All of your files are encrypted!
Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/{UID}
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
{KEY}
=========Attention!!!=========
Also your private data was downloaded. We will publish it in case you will not get in touch with us asap.
==============================
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
sub
6772
svc
msseces
DsSvc
sppsvc
macmnsvc
ViprePPLSvc
TMBMServer
Microsoft.exchange.store.worker.exe
VeeamMountSvc
"Sage 100c Advanced 2017 (9917)"
"Sophos Endpoint Defense Service"
Altaro.SubAgent.N2.exe
"Sophos System Protection Service"
"Sophos Clean Service"
ds_notifier
AzureADConnectAuthenticationAgent
VeeamTransportSvc
AzureADConnectHealthSyncMonitor
masvc
"StorageCraft Raw Agent"
MSSQLFDLauncher$TESTBACKUP02DEV
AltiBack
svcGenericHost
ADSync
"ofcservice"
HuntressAgent
AltiPhoneServ
"SQLServer Reporting Services (MSSQLSERVER)"
mfemms
psqlWGE
AzureADConnectHealthSyncInsights
ReportServer
MSSQLFDLauncher
"Sophos Web Control Service"
Code42Service
"Sophos Safestore Service"
"TeamViewer"
ThreadLocker
"Sophos File Scanner Service"
"SQLServer Integration Services 12.0"
SQLTELEMETRY$MSGPMR
SQLSERVERAGENT
"ds_notifier"
MsDtsServer120
Telemetryserver
sqlservr
KaseyaAgent
Amsp
MSSQLFDLauncher$SQLEXPRESS
SQLTELEMETRY
KaseyaAgentEndpoint
AltiCTProxy
ds_agent
LTSvcMon
SQLWriter
AUService
MSSQLSERVER
ofcservice
Altaro.UI.Service.exe
"Amsp"
SQLTELEMETRY$SQLEXPRESS
MSSQLServerADHelper100
klnagent
SSISTELEMETRY130
KAENDCHIPS906995744173948
VeeamNFSSvc
MSSQLLaunchpad$SQLEXPRESS
HuntressUpdater
LTService
"ds_agent"
Altaro.Agent.exe
"ProtectedStorage"
KACHIPS906995744173948
MySQL
VeeamHvIntegrationSvc
"StorageCraft Shadow Copy Provider"
MSSQLServerOLAPService
SBAMSvc
"SophosFIM"
MSSQL$QM
"Sophos AutoUpdate Service"
"SAVService"
McAfeeFramework
SQLBrowser
MSSQL$SQLEXPRESS
BackupExecAgentAccelerator
"swi_service"
SQLEXPRESSADV
"Sophos MCS Client"
MSSQL$HPWJA
MSSQL$MSGPMR
AltiFTPUploader
AzureADConnectAgentUpdater
"SAVAdminService"
mfevtp
VeeamDeploySvc
MBAMService
ProtectedStorage
"SntpService"
SSASTELEMETRY
Altaro.OffsiteServer.UI.Service.exe
VeeamDeploymentService
MsDtsServer130
sophossps
tmlisten
mfewc
KAVFS
Altaro.SubAgent.exe
mysqld
"Sophos MCS Agent"
"Sophos Health Service"
VipreAAPSvc
SQLAgent$MSGPMR
"Sage.NA.AT_AU.Service"
"Sage 100cloud Advanced 2020 (9920)"
VSS
Altaro.OffsiteServer.Service.exe
TeamViewer
TmCCSF
"ThreadLocker"
bedbg
ALTIVRM
ntrtscan
VeeamEndpointBackupSvc
Altaro.DedupService.exe
"SQLServer Analysis Services (MSSQLSERVER)"
"StorageCraft ImageReady"
ds_monitor
"ds_monitor"
kavfsscs
Altaro.HyperV.WAN.RemoteService.exe
MsDtsServer110
"swi_filter"
MSSQLTESTBACKUP02DEV
MSSQL$SQLEXPRESSADV
"Sophos Device Control Service"
SQLAgent$SQLEXPRESS
Extracted
Path
C:\xm1mobm1s-readme.txt
Family
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension xm1mobm1s.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A15C929A93F59510
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/A15C929A93F59510
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
Vycu1yteiK23ayojTTFn8Ofjitq/QPMOO2k1Ik9k1fLMuNtoHPjEqdcc4Apc2Esg
E7dof+Xah7n+m7lddzApZmSt+l7Har/kwim70aM6PCECTnEabQ3IenDb5Nt+Mn+2
tHD2UxaNSWQLdGaorBIj0nGFldV4AqMILaCDriZqywkycQdp2XD/srFl15tSfghe
YuCR26zGG1Xu6GLCZ6YONMztV+ZBz4ZPnmbab5mn+ODcCpCQ3yGdrdTQ+gRxhSsz
pZfX6Rmvb8GTrzWBlZ29jtxBtkIzYyfm4w7lPEgDf5EEYY3SdtGWnX1wz2RnQU00
gWlanp7eazuCVJ0ls1Stc8DOdNiisP5a/Yf7/HivhznFRIy42SvOLClxXSxsxApl
KK11/IAhyN356XrYYRqiLB76eDXqS9lz6rM9bfZ+2p4lr7++gS3peNadi0WnJc3B
zTqqUjaAvib+RNnAh0kwtta+wsG7lmoBWyGP81eN6oUgMEn4QiNUmW7sUXf8sovh
GU3a36P39M4eRq9EPVMWhXaBe3NPQeKSRdZiYEXYuTlhoJmNJWENYtx+unLqzVx9
ammpmBxcuvuVqwFWNCADLPKOSJJ3Zp8Tf5xpOsBLfrZJ2QA+PDAfWg+MLbXGlbbt
AVT2CXMIKkNP87FlfSQhMZkZq9Fig6Q3MSVGFRI7Tyt0nPu2aRUTRZB/FJDfTrvU
zKfxh7g9cIkAKuiNoz/6s+QPvOisOTQ4+m68laNLrAVpIHdu8fS0A7lQ3uzjN6Rn
h9nBFhWzNkv1dSzUROTkdPWX92LQ1LU6idCuqF5/i6qvDFpd395e5Bkrh+Enxx8P
znwsVoSCfHlG8N/Pr/Gbg+glP/GQySGCASjKHZZaclsv2l9ksg4jVHn3YMTP+m/I
KX5scDRLv+Z9m8krueh43vhjlD+ITgYVqAHUq/+sBQ95MWRrjF3fwpKbgVk/0ohf
WbbcKpUpF50g32+QjaOqx3WT70SELRwnFQuQoAkgO9yKWk1yANADTu5UcEDicFaM
kf/tEkY7IUlP/XEbLBfbI4HVGerc79j2IqAM8QFjl1sBCLvcHKKbew4tn+MzKIG1
ANRJduLYGG+RBNlhBPsy6TOJgLnn92C8gZtKxfUK2PJVo2hS1dGlX2icy2ChXH+O
qMZA0brf7HdZQNjIYYBa1W8TXEY3qmz2vmIZey6sjgTehp8lyUb7oUYDABW1duT0
YCeQRPWwBDINtUPZK8fm64BmcYvQ1rvKZ+1BBm2FOSwmu4s1DUc17wKmpmK2vurx
kYOkgYcVvUp+o7eRLSRjb/iZBR0ncFML6ZOZaq1mz04GL4oU
=========Attention!!!=========
Also your private data was downloaded. We will publish it in case you will not get in touch with us asap.
==============================
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
