Static task
static1
Behavioral task
behavioral1
Sample
2fa7b5a60cd1a8b67b09a13e09529fe399d2f3f62c5591badaccf5d3a052289f.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2fa7b5a60cd1a8b67b09a13e09529fe399d2f3f62c5591badaccf5d3a052289f.dll
Resource
win10-en-20211208
General
-
Target
2fa7b5a60cd1a8b67b09a13e09529fe399d2f3f62c5591badaccf5d3a052289f
-
Size
164KB
-
MD5
5fa2e3adcd15792d66654130fcf47744
-
SHA1
1df8a5fb27139fb5ca5cf0f5921e4e9808ee97a1
-
SHA256
2fa7b5a60cd1a8b67b09a13e09529fe399d2f3f62c5591badaccf5d3a052289f
-
SHA512
41ddd0647a56174e9953322236892a4b6db133503bf6421b6dcfa24f103f584be0e6000fe574e69293468b72e4191bd95a18dbaa9add6fc11ce20b022c0aa37e
-
SSDEEP
3072:gdh/MHQzMozq4ndm8jX5IXzs+M9VQHDO1qIo0xfVl:gdh/EGMgpdmwIXo+M9VQHDu
Malware Config
Extracted
sodinokibi
28
1432
wasnederland.nl
radishallgood.com
burg-zelem.de
loparnille.se
hiddensee-buhne11.de
qandmmusiccenter.com
heimdalbygg.no
michaelfiegel.com
gaearoyals.com
annenymus.com
customroasts.com
agenceassemble.fr
mercadodelrio.com
krishnabrawijaya.com
cotton-avenue.co.il
alaskaremote.com
livedeveloper.com
adabible.org
palema.gr
janellrardon.com
eurethicsport.eu
unislaw-narty.pl
abulanov.com
rentingwell.com
askstaffing.com
cesep2019.com
quitescorting.com
spirello.nl
mieleshopping.it
drbrianhweeks.com
motocrossplace.co.uk
log-barn.co.uk
enactusnhlstenden.com
opticahubertruiz.com
purepreprod4.com
perceptdecor.com
gavelmasters.com
mariannelemenestrel.com
dinedrinkdetroit.com
fidelitytitleoregon.com
carsten.sparen-it.de
leadforensics.com
letsstopsmoking.co.uk
lisa-poncon.fr
ketomealprep.academy
narca.net
alnectus.com
phoenixcrane.com
liverpoolabudhabi.ae
oro.ae
proffteplo.com
photographycreativity.co.uk
awaisghauri.com
nevadaruralhousingstudies.org
eafx.pro
veggienessa.com
pokemonturkiye.com
craftingalegacy.com
cuadc.org
ikadomus.com
queertube.net
creohn.de
mundo-pieces-auto.fr
liveyourheartout.co
qwikcoach.com
racefietsenblog.nl
lidkopingsnytt.nu
envomask.com
forumsittard.nl
lunoluno.com
nepressurecleaning.com
ronaldhendriks.nl
janasfokus.com
lattalvor.com
afbudsrejserallinclusive.dk
condormobile.fr
brannbornfastigheter.se
limmortelyouth.com
cp-bap.de
mazift.dk
xtensifi.com
bluemarinefoundation.com
nginx.com
xn--80addfr4ahr.dp.ua
domilivefurniture.com
suitesartemis.gr
salonlamar.nl
nxtstg.org
justaroundthecornerpetsit.com
modamarfil.com
ikzoekgod.be
dmlcpa.com
physio-lang.de
chorusconsulting.net
davedavisphotos.com
arazi.eus
bcmets.info
parseport.com
vitormmcosta.com
randyabrown.com
directique.com
linearete.com
campinglaforetdetesse.com
sytzedevries.com
thegetawaycollective.com
geitoniatonaggelon.gr
ox-home.com
acornishstudio.co.uk
singletonfinancial.com
yourcosmicbeing.com
liepertgrafikweb.at
georgemuncey.com
mariamalmahdi.com
bratek-immobilien.de
acb-gruppe.ch
secrets-clubs.co.uk
boyfriendsgoal.site
arearugcleaningnyc.com
smartercashsystem.com
hotelturbo.de
makingmillionaires.net
reizenmetkinderen.be
ddmgen.com
whoopingcrane.com
plbinsurance.com
vvego.com
aceroprime.com
akwaba-safaris.com
carolynfriedlander.com
leloupblanc.gr
5thactors.com
bg.szczecin.pl
lovetzuchia.com
ced-elec.com
baikalflot.ru
cap29010.it
sharonalbrightdds.com
smartworkplaza.com
martinipstudios.com
jalkapuu.net
9nar.com
dieetuniversiteit.nl
theatre-embellie.fr
mrmac.com
alattekniksipil.com
kookooo.com
ceocenters.com
andreaskildegaard.dk
avtoboss163.ru:443
voetbalhoogeveen.nl
kemtron.fr
markseymourphotography.co.uk
kristianboennelykke.dk
11.in.ua
auberives-sur-vareze.fr
polynine.com
angelika-schwarz.com
skooppi.fi
drvoip.com
chainofhopeeurope.eu
mindfuelers.com
iron-mine.ru
eyedoctordallas.com
noda.com.ua
wrinstitute.org
juergenblaetz.de
logosindustries.com
rarefoods.ro
sshomme.com
adaduga.info
catering.com
1deals.com
tesisatonarim.com
lyricalduniya.com
hypogenforensic.com
tzn.nu
brownswoodblog.com
amyandzac.com
sppdstats.com
alcye.com
greatofficespaces.net
dinecorp.com
istantidigitali.com
basindentistry.com
asiaartgallery.jp
ruggestar.ch
matteoruzzaofficial.com
kosten-vochtbestrijding.be
amelielecompte.wordpress.com
johnkoen.com
sber-biznes.com
activeterroristwarningcompany.com
ideamode.com
circlecitydj.com
ludoil.it
solutionshosting.co.uk
golfclublandgoednieuwkerk.nl
schroederschoembs.com
rechtenplicht.be
direitapernambuco.com
rino-gmbh.com
adedesign.com
atrgroup.it
zealcon.ae
renehartman.nl
profibersan.com
autoteamlast.de
imaginekithomes.co.nz
larchwoodmarketing.com
cac2040.com
encounter-p.net
goodherbalhealth.com
sololibrerie.it
premiumweb.com.ua:443
happylublog.wordpress.com
zwemofficial.nl
renderbox.ch
billscars.net
nbva.co.uk
watchsale.biz
epicjapanart.com
bd2fly.com
irizar.com
bescomedical.de
wyreforest.net
imajyuku-sozoku.com
111firstdelray.com
gta-jjb.fr
jobscore.com
alabamaroofingllc.com
dcc-eu.com
cyberpromote.de
malzomattalar.com
leopoldineroux.com
myfbateam.com
lollachiro.com
silkeight.com
die-immo-agentur.de
jlwilsonbooks.com
collegetennis.info
perfectgrin.com
relevantonline.eu
sarahspics.co.uk
topautoinsurers.net
2020hindsight.info
molade.nl
thegrinningmanmusical.com
the5thquestion.com
soncini.ch
csaballoons.com
bookingwheel.com
nieuwsindeklas.be
rattanwarehouse.co.uk
uncensoredhentaigif.com
mindsparkescape.com
lmmont.sk
fotoeditores.com
insane.agency
ronielyn.com
baita.ac
angelsmirrorus.com
annida.it
delegationhub.com
kdbrh.com
innervisions-id.com
skidpiping.de
etgdogz.de
heuvelland-oaze.nl
cormanmarketing.com
selected-minds.de
production-stills.co.uk
jobkiwi.com.ng
citiscapes-art.com
paprikapod.com
letterscan.de
kompresory-opravy.com
hvitfeldt.dk
hartofurniture.com
maryairbnb.wordpress.com
limounie.com
jacquesgarcianoto.com
prometeyagro.com.ua
breakluckrecords.com
galatee-couture.com
janmorgenstern.com
advesa.com
mind2muscle.nl
uci-france.fr
skyscanner.ro
yvesdoin-aquarelles.fr
littlesaints.academy
motocrosshideout.com
voice2biz.com
bundan.com
subquercy.fr
factorywizuk.com
kiraribeaute-nani.com
alltagsrassismus-entknoten.de
artvark.nl
mangimirossana.it
drbenveniste.com
tradenavigator.ch
druktemakersheerenveen.nl
ayudaespiritualtamara.com
richardiv.com
cmeow.com
promus.ca
zaczytana.com
elitkeramika-shop.com.ua
laylavalentine.com
jlgraphisme.fr
floweringsun.org
kartuindonesia.com
lesyeuxbleus.net
chatterchatterchatter.com
pourlabretagne.bzh
riffenmattgarage.ch
rolleepollee.com
antesacademy.it
toranjtuition.org
frankgoll.com
tellthebell.website
schluesseldienste-hannover.de
inewsstar.com
malevannye.ru
ilovefullcircle.com
arabianmice.com
awaitspain.com
auto-opel.ro
ocduiblog.com
eatyoveges.com
rhino-storage.co.uk
gratiocafeblog.wordpress.com
speakaudible.com
buffdaddyblog.com
biketruck.de
harleystreetspineclinic.com
rozmata.com
alisodentalcare.com
animation-pro.co.uk
palmenhaus-erfurt.de
sambaglow.com
frimec-international.es
tilldeeke.de
eventosvirtualesexitosos.com
p-ride.live
corporacionrr.com
alwaysdc.com
precisetemp.com
electricianul.com
grupoexin10.com
clinic-beethovenstrasse-ag.ch
bodymindchallenger.com
bluetenreich-brilon.de
leatherjees.com
framemyballs.com
universelle.fr
animalfood-online.de
jakubrybak.com
jimprattmediations.com
k-zubki.ru
eshop.design
so-sage.fr
breathebettertolivebetter.com
olry-cloisons.fr
skolaprome.eu
thiagoperez.com
kenmccallum.com
luvbec.com
keyboardjournal.com
chatberlin.de
jonnyhooley.com
andermattswisswatches.ch
internestdigital.com
amco.net.au
holocine.de
cookinn.nl
glende-pflanzenparadies.de
ravage-webzine.nl
theintellect.edu.pk
teutoradio.de
biblica.com
raeoflightmusic.com
lgiwines.com
a-zpaperwork.eu
weddingceremonieswithtim.com
grafikstudio-visuell.de
louiedager.com
goddardleadership.org
ivancacu.com
elex.is
nalliasmali.net
from02pro.com
cc-experts.de
rename.kz
adterium.com
morgansconsult.com
vitoriaecoturismo.com.br
myplaywin3.com
triavlete.com
hekecrm.com
mrkluttz.com
levencovka.ru
forextimes.ru
evsynthacademy.org
lumturo.academy
curtsdiscountguns.com
sbit.ag
mjk.digital
advanced-removals.co.uk
mediahub.co.nz
andrealuchesi.it
fridakids.com
smartspeak.com
palmecophilippines.com
tages-geldvergleich.de
sellthewrightway.com
datatri.be
yayasanprimaunggul.org
spartamovers.com
mursall.de
kerstliedjeszingen.nl
saint-malo-developpement.fr
blueridgeheritage.com
aktivfriskcenter.se
endstarvation.com
bertbutter.nl
haard-totaal.nl
cl0nazepamblog.com
descargandoprogramas.com
cainlaw-okc.com
hawaiisteelbuilding.com
axisoflove.org:443
prodentalblue.com
claudiakilian.de
newonestop.com
daveystownhouse.com
mahikuchen.com
saberconcrete.com
advancedeyecare.com
professionetata.com
photonag.com
witraz.pl
jglconsultancy.com
azloans.com
tetameble.pl
tutvracks.com
techybash.com
trevi-vl.ru
tothebackofthemoon.com
gosouldeep.com
ya-elka.ru
circuit-diagramz.com
wordpress.idium.no
entdoctor-durban.com
signededenroth.dk
victorvictoria.com
jmmartinezilustrador.com
aslog.fr
hensleymarketing.com
webforsites.com
brisbaneosteopathic.com.au
jdscenter.com
ahgarage.com
charlesfrancis.photos
lifeinbreaths.com
enews-qca.com
o2o-academy.com
bellesiniacademy.org
dentourage.com
towelroot.co
nicksrock.com
teethinadaydentalimplants.com
premier-iowa.com
betterce.com
bcabattoirs.org
agencewho-aixenprovence.fr
netadultere.fr
kroophold-sjaelland.dk
theater-lueneburg.de
bumbipdeco.site
soundseeing.net
b3b.ch
mamajenedesigns.com
citydogslife.com
slotspinner.com
bychowo.pl
taulunkartano.fi
lovcase.com
furland.ru
pajagus.fr
tastevirginia.com
nauticmarine.dk
globalskills.pt
jax-interim-and-projectmanagement.com
ntinasfiloxenia.gr
schulz-moelln.de
saboboxtel.uk
fazagostar.co
finnergo.eu
mediogiro.com.ar
bulyginnikitav.000webhostapp.com
speiserei-hannover.de
stoneridgemontessori.com
sochi-okna23.ru
pureelements.nl
elliemaccreative.wordpress.com
azerbaycanas.com
licensed-public-adjuster.com
stanleyqualitysystems.com
peppergreenfarmcatering.com.au
iactechnologies.net
sycamoregreenapts.com
zinnystar.com
redpebblephotography.com
chris-anne.com
centuryvisionglobal.com
karelinjames.com
wineandgo.hu
rizplakatjaya.com
legundschiess.de
penumbuhrambutkeiskei.com
osn.ro
sjtpo.org
alene.co
lsngroupe.com
agora-collectivites.com
achetrabalhos.com
handyman-silkeborg.dk
min-virksomhed.dk
ziliak.com
itheroes.dk
stabilisateur.fr
diakonie-weitramsdorf-sesslach.de
welovecustomers.fr
agendatwentytwenty.com
indiebizadvocates.org
pinkxgayvideoawards.com
hinotruckwreckers.com.au
cincinnatiphotocompany.org
mneti.ru
loysonbryan.com
lagschools.ng
keuken-prijs.nl
metriplica.academy
fanuli.com.au
broccolisoep.nl
avis.mantova.it
skyboundnutrition.co.uk
the-beauty-guides.com
tweedekansenloket.nl
beauty-traveller.com
atma.nl
sweetz.fr
acumenconsultingcompany.com
dr-vita.de
jandhpest.com
omnicademy.com
tieronechic.com
bluelakevision.com
khtrx.com
eos-horlogerie.com
kryddersnapsen.dk
triplettabordeaux.fr
dennisverschuur.com
mediabolmong.com
biodentify.ai
factoriareloj.com
wallflowersandrakes.com
the3-week-diet.net
hostastay.com
publicompserver.de
brunoimmobilier.com
stathmoulis.gr
lashandbrowenvy.com
greeneyetattoo.com
thesilkroadny.com
parksideseniorliving.net
nykfdyrehospital.dk
trainiumacademy.com
linkbuilding.life
pilotgreen.com
verbouwingsdouche.nl
walterman.es
primemarineengineering.com
unexplored.gr
stralsund-ansichten.de
rentsportsequip.com
o90.dk
altocontatto.net
zumrutkuyutemel.com
parisschool.ru
innovationgames-brabant.nl
glas-kuck.de
werkzeugtrolley.net
interlinkone.com
wribrazil.com
kvetymichalovce.sk
aheadloftladders.co.uk
g2mediainc.com
line-x.co.uk
bourchier.org
der-stempelking.de
projektparkiet.pl
augen-praxisklinik-rostock.de
scotlandsroute66.co.uk
grancanariaregional.com
xn--80abehgab4ak0ddz.xn--p1ai
paradigmlandscape.com
kamin-somnium.de
brinkdoepke.eu
spacebel.be
aidanpublishing.co.uk
sealgrinderpt.com
fluzfluzrewards.com
neonodi.be
napisat-pismo-gubernatoru.ru:443
block-optic.com
hotjapaneselesbian.com
haus-landliebe.de
tchernia-conseil.fr
testitjavertailut.net
cops4causes.org
fitnessblenderstory.com
global-migrate.com
oraweb.net
shortysspices.com
buzzneakers.com
expohomes.com
rsidesigns.com
opt4cdi.com
futurenetworking.com
campusce.com
mslp.org
martha-frets-ceramics.nl
fskhjalmar.se
nuohous.com
matthieupetel.fr
blavait.fr
test-teleachat.fr
satoblog.org
lookandseen.com
craftstone.co.nz
hnkns.com
four-ways.com
valiant-voice.com
wg-heiligenstadt.de
parentsandkids.com
unboxtherapy.site
boomerslivinglively.com
shortsalemap.com
ebible.co
lexced.com
successcolony.com.ng
santastoy.store
zuerich-umzug.ch
acibademmobil.com.tr
ijsselbeton.nl
internalresults.com
pxsrl.it
fire-space.com
fsbforsale.com
epsondriversforwindows.com
chomiksy.net
onesynergyinternational.com
vipcarrental.ae
dibli.store
jayfurnitureco.com
mesajjongeren.nl
gardenpartner.pl
therapybusinessacademy.com
magnetvisual.com
bavovrienden.nl
otpusk.zp.ua
geoweb.software
craftron.com
nvisionsigns.com
carmel-york.com
cardsandloyalty.com
alharsunindo.com
pharmeko-group.com
albcleaner.fr
computer-place.de
goeppinger-teppichreinigung.de
blucamp.com
globalcompliancenews.com
ninjaki.com
arthakapitalforvaltning.dk
drnelsonpediatrics.com
cssp-mediation.org
hepishopping.com
fbmagazine.ru
cascinarosa33.it
artcase.pl
jefersonalessandro.com
smarttourism.academy
donau-guides.eu
shrinkingplanet.com
signamedia.de
theboardroomafrica.com
crestgood.com
hospitalitytrainingsolutions.co.uk
espaciopolitica.com
pubcon.com
affligemsehondenschool.be
duthler.nl
stage-infirmier.fr
bajova.sk
catalyseurdetransformation.com
jeanmonti.com
foerderverein-vatterschule.de
go.labibini.ch
miscbo.it
naukaip.ru
groovedealers.ru
5pointpt.com
turing.academy
stressreliefadvice.com
molinum.pt
hawthornsretirement.co.uk
bmw-i-pure-impulse.com
tbalp.co.uk
kuriero.pro
buonabitare.com
bodet150ans.com
hom-frisor.dk
dayenne-styling.nl
utilisacteur.fr
avisioninthedesert.com
rivermusic.nl
benchbiz.com
nutriwell.com.sg
xrresources.com
edrickennedymacfoy.com
denverwynkoopdentist.com
muni.pe
berdonllp.com
baumfinancialservices.com
latableacrepes-meaux.fr
tramadolhealth.com
piestar.com
the-cupboard.co.uk
hoteltantra.com
frameshift.it
yournextshoes.com
memphishealthandwellness.com
bayshoreelite.com
muller.nl
apogeeconseils.fr
apmollerpension.com
fta-media.com
kickittickets.com
rishigangoly.com
mazzaropi.com.br
ledyoucan.com
flossmoordental.com
hostingbangladesh.net
ultimatelifesource.com
gazelle-du-web.com
margaretmcshane.com
midwestschool.org
m2graph.fr
vedsegaard.dk
johnstonmingmanning.com
dantreranch.com
scietech.academy
metallbau-hartmann.eu
specialtyhomeservicesllc.com
onlinetvgroup.com
dentallabor-luenen.de
supercarhire.co.uk
stitch-n-bitch.com
mrcar.nl
alexwenzel.de
buerocenter-butzbach-werbemittel.de
tatyanakopieva.ru
coachpreneuracademy.com
hm-com.com
banksrl.co.za
domaine-des-pothiers.com
springfieldplumbermo.com
bringmehope.org
thisprettyhair.com
neolaiamedispa.com
thepixelfairy.com
katherinealy.com
vdolg24.online
nexstagefinancial.com
t3brothers.com
pro-gamer.pl
casinodepositors.com
ramirezprono.com
diverfiestas.com.es
traitware.com
airvapourbarrier.com
peninggibadan.co.id
dnqa.co.uk
akcadagofis.com
patassociation.com
endlessrealms.net
topvijesti.net
awag-blog.de
mike.matthies.de
nationnewsroom.com
worldproskitour.com
patriotcleaning.net
funworx.de
graygreenbiomedservices.com
stringnosis.academy
nepal-pictures.com
bubbalucious.com
profiz.com
mgimalta.com
tanatek.com
docarefoundation.org
kryptos72.com
ncjc.ca
web865.com
ilveshistoria.com
designimage.ae
laaisterplakky.nl
aoyama.ac
babysitting-hk.helpergo.co
airserviceunlimited.com
devplus.be
explora.nl
husetsanitas.dk
levelseven.be
startuplive.org
mikegoodfellow.co.uk
fann.ru
yourhappyevents.fr
mustangmarketinggroup.com
beandrivingschool.com.au
leansupremegarcinia.net
n-newmedia.de
anleggsregisteret.no
pedmanson.com
guohedd.com
angeleyezstripclub.com
aberdeenartwalk.org
strauchs-wanderlust.info
poems-for-the-soul.ch
brighthillgroup.com
leijstrom.com
devus.de
metroton.ru
aquacheck.co.za
hutchstyle.co.uk
apiarista.de
sachainchiuk.com
glennverschueren.be
kombi-dress.com
concontactodirecto.com
deduktia.fi
mollymccarthydesign.com
egpu.fr
subyard.com
oncarrot.com
almamidwifery.com
pvandambv.nl
transifer.fr
moira-cristescu.com
alpesiberie.com
smartmind.net
digitale-elite.de
skoczynski.eu
bakingismyyoga.com
manzel.tn
richardmaybury.co.uk
baptistdistinctives.org
3daywebs.com
ykobbqchicken.ca
karmeliterviertel.com
sunsolutions.es
christianscholz.de
gsconcretecoatings.com
humanviruses.org
vapiano.fr
pays-saint-flour.fr
qrs-international.com
landgoedspica.nl
energosbit-rp.ru
colored-shelves.com
rhino-turf.com
clemenfoto.dk
fi-institutionalfunds.com
billyoart.com
billigeflybilletter.dk
bonitabeachassociation.com
oscommunity.de
wademurray.com
orchardbrickwork.com
rvside.com
pazarspor.org.tr
nourella.com
operativadigital.com
rs-danmark.dk
look.academy
dreamvoiceclub.org
pisofare.co
easydental.ae
bilius.dk
rokthetalk.com
dierenambulancealkmaar.nl
pixelhealth.net
outstandingminialbums.com
texanscan.org
nrgvalue.com
chinowarehousespace.com
magrinya.net
redctei.co
omegamarbella.com
kellengatton.com
fixx-repair.com
marmarabasin.com
sveneulberg.de
gatlinburgcottage.com
aciscomputers.com
zdrowieszczecin.pl
cxcompany.com
skinkeeper.li
oexebusiness.com
marcandy.com
switch-made.com
sprintcoach.com
greenrider.nl
putzen-reinigen.com
belinda.af
mondolandscapes.com
medicalsupportco.com
boloria.de
kafkacare.com
focuskontur.com
altitudeboise.com
jaaphoekzema.nl
monstarrsoccer.com
mayprogulka.ru
yuanshenghotel.com
xn--ziinoapte-6ld.ro
reygroup.pt
fotoslubna.com
fascaonline.com
stagefxinc.com
girlish.ae
suonenjoen.fi
belofloripa.be
thestudio.academy
bohrlochversicherung.info
goodboyscustom.com
luvinsburger.fr
richardkershawwines.co.za
jobstomoveamerica.org
site.markkit.com.br
spectamarketingdigital.com.br
ingresosextras.online
pinthelook.com
ncn.nl
rossomattonecase.it
triplettagaite.fr
forskolinslimeffect.net
wirmuessenreden.com
distrifresh.com
invela.dk
trivselsguide.dk
eastgrinsteadwingchun.com
terraflair.de
campusescalade.com
mensemetgesigte.co.za
agriturismocastagneto.it
scentedlair.com
business-basic.de
birthplacemag.com
initconf.com
koncept-m.ru
schlagbohrmaschinetests.com
mbuildinghomes.com
bjornvanvulpen.nl
rapid5kloan.org
ciga-france.fr
thenalpa.com
hostaletdelsindians.es
pankiss.ru
solidhosting.nl
comoserescritor.com
optigas.com
dogsunlimitedguide.com
reputation-medical.online
silverbird.dk
metcalfe.ca
pansionatblago.ru
bridalcave.com
90nguyentuan.com
galaniuklaw.com
cymru.futbol
xn--billigafrgpatroner-stb.se
placermonticello.com
julielusktherapy.com
k-v-f.de
studionumerik.fr
denhaagfoodie.nl
bruut.online
mariajosediazdemera.com
christopherhannan.com
iexpert99.com
ufovidmag.com
fysiotherapierijnmond.nl
klapanvent.ru
barbaramcfadyenjewelry.com
imagine-entertainment.com
catchup-mag.com
slotenmakerszwijndrecht.nl
lassocrm.com
allinonecampaign.com
masecologicos.com
latteswithleslie.com
lapponiasafaris.com
kelsigordon.com
deziplan.ru
maxcube24.com.ua
mac-computer-support-hamburg.de
ownidentity.com
jag.me
efficiencyconsulting.es
zorgboerderijravensbosch.nl
scholarquotes.com
onlinemarketingsurgery.co.uk
amorbellezaysalud.com
charlottelhanna.com
bendel-partner.de
phukienbepthanhdat.com
jameswilliamspainting.com
teamsegeln.ch
powershell.su
astrographic.com
cleanroomequipment.ie
rubyaudiology.com
paardcentraal.nl
eksperdanismanlik.com
oportowebdesign.com
bagaholics.in
michal-s.co.il
ygallerysalonsoho.com:443
agrifarm.dk
simpleitsolutions.ch
atelierkomon.com
banukumbak.com
cmascd.com
kausette.com
fla.se
jollity.hu
advance-refle.com
c-sprop.com
dentalcircle.com
anchelor.com
finsahome.co.uk
happycatering.de
edvestors.org
tecleados.com
oththukaruva.com
gurutechnologies.net
gbk-tp1.de
innersurrection.com
thehovecounsellingpractice.co.uk
natturestaurante.com.br
johnsonweekly.com
hameghlim.com
protoplay.ca
volta.plus
livelai.com
slideevents.be
housesofwa.com
rtc24.com
-
net
true
-
pid
28
-
prc
dbeng50
ocautoupds
ocomm
firefox
onenote
outlook
thebat
sql
mydesktopservice
powerpnt
winword
mspub
agntsvc
sqbcoreservice
oracle
excel
msaccess
isqlplussvc
xfssvccon
steam
ocssd
synctime
thunderbird
wordpa
visio
infopath
tbirdconfig
mydesktopqos
dbsnmp
encsvc
-
ransom_oneliner
All of your files are encrypted! Find {EXT}_Wannadie.txt and follow instructions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1432
-
svc
sql
backup
sophos
memtas
mepocs
vss
veeam
svc$
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi
Files
-
2fa7b5a60cd1a8b67b09a13e09529fe399d2f3f62c5591badaccf5d3a052289f.dll windows x86
c4c29c7e6a6897be412c7fedfcca8fe4
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
SetErrorMode
CreateThread
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.6ai0 Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ