All of your files are encrypted!
Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/{UID}
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
{KEY}
-----------------------------------------------------------------------------------------
We will use the data gathered from your systems in future campaigns in 14 days
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
sub
7563
svc
veeam
svc$
memtas
sophos
sql
vss
backup
mepocs
Extracted
Path
C:\ProgramData\91j63-readme.txt
Family
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 91j63.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4622FFA5C14C933B
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/4622FFA5C14C933B
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
MEu9pNTt//ljc0uR77/7uQMsruK+eMUFWYbDvcQMxThwm7iKhZt/IkZn5PIiuq7r
EO9ouojSikHJHlOX36OJffpFa4C/MsmuuMvsC4etvAD53cUnxB/gpPmxR6IQzqem
rbKfhwSysLvHWPziklcXtS9Js9HtvxxMUJWBRp0xeT4zL5MDFqBg+3/kqg1f/b+h
0XXY9RpU84T0sWet6tnLVX7tJ9ky/TT7DS0HddksSHRC9Vp70g41J9MwmR9NOPBV
TkOgCFgdx8lsMSYwTxfLVXfEhlhapGzQMzVJsj3bHNoZJT5shSRHqBVQW1bVa5d/
6el8HgRXqU/Tq+r0NeWTK1qLCeBRY5i5NkwKYbIjnfZSn9ZHKU81Myaxs0rJhyRu
ORXf3Li4kbPT85QWeUqIxSpqkmmHM5drgGn4shZDFN4dHWcE+hneiZuVS1Lu39Ak
k+CetZWtjSDx9gx1snvj73E3Lt7yZUOTLtPj2JkHlhqLHPIgH7j3q8eu/MFrNlCc
w+sqsYhX5h1URAQb4tLQkagtSUHHOhxc2M1ONJBuIvls4Bxl8fyk/u1GjDil0g/9
B806zD0p7vpfdmEO/bF1MNG7zMK6VJXLv/o/qNzVE+qWM7zJNtaio9Yualmf+SVC
zFdDvhrrmFxCQXZJmXP+KHdTdpXVGuFFgs/X8eBs6WGroOq2qQ7mRJOmcAQhfXGN
NwADeLyMB7gvfZP13JZCsXjA+qb30fO6pqkPM8qT/+DOhs/+ebLcuYMECszQco4M
QFtXalN2vJHg+y36jvMBtyvrWesvBCy7ls0a5Y2j1m392inBbE75nFmn0AghCFkQ
k8i+mLZHLeVwnk1kT1MVWgdYuuc+j7VBLt8NZwPnaKJf0+AZQYhktID3A/n6iWvS
g5OIOs2XecEinwf0/ScXtQs3nqcY6S5hj8UzrLureSiXSk9GkSb+Jy7TIzjo/cO4
DVabukRfNbohGqpIj7xYuiXjpccDQRdoCgXdzjcr012EI3ctOeuZwayy6TFV4FFr
hEEnzJWLRVSoQCXz9zea1WHNNe99P2/WzdD05nrvuKdveeo5QxQeQM2umViOthxT
uNT7CVFgfnEL+kWjSicxWY2E2Tw8v7CkIoGKoxJNXm2UBw7K1j3R8B9y9WMGwQr0
T+5cFpi0rEXAmC39ngIuYm1L7xt+Ar8oHRz7u1QpLQ9lXpFEz1CLbH3bpxsL8YWd
1eK3a5lNvcHyyVHL+oosPX4RJH+EhvY8ilC9pRPuzlBYl85sCnqy6IkXQoVmSpEc
c6F/Khr/clENam9t6Yof5lQL8CgmUCuXP0OgLmoCXekudVpEnu+VZNS4aOoOMy79
MHUKSmE/G9DDO9qtxh84FoFzKqx48c7gLJw=
-----------------------------------------------------------------------------------------
We will use the data gathered from your systems in future campaigns in 14 days
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
