Static task
static1
Behavioral task
behavioral1
Sample
06704bd07416c61583ad5929b39329a6d90c7299e64bb107c37973ed393df762.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
06704bd07416c61583ad5929b39329a6d90c7299e64bb107c37973ed393df762.dll
Resource
win10v2004-20220414-en
General
-
Target
06704bd07416c61583ad5929b39329a6d90c7299e64bb107c37973ed393df762
-
Size
164KB
-
MD5
ecf7748fac09f62da5e16cbc0956f973
-
SHA1
8ddff0ed4213273006943ab911a0358c6ca87d7f
-
SHA256
06704bd07416c61583ad5929b39329a6d90c7299e64bb107c37973ed393df762
-
SHA512
5b4396d10d4c25865f7b54b594ae5879ad86d36d80a15084ab9691c7f82314bf5c0200a1e2d8355aaf69a5a952d735f939508aaae3aa2ad66d623028673921b6
-
SSDEEP
3072:FWeI5JXJRGpUhFiWjmfb+HP+rnRfURLogYb5V:FWe29/GuzjmfCHWtURLg
Malware Config
Extracted
sodinokibi
23
1346
marcandy.com
lagschools.ng
stage-infirmier.fr
aberdeenartwalk.org
leansupremegarcinia.net
luvbec.com
juergenblaetz.de
soncini.ch
thesilkroadny.com
rivermusic.nl
entdoctor-durban.com
turing.academy
thegetawaycollective.com
global-migrate.com
volta.plus
cincinnatiphotocompany.org
skolaprome.eu
walterman.es
stanleyqualitysystems.com
efficiencyconsulting.es
gaearoyals.com
moira-cristescu.com
parksideseniorliving.net
adaduga.info
andermattswisswatches.ch
palmecophilippines.com
victorvictoria.com
maxcube24.com.ua
finsahome.co.uk
gavelmasters.com
newonestop.com
leatherjees.com
111firstdelray.com
airserviceunlimited.com
nexstagefinancial.com
ykobbqchicken.ca
perceptdecor.com
liverpoolabudhabi.ae
dnqa.co.uk
devus.de
sshomme.com
agenceassemble.fr
advance-refle.com
burg-zelem.de
muni.pe
iexpert99.com
bayshoreelite.com
morgansconsult.com
beauty-traveller.com
salonlamar.nl
secrets-clubs.co.uk
leloupblanc.gr
zinnystar.com
furland.ru
tesisatonarim.com
ntinasfiloxenia.gr
mustangmarketinggroup.com
triavlete.com
matteoruzzaofficial.com
charlottelhanna.com
logosindustries.com
stralsund-ansichten.de
miscbo.it
mariannelemenestrel.com
xtensifi.com
angelika-schwarz.com
ziliak.com
sycamoregreenapts.com
tetameble.pl
larchwoodmarketing.com
traitware.com
molade.nl
nationnewsroom.com
lyricalduniya.com
chatberlin.de
netadultere.fr
zumrutkuyutemel.com
satoblog.org
diakonie-weitramsdorf-sesslach.de
1deals.com
denverwynkoopdentist.com
ufovidmag.com
sber-biznes.com
lattalvor.com
geitoniatonaggelon.gr
oro.ae
tages-geldvergleich.de
wg-heiligenstadt.de
askstaffing.com
schluesseldienste-hannover.de
omnicademy.com
onlinetvgroup.com
sarahspics.co.uk
asiaartgallery.jp
yayasanprimaunggul.org
evsynthacademy.org
dayenne-styling.nl
skyboundnutrition.co.uk
saberconcrete.com
sbit.ag
karmeliterviertel.com
kenmccallum.com
vedsegaard.dk
galaniuklaw.com
redpebblephotography.com
lumturo.academy
welovecustomers.fr
christianscholz.de
dinedrinkdetroit.com
elitkeramika-shop.com.ua
stringnosis.academy
happycatering.de
iron-mine.ru
espaciopolitica.com
web865.com
advesa.com
subyard.com
alharsunindo.com
latableacrepes-meaux.fr
animation-pro.co.uk
yvesdoin-aquarelles.fr
startuplive.org
dentourage.com
jakubrybak.com
frankgoll.com
hnkns.com
ninjaki.com
ideamode.com
babysitting-hk.helpergo.co
skidpiping.de
rossomattonecase.it
belofloripa.be
broccolisoep.nl
margaretmcshane.com
graygreenbiomedservices.com
holocine.de
internalresults.com
fotoslubna.com
pharmeko-group.com
vvego.com
avis.mantova.it
sololibrerie.it
unislaw-narty.pl
zwemofficial.nl
hutchstyle.co.uk
the-cupboard.co.uk
mariajosediazdemera.com
kickittickets.com
prometeyagro.com.ua
triplettabordeaux.fr
condormobile.fr
wirmuessenreden.com
nalliasmali.net
alltagsrassismus-entknoten.de
voetbalhoogeveen.nl
lesyeuxbleus.net
ledyoucan.com
dierenambulancealkmaar.nl
tutvracks.com
factoriareloj.com
metcalfe.ca
sveneulberg.de
pilotgreen.com
johnsonweekly.com
rhino-storage.co.uk
die-immo-agentur.de
initconf.com
renehartman.nl
circlecitydj.com
carmel-york.com
toranjtuition.org
tbalp.co.uk
adterium.com
aoyama.ac
photonag.com
birthplacemag.com
annenymus.com
direitapernambuco.com
mindfuelers.com
qandmmusiccenter.com
pro-gamer.pl
bilius.dk
acornishstudio.co.uk
polynine.com
speiserei-hannover.de
pankiss.ru
linkbuilding.life
electricianul.com
dibli.store
tecleados.com
myplaywin3.com
azerbaycanas.com
mgimalta.com
chainofhopeeurope.eu
limmortelyouth.com
alpesiberie.com
gazelle-du-web.com
lovcase.com
signamedia.de
nbva.co.uk
levelseven.be
craftron.com
cac2040.com
the5thquestion.com
janmorgenstern.com
edrickennedymacfoy.com
witraz.pl
awaitspain.com
studionumerik.fr
mercadodelrio.com
kroophold-sjaelland.dk
cascinarosa33.it
craftingalegacy.com
nuohous.com
block-optic.com
subquercy.fr
ygallerysalonsoho.com:443
hospitalitytrainingsolutions.co.uk
90nguyentuan.com
innersurrection.com
nicksrock.com
universelle.fr
queertube.net
zuerich-umzug.ch
hom-frisor.dk
tothebackofthemoon.com
strauchs-wanderlust.info
customroasts.com
schulz-moelln.de
jameswilliamspainting.com
michal-s.co.il
gurutechnologies.net
kelsigordon.com
magnetvisual.com
so-sage.fr
fazagostar.co
leopoldineroux.com
veggienessa.com
nepal-pictures.com
schroederschoembs.com
biodentify.ai
rs-danmark.dk
livedeveloper.com
yournextshoes.com
wallflowersandrakes.com
ludoil.it
k-v-f.de
cymru.futbol
autoteamlast.de
jaaphoekzema.nl
n-newmedia.de
kellengatton.com
profiz.com
pourlabretagne.bzh
peninggibadan.co.id
fitnessblenderstory.com
specialtyhomeservicesllc.com
acb-gruppe.ch
neolaiamedispa.com
jayfurnitureco.com
marmarabasin.com
tilldeeke.de
altocontatto.net
speakaudible.com
koncept-m.ru
sytzedevries.com
edvestors.org
concontactodirecto.com
mariamalmahdi.com
agendatwentytwenty.com
eventosvirtualesexitosos.com
spacebel.be
hepishopping.com
kompresory-opravy.com
premiumweb.com.ua:443
eatyoveges.com
kombi-dress.com
oththukaruva.com
purepreprod4.com
rhino-turf.com
soundseeing.net
thiagoperez.com
wribrazil.com
terraflair.de
auberives-sur-vareze.fr
pvandambv.nl
reputation-medical.online
inewsstar.com
sochi-okna23.ru
scietech.academy
brunoimmobilier.com
motocrosshideout.com
foerderverein-vatterschule.de
test-teleachat.fr
jglconsultancy.com
blueridgeheritage.com
kausette.com
parseport.com
topvijesti.net
cxcompany.com
ox-home.com
pazarspor.org.tr
claudiakilian.de
chatterchatterchatter.com
prodentalblue.com
redctei.co
kafkacare.com
betterce.com
apiarista.de
jefersonalessandro.com
wordpress.idium.no
nauticmarine.dk
angelsmirrorus.com
goodherbalhealth.com
log-barn.co.uk
jonnyhooley.com
mensemetgesigte.co.za
putzen-reinigen.com
banksrl.co.za
bjornvanvulpen.nl
janellrardon.com
avtoboss163.ru:443
fire-space.com
premier-iowa.com
topautoinsurers.net
glennverschueren.be
cp-bap.de
apmollerpension.com
cardsandloyalty.com
placermonticello.com
interlinkone.com
bluelakevision.com
belinda.af
business-basic.de
bohrlochversicherung.info
lsngroupe.com
rentingwell.com
ddmgen.com
fysiotherapierijnmond.nl
hypogenforensic.com
xn--billigafrgpatroner-stb.se
alwaysdc.com
xn--80addfr4ahr.dp.ua
unexplored.gr
stressreliefadvice.com
greatofficespaces.net
verbouwingsdouche.nl
the-beauty-guides.com
5pointpt.com
fta-media.com
irizar.com
ceocenters.com
natturestaurante.com.br
duthler.nl
globalskills.pt
eshop.design
mikegoodfellow.co.uk
gbk-tp1.de
der-stempelking.de
primemarineengineering.com
beandrivingschool.com.au
docarefoundation.org
naukaip.ru
forextimes.ru
jag.me
georgemuncey.com
karelinjames.com
alnectus.com
ebible.co
glas-kuck.de
fluzfluzrewards.com
factorywizuk.com
lidkopingsnytt.nu
oncarrot.com
b3b.ch
cssp-mediation.org
otpusk.zp.ua
dentalcircle.com
albcleaner.fr
kiraribeaute-nani.com
theboardroomafrica.com
radishallgood.com
vitormmcosta.com
zaczytana.com
reygroup.pt
photographycreativity.co.uk
gratiocafeblog.wordpress.com
atma.nl
bumbipdeco.site
cap29010.it
palema.gr
davedavisphotos.com
bertbutter.nl
motocrossplace.co.uk
tramadolhealth.com
relevantonline.eu
envomask.com
optigas.com
colored-shelves.com
jobstomoveamerica.org
hoteltantra.com
bagaholics.in
martha-frets-ceramics.nl
aidanpublishing.co.uk
agriturismocastagneto.it
krishnabrawijaya.com
perfectgrin.com
humanviruses.org
haus-landliebe.de
singletonfinancial.com
hensleymarketing.com
shrinkingplanet.com
eastgrinsteadwingchun.com
santastoy.store
dentallabor-luenen.de
bruut.online
kryddersnapsen.dk
smarttourism.academy
hawaiisteelbuilding.com
shortsalemap.com
rattanwarehouse.co.uk
antesacademy.it
andrealuchesi.it
hartofurniture.com
simpleitsolutions.ch
wyreforest.net
deziplan.ru
thepixelfairy.com
skyscanner.ro
yuanshenghotel.com
wasnederland.nl
sambaglow.com
bodymindchallenger.com
narca.net
signededenroth.dk
livelai.com
wineandgo.hu
g2mediainc.com
supercarhire.co.uk
springfieldplumbermo.com
bratek-immobilien.de
rename.kz
cesep2019.com
eos-horlogerie.com
klapanvent.ru
breathebettertolivebetter.com
azloans.com
futurenetworking.com
jlwilsonbooks.com
citydogslife.com
alaskaremote.com
bluetenreich-brilon.de
trainiumacademy.com
ahgarage.com
boomerslivinglively.com
wrinstitute.org
pinthelook.com
almamidwifery.com
fascaonline.com
explora.nl
drvoip.com
alene.co
dr-vita.de
landgoedspica.nl
publicompserver.de
tieronechic.com
kerstliedjeszingen.nl
lassocrm.com
dmlcpa.com
skoczynski.eu
testitjavertailut.net
benchbiz.com
distrifresh.com
citiscapes-art.com
innovationgames-brabant.nl
arthakapitalforvaltning.dk
arearugcleaningnyc.com
richardmaybury.co.uk
pxsrl.it
peppergreenfarmcatering.com.au
aciscomputers.com
legundschiess.de
ya-elka.ru
frameshift.it
teethinadaydentalimplants.com
oportowebdesign.com
golfclublandgoednieuwkerk.nl
grafikstudio-visuell.de
tanatek.com
ingresosextras.online
schlagbohrmaschinetests.com
gatlinburgcottage.com
9nar.com
laylavalentine.com
towelroot.co
insane.agency
rubyaudiology.com
floweringsun.org
aquacheck.co.za
3daywebs.com
flossmoordental.com
collegetennis.info
zdrowieszczecin.pl
omegamarbella.com
hotelturbo.de
campinglaforetdetesse.com
weddingceremonieswithtim.com
stathmoulis.gr
four-ways.com
encounter-p.net
nieuwsindeklas.be
epsondriversforwindows.com
tradenavigator.ch
ultimatelifesource.com
alexwenzel.de
centuryvisionglobal.com
blucamp.com
mindsparkescape.com
ncn.nl
matthieupetel.fr
descargandoprogramas.com
kryptos72.com
trevi-vl.ru
stagefxinc.com
utilisacteur.fr
teutoradio.de
denhaagfoodie.nl
drbrianhweeks.com
eurethicsport.eu
mac-computer-support-hamburg.de
the3-week-diet.net
kartuindonesia.com
ownidentity.com
leijstrom.com
suitesartemis.gr
mbuildinghomes.com
smartercashsystem.com
thegrinningmanmusical.com
markseymourphotography.co.uk
kristianboennelykke.dk
frimec-international.es
reizenmetkinderen.be
dreamvoiceclub.org
pansionatblago.ru
zealcon.ae
banukumbak.com
achetrabalhos.com
vipcarrental.ae
whoopingcrane.com
airvapourbarrier.com
skooppi.fi
scentedlair.com
circuit-diagramz.com
istantidigitali.com
proffteplo.com
lunoluno.com
lmmont.sk
min-virksomhed.dk
craftstone.co.nz
druktemakersheerenveen.nl
sharonalbrightdds.com
donau-guides.eu
trivselsguide.dk
t3brothers.com
jacquesgarcianoto.com
liveyourheartout.co
mazzaropi.com.br
blavait.fr
computer-place.de
poems-for-the-soul.ch
ilovefullcircle.com
voice2biz.com
licensed-public-adjuster.com
cormanmarketing.com
hiddensee-buhne11.de
scholarquotes.com
racefietsenblog.nl
yourhappyevents.fr
justaroundthecornerpetsit.com
techybash.com
baumfinancialservices.com
greenrider.nl
invela.dk
look.academy
nepressurecleaning.com
palmenhaus-erfurt.de
drnelsonpediatrics.com
angeleyezstripclub.com
alcye.com
cmascd.com
mike.matthies.de
louiedager.com
goeppinger-teppichreinigung.de
outstandingminialbums.com
artcase.pl
janasfokus.com
lapponiasafaris.com
shortysspices.com
epicjapanart.com
pisofare.co
theater-lueneburg.de
gosouldeep.com
bcmets.info
levencovka.ru
crestgood.com
unboxtherapy.site
raeoflightmusic.com
clinic-beethovenstrasse-ag.ch
rizplakatjaya.com
o2o-academy.com
datatri.be
bundan.com
aktivfriskcenter.se
haard-totaal.nl
mediogiro.com.ar
rapid5kloan.org
c-sprop.com
loparnille.se
jeanmonti.com
bakingismyyoga.com
pixelhealth.net
watchsale.biz
allinonecampaign.com
memphishealthandwellness.com
barbaramcfadyenjewelry.com
clemenfoto.dk
biketruck.de
etgdogz.de
chris-anne.com
silverbird.dk
baita.ac
cl0nazepamblog.com
mrcar.nl
atrgroup.it
aceroprime.com
lifeinbreaths.com
mursall.de
ronaldhendriks.nl
csaballoons.com
bmw-i-pure-impulse.com
qwikcoach.com
zorgboerderijravensbosch.nl
charlesfrancis.photos
endlessrealms.net
chinowarehousespace.com
solutionshosting.co.uk
awaisghauri.com
scotlandsroute66.co.uk
apogeeconseils.fr
bajova.sk
anleggsregisteret.no
lovetzuchia.com
mollymccarthydesign.com
elex.is
kdbrh.com
imagine-entertainment.com
promus.ca
xn--80abehgab4ak0ddz.xn--p1ai
latteswithleslie.com
axisoflove.org:443
professionetata.com
bourchier.org
parisschool.ru
patassociation.com
bendel-partner.de
ikadomus.com
agrifarm.dk
jmmartinezilustrador.com
tellthebell.website
precisetemp.com
yourcosmicbeing.com
o90.dk
a-zpaperwork.eu
cotton-avenue.co.il
physio-lang.de
billscars.net
protoplay.ca
ijsselbeton.nl
astrographic.com
tweedekansenloket.nl
muller.nl
curtsdiscountguns.com
advanced-removals.co.uk
ruggestar.ch
animalfood-online.de
tchernia-conseil.fr
jdscenter.com
sealgrinderpt.com
alattekniksipil.com
heuvelland-oaze.nl
devplus.be
k-zubki.ru
production-stills.co.uk
khtrx.com
mamajenedesigns.com
oexebusiness.com
auto-opel.ro
webforsites.com
cuadc.org
buerocenter-butzbach-werbemittel.de
annida.it
bringmehope.org
keyboardjournal.com
bridalcave.com
worldproskitour.com
buonabitare.com
ronielyn.com
boyfriendsgoal.site
expohomes.com
alabamaroofingllc.com
deduktia.fi
medicalsupportco.com
nrgvalue.com
andreaskildegaard.dk
groovedealers.ru
letterscan.de
hostaletdelsindians.es
11.in.ua
lookandseen.com
basindentistry.com
solidhosting.nl
linearete.com
dennisverschuur.com
go.labibini.ch
keuken-prijs.nl
thehovecounsellingpractice.co.uk
osn.ro
mjk.digital
sunsolutions.es
cops4causes.org
lashandbrowenvy.com
fbmagazine.ru
monstarrsoccer.com
rtc24.com
ocduiblog.com
johnkoen.com
hawthornsretirement.co.uk
manzel.tn
bcabattoirs.org
plbinsurance.com
ketomealprep.academy
mondolandscapes.com
stitch-n-bitch.com
delegationhub.com
jimprattmediations.com
kookooo.com
molinum.pt
fla.se
catchup-mag.com
activeterroristwarningcompany.com
spartamovers.com
p-ride.live
tastevirginia.com
eyedoctordallas.com
sachainchiuk.com
vitoriaecoturismo.com.br
chomiksy.net
kuriero.pro
adedesign.com
bodet150ans.com
advancedeyecare.com
arabianmice.com
billigeflybilletter.dk
ayudaespiritualtamara.com
qrs-international.com
rarefoods.ro
directique.com
galatee-couture.com
metallbau-hartmann.eu
switch-made.com
nutriwell.com.sg
campusescalade.com
kvetymichalovce.sk
gsconcretecoatings.com
powershell.su
vapiano.fr
thisprettyhair.com
itheroes.dk
iactechnologies.net
stabilisateur.fr
corporacionrr.com
limounie.com
nourella.com
michaelfiegel.com
cyberpromote.de
mayprogulka.ru
oraweb.net
lgiwines.com
forumsittard.nl
abulanov.com
letsstopsmoking.co.uk
ciga-france.fr
cc-experts.de
dogsunlimitedguide.com
bychowo.pl
xn--ziinoapte-6ld.ro
sprintcoach.com
mediahub.co.nz
profibersan.com
aheadloftladders.co.uk
funworx.de
christopherhannan.com
malzomattalar.com
2020hindsight.info
focuskontur.com
bookingwheel.com
fotoeditores.com
finnergo.eu
valiant-voice.com
nykfdyrehospital.dk
thestudio.academy
mieleshopping.it
fanuli.com.au
elliemaccreative.wordpress.com
goddardleadership.org
hinotruckwreckers.com.au
rechtenplicht.be
pokemonturkiye.com
indiebizadvocates.org
phoenixcrane.com
pays-saint-flour.fr
fskhjalmar.se
framemyballs.com
parentsandkids.com
saboboxtel.uk
paardcentraal.nl
hm-com.com
sweetz.fr
brighthillgroup.com
rsidesigns.com
fridakids.com
lollachiro.com
onesynergyinternational.com
gta-jjb.fr
amyandzac.com
globalcompliancenews.com
coachpreneuracademy.com
acumenconsultingcompany.com
rishigangoly.com
nvisionsigns.com
leadforensics.com
smartworkplaza.com
mahikuchen.com
texanscan.org
jobkiwi.com.ng
rvside.com
mediabolmong.com
eafx.pro
martinipstudios.com
dinecorp.com
bd2fly.com
riffenmattgarage.ch
myfbateam.com
awag-blog.de
renderbox.ch
smartspeak.com
domaine-des-pothiers.com
kamin-somnium.de
stoneridgemontessori.com
midwestschool.org
malevannye.ru
ncjc.ca
pajagus.fr
bellesiniacademy.org
5thactors.com
jandhpest.com
carolynfriedlander.com
amelielecompte.wordpress.com
easydental.ae
richardiv.com
laaisterplakky.nl
suonenjoen.fi
sellthewrightway.com
theintellect.edu.pk
jlgraphisme.fr
mangimirossana.it
opticahubertruiz.com
nxtstg.org
fi-institutionalfunds.com
innervisions-id.com
orchardbrickwork.com
bonitabeachassociation.com
lisa-poncon.fr
theatre-embellie.fr
afbudsrejserallinclusive.dk
phukienbepthanhdat.com
energosbit-rp.ru
teamsegeln.ch
from02pro.com
handyman-silkeborg.dk
girlish.ae
noda.com.ua
tatyanakopieva.ru
fsbforsale.com
mazift.dk
dantreranch.com
baikalflot.ru
makingmillionaires.net
werkzeugtrolley.net
randyabrown.com
hvitfeldt.dk
neonodi.be
line-x.co.uk
agora-collectivites.com
campusce.com
magrinya.net
silkeight.com
fidelitytitleoregon.com
xrresources.com
bavovrienden.nl
mrmac.com
drbenveniste.com
designimage.ae
internestdigital.com
spirello.nl
endstarvation.com
taulunkartano.fi
cookinn.nl
rozmata.com
m2graph.fr
domilivefurniture.com
atelierkomon.com
buffdaddyblog.com
smartmind.net
spectamarketingdigital.com.br
kemtron.fr
ilveshistoria.com
grupoexin10.com
dieetuniversiteit.nl
augen-praxisklinik-rostock.de
boloria.de
creohn.de
rolleepollee.com
pedmanson.com
saint-malo-developpement.fr
buzzneakers.com
ravage-webzine.nl
metriplica.academy
vdolg24.online
sjtpo.org
fixx-repair.com
mrkluttz.com
quitescorting.com
hostingbangladesh.net
projektparkiet.pl
brownswoodblog.com
catering.com
penumbuhrambutkeiskei.com
mundo-pieces-auto.fr
harleystreetspineclinic.com
paradigmlandscape.com
daveystownhouse.com
richardkershawwines.co.za
lexced.com
anchelor.com
littlesaints.academy
modamarfil.com
billyoart.com
eksperdanismanlik.com
carsten.sparen-it.de
greeneyetattoo.com
guohedd.com
uncensoredhentaigif.com
olry-cloisons.fr
successcolony.com.ng
casinodepositors.com
biblica.com
bubbalucious.com
hotjapaneselesbian.com
avisioninthedesert.com
paprikapod.com
baptistdistinctives.org
piestar.com
amorbellezaysalud.com
selected-minds.de
happylublog.wordpress.com
transifer.fr
pubcon.com
jobscore.com
hameghlim.com
nginx.com
cmeow.com
jalkapuu.net
husetsanitas.dk
nevadaruralhousingstudies.org
gardenpartner.pl
bg.szczecin.pl
bluemarinefoundation.com
masecologicos.com
rino-gmbh.com
onlinemarketingsurgery.co.uk
enews-qca.com
fann.ru
amco.net.au
jollity.hu
chorusconsulting.net
brannbornfastigheter.se
imajyuku-sozoku.com
cainlaw-okc.com
mind2muscle.nl
katherinealy.com
slotspinner.com
adabible.org
mslp.org
akcadagofis.com
mesajjongeren.nl
catalyseurdetransformation.com
pureelements.nl
therapybusinessacademy.com
oscommunity.de
jax-interim-and-projectmanagement.com
slotenmakerszwijndrecht.nl
napisat-pismo-gubernatoru.ru:443
heimdalbygg.no
forskolinslimeffect.net
arazi.eus
thenalpa.com
metroton.ru
acibademmobil.com.tr
patriotcleaning.net
alisodentalcare.com
rokthetalk.com
pinkxgayvideoawards.com
diverfiestas.com.es
brisbaneosteopathic.com.au
breakluckrecords.com
ivancacu.com
kosten-vochtbestrijding.be
housesofwa.com
digitale-elite.de
opt4cdi.com
bulyginnikitav.000webhostapp.com
maryairbnb.wordpress.com
brinkdoepke.eu
enactusnhlstenden.com
liepertgrafikweb.at
ramirezprono.com
operativadigital.com
agencewho-aixenprovence.fr
geoweb.software
loysonbryan.com
egpu.fr
johnstonmingmanning.com
artvark.nl
skinkeeper.li
luvinsburger.fr
triplettagaite.fr
hekecrm.com
tzn.nu
hostastay.com
comoserescritor.com
site.markkit.com.br
aslog.fr
grancanariaregional.com
affligemsehondenschool.be
cleanroomequipment.ie
altitudeboise.com
ced-elec.com
akwaba-safaris.com
sppdstats.com
ikzoekgod.be
rentsportsequip.com
uci-france.fr
imaginekithomes.co.nz
julielusktherapy.com
slideevents.be
berdonllp.com
goodboyscustom.com
bescomedical.de
mneti.ru
glende-pflanzenparadies.de
wademurray.com
dcc-eu.com
-
net
true
-
pid
23
-
prc
msaccess
oracle
dbsnmp
thebat
sqbcoreservice
dbeng50
firefox
powerpnt
sql
infopath
winword
tbirdconfig
agntsvc
mspub
wordpa
xfssvccon
thunderbird
ocomm
synctime
onenote
encsvc
ocssd
mydesktopservice
isqlplussvc
steam
excel
outlook
ocautoupds
visio
mydesktopqos
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1346
-
svc
vss
sql
memtas
svc$
backup
veeam
mepocs
sophos
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi
Files
-
06704bd07416c61583ad5929b39329a6d90c7299e64bb107c37973ed393df762.dll windows x86
c4c29c7e6a6897be412c7fedfcca8fe4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
SetErrorMode
CreateThread
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.e4sm3 Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ