All of your files are encrypted!
Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. ===---
Merry Christmas and Happy Holidays everyone!
You have a great opportunity to enter the new year, leaving all the bad in the outgoing year.
I advise you to write to us as soon as possible and not waste your precious time that you can spend with your family.
With our decryptors recovery will take you the least time, without us you will have a very hard time and some of your files will not be recovered never.
The longer you think, the harder it will be for us to negotiate with you .
Waiting for your dialogues in our chat, below you can get acquainted with what happened.
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decryptor.top/{UID}
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
{KEY}
Extension name:
{EXT}
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
For google: Revil/Sodinokibi
sub
2361
svc
sophos
veeam
vss
AcronisAgent
BackupExecJobEngine
AcrSch2Svc
BackupExecManagementService
BackupExecVSSProvider
mepocs
stc_raw_agent
bedbg
MSExchange$
MSExchange
MVArmor
CAARCUpdateSvc
memtas
MSSQL$
BackupExecAgentBrowser
PDVFSService
WSBExchange
sql
ARSM
svc$
VeeamNFSSvc
BackupExecRPCService
CASAD2DWebSvc
VeeamTransportSvc
VeeamDeploymentService
backup
MVarmor64
BackupExecAgentAccelerator
BackupExecDiveciMediaService
VSNAPVSS
MSSQL
Extracted
Path
C:\Program Files (x86)\nv0csx837m-readme.txt
Ransom Note
---=== Welcome. ===---
Merry Christmas and Happy Holidays everyone!
You have a great opportunity to enter the new year, leaving all the bad in the outgoing year.
I advise you to write to us as soon as possible and not waste your precious time that you can spend with your family.
With our decryptors recovery will take you the least time, without us you will have a very hard time and some of your files will not be recovered never.
The longer you think, the harder it will be for us to negotiate with you .
Waiting for your dialogues in our chat, below you can get acquainted with what happened.
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension nv0csx837m.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A36523C961A980CB
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decryptor.top/A36523C961A980CB
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
J2/Nyfatv3cgR/YnA/3GzpVa4nReVho+PVPP96QvKPcZWmx52jycO+6ZOhnSx7Y3
eB1Itru+Rak9UIpg30GBivye6H1MLFcj88CXq6uk29qr5T0JOwiW1WEfWHCfO2iU
yMjKCd9tIn5FluRwHvarGr3dqWUl0vaVV5tdZkrmoISFJyjn4uaCl9CIG7lthpNW
LvCyTg7XOPDmUgFCwokGFupQ/ZVWnKQ0PnmuFQqfHhUwvby2e7m3KbkP1+9zsh9E
lFEDLlOBc1iC1qAOPwa2IlAkK8Rej+OI56DikbuoSY4qoZ4+VcYw7AbRdVzPqN5B
fysulUIbFy7Nxoi/isThqxfP3n8ajin70Ig6cBjGQc+7x5Hfk7iiQyCO929/K31l
gwoKwkxBFg0PSX2IrNY8sNlcvx6znNO6GYnnH82czwh7PS840vzWuVbYG8kQBz6m
sDh/EQsnYWp6QsrKBIJl8dCRFeL+vDtcjHTkUvBLmUDw2eAtg81IPep2ne5J8zTq
H4q0KUvXJi0D5Ivq4WeGwXK4SjMpPbZ4dj1wkzL01qMhFvUJuIvtQQo3ekcSdG0J
fjySQOZkEFsy4lHUfAVmQ0BL0+/aeQOQSPQCRFVc4wIfmT6M53+fFHCH8a0xHMWP
EvicSKpum0bdRCDa94HvomK9gI1QsGiIGrI4gPgnRRPX3tlJqzwwYGZEqwKhhvT1
FJfxP4+R39PQ75/+dPZZczbPgV/DgHiR9sKLRvv61H+9PQgGkkOwy6b5QmM1qZsL
wiTmaatQZajhtH+Outdba+xwEHIGnta9BlAm7xsaEWDkU1wS9vR+4f166WFTwv+Q
5w6JJxvd0XcZS1qzD7dtGiokv9bVggwalN59d681p9iYpLbqxNvRga4g4dTQjOd1
/2VehEpQVagc4NHhgRbNBgkcqVpidDrusgH/zXG6WTNgWRwe4f3nFVdPN7VYzY2b
je/85Ci8v6CzpkUoB6a/Koyxq/dH75Cdn8QMG4ss6oxNF9Wh4wlfdvXrpiWKkPV1
RaOvfTuFblPVsxmaE+k6XZkUVo3WXtoBumVr91wD4NoQX8XRLEmJZ2RRrAPM9pha
SNNLLyl+tJX7kUxPNBEpF2Xhn0seGHgk6OdKNy3QKQRn1wVVmeWZV/+F0WIz7ov/
ans3la3qKaCRtgPemhF5RbT721KMAKfUCDYRp/RHUgPqSEzsjIIrsfTSk0oKSvcp
L1DsD5VpcD3PEBc6WrESzGsTgr0qNKbY38g=
Extension name:
nv0csx837m
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
For google: Revil/Sodinokibi
