All of your files are encrypted!
Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
=========Attention!!!=========
Also your private data was downloaded. We will publish it in case you will not get in touch with us asap.
==============================
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/{UID}
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
{KEY}
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
sub
7114
svc
Telemetryserver
"Sophos AutoUpdate Service"
sophos
Altaro.Agent.exe
mysqld
MSSQL$MSGPMR
"SophosFIM"
"Sophos Web Control Service"
SQLWriter
svcGenericHost
AltiBack
"SQLServer Analysis Services (MSSQLSERVER)"
BackupExecAgentAccelerator
"StorageCraft ImageReady"
SQLTELEMETRY
AzureADConnectAuthenticationAgent
ntrtscan
ds_notifier
TeamViewer
"StorageCraft Raw Agent"
"StorageCraft Shadow Copy Provider"
SQLTELEMETRY$SQLEXPRESS
VeeamHvIntegrationSvc
AltiCTProxy
MsDtsServer130
ViprePPLSvc
McAfeeFramework
MSSQL$QM
"swi_service"
"ThreadLocker"
ofcservice
AUService
sophossps
AzureADConnectHealthSyncMonitor
Altaro.OffsiteServer.UI.Service.exe
"SAVAdminService"
ds_monitor
ALTIVRM
SSASTELEMETRY
TmCCSF
MsDtsServer110
"Sophos MCS Client"
TMBMServer
SBAMSvc
mfewc
"Sophos System Protection Service"
MSSQLFDLauncher$TESTBACKUP02DEV
VeeamDeploymentService
masvc
backup
MSSQL$SQLEXPRESS
AltiPhoneServ
MSSQLServerOLAPService
SSISTELEMETRY130
VeeamEndpointBackupSvc
mepocs
Altaro.UI.Service.exe
"ds_agent"
HuntressUpdater
MSSQLFDLauncher
"Sophos File Scanner Service"
SQLAgent$MSGPMR
ADSync
KaseyaAgent
ReportServer
MSSQLFDLauncher$SQLEXPRESS
MSSQL$HPWJA
KaseyaAgentEndpoint
VeeamTransportSvc
"ds_monitor"
mfevtp
MSSQLTESTBACKUP02DEV
SQLTELEMETRY$MSGPMR
ThreadLocker
MSSQLServerADHelper100
veeam
tmlisten
AzureADConnectHealthSyncInsights
"swi_filter"
MsDtsServer120
ProtectedStorage
VeeamDeploySvc
memtas
ds_agent
VeeamMountSvc
HuntressAgent
SQLAgent$SQLEXPRESS
bedbg
MSSQLSERVER
"ofcservice"
VipreAAPSvc
"Sophos Endpoint Defense Service"
KACHIPS906995744173948
DsSvc
MSSQLLaunchpad$SQLEXPRESS
msseces
macmnsvc
LTService
Code42Service
Altaro.HyperV.WAN.RemoteService.exe
LTSvcMon
MSSQL$SQLEXPRESSADV
"SAVService"
Altaro.OffsiteServer.Service.exe
"Sage 100cloud Advanced 2020 (9920)"
Altaro.SubAgent.exe
mfemms
"TeamViewer"
"SQLServer Reporting Services (MSSQLSERVER)"
VSS
sql
Altaro.SubAgent.N2.exe
"SQLServer Integration Services 12.0"
SQLSERVERAGENT
vss
"Sophos Safestore Service"
klnagent
"Sage.NA.AT_AU.Service"
MBAMService
"Sophos Health Service"
SQLBrowser
MySQL
"ProtectedStorage"
"Sophos Clean Service"
"Sage 100c Advanced 2017 (9917)"
"SntpService"
VeeamNFSSvc
KAVFS
SQLEXPRESSADV
KAENDCHIPS906995744173948
sppsvc
Amsp
psqlWGE
Microsoft.exchange.store.worker.exe
kavfsscs
"Amsp"
sqlservr
Altaro.DedupService.exe
svc$
"ds_notifier"
"Sophos Device Control Service"
AzureADConnectAgentUpdater
AltiFTPUploader
"Sophos MCS Agent"
Extracted
Path
C:\Recovery\lbqnh-readme.txt
Family
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension lbqnh.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
=========Attention!!!=========
Also your private data was downloaded. We will publish it in case you will not get in touch with us asap.
==============================
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/67E8A2017A072ECF
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/67E8A2017A072ECF
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
PFwCeJwcW5UD1bPySdcCAtU+sIOXbV0FBdiTMvA5gbuN8HPY4sYfpFWDXgpyBJAz
DOfOcyLdwDHGgXhP5fIR6sE3Fo9f4Do0o/Ak4jpQIXQdx/2ElPZz8jTZxg/4K7u5
CMRHoEWY7ldzfqGn8zbeK4p+1FTI/l20JEZn1Of4FFro1AEWV+0aYMV4rv6+q8p1
XWPosrLMYGP+znPOqMFvXl4vqkQn1nkVOVPSYEHHM8kSuvDA2l6Il1tQhl7rSwqo
1+VnCefxgb/WttdZ9BhGkAOUrpkDChJ8J9Y7Tyewv1W/iJq9GLk/sfwfrIpBtony
MqMh6IFi3w+CpNoUSRfBlcZEXcnInJz5d2rIPYHyv0087DrP8q+nbgGGz20s4L2h
Kzg9CPikr8D40e9xnaMjU2ppg5mNeMo3Hy8udSepJNoq2p6LykCCJuDRafgjiW/N
tc/uWLInmYYEhNfQ54NcWVKDpiuqN3CcOZARR/idfGbwxDisN2Pwu+jfDuk4SeSZ
YxR8Hle9DcLtCjwqauq60yhY9fgD4Rt5r69ov/W2tF+0eFVygboEV7yLZ+8Fsj7H
jLwNvfpnz7Q1vE71L5k9wvfucYHOjMVJH/anl1v0peIaM767CNSySfU+p+eTYwuc
EDXFAQiODFB+Gy0ug36W7YI1biXO+8J5Wj7TZL767zPhvqyxqk5MzJk/xzIvoNjJ
N59kovXDSoy13zwRzwO+hK1fTcW0s2RN86E5P9cqDxF5bQKdgd2xaVHZGBFAiUFP
ZJtseslVrVNr2mIkAUk1MKCN4XcU1dkltm8ZJ4Q4Eg3EcFGDL2A/UbgQ5hpJzKVe
wSPQ8mgpfyxINTxS7C2czTQgohStznldZ55tO9cqov3eM1m6mDy1h0ufxGnglb6b
uUJe4ocXNm5qlIFf4g5Q57+MdNXuePXkUQy6Ym8Kj2WM4pDqFa9txtmtZrktZ0nq
0jU0A+0RPwwQpWKGX6IEdXkDt7GEsyr2CMzPU5ah7VcvHl7bTl5tLVCdTqRjszic
gBD9LCiNfviIp/AlISTJUv5WXlfxs9mX+J20cZ2qYeTgGGeAmJPqvsmit59Qj08x
S6QgPpOq/coM5QpU1ZUHV3nNCHj5Fw49lB7/Mdrv6Lvr/ELrcUtehHVNxqSOoj/x
prYwIaCanqWUYrg/PuqsRkOY1JMQ3V2Lxbukp/1h01/U9a95zQfu4bdCmrPKSHN1
d6KNX3oa8EOMdm3EdF35s7V8sHmq5b2kpknbrFBSUXI7KtO/YeuLJ9K0OMVFfCKT
Mov4ehCBKQ/tq4ENUwuDJ3mo
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
