Locky (08/09/2017)

XOR key: ttXahvVnoAyxGwH7YyrZV3PphTR8lbYw
XORed payload: 3e1924867806778624d231df10928d4d4deef2b3f24de5505f624ddde7d33636
UnXORed payload: 278e5503f777b0fec03cff2acddedb67f8b62bb14f34a9e761408aaf3ce5450f
Pattern: "MS-INV-<4 digits>.vbs"

hxxp://aac-autoecole.com/3936jkgHGdcm
hxxp://activ-conduite.eu/3936jkgHGdcm
hxxp://autoecolecarnot.com/3936jkgHGdcm
hxxp://awholeblueworld.com/3936jkgHGdcm
hxxp://bit-chasers.com/3936jkgHGdcm
hxxp://blaeberrycabin.com/3936jkgHGdcm
hxxp://brandingforbuyout.com/3936jkgHGdcm
hxxp://dueeffepromotion.com/3936jkgHGdcm
hxxp://etforhartohat.info/af/3936jkgHGdcm
hxxp://geolearner.com/3936jkgHGdcm
hxxp://handhi.com/3936jkgHGdcm
hxxp://lagrangeglassandmirrorco.com/3936jkgHGdcm
hxxp://lp-usti.cz/3936jkgHGdcm
hxxp://montessibooks.com/3936jkgHGdcm
hxxp://multicolourflyers.co.uk/3936jkgHGdcm
hxxp://ostiavolleyclub.it/3936jkgHGdcm
hxxp://pack-lines.com/3936jkgHGdcm
hxxp://qxr33qxr.com/3936jkgHGdcm
hxxp://studiotoscanosrl.it/3936jkgHGdcm
hxxp://suncoastot.com/3936jkgHGdcm
hxxp://weekendjevliegen.nl/3936jkgHGdcm