport.com
rechtenplicht.be
alexwenzel.de
biodentify.ai
lidkopingsnytt.nu
palema.gr
lisa-poncon.fr
iron-mine.ru
gazelle-du-web.com
wribrazil.com
dmlcpa.com
advancedeyecare.com
denhaagfoodie.nl
daveystownhouse.com
corporacionrr.com
bcmets.info
jimprattmediations.com
wineandgo.hu
vedsegaard.dk
mesajjongeren.nl
eventosvirtualesexitosos.com
parisschool.ru
colored-shelves.com
jmmartinezilustrador.com
lmmont.sk
arearugcleaningnyc.com
bohrlochversicherung.info
kausette.com
fidelitytitleoregon.com
ox-home.com
apiarista.de
hekecrm.com
csaballoons.com
walterman.es
cookinn.nl
optigas.com
ceocenters.com
andreaskildegaard.dk
lapponiasafaris.com
malevannye.ru
elliemaccreative.wordpress.com
campusce.com
slotenmakerszwijndrecht.nl
jayfurnitureco.com
basindentistry.com
hostaletdelsindians.es
stathmoulis.gr
levencovka.ru
bundan.com
christopherhannan.com
aceroprime.com
muller.nl
edvestors.org
motocrosshideout.com
test-teleachat.fr
fridakids.com
jdscenter.com
pankiss.ru
terraflair.de
easydental.ae
nrgvalue.com
agriturismocastagneto.it
mrmac.com
mustangmarketinggroup.com
modamarfil.com
witraz.pl
hartofurniture.com
luvbec.com
nalliasmali.net
advesa.com
mayprogulka.ru
frankgoll.com
hinotruckwreckers.com.au
selected-minds.de
forextimes.ru
midwestschool.org
alabamaroofingllc.com
rename.kz
soncini.ch
speakaudible.com
denverwynkoopdentist.com
9nar.com
avis.mantova.it
perceptdecor.com
apogeeconseils.fr
poems-for-the-soul.ch
brighthillgroup.com
signamedia.de
epicjapanart.com
triplettagaite.fr
agenceassemble.fr
ingresosextras.online
evsynthacademy.org
invela.dk
premiumweb.com.ua:443
apmollerpension.com
ronaldhendriks.nl
utilisacteur.fr
o90.dk
heimdalbygg.no
kookooo.com
liepertgrafikweb.at
leloupblanc.gr
palmenhaus-erfurt.de
welovecustomers.fr
pajagus.fr
go.labibini.ch
airserviceunlimited.com
geitoniatonaggelon.gr
projektparkiet.pl
placermonticello.com
aquacheck.co.za
rolleepollee.com
hospitalitytrainingsolutions.co.uk
kartuindonesia.com
proffteplo.com
bodymindchallenger.com
fascaonline.com
adedesign.com
site.markkit.com.br
amco.net.au
stralsund-ansichten.de
onlinetvgroup.com
polynine.com
mariajosediazdemera.com
limounie.com
tweedekansenloket.nl
licensed-public-adjuster.com
sarahspics.co.uk
tchernia-conseil.fr
sharonalbrightdds.com
atma.nl
ayudaespiritualtamara.com
rino-gmbh.com
publicompserver.de
globalcompliancenews.com
saboboxtel.uk
jollity.hu
maxcube24.com.ua
leansupremegarcinia.net
boomerslivinglively.com
gsconcretecoatings.com
anleggsregisteret.no
factoriareloj.com
olry-cloisons.fr
triplettabordeaux.fr
line-x.co.uk
eksperdanismanlik.com
skyscanner.ro
ketomealprep.academy
casinodepositors.com
nykfdyrehospital.dk
mikegoodfellow.co.uk
enews-qca.com
thestudio.academy
osn.ro
direitapernambuco.com
suitesartemis.gr
sbit.ag
dinecorp.com
riffenmattgarage.ch
eurethicsport.eu
satoblog.org
fotoslubna.com
alwaysdc.com
nevadaruralhousingstudies.org
ijsselbeton.nl
julielusktherapy.com
bcabattoirs.org
acb-gruppe.ch
cesep2019.com
magnetvisual.com
mieleshopping.it
laylavalentine.com
xtensifi.com
deduktia.fi
o2o-academy.com
lyricalduniya.com
angelika-schwarz.com
lesyeuxbleus.net
toranjtuition.org
kuriero.pro
eastgrinsteadwingchun.com
dcc-eu.com
datatri.be
akcadagofis.com
deziplan.ru
brownswoodblog.com
salonlamar.nl
michal-s.co.il
silkeight.com
stanleyqualitysystems.com
manzel.tn
metallbau-hartmann.eu
tbalp.co.uk
adabible.org
victorvictoria.com
autoteamlast.de
nbva.co.uk
spectamarketingdigital.com.br
galatee-couture.com
scotlandsroute66.co.uk
sjtpo.org
tothebackofthemoon.com
sealgrinderpt.com
goeppinger-teppichreinigung.de
shortsalemap.com
triavlete.com
hiddensee-buhne11.de
prometeyagro.com.ua
karelinjames.com
topautoinsurers.net
ilveshistoria.com
muni.pe
clinic-beethovenstrasse-ag.ch
goddardleadership.org
blucamp.com
worldproskitour.com
albcleaner.fr
peninggibadan.co.id
yournextshoes.com
johnstonmingmanning.com
smartercashsystem.com
pazarspor.org.tr
ultimatelifesource.com
flossmoordental.com
mneti.ru
redpebblephotography.com
stitch-n-bitch.com
electricianul.com
babysitting-hk.helpergo.co
dibli.store
afbudsrejserallinclusive.dk
richardmaybury.co.uk
cainlaw-okc.com
fitnessblenderstory.com
stagefxinc.com
lassocrm.com
thisprettyhair.com
jefersonalessandro.com
zorgboerderijravensbosch.nl
paradigmlandscape.com
tesisatonarim.com
c-sprop.com
beauty-traveller.com
catalyseurdetransformation.com
bringmehope.org
11.in.ua
craftingalegacy.com
thehovecounsellingpractice.co.uk
pinthelook.com
jglconsultancy.com
eos-horlogerie.com
cyberpromote.de
expohomes.com
sochi-okna23.ru
hostingbangladesh.net
pxsrl.it
dennisverschuur.com
ownidentity.com
airvapourbarrier.com
eyedoctordallas.com
xn--billigafrgpatroner-stb.se
orchardbrickwork.com
chris-anne.com
noda.com.ua
asiaartgallery.jp
nvisionsigns.com
designimage.ae
sweetz.fr
imagine-entertainment.com
ideamode.com
traitware.com
rsidesigns.com
laaisterplakky.nl
breathebettertolivebetter.com
otpusk.zp.ua
acibademmobil.com.tr
xn--80abehgab4ak0ddz.xn--p1ai
michaelfiegel.com
janellrardon.com
advance-refle.com
rozmata.com
loparnille.se
outstandingminialbums.com
louiedager.com
kristianboennelykke.dk
ikzoekgod.be
donau-guides.eu
supercarhire.co.uk
the3-week-diet.net
neolaiamedispa.com
comoserescritor.com
rivermusic.nl
frameshift.it
quitescorting.com
larchwoodmarketing.com
leopoldineroux.com
rubyaudiology.com
fysiotherapierijnmond.nl
gratiocafeblog.wordpress.com
schluesseldienste-hannover.de
zinnystar.com
wasnederland.nl
rhino-turf.com
craftstone.co.nz
buonabitare.com
livedeveloper.com
pixelhealth.net
mamajenedesigns.com
singletonfinancial.com
forskolinslimeffect.net
unislaw-narty.pl
skooppi.fi
bumbipdeco.site
therapybusinessacademy.com
mercadodelrio.com
soundseeing.net
techybash.com
unexplored.gr
jobscore.com
richardiv.com
teamsegeln.ch
skidpiping.de
sveneulberg.de
centuryvisionglobal.com
physio-lang.de
bubbalucious.com
oththukaruva.com
photographycreativity.co.uk
bakingismyyoga.com
marmarabasin.com
cascinarosa33.it
agendatwentytwenty.com
medicalsupportco.com
the-cupboard.co.uk
adaduga.info
auberives-sur-vareze.fr
fbmagazine.ru
jlwilsonbooks.com
koncept-m.ru
penumbuhrambutkeiskei.com
-
net
true
-
pid
19
-
prc
encsvc
onenote
isqlplussvc
powerpnt
sqlwriter
agntsvc
sqbcoreservice
sqlagent
winword
ocomm
thunderbird
thebat
tbirdconfig
mysqld
mysqld_nt
visio
mydesktopqos
firefoxconfig
synctime
mspub
infopath
dbeng50
oracle
mysqld_opt
xfssvccon
steam
mydesktopservice
dbsnmp
thebat64
sqlbrowser
ocssd
excel
msftesql
ocautoupds
msaccess
outlook
wordpad
sqlservr
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1428
-
svc
sql
memtas
veeam
mepocs
vss
svc$
backup
sophos
Extracted
C:\m441vh-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A4C32041CAACCD61
http://decryptor.top/A4C32041CAACCD61
Targets
-
-
Target
6c76a26ece2888f8254e03a8de26d351cf20a8de4bc4083fdd36ea84cc37fc96
-
Size
220KB
-
MD5
ff60a4c11e7fbab1d3a014241ab16dad
-
SHA1
0a3ebc85854bb2f9202a030091e96f8235f77b6c
-
SHA256
6c76a26ece2888f8254e03a8de26d351cf20a8de4bc4083fdd36ea84cc37fc96
-
SHA512
f147fd0bfc90fc7c081e2a9bb1a3b9523082a3fce458683a3ded64770859289dc3915fa2bef3a3ea869949cd331a045eb94829b9cb848993521bca0289e1e35a
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-