All of your files are encrypted!
Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/{UID}
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
{KEY}
-----------------------------------------------------------------------------------------
We will use the data gathered from your systems in future campaigns in 14 days
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
sub
7563
svc
veeam
svc$
memtas
sophos
sql
vss
backup
mepocs
Extracted
Path
C:\Recovery\tctrh2h0p-readme.txt
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension tctrh2h0p.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/18FC7B4F12D20D2F
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/18FC7B4F12D20D2F
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
qZp5gYrt+C1Z1kfk6N09gpIDCdYXy1ZUsjKSTFO3R9SsAgCO++Nf2+X7UmZO1T+R
A0ObU26glz529Xd8/gy84ktP5tgnZuHrTCkzMz1E2eDH0E0DT9QzHU/WzqLM6Chm
hE6fbZazkwofRhSlgN/DREgc3Mfk+SEXULkKR69TgjjkxNfs9TZ8pMn0ENPVQtWl
icldCCHP71/ZVcUKjBX6ZHtt9ZgiCfZrUjj/OKZHwlde3OCnZCf9gnRmiWtGnWY1
wZ0dQ15dzfup1iQnCvSNIU5h26R+Td+a7s6ok+HMF2k7Dd2LNC7VnRy5X/9N4bRD
M9eWLjqfSj3xa8SKO+aAUWNAFFX83jVszxxReqiEkqbvwvtmQrn8uESNQzmewTpR
bscwyT0deZag8JUrP//xyX48u3qCE+Rsmj/bKfDt2KXJ9WQ657jotqpPF6aIq53C
fJ0Z7iTdwQagNmdzOCeu6P6FAxoQ6QhJeVVFM97eNSwFAdne7Yo5d7mjMbEx2rdI
xJ9LLE09x7171m5yEsUJ4y4RP0XhElgvPhOSpgdmznXxVTLRLF3m2cnr2+tKOaSG
zo4T/Lt4gMVss9yUZG4jeeInzyXdfE8uOkIeDaJSwRmB/wkYYax1IYH1nj/mxudd
H6BI1wpw82IYlXfMslJy4z6bQDepcOdwCwtwCu5Pf4QG2YS9VeQ30L27SQL3qp0M
+xzw1S2ikhr+YvnQZkWLLmaflZFzK8vrsJkv7uV1X3gWy7t8zJuiUeLzMnNlZCT0
+C0o+ApErvkcgZNn2hkiPUSHWVLkH3w3WP5QhE+K2zJjZdu16Wx1RFaFmTxts5TE
73mK0JQZIhlM1+arYHwGfjtBjlGjF1zucBNABFyNuGVS2f8k17D9SZY6Aw/5cENC
gls9dey1P8oy7W57L9laWHhP9ArU2DPoNivXA2oZm/09AdaUa6UyRwwnGLO/cPbo
3bHLVm4/As3BzXIge49CXkqZcTYm+N79yf5HKwShwTaebMZWM1DGqtKM40eJzYRR
Ev0NaHdWIXg/Q9FXY0dSeclQZRFdIJjxj3uozMAUc/p6QdnqGM6oL8Jhs1pIkHIW
OrF4wwBfnI3+dP7O397cGKZ1k4bsoqfCLLzrrnxRHq+AeX/bs46xDWHDAhUvgMp2
bJUupscq8l0UK54fPzgIDdurf9ugNHKjZmown1J72//NAtAV2VXVOQIPYcNHHVVB
GhpYkLojvFkSkYMNsjgR2gXf87P4ppZ80f2npt8mUjmDJfpr9Nq6Slg2Rpi2NnFO
JDn8npxUrgLHWtcIQLW6mc9nN+w7svdL/C0FN8gVz5NuBjbA8oH91N+oYbivMWrM
1Sdp2FiXeHn8Obe8RNm81hjB94WIPx3zLgRuCng+Gh9CU7DFhhdVbOyEP6Bb93O+
6nk+Kqiz
-----------------------------------------------------------------------------------------
We will use the data gathered from your systems in future campaigns in 14 days
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
