All of your files are encrypted!
Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Hi there! We wish you to have a good day during these difficult times! We have to notify you that we have completed the downloading all sensitive data, including personal data about your clients, projects, databases, reports etc. Ask us - we will provide you with proofs. We will public all the data in case you refuse to pay.
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). In your interests to contact with us ASAP. Otherwise all your valuable information will be published and sold. Believe us, it's gonna cause way more expenses, than the price we ask.
[+] What guarantees? [+]
It's just a business. We absolutely do not care about you and your deals, besides receiving advantages. If we do not make our work and obligations - no one will cooperate with us. This is not in our interests.
To check the ability to return files, you must go to our website. There you can decrypt one file for free. This is our warranty.
If you do not cooperate with our service - for us, it does not matter. But you lose your time and data, because we have a private key. In practice - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/{UID}
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
{KEY}
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
[+] Attention!!! [+]
Also your private data was downloaded.
We will publish it in case you will not get in touch with us asap.
sub
7231
svc
tmlisten
mfemms
Altaro.HyperV.WAN.RemoteService.exe
BackupExecAgentAccelerator
AltiCTProxy
AltiFTPUploader
VeeamNFSSvc
TeamViewer
memtas
ntrtscan
SBAMSvc
Altaro.SubAgent.N2.exe
MSSQLFDLauncher$SQLEXPRESS
ds_notifier
psqlWGE
veeam
SAVAdminService
masvc
sophos
McAfeeFramework
sqlservr
mcafee
VeeamEndpointBackupSvc
KAVFS
klnagent
Sage.NA.AT_AU.Service
ofcservice
SQLAgent$MSGPMR
MSSQLTESTBACKUP02DEV
Code42Service
mfewc
ADSync
SAVService
azurea
VeeamDeploySvc
VeeamMountSvc
MSSQL$SQLEXPRESS
ds_agent
VipreAAPSvc
kaendchips
MBAMService
VeeamTransportSvc
MySQL
ds_monitor
Altaro.Agent.exe
SQLEXPRESSADV
ALTIVRM
mepocs
SQLAgent$SQLEXPRESS
MSSQL$HPWJA
AzureADConnectAuthenticationAgent
MSSQL$SQLEXPRESSADV
Altaro.OffsiteServer.UI.Service.exe
ProtectedStorage
MsDtsServer110
KACHIPS906995744173948
SSASTELEMETRY
SophosFIM
msdtsserver
Microsoft.exchange.store.worker.exe
swi_service
MSSQLLaunchpad$SQLEXPRESS
mfevtp
HuntressUpdater
LTService
swi_filter
ThreadLocker
MsDtsServer130
Telemetryserver
MSSQLFDLauncher
KAENDCHIPS906995744173948
AUService
SQLTELEMETRY
LTSvcMon
MSSQL$MSGPMR
VeeamDeploymentService
MSSQLFDLauncher$TESTBACKUP02DEV
Altaro.SubAgent.exe
VSS
SQLTELEMETRY$SQLEXPRESS
ViprePPLSvc
AzureADConnectHealthSyncMonitor
Altaro.UI.Service.exe
MsDtsServer120
bedbg
TMBMServer
StorageCraft
Altaro.DedupService.exe
KaseyaAgent
VeeamHvIntegrationSvc
SQL
MSSQLServerOLAPService
SntpService
Altaro.OffsiteServer.Service.exe
SSISTELEMETRY130
macmnsvc
DsSvc
msseces
ReportServer
kavfsscs
MSSQLServerADHelper100
svcGenericHost
SQLTELEMETRY$MSGPMR
backup
sophossps
ssistelemetry
KaseyaAgentEndpoint
AltiBack
MSSQL$QM
sppsvc
HuntressAgent
TmCCSF
mysqld
Amsp
AzureADConnectHealthSyncInsights
AzureADConnectAgentUpdater
AltiPhoneServ
altaro
Extracted
Path
C:\537g9n6uo8-readme.txt
Family
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Hi there! We wish you to have a good day during these difficult times! We have to notify you that we have completed the downloading all sensitive data, including personal data about your clients, projects, databases, reports etc. Ask us - we will provide you with proofs. We will public all the data in case you refuse to pay.
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 537g9n6uo8.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). In your interests to contact with us ASAP. Otherwise all your valuable information will be published and sold. Believe us, it's gonna cause way more expenses, than the price we ask.
[+] What guarantees? [+]
It's just a business. We absolutely do not care about you and your deals, besides receiving advantages. If we do not make our work and obligations - no one will cooperate with us. This is not in our interests.
To check the ability to return files, you must go to our website. There you can decrypt one file for free. This is our warranty.
If you do not cooperate with our service - for us, it does not matter. But you lose your time and data, because we have a private key. In practice - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8C53175BEC78A7B3
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/8C53175BEC78A7B3
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
eEWxlG5zoVGERwgsxFrA91+KjsbYmOBBxDL1akVXy6K/7s4PpsYld1zbdGw8muSJ
Y3v3AfOXPXCF5xv0ivQKF9YMecdUHO2MsmwjtySTwz9cDgIDGDX3va0sthAI4O2Q
/JMJbxUnd81YJ+RxhQoBpJJxcjcuygWfAzNmk4yBm4OA0CqKckHmc8vnb46D0wzT
6cH6LUgztPrx8wi0+ZpupcVx59bIdgORgDydvTbOCtSVjzKW1jHCQnWvr0FW70NX
9tuhH+spVCQOv8NllB/NtONYrWow3SkH8kfxHzouH9qObGOQ6mJkMt11xpzWI1dc
9MJypjL+6ZVGnRdDjRDPioMl0XuCS6KjRcJ1LG4xsIxlD3sEWCJzWasg+HtWnLah
7J598P4IB8PQj4Kf3KUjHKU/HLiHM9gVd/MqjLF8Ge3bGxh/tjNTaN24v8eoH7sf
2y7feQQj9LrWn+TMLbzkljHo50hlVFQk1c37pHOrWLZ5wSAe731kPx04EbXCKlK5
CkIA+tjCqo4E868kpc+w5AGnjSdUM/p2qIrSQwNTjwE43HACwDi8GO1SRnO7iJrn
JAFRx4cevMIbA1GX4Of8V7U1ObCQYy3fk5L2J59QbCf6YBQKBSAjp0eaYwRFncsV
Pw8fvpV6FCKM+GlQN7zm0IB55SiLS0E6yw6bB0ijoAdLauJQR738UrscWUCVtUvx
PnyfJ+spswggGcD1KW12yIHojFET88qyo34J3bNgaHfm5XSuNAvYIuP8b1C6HdEQ
yqwTqpt0nbFwRuGeoNadXXnkHj4E0fXlSC1EhRNtIG/KOPWWG2+GxduCfI+jwSvG
gv+tNry9/e2V7iGbVS3X5IbjJ+X0BSNz3s8KV0fFm06ahjvSNw87wdzxMMJMAa1z
yFscVHwCRtP5jXXxc2StK/SUeMWH2qIRnNorVEacDldXmO6kLrWXZgyCjE6bADFr
meb1UDWWpRBbR8gUTT878D7Dia92QtHuat0mrUgcqgjVY77S4NzJlHi/aILY4qs1
xCmWdRvam0s9/hjJdDXxZ6NVS7nkyoomUnWpJRlX9XXYFXOWG5Y+KB8337ra/vqB
EaDG0x2Ww9r6BR0KXILj3MTCibqtEaW6XOFLBN5d0emn03BLpnbLoMqTf2Bfe5ky
gDILkcJnwhYMiDK0A44BuXAaBUZHivhVVbPL+tuITH8CsrPo45lKmpipDeZmqXDX
2jOvQIuurZZYxI6o4zL+Vj+4goLCVcewz1C9t1oQDX/676WU2Xxggf44qew/kt+2
mY/BBuHJthchj29at8M=
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
[+] Attention!!! [+]
Also your private data was downloaded.
We will publish it in case you will not get in touch with us asap.
