All of your files are encrypted!
Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/{UID}
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
{KEY}
=========Attention!!!=========
Also your private data was downloaded. We will publish it in case you will not get in touch with us asap.
==============================
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
sub
6769
svc
Altaro.HyperV.WAN.RemoteService.exe
"Sophos Web Control Service"
AUService
TMBMServer
mysqld
"StorageCraft Shadow Copy Provider"
HuntressUpdater
VeeamMountSvc
"Sophos MCS Client"
MSSQL$SQLEXPRESSADV
"TeamViewer"
BackupExecAgentAccelerator
"Sophos Endpoint Defense Service"
AltiBack
MSSQL$QM
MSSQL$SQLEXPRESS
Altaro.SubAgent.N2.exe
MSSQLFDLauncher$SQLEXPRESS
ofcservice
"ds_notifier"
SQLTELEMETRY$SQLEXPRESS
sppsvc
VSS
MSSQLFDLauncher
KACHIPS906995744173948
MSSQLServerOLAPService
SQLWriter
"Sophos Clean Service"
McAfeeFramework
ntrtscan
SQLAgent$MSGPMR
MSSQLFDLauncher$TESTBACKUP02DEV
"ProtectedStorage"
masvc
"swi_filter"
MsDtsServer110
VeeamHvIntegrationSvc
Altaro.OffsiteServer.Service.exe
MSSQL$HPWJA
AzureADConnectAgentUpdater
SQLEXPRESSADV
Code42Service
psqlWGE
"ds_monitor"
"Sophos System Protection Service"
KaseyaAgent
ThreadLocker
Altaro.Agent.exe
ds_notifier
"swi_service"
"Sage 100cloud Advanced 2020 (9920)"
MBAMService
AzureADConnectHealthSyncInsights
MSSQLServerADHelper100
"StorageCraft Raw Agent"
"SntpService"
LTService
MsDtsServer130
ds_monitor
MSSQL$MSGPMR
"SAVService"
"ofcservice"
KaseyaAgentEndpoint
AzureADConnectHealthSyncMonitor
AltiCTProxy
ds_agent
msseces
"Sophos Device Control Service"
mfevtp
"Amsp"
MsDtsServer120
KAENDCHIPS906995744173948
Altaro.SubAgent.exe
"Sophos MCS Agent"
Altaro.OffsiteServer.UI.Service.exe
AltiPhoneServ
Altaro.UI.Service.exe
VeeamTransportSvc
"Sage.NA.AT_AU.Service"
VeeamNFSSvc
ReportServer
AltiFTPUploader
SBAMSvc
"ds_agent"
Telemetryserver
mfewc
klnagent
"Sophos File Scanner Service"
"SQLServer Analysis Services (MSSQLSERVER)"
"SQLServer Integration Services 12.0"
VipreAAPSvc
ALTIVRM
MSSQLTESTBACKUP02DEV
HuntressAgent
VeeamDeploymentService
MySQL
ViprePPLSvc
tmlisten
bedbg
TmCCSF
mfemms
"StorageCraft ImageReady"
"Sophos Safestore Service"
"SQLServer Reporting Services (MSSQLSERVER)"
SSISTELEMETRY130
macmnsvc
kavfsscs
SQLAgent$SQLEXPRESS
SSASTELEMETRY
Altaro.DedupService.exe
sophossps
"Sophos Health Service"
AzureADConnectAuthenticationAgent
Amsp
VeeamEndpointBackupSvc
LTSvcMon
MSSQLLaunchpad$SQLEXPRESS
SQLBrowser
svcGenericHost
"Sophos AutoUpdate Service"
"SophosFIM"
"Sage 100c Advanced 2017 (9917)"
SQLTELEMETRY
SQLTELEMETRY$MSGPMR
ProtectedStorage
Microsoft.exchange.store.worker.exe
KAVFS
"SAVAdminService"
SQLSERVERAGENT
VeeamDeploySvc
"ThreadLocker"
sqlservr
MSSQLSERVER
ADSync
TeamViewer
DsSvc
Extracted
Path
C:\Users\Admin\pz370-readme.txt
Family
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension pz370.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6495FD5092B44CCC
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/6495FD5092B44CCC
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
mXwGv6BE3lE9lV43xqQ/h5x45rQsDAiSvix8lWCNyXKJZNq4aE3vL6OttmskG3No
6hWvykV2Hw/gaRudobWyMUCJbFkyRNrPcktmORHruAxYms0TjWzHyocrLwI/T409
fhng2h+uaiL/CsXMrLP3NOhl4h7wHg38XqLdHfALe2s9GFxf8eNpioUSasDyCdqG
B1uFjtT/5NuZnvWH5zlDp0yPTa6b9BFRXJGUaK56q+YDdUV+76ApSCzh1I4UpY+4
kKbjsyVrXEiqeqRRpmv2yN3IRk1QvXuA80eDbrPE+xGNUlo1LjRbPet06gfZEqjX
Kf/83MxzYKp16L6cqCsGLtUWjuebtU3LMX61KkTp5rheYK3rTj7oLU4oL3KpFyCx
XiIt9Vjsip8YorA3bW74ZP++0A+YLyhfUKlYG5CCiwPC4lCwusBtXAcgcGPHwWel
GANlr5pmk2wCvoQUb6WyNizDVU/cIdypZy01D+rSyv9+a+wxuQScCAjcNbcgOIyv
G4BoExMl86mPpjrf7Auriv5JUqU3+apQhzO9gs37TyUcJRUsYe2KI7JTOidPpzww
upGrzIh4Um6uQ9TFe071fRxAxoBZ+H8ddAsZh6P5r9Ba7RcO/Gz+hpphnScWB4iu
M60z3JTLcuD4pXvOXVvPu5GHu7hj7vllBGzs8qTkWm530zgQJsiHk9SKb0BvJ3y6
gSXFnLjGts7YiVzwBb+o7SU3L9FsID2zr+P2DAYnXL2VS9WsZi13c0pdGPCR/TKF
9qubKjZ7o/nq8S7AUrjacSUyxl30HLOjOnxGo693btQo5SMDCAkjW8LaWaGjTVAq
Q5aeGEzmZtf09o01+7EM0Qbac1JwT16A6yHIOBDzOXtmsw0IEvmFmpu5SUyNacyS
U0YVC+Jb/iIcwTBoFjkutOEY87vR4YE6SXW39JWY7rCX8NLbU6kgyzkHc5wnEGhm
iNzbc75WszkRTWBBlJ4HCgdVheXlyiItZge5Q2cz3IKAE/9QdgLjgni4qSmOcmxD
Cb2oDrWRQMGQ97A+LS4LI4DQN7VG1ct93lJEhhLu8i6l5T3Oq8QLVb2YTiuNJ0PX
0mhANdgkh0XhLX+ACP2FiPWu0rrswMsvp7QrRhDQUIKVDjleQNQbXhBYnpzUo5bL
ZCH9r+VO2GwMZIaVogBfQryWC3AzZXYdXivt2iZuWs9cTrq4AWJrJuqH5T/BAjvi
1YLcUK+v/JHAYHsXlbRL2pyZU8UN8K0I/fnl1073ZFYTdzW6J+kf5XW3E9mwyjtW
2bgt1p+6AjHxAnCtkjPCakOvxzkBE4zz+FTTA1X68KpmqMDeSZXEErEjYBG026X0
pdoQusOj+fojZwMtDEj8VCL7EzqxY7RXW1JPbacI2qBzwV0o
=========Attention!!!=========
Also your private data was downloaded. We will publish it in case you will not get in touch with us asap.
==============================
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
