All of your files are encrypted!
Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/{UID}
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
{KEY}
-----------------------------------------------------------------------------------------
We will use the data gathered from your systems in future campaigns in 14 days
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
sub
7563
svc
veeam
svc$
memtas
sophos
sql
vss
backup
mepocs
Extracted
Path
C:\ProgramData\9oo2ne1s7-readme.txt
Family
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 9oo2ne1s7.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/18E4DE1A3746FDBC
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/18E4DE1A3746FDBC
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
28qvZweCiecAApGOdz1r6TGWw27QhxmcMNlGnVofmCWvWZ0MhnKCiA7yTlofmqnd
9/1T69yCiIyQGWn+lKPoRwjKv4IVd93dU1LUfUpBwcyRfi5CMXas1ZY5hJKeXsNd
pSE64Lh84I+VV+0OQTkecQ8xuz/1TNzlMD8s4eiXO1GlR59xq92IjD8df/7YbFg6
tc7Q2j/R/vfabKbcrT9ffszPmyeFZ0T7bYoNN5Q42RDdMjXGcKfjuGTRGMzPrcvo
VmOrmXxK9p0WgSp5C0UKjRvYwUnVYewVOmHEG19jQ/J0bXR8ylMvpR3dYuUXmH//
MmNUlite9dqRqxk4Uzw5lVH2kYIoreIaxBZ+6b7iEdKOFC1/+m7cUpw9DQIeeImx
J1fFbOhdNluYZ48r5lhxeF+xA5rcwn+2WkebDljCeyi9Q6nIFtT4bb7Sg2pQCyRK
N4xW37rMwI62ljFgkKq3YPfESvbCxHuVZY8hYokdM+UxILykL2jHKDKdsDV4mjR/
isTuJ7W+iaw36L9OqmNHC4LYtHqio5Bfyh5a6k1ItjQcRZenSrmIhLrnxoTjNz5B
NErhnlhLhwAohYbvGmGxGKmBasCWY3JteKW6BP2rRJ6Re92yWRTBt7KJTmxy8FCz
b8bFutUCOBG2IqdayBg9/W45mGbHIW3+nlydaYqE9AA5FXn32fsII6J/Fvb4Zcv4
qFBDXlUak/idf0xIR5AL/UT6zT8igFvGwgi/JCnL9HZDLAiyfK9V/dWC30ZHAoTd
KBRMgpxwrQhEjTv8x/XMJ0fEFpohE4u+JiAdgWU1tY2Q1lCzpgjlD6gFRbcInESj
TUgjD0aOHJGXSnaoOmJyUF7knmyuHavzxjT8jFNKLlubcCpYMRkDQ7kmhcaY6bLP
Gpx7qYlBtUghJAygc+E81/HLNWw+FkIT/tFWzvTIOVMcUb6Pywr7vTKbPH8PRsvz
KrQylRubc2RHMzJvxFW3gJZyqqgEDkvIbPy1j9awuUSO/ogXrrBusUqGdb7yfzdW
h7HtTwpGJU/hZJu5SXPPzyJmef+h3PMuiTQD8aYvn7hSt3XcWHGrx6/d0oatcrDB
SAemxpbApt6Gwlk8OKxNWvB3TaA996YXF4SMc0L9Zh5lKmLYBZlPZDaVET7Nivch
EgCyC5jFcnHbiHdE1Qm6CJtguV21xw1xIsPxI6OPDmvXf2qxCyo4n2QfRBDOTZ+R
7ZwEKdjvm+3C5VGGZ8nrysI/8o7QPiuVUqBpjnzXttrkQ5isoHHhPWOl9UfxFfaO
4OdzPcu5j/eO2G8f/v6EEmSy7mdhk52CHe+t16ft+2I6RvgXEMQLccBvbyliUg6L
ygPzHT0P96yyI015Y0vQttp+uIAJsSzv3iZmlJafJUjbxg==
-----------------------------------------------------------------------------------------
We will use the data gathered from your systems in future campaigns in 14 days
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
