General
-
Target
RNSM00450.7z
-
Size
42.2MB
-
Sample
241012-wj5y7stblc
-
MD5
bfd40652a6a56169533500d1f6725940
-
SHA1
b070b8b7777b2c32965196aed7a47a3f2f7526a5
-
SHA256
c90c7e54c06ebeb429bc6b61be52dc96134991f5100779c1357b50beffa3a756
-
SHA512
60374aaecfdf66c68bb7e8f67285c84019792f4b16b3242a82de5e4d80fcf11878138e0e65a7b66a49cf7cc203e3445439b4a0c5a7c9f95481d7965e386f5804
-
SSDEEP
786432:4l+NsvkAVmYGhyE4cFDaKpPNFoRHiOjOIaYyV//qiYBv4CVL4CQsRA9BYLfJ:hKvlm7yE4STPNFoRBjOIbyV/Ci+v4Ci6
Static task
static1
Behavioral task
behavioral1
Sample
RNSM00450.7z
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\Recovery\read_me_lock.txt
http://t532wrjittpwhxhlf356ie3ee3t5g2mnksaubovgdagsy72cu5nbxuad.onion/4e648ee1402bb2bc
Extracted
sodinokibi
$2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq
8254
boisehosting.net
fotoideaymedia.es
dubnew.com
stallbyggen.se
koken-voor-baby.nl
juneauopioidworkgroup.org
vancouver-print.ca
zewatchers.com
bouquet-de-roses.com
seevilla-dr-sturm.at
olejack.ru
i-trust.dk
wasmachtmeinfonds.at
appsformacpc.com
friendsandbrgrs.com
thenewrejuveme.com
xn--singlebrsen-vergleich-nec.com
sabel-bf.com
seminoc.com
ceres.org.au
cursoporcelanatoliquido.online
marietteaernoudts.nl
tastewilliamsburg.com
charlottepoudroux-photographie.fr
aselbermachen.com
klimt2012.info
accountancywijchen.nl
creamery201.com
rerekatu.com
makeurvoiceheard.com
vannesteconstruct.be
wellplast.se
andersongilmour.co.uk
bradynursery.com
aarvorg.com
facettenreich27.de
balticdermatology.lt
artige.com
highlinesouthasc.com
crowd-patch.co.uk
sofavietxinh.com
jorgobe.at
danskretursystem.dk
higadograsoweb.com
supportsumba.nl
ruralarcoiris.com
projetlyonturin.fr
kidbucketlist.com.au
harpershologram.wordpress.com
ohidesign.com
international-sound-awards.com
krlosdavid.com
durganews.com
leather-factory.co.jp
coding-machine.com
i-arslan.de
caribbeansunpoker.com
mir-na-iznanku.com
ki-lowroermond.nl
promesapuertorico.com
kissit.ca
dezatec.es
cite4me.org
grelot-home.com
musictreehouse.net
hkr-reise.de
id-vet.com
gasolspecialisten.se
vyhino-zhulebino-24.ru
karacaoglu.nl
bayoga.co.uk
solhaug.tk
jadwalbolanet.info
ncid.bc.ca
bricotienda.com
boldcitydowntown.com
homecomingstudio.com
sojamindbody.com
castillobalduz.es
asgestion.com
dushka.ua
hiddencitysecrets.com.au
danubecloud.com
roadwarrior.app
newstap.com.ng
no-plans.com
schoolofpassivewealth.com
senson.fi
denifl-consulting.at
lmtprovisions.com
talentwunder.com
acomprarseguidores.com
myzk.site
theapifactory.com
midmohandyman.com
argos.wityu.fund
dinslips.se
kalkulator-oszczednosci.pl
wurmpower.at
drugdevice.org
foretprivee.ca
nurturingwisdom.com
funjose.org.gt
blgr.be
readberserk.com
lescomtesdemean.be
firstpaymentservices.com
malychanieruchomoscipremium.com
travelffeine.com
latribuessentielle.com
lusak.at
better.town
smessier.com
kafu.ch
ikads.org
id-et-d.fr
sanaia.com
prochain-voyage.net
edrcreditservices.nl
yassir.pro
gantungankunciakrilikbandung.com
moveonnews.com
bhwlawfirm.com
bigbaguettes.eu
edv-live.de
littlebird.salon
iyengaryogacharlotte.com
toponlinecasinosuk.co.uk
zonamovie21.net
caribdoctor.org
body-guards.it
calabasasdigest.com
elimchan.com
herbstfeststaefa.ch
thewellnessmimi.com
corola.es
pomodori-pizzeria.de
controldekk.com
lichencafe.com
lefumetdesdombes.com
seagatesthreecharters.com
copystar.co.uk
systemate.dk
alsace-first.com
webmaster-peloton.com
koko-nora.dk
jakekozmor.com
mousepad-direkt.de
iwelt.de
dirittosanitario.biz
precisionbevel.com
boulderwelt-muenchen-west.de
chatizel-paysage.fr
praxis-foerderdiagnostik.de
globedivers.wordpress.com
nosuchthingasgovernment.com
neuschelectrical.co.za
schmalhorst.de
mediaclan.info
ihr-news.jp
bunburyfreightservices.com.au
edelman.jp
backstreetpub.com
spsshomeworkhelp.com
lillegrandpalais.com
smithmediastrategies.com
enovos.de
loprus.pl
bsaship.com
importardechina.info
shhealthlaw.com
freie-baugutachterpraxis.de
maxadams.london
deprobatehelp.com
baylegacy.com
deltacleta.cat
financescorecard.com
maureenbreezedancetheater.org
plv.media
winrace.no
leoben.at
pawsuppetlovers.com
tuuliautio.fi
paradicepacks.com
1team.es
testcoreprohealthuk.com
broseller.com
iyahayki.nl
lorenacarnero.com
satyayoga.de
notmissingout.com
chavesdoareeiro.com
mezhdu-delom.ru
hugoversichert.de
jusibe.com
imaginado.de
craftleathermnl.com
sauschneider.info
atalent.fi
conexa4papers.trade
global-kids.info
serce.info.pl
agence-referencement-naturel-geneve.net
zimmerei-fl.de
augenta.com
fannmedias.com
villa-marrakesch.de
ulyssemarketing.com
x-ray.ca
schraven.de
bowengroup.com.au
sairaku.net
southeasternacademyofprosthodontics.org
modamilyon.com
pubweb.carnet.hr
alysonhoward.com
sahalstore.com
triactis.com
panelsandwichmadrid.es
xn--vrftet-pua.biz
adoptioperheet.fi
miriamgrimm.de
filmstreamingvfcomplet.be
kostenlose-webcams.com
deoudedorpskernnoordwijk.nl
live-your-life.jp
mardenherefordshire-pc.gov.uk
instatron.net
mirjamholleman.nl
euro-trend.pl
kojima-shihou.com
nuzech.com
basisschooldezonnewijzer.nl
quemargrasa.net
actecfoundation.org
gamesboard.info
podsosnami.ru
extensionmaison.info
retroearthstudio.com
polzine.net
hmsdanmark.dk
linnankellari.fi
schoellhammer.com
elpa.se
mooreslawngarden.com
rozemondcoaching.nl
lenreactiv-shop.ru
uranus.nl
advokathuset.dk
ora-it.de
love30-chanko.com
smartypractice.com
rebeccarisher.com
cafemattmeera.com
bargningavesta.se
www1.proresult.no
rhinosfootballacademy.com
polychromelabs.com
notsilentmd.org
makeflowers.ru
zimmerei-deboer.de
ccpbroadband.com
iwr.nl
wychowanieprzedszkolne.pl
greenpark.ch
bimnapratica.com
lachofikschiet.nl
memaag.com
parking.netgateway.eu
tanzschule-kieber.de
antiaginghealthbenefits.com
simulatebrain.com
digi-talents.com
hairnetty.wordpress.com
samnewbyjax.com
helikoptervluchtnewyork.nl
devlaur.com
cimanchesterescorts.co.uk
houseofplus.com
rushhourappliances.com
pelorus.group
kedak.de
lapmangfpt.info.vn
pivoineetc.fr
marchand-sloboda.com
anybookreader.de
markelbroch.com
celularity.com
rafaut.com
unim.su
latestmodsapks.com
thedresserie.com
bigasgrup.com
slimidealherbal.com
phantastyk.com
thailandholic.com
tophumanservicescourses.com
aakritpatel.com
navyfederalautooverseas.com
wien-mitte.co.at
forestlakeuca.org.au
sporthamper.com
psnacademy.in
michaelsmeriglioracing.com
jbbjw.com
colorofhorses.com
iqbalscientific.com
cleliaekiko.online
stemplusacademy.com
effortlesspromo.com
microcirc.net
mbfagency.com
theduke.de
drinkseed.com
troegs.com
peterstrobos.com
consultaractadenacimiento.com
huissier-creteil.com
geoffreymeuli.com
skanah.com
despedidascostablanca.es
alten-mebel63.ru
theadventureedge.com
profectis.de
mepavex.nl
rimborsobancario.net
pasvenska.se
tampaallen.com
symphonyenvironmental.com
videomarketing.pro
pickanose.com
licor43.de
aniblinova.wordpress.com
ventti.com.ar
hhcourier.com
buymedical.biz
oncarrot.com
nachhilfe-unterricht.com
mapawood.com
vox-surveys.com
milsing.hr
sotsioloogia.ee
nativeformulas.com
kirkepartner.dk
partnertaxi.sk
visiativ-industry.fr
transliminaltribe.wordpress.com
chefdays.de
cursosgratuitosnainternet.com
faronics.com
d2marketing.co.uk
lapinlviasennus.fi
miraclediet.fun
bristolaeroclub.co.uk
jameskibbie.com
songunceliptv.com
baronloan.org
idemblogs.com
eglectonk.online
christinarebuffetcourses.com
bastutunnan.se
blogdecachorros.com
finde-deine-marke.de
platformier.com
antenanavi.com
vanswigchemdesign.com
gporf.fr
pmc-services.de
atmos-show.com
danholzmann.com
itelagen.com
transportesycementoshidalgo.es
gymnasedumanagement.com
siluet-decor.ru
gasbarre.com
milltimber.aberdeen.sch.uk
tinkoff-mobayl.ru
expandet.dk
rumahminangberdaya.com
polymedia.dk
newyou.at
zenderthelender.com
artallnightdc.com
tomaso.gr
centrospgolega.com
sweering.fr
tux-espacios.com
ecopro-kanto.com
spacecitysisters.org
bierensgebakkramen.nl
all-turtles.com
coffreo.biz
tandartspraktijkheesch.nl
vietlawconsultancy.com
deko4you.at
tennisclubetten.nl
extraordinaryoutdoors.com
crowcanyon.com
classycurtainsltd.co.uk
apolomarcas.com
verytycs.com
manijaipur.com
veybachcenter.de
falcou.fr
associationanalytics.com
beautychance.se
pocket-opera.de
christ-michael.net
vdberg-autoimport.nl
4net.guru
finediningweek.pl
stampagrafica.es
naturalrapids.com
ussmontanacommittee.us
beaconhealthsystem.org
upplandsspar.se
tradiematepro.com.au
oneplusresource.org
maasreusel.nl
aodaichandung.com
campus2day.de
burkert-ideenreich.de
you-bysia.com.au
mediaacademy-iraq.org
xtptrack.com
eaglemeetstiger.de
mountaintoptinyhomes.com
stemenstilte.nl
noskierrenteria.com
ivfminiua.com
biapi-coaching.fr
art2gointerieurprojecten.nl
corendonhotels.com
ditog.fr
kadesignandbuild.co.uk
abogadosaccidentetraficosevilla.es
camsadviser.com
limassoldriving.com
worldhealthbasicinfo.com
kojinsaisei.info
bigler-hrconsulting.ch
girlillamarketing.com
xn--rumung-bua.online
naturstein-hotte.de
agence-chocolat-noir.com
stormwall.se
collaborativeclassroom.org
baptisttabernacle.com
streamerzradio1.site
mooglee.com
smart-light.co.uk
fitovitaforum.com
c2e-poitiers.com
igrealestate.com
wari.com.pe
takeflat.com
logopaedie-blomberg.de
mrsplans.net
mooshine.com
humanityplus.org
otsu-bon.com
onlyresultsmarketing.com
interactcenter.org
ungsvenskarna.se
35-40konkatsu.net
zzyjtsgls.com
spectrmash.ru
tenacitytenfold.com
torgbodenbollnas.se
drnice.de
lightair.com
huesges-gruppe.de
promalaga.es
paulisdogshop.de
hotelsolbh.com.br
julis-lsa.de
myteamgenius.com
darnallwellbeing.org.uk
refluxreducer.com
educar.org
kuntokeskusrok.fi
truenyc.co
comparatif-lave-linge.fr
frontierweldingllc.com
autodemontagenijmegen.nl
spylista.com
allfortheloveofyou.com
ilso.net
corona-handles.com
micahkoleoso.de
fairfriends18.de
haremnick.com
ecoledansemulhouse.fr
blewback.com
macabaneaupaysflechois.com
osterberg.fi
surespark.org.uk
stupbratt.no
hokagestore.com
mirkoreisser.de
tomoiyuma.com
tigsltd.com
manifestinglab.com
glennroberts.co.nz
hardinggroup.com
zso-mannheim.de
yousay.site
dublikator.com
oneheartwarriors.at
pointos.com
kenhnoithatgo.com
ausbeverage.com.au
testzandbakmetmening.online
grupocarvalhoerodrigues.com.br
werkkring.nl
hotelzentral.at
vibethink.net
123vrachi.ru
allure-cosmetics.at
mrxermon.de
bloggyboulga.net
bouldercafe-wuppertal.de
sobreholanda.com
smogathon.com
beyondmarcomdotcom.wordpress.com
wraithco.com
bookspeopleplaces.com
montrium.com
webcodingstudio.com
lucidinvestbank.com
ncs-graphic-studio.com
stingraybeach.com
aglend.com.au
lecantou-coworking.com
tongdaifpthaiphong.net
solerluethi-allart.ch
coursio.com
otto-bollmann.de
madinblack.com
vibehouse.rw
bridgeloanslenders.com
erstatningsadvokaterne.dk
resortmtn.com
socstrp.org
pier40forall.org
ostheimer.at
quickyfunds.com
aminaboutique247.com
jobcenterkenya.com
jenniferandersonwriter.com
marcuswhitten.site
mediaplayertest.net
irinaverwer.com
stoeberstuuv.de
lebellevue.fr
the-virtualizer.com
outcomeisincome.com
gonzalezfornes.es
kunze-immobilien.de
myhealth.net.au
helenekowalsky.com
xn--fn-kka.no
withahmed.com
simplyblessedbykeepingitreal.com
havecamerawilltravel2017.wordpress.com
muamuadolls.com
balticdentists.com
mank.de
croftprecision.co.uk
jandaonline.com
datacenters-in-europe.com
gw2guilds.org
raschlosser.de
geekwork.pl
pv-design.de
opatrovanie-ako.sk
ausair.com.au
commonground-stories.com
parebrise-tla.fr
vloeren-nu.nl
conasmanagement.de
dlc.berlin
liveottelut.com
4youbeautysalon.com
lykkeliv.net
adultgamezone.com
hexcreatives.co
citymax-cr.com
portoesdofarrobo.com
patrickfoundation.net
tonelektro.nl
atozdistribution.co.uk
urclan.net
evergreen-fishing.com
body-armour.online
nsec.se
autopfand24.de
syndikat-asphaltfieber.de
yourobgyn.net
vihannesporssi.fi
new.devon.gov.uk
teczowadolina.bytom.pl
antonmack.de
dpo-as-a-service.com
pogypneu.sk
creative-waves.co.uk
htchorst.nl
xn--fnsterputssollentuna-39b.se
norpol-yachting.com
parkstreetauto.net
sloverse.com
candyhouseusa.com
tsklogistik.eu
smejump.co.th
diversiapsicologia.es
unetica.fr
drfoyle.com
cranleighscoutgroup.org
dekkinngay.com
n1-headache.com
amerikansktgodis.se
evangelische-pfarrgemeinde-tuniberg.de
fransespiegels.nl
coastalbridgeadvisors.com
qualitaetstag.de
kath-kirche-gera.de
alhashem.net
schutting-info.nl
2ekeus.nl
berlin-bamboo-bikes.org
minipara.com
blood-sports.net
milestoneshows.com
physiofischer.de
ontrailsandboulevards.com
babcockchurch.org
healthyyworkout.com
plantag.de
krcove-zily.eu
mylolis.com
fax-payday-loans.com
praxis-management-plus.de
smokeysstoves.com
longislandelderlaw.com
calxplus.eu
mountsoul.de
dubscollective.com
luckypatcher-apkz.com
epwritescom.wordpress.com
fundaciongregal.org
klusbeter.nl
jobmap.at
oldschoolfun.net
abl1.net
labobit.it
romeguidedvisit.com
carrybrands.nl
people-biz.com
blossombeyond50.com
theclubms.com
whittier5k.com
jolly-events.com
kisplanning.com.au
rostoncastings.co.uk
ravensnesthomegoods.com
nhadatcanho247.com
vetapharma.fr
hihaho.com
tulsawaterheaterinstallation.com
purposeadvisorsolutions.com
faizanullah.com
directwindowco.com
herbayupro.com
pay4essays.net
work2live.de
stoneys.ch
webhostingsrbija.rs
lange.host
baustb.de
psa-sec.de
hushavefritid.dk
lloydconstruction.com
ra-staudte.de
mbxvii.com
tecnojobsnet.com
starsarecircular.org
twohourswithlena.wordpress.com
stoeferlehalle.de
merzi.info
garage-lecompte-rouen.fr
hypozentrum.com
nestor-swiss.ch
thomasvicino.com
kmbshipping.co.uk
denovofoodsgroup.com
planchaavapor.net
dr-pipi.de
qlog.de
lynsayshepherd.co.uk
aco-media.nl
abogadoengijon.es
bestbet.com
liliesandbeauties.org
norovirus-ratgeber.de
thee.network
stacyloeb.com
bundabergeyeclinic.com.au
sandd.nl
americafirstcommittee.org
milanonotai.it
kevinjodea.com
easytrans.com.au
westdeptfordbuyrite.com
carriagehousesalonvt.com
operaslovakia.sk
corelifenutrition.com
hashkasolutindo.com
compliancesolutionsstrategies.com
edgewoodestates.org
mastertechengineering.com
pinkexcel.com
cnoia.org
aprepol.com
rieed.de
katketytaanet.fi
lascuola.nl
assurancesalextrespaille.fr
paymybill.guru
xoabigail.com
ligiercenter-sachsen.de
answerstest.ru
airconditioning-waalwijk.nl
pixelarttees.com
freie-gewerkschaften.de
dnepr-beskid.com.ua
eco-southafrica.com
dutchcoder.nl
iphoneszervizbudapest.hu
allentownpapershow.com
bingonearme.org
summitmarketingstrategies.com
completeweddingkansas.com
wolf-glas-und-kunst.de
employeesurveys.com
scenepublique.net
monark.com
seitzdruck.com
alvinschwartz.wordpress.com
knowledgemuseumbd.com
spd-ehningen.de
boosthybrid.com.au
launchhubl.com
revezlimage.com
dontpassthepepper.com
petnest.ir
associacioesportivapolitg.cat
12starhd.online
jerling.de
kaotikkustomz.com
sarbatkhalsafoundation.org
solinegraphic.com
skiltogprint.no
craigmccabe.fun
puertamatic.es
mylovelybluesky.com
run4study.com
pierrehale.com
cactusthebrand.com
101gowrie.com
nicoleaeschbachorg.wordpress.com
architekturbuero-wagner.net
mindpackstudios.com
vitavia.lt
bouncingbonanza.com
lukeshepley.wordpress.com
igfap.com
bockamp.com
levihotelspa.fi
exenberger.at
tinyagency.com
familypark40.com
alfa-stroy72.com
boompinoy.com
mdacares.com
architecturalfiberglass.org
slupetzky.at
sinal.org
qualitus.com
deepsouthclothingcompany.com
groupe-frayssinet.fr
synlab.lt
kamienny-dywan24.pl
ilcdover.com
humancondition.com
insigniapmg.com
arteservicefabbro.com
team-montage.dk
iviaggisonciliegie.it
austinlchurch.com
rehabilitationcentersinhouston.net
zervicethai.co.th
vickiegrayimages.com
ziegler-praezisionsteile.de
crediacces.com
comarenterprises.com
courteney-cox.net
trapiantofue.it
space.ua
odiclinic.org
noesis.tech
urmasiimariiuniri.ro
8449nohate.org
xltyu.com
kikedeoliveira.com
remcakram.com
degroenetunnel.com
strandcampingdoonbeg.com
haar-spange.com
pmcimpact.com
ceid.info.tr
gemeentehetkompas.nl
stopilhan.com
dareckleyministries.com
sportverein-tambach.de
ivivo.es
braffinjurylawfirm.com
pcprofessor.com
bordercollie-nim.nl
hrabritelefon.hr
ctrler.cn
makeitcount.at
foryourhealth.live
seproc.hn
ianaswanson.com
nijaplay.com
brandl-blumen.de
lubetkinmediacompanies.com
ouryoungminds.wordpress.com
micro-automation.de
apprendrelaudit.com
securityfmm.com
geisterradler.de
morawe-krueger.de
nmiec.com
sla-paris.com
figura.team
vitalyscenter.es
jvanvlietdichter.nl
crosspointefellowship.church
handi-jack-llc.com
femxarxa.cat
wsoil.com.sg
xlarge.at
groupe-cets.com
admos-gleitlager.de
liikelataamo.fi
sevenadvertising.com
nancy-informatique.fr
ateliergamila.com
stefanpasch.me
wacochamber.com
aurum-juweliere.de
hatech.io
centuryrs.com
ilive.lt
fensterbau-ziegler.de
zflas.com
thefixhut.com
goodgirlrecovery.com
botanicinnovations.com
saxtec.com
tips.technology
smalltownideamill.wordpress.com
pt-arnold.de
tarotdeseidel.com
bildungsunderlebnis.haus
brevitempore.net
imadarchid.com
sportiomsportfondsen.nl
digivod.de
darrenkeslerministries.com
smhydro.com.pl
echtveilig.nl
schlafsack-test.net
galserwis.pl
eraorastudio.com
faroairporttransfers.net
connectedace.com
pcp-nc.com
jyzdesign.com
suncrestcabinets.ca
offroadbeasts.com
teresianmedia.org
greenfieldoptimaldentalcare.com
thomas-hospital.de
embracinghiscall.com
ralister.co.uk
rosavalamedahr.com
quizzingbee.com
richard-felix.co.uk
sipstroysochi.ru
todocaracoles.com
shiftinspiration.com
campusoutreach.org
bodyforwife.com
katiekerr.co.uk
sportsmassoren.com
trystana.com
ino-professional.ru
slashdb.com
selfoutlet.com
personalenhancementcenter.com
proudground.org
walkingdeadnj.com
d1franchise.com
anthonystreetrimming.com
forskolorna.org
brawnmediany.com
uimaan.fi
journeybacktolife.com
pferdebiester.de
kao.at
asteriag.com
hvccfloorcare.com
parks-nuernberg.de
div-vertriebsforschung.de
centromarysalud.com
asiluxury.com
chrissieperry.com
verbisonline.com
onlybacklink.com
radaradvies.nl
daklesa.de
sagadc.com
waveneyrivercentre.co.uk
mytechnoway.com
fitnessbazaar.com
fibrofolliculoma.info
fayrecreations.com
maryloutaylor.com
whyinterestingly.ru
maratonaclubedeportugal.com
maineemploymentlawyerblog.com
kosterra.com
blumenhof-wegleitner.at
punchbaby.com
wmiadmin.com
bxdf.info
harveybp.com
vermoote.de
johnsonfamilyfarmblog.wordpress.com
plastidip.com.ar
autofolierung-lu.de
highimpactoutdoors.net
cwsitservices.co.uk
hairstylesnow.site
mymoneyforex.com
victoriousfestival.co.uk
farhaani.com
web.ion.ag
simoneblum.de
carolinepenn.com
blacksirius.de
trackyourconstruction.com
naturavetal.hr
heliomotion.com
rollingrockcolumbia.com
judithjansen.com
poultrypartners.nl
baumkuchenexpo.jp
insidegarage.pl
irishmachineryauctions.com
intecwi.com
porno-gringo.com
penco.ie
jacquin-maquettes.com
anteniti.com
hebkft.hu
ftlc.es
dutchbrewingcoffee.com
behavioralmedicinespecialists.com
socialonemedia.com
cirugiauretra.es
c-a.co.in
nokesvilledentistry.com
chandlerpd.com
aunexis.ch
gmto.fr
berliner-versicherungsvergleich.de
jsfg.com
vesinhnha.com.vn
joyeriaorindia.com
greenko.pl
cerebralforce.net
rota-installations.co.uk
presseclub-magdeburg.de
yamalevents.com
renergysolution.com
roygolden.com
verifort-capital.de
delawarecorporatelaw.com
jiloc.com
icpcnj.org
1kbk.com.ua
noixdecocom.fr
entopic.com
hellohope.com
flexicloud.hk
danielblum.info
thaysa.com
mdk-mediadesign.de
nataschawessels.com
smale-opticiens.nl
charlesreger.com
kaliber.co.jp
almosthomedogrescue.dog
reddysbakery.com
waynela.com
ahouseforlease.com
binder-buerotechnik.at
happyeasterimages.org
dr-tremel-rednitzhembach.de
mikeramirezcpa.com
zweerscreatives.nl
dramagickcom.wordpress.com
commercialboatbuilding.com
argenblogs.com.ar
heurigen-bauer.at
ogdenvision.com
gadgetedges.com
izzi360.com
turkcaparbariatrics.com
spargel-kochen.de
pridoxmaterieel.nl
heidelbergartstudio.gallery
ftf.or.at
kaminscy.com
filmvideoweb.com
meusharklinithome.wordpress.com
xn--thucmctc-13a1357egba.com
tstaffing.nl
abogadosadomicilio.es
igorbarbosa.com
homesdollar.com
ncuccr.org
caffeinternet.it
abogados-en-alicante.es
evologic-technologies.com
oslomf.no
desert-trails.com
gastsicht.de
nvwoodwerks.com
slwgs.org
vorotauu.ru
lionware.de
bodyfulls.com
myhostcloud.com
amylendscrestview.com
bptdmaluku.com
bogdanpeptine.ro
perbudget.com
strategicstatements.com
simpliza.com
innote.fi
365questions.org
sanyue119.com
walter-lemm.de
cuppacap.com
teknoz.net
layrshift.eu
blog.solutionsarchitect.guru
parkcf.nl
themadbotter.com
upmrkt.co
modelmaking.nl
nandistribution.nl
ledmes.ru
coding-marking.com
sachnendoc.com
thedad.com
mercantedifiori.com
artotelamsterdam.com
plotlinecreative.com
bauertree.com
woodleyacademy.org
dw-css.de
leda-ukraine.com.ua
destinationclients.fr
jasonbaileystudio.com
cheminpsy.fr
devstyle.org
kindersitze-vergleich.de
live-con-arte.de
bee4win.com
fiscalsort.com
jeanlouissibomana.com
huehnerauge-entfernen.de
eadsmurraypugh.com
fotoscondron.com
DupontSellsHomes.com
brigitte-erler.com
imperfectstore.com
shonacox.com
nacktfalter.de
devok.info
esope-formation.fr
mariposapropaneaz.com
sw1m.ru
mrtour.site
hannah-fink.de
bafuncs.org
kampotpepper.gives
ampisolabergeggi.it
cuspdental.com
philippedebroca.com
abitur-undwieweiter.de
hoteledenpadova.it
tanciu.com
delchacay.com.ar
cortec-neuro.com
theshungiteexperience.com.au
deschl.net
biortaggivaldelsa.com
fitnessingbyjessica.com
dsl-ip.de
officehymy.com
shadebarandgrillorlando.com
bargningharnosand.se
mmgdouai.fr
daniel-akermann-architektur-und-planung.ch
xn--logopdie-leverkusen-kwb.de
buroludo.nl
ymca-cw.org.uk
executiveairllc.com
allamatberedare.se
servicegsm.net
kingfamily.construction
nakupunafoundation.org
henricekupper.com
shsthepapercut.com
lbcframingelectrical.com
ladelirante.fr
clos-galant.com
dr-seleznev.com
siliconbeach-realestate.com
tanzprojekt.com
fatfreezingmachines.com
kamahouse.net
gratispresent.se
softsproductkey.com
marathonerpaolo.com
gopackapp.com
manutouchmassage.com
marketingsulweb.com
craigvalentineacademy.com
catholicmusicfest.com
gaiam.nl
woodworkersolution.com
pasivect.co.uk
cyntox.com
advizewealth.com
y-archive.com
saarland-thermen-resort.com
fizzl.ru
oemands.dk
mrsfieldskc.com
levdittliv.se
rksbusiness.com
sexandfessenjoon.wordpress.com
first-2-aid-u.com
simpkinsedwards.co.uk
the-domain-trader.com
rocketccw.com
celeclub.org
urist-bogatyr.ru
lapinvihreat.fi
ecpmedia.vn
zieglerbrothers.de
piajeppesen.dk
joseconstela.com
carlosja.com
real-estate-experts.com
toreria.es
analiticapublica.es
kariokids.com
leeuwardenstudentcity.nl
psc.de
tetinfo.in
ai-spt.jp
homng.net
em-gmbh.ch
trulynolen.co.uk
oceanastudios.com
csgospeltips.se
luxurytv.jp
abuelos.com
birnam-wood.com
theletter.company
bbsmobler.se
restaurantesszimmer.de
insp.bi
besttechie.com
autodujos.lt
chaotrang.com
galleryartfair.com
321play.com.hk
saka.gr
tandartspraktijkhartjegroningen.nl
steampluscarpetandfloors.com
waermetauscher-berechnen.de
sterlingessay.com
justinvieira.com
waywithwords.net
shiresresidential.com
naswrrg.org
spinheal.ru
slimani.net
modestmanagement.com
triggi.de
cityorchardhtx.com
narcert.com
-
net
false
-
pid
$2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq
-
prc
encsvc
powerpnt
ocssd
steam
isqlplussvc
outlook
sql
ocomm
agntsvc
mspub
onenote
winword
thebat
excel
mydesktopqos
ocautoupds
thunderbird
synctime
infopath
mydesktopservice
firefox
oracle
sqbcoreservice
dbeng50
tbirdconfig
msaccess
visio
dbsnmp
wordpad
xfssvccon
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
8254
-
svc
veeam
memtas
sql
backup
vss
sophos
svc$
mepocs
Extracted
crimsonrat
134.119.181.142
10.5.26.108
Extracted
vidar
39.4
931
https://sergeevih43.tumblr.com/
-
profile_id
931
Extracted
C:\Program Files\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.best
Extracted
C:\Recovery\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.best
Extracted
C:\Recovery\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.icu/
Extracted
C:\Users\r9p1525r-readme.txt
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8305E0107A7515E2
http://decoder.re/8305E0107A7515E2
Extracted
C:\Users\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.top
Extracted
C:\Program Files\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.best
Extracted
djvu
http://astdg.top/nddddhsspen6/get.php
-
extension
.zzla
-
offline_id
nZH1798DvPbIMQmK7lZZDSpe81UIFzsEMm3NtJt1
-
payload_url
http://dgos.top/dl/build2.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-mNr1oio2P6 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0314ewgfDd
Extracted
redline
terrornax
45.88.3.176:17033
Targets
-
-
Target
RNSM00450.7z
-
Size
42.2MB
-
MD5
bfd40652a6a56169533500d1f6725940
-
SHA1
b070b8b7777b2c32965196aed7a47a3f2f7526a5
-
SHA256
c90c7e54c06ebeb429bc6b61be52dc96134991f5100779c1357b50beffa3a756
-
SHA512
60374aaecfdf66c68bb7e8f67285c84019792f4b16b3242a82de5e4d80fcf11878138e0e65a7b66a49cf7cc203e3445439b4a0c5a7c9f95481d7965e386f5804
-
SSDEEP
786432:4l+NsvkAVmYGhyE4cFDaKpPNFoRHiOjOIaYyV//qiYBv4CVL4CQsRA9BYLfJ:hKvlm7yE4STPNFoRBjOIbyV/Ci+v4Ci6
-
Detect ZGRat V2
-
Detected Djvu ransomware
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Vidar Stealer
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Access Token Manipulation
1Create Process with Token
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Access Token Manipulation
1Create Process with Token
1File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2