All of your files are encrypted!
Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. ===---
Merry Christmas and Happy Holidays everyone!
You have a great opportunity to enter the new year, leaving all the bad in the outgoing year.
I advise you to write to us as soon as possible and not waste your precious time that you can spend with your family.
With our decryptors recovery will take you the least time, without us you will have a very hard time and some of your files will not be recovered never.
The longer you think, the harder it will be for us to negotiate with you .
Waiting for your dialogues in our chat, below you can get acquainted with what happened.
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decryptor.top/{UID}
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
{KEY}
Extension name:
{EXT}
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
For google: Revil/Sodinokibi
sub
2361
svc
sophos
veeam
vss
AcronisAgent
BackupExecJobEngine
AcrSch2Svc
BackupExecManagementService
BackupExecVSSProvider
mepocs
stc_raw_agent
bedbg
MSExchange$
MSExchange
MVArmor
CAARCUpdateSvc
memtas
MSSQL$
BackupExecAgentBrowser
PDVFSService
WSBExchange
sql
ARSM
svc$
VeeamNFSSvc
BackupExecRPCService
CASAD2DWebSvc
VeeamTransportSvc
VeeamDeploymentService
backup
MVarmor64
BackupExecAgentAccelerator
BackupExecDiveciMediaService
VSNAPVSS
MSSQL
Extracted
Path
C:\Program Files (x86)\16w8cy978z-readme.txt
Ransom Note
---=== Welcome. ===---
Merry Christmas and Happy Holidays everyone!
You have a great opportunity to enter the new year, leaving all the bad in the outgoing year.
I advise you to write to us as soon as possible and not waste your precious time that you can spend with your family.
With our decryptors recovery will take you the least time, without us you will have a very hard time and some of your files will not be recovered never.
The longer you think, the harder it will be for us to negotiate with you .
Waiting for your dialogues in our chat, below you can get acquainted with what happened.
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 16w8cy978z.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/83933461B08BDC1F
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decryptor.top/83933461B08BDC1F
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
NUm3im8+Xxf5aXpcao5PqzOyQBDp/B9epPI6vERRJh3Kl8xauv90oSPswJkk+mcs
zwX2CmtkFGjyqNXT8GU2+djv6Usl9YePohYWzkifJn3W1LaO5sxIypkQ3jFNz1rp
K6mLvRQcFpYmgI3D8VdxlEmVtp7Q0f0BBrUbSQ1xchPSyD9Lp9tHCvXDX+0IvFo6
+Mvjcbcu/b7NjqQ4K19pFxRCYigfBkIZSwi69cZh2yY7YAXwJ9rMzTQqdgLngLoL
arJE8NxrZKgd7eQnN1/oqss0VnPP9rlPJIMpobQKlAhQwqcZofarolM9bHZa56jL
18VQ4P4azk8qK8S7mKhpJyTiTSvDwwQrT+nWMl0EeM5b5Di32Zt1BVoyFVR8aNcC
CGDuq0LN1Ip1969ybykm+06yxrEynP53DkFEwCmMZ2PG/GIp1tNDk25PrSx0pyl3
wQrdToVziDCDuS+iIBTvZzioRck1xbHk8p5SwDZm3yz0I2bgct85/8iW1xxvglsw
oCmVKDIw7PYdMie1TFQnqC5uqRykS2BHCAHdZGArK9YUwaTomv2Q9taGnV+XjqFS
IktNHuBBWip3CxOrDMzZPekOYtQ7WyPkcDqDJvXuSzugZodcsUOWc5+3vZMQtH1I
Ke/AtNYgEgSv1+sPOQxeZPW0TCPnM+QcU0hKj02zOOUMURs2RzWxKe7e9FmWIp5b
jaTJOaFK/QPEL5VNX7FGU48/KGwzXCTf6NTYU0NIHL2IEaK9vq02fX7oA03JpbDz
2TdJSBRU2DPEmJHNqWKwUu3FkgWEsQE6AunIITuDbUFpgUV1O9+pGFbjtv6xxFWg
7WQ4bbqrNnCUvge07quSpHcb8B5W6F1tkzwW96YkYZd0eASE5k6O0/2j+By2WP0w
ddxCc4DY49n+xVgpvlBWw95da3gvCAJEEf+FzZKDuL4mjTNA3ed8B7re2tIrRnY/
HH+Vjj+bOq5PUu31bLFU+HZAG8k9IUJ9MqnC1X8g5APCx2VWF8B8ggmQnPOl2OCK
o1mMr16CncuaxmzMQ6VoG3dYtyQIOWobgbi10bSQLK1fdmr/WXoit5A4PJo+cDW4
zNHS8WRvt35sldejFGlF2ZYUuuQnewDu8CWdnAb3xG+4NFWCqiuZZEJhogUAhIgz
AgfC3zyMYr1Y6VUuzmglmgSWiXD2uvrhD5ta2335A3GrqBo9AlcTbmcrJwEhysHK
QvpjOI0sHuNFa9+2y4E7Ojbo+CQ9BLGyVQs=
Extension name:
16w8cy978z
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
For google: Revil/Sodinokibi
