All of your files are encrypted!
Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Hi there! We wish you to have a good day during these difficult times! We have to notify you that we have completed the downloading all sensitive data, including personal data about your clients, projects, databases, reports etc. Ask us - we will provide you with proofs. We will public all the data in case you refuse to pay.
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). In your interests to contact with us ASAP. Otherwise all your valuable information will be published and sold. Believe us, it's gonna cause way more expenses, than the price we ask.
[+] What guarantees? [+]
It's just a business. We absolutely do not care about you and your deals, besides receiving advantages. If we do not make our work and obligations - no one will cooperate with us. This is not in our interests.
To check the ability to return files, you must go to our website. There you can decrypt one file for free. This is our warranty.
If you do not cooperate with our service - for us, it does not matter. But you lose your time and data, because we have a private key. In practice - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/{UID}
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
{KEY}
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
[+] Attention!!! [+]
Also your private data was downloaded.
We will publish it in case you will not get in touch with us asap.
sub
7231
svc
tmlisten
mfemms
Altaro.HyperV.WAN.RemoteService.exe
BackupExecAgentAccelerator
AltiCTProxy
AltiFTPUploader
VeeamNFSSvc
TeamViewer
memtas
ntrtscan
SBAMSvc
Altaro.SubAgent.N2.exe
MSSQLFDLauncher$SQLEXPRESS
ds_notifier
psqlWGE
veeam
SAVAdminService
masvc
sophos
McAfeeFramework
sqlservr
mcafee
VeeamEndpointBackupSvc
KAVFS
klnagent
Sage.NA.AT_AU.Service
ofcservice
SQLAgent$MSGPMR
MSSQLTESTBACKUP02DEV
Code42Service
mfewc
ADSync
SAVService
azurea
VeeamDeploySvc
VeeamMountSvc
MSSQL$SQLEXPRESS
ds_agent
VipreAAPSvc
kaendchips
MBAMService
VeeamTransportSvc
MySQL
ds_monitor
Altaro.Agent.exe
SQLEXPRESSADV
ALTIVRM
mepocs
SQLAgent$SQLEXPRESS
MSSQL$HPWJA
AzureADConnectAuthenticationAgent
MSSQL$SQLEXPRESSADV
Altaro.OffsiteServer.UI.Service.exe
ProtectedStorage
MsDtsServer110
KACHIPS906995744173948
SSASTELEMETRY
SophosFIM
msdtsserver
Microsoft.exchange.store.worker.exe
swi_service
MSSQLLaunchpad$SQLEXPRESS
mfevtp
HuntressUpdater
LTService
swi_filter
ThreadLocker
MsDtsServer130
Telemetryserver
MSSQLFDLauncher
KAENDCHIPS906995744173948
AUService
SQLTELEMETRY
LTSvcMon
MSSQL$MSGPMR
VeeamDeploymentService
MSSQLFDLauncher$TESTBACKUP02DEV
Altaro.SubAgent.exe
VSS
SQLTELEMETRY$SQLEXPRESS
ViprePPLSvc
AzureADConnectHealthSyncMonitor
Altaro.UI.Service.exe
MsDtsServer120
bedbg
TMBMServer
StorageCraft
Altaro.DedupService.exe
KaseyaAgent
VeeamHvIntegrationSvc
SQL
MSSQLServerOLAPService
SntpService
Altaro.OffsiteServer.Service.exe
SSISTELEMETRY130
macmnsvc
DsSvc
msseces
ReportServer
kavfsscs
MSSQLServerADHelper100
svcGenericHost
SQLTELEMETRY$MSGPMR
backup
sophossps
ssistelemetry
KaseyaAgentEndpoint
AltiBack
MSSQL$QM
sppsvc
HuntressAgent
TmCCSF
mysqld
Amsp
AzureADConnectHealthSyncInsights
AzureADConnectAgentUpdater
AltiPhoneServ
altaro
Extracted
Path
C:\t52x6-readme.txt
Family
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Hi there! We wish you to have a good day during these difficult times! We have to notify you that we have completed the downloading all sensitive data, including personal data about your clients, projects, databases, reports etc. Ask us - we will provide you with proofs. We will public all the data in case you refuse to pay.
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension t52x6.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). In your interests to contact with us ASAP. Otherwise all your valuable information will be published and sold. Believe us, it's gonna cause way more expenses, than the price we ask.
[+] What guarantees? [+]
It's just a business. We absolutely do not care about you and your deals, besides receiving advantages. If we do not make our work and obligations - no one will cooperate with us. This is not in our interests.
To check the ability to return files, you must go to our website. There you can decrypt one file for free. This is our warranty.
If you do not cooperate with our service - for us, it does not matter. But you lose your time and data, because we have a private key. In practice - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FD60647B407AC4CC
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/FD60647B407AC4CC
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
Ic+DHjnfxZZbiljyArfp8ZFNht1JV8kYMDTAnW2UZMz4X8BnDAjjvRRPsuKa6WrI
On2D5eJaEMWarEauPuUzGZDx37u0eIItKXay8SPrH4TRxSYHtctRlU5FGF3Gvbm5
DZyvfK0inRtHBu5BYExJhGBsVf+VUG0kQIl4lQo563PzlgIFHw8bN/YhaWl2DhEK
zkV/TH4tt3RaufXjyQEXCWZe1gM5/MvIv1li1BFAvgTkAwVWQmAW8z3R5xkzUZoR
AtgAh/qyrV3uREGPh5IzFsvFl7SyjWOW7GPJSlZUGEF5tmc7eiWZfzp8/d8kiBLx
b0Ej2YCQiD/FlLwGzvKNrZKb6RdZHgN/bJCkV21FGBfcw8f63u5DMSfwSQdR+9xf
tD4+05Lqf5Au5aBps0KeZ2++gZ085mX5qq8CY0fqPPGQEqSNrM7W+YfnU9Nh6esT
3phmG0Fe+R8HOwg63d0wGcq3AY9SF0HvjlaxulBGrmd5AYueSQtjLgtykfwMR0Cy
vLNlYIQSMfAc5BoRscnZs5y3DuI3lEI4TjLzxJtvhRFop/TekF+sA2Lps9/36XEk
Gs2tlmmkFi5a6atI9okqH1E6AxBE86jQxYDE1v9zpMG5Z62QVp8x470UQuw9FEZW
avmfJyE9+AX77eyJXveCBWaXxNhQFKmahce6T2cxeHrf8xjGS7zZ7ydXNZQlTndu
uBNGSEt0uyBS6pzmcWcGn0xJSWlFVJ5Qet4CrOIr9zFC9PGb0JFSAPvmSjyq0RNo
HYPaYbpgtTcqW4Z10IbqsdS3GsdTfXC3lZwGZAZYwiqCVbpbm11xtvKfx4VJZzmB
2pAXsln9ltaBtHhjcgu+Dfu+UCC0fCYAIZnp9hwWmt2rfBgQ1Y65SCBNyZELS/GF
TjEhdUKJXHcQzugq+vmn13nyO/UxPN6ZqHsvQbEq1orhDsPi5C5Xg9Ge45VaMfl+
kU/fN2Rh/e+Gnwg/yWRl/h6wV2uWNIQrOfxPholZ9D6I2829ZHAmN3EntxD8s7ET
ARNX+POd9r6bTKyfwDXtdMubLv1LyFRsXwPZyND98YTpOPjUmlvr+566nd+ZzzLj
V5PDKfApt2KufqTSJ+iK5SS9VXYmKB6P8dlpakfgtptz7xIMCDAe4DkGn+Pt1NG1
ldgkw+tlcAwgspT93Bsylm5Bv+X9UkZdAse/ZPABwlHMTaInEbjZMqLWGcWr4OA8
O5dqnBv4X6IMseaw81cUNpoA9hy6uR3BXrCSO/r9LHt8tGiG0jdNSEsloQAassHd
H0UIcQ==
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
[+] Attention!!! [+]
Also your private data was downloaded.
We will publish it in case you will not get in touch with us asap.
