https://detonation.group-ib.com/report/71cb27b2-c5ae-43ba-b996-cab9c2bc5ee4
c-windows-apppatch-svchost.exe (Sodinokibi) — malware analysis report | Group-IB MDP Reports
Dynamic analysis of c-windows-apppatch-svchost.exe. Family: Sodinokibi. File type: PE32 executable (GUI) Intel 80386. SHA1:...
malware analysisgroup ibwindowssvchostexe
https://blag.nullteilerfrei.de/2020/02/02/defeating-sodinokibi-revil-string-obfuscation-in-ghidra/
Defeating Sodinokibi/REvil String-Obfuscation in Ghidra – nullteilerfrei
defeatingsodinokibirevilstringobfuscation