buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ 8|)7| Gd| Gd| Gd'uDev Gd'uBeð Gd'uCen Gd·rBeY Gd·rCem Gd·rDem Gd'uFem Gd| Fdü Gd'uAe} GdúmOev GdúmEe} GdRich| Gd PE L V_9c à | 0 @ à @ ä ´ À P 8 @ 0 à .text `.rdata b 0 d $ @ @.data @ À.reloc À @ B base_address:0x00400000 process_identifier:2860 process_handle:0x000002a4
1
1
0
WriteProcessMemory
buffer:±¿DNæ@»ÿÿÿÿ ÿÿÿÿ ÿÿÿÿ èEA ¡A ¡A ¡A ¡A ¡A H¦A hHA èIA è?A ` A (¡A C abcdefghijklmnopqrstuvwxyz ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz ABCDEFGHIJKLMNOPQRSTUVWXYZ ¤ `y! ¦ß ¡¥ àü @~ü ¨ Á£Ú£ þ @þ µ Á£Ú£ þ Aþ ¶ Ï¢ä¢ å¢è¢[ þ @~¡þ Q QÚ^Ú _ÚjÚ2 ÓØÞàù 1~þ ¦A ðµA ðµA ðµA ðµA ðµA ðµA ðµA ðµA ðµA ¦A ôµA ôµA ôµA ôµA ôµA ôµA ôµA . . þÿÿÿ $ þÿÿÿ u º[$B´4¿Ï«)ݹÒï
ÈÕ=ù&<¼°ñW3CRYPTO LOCKER Attention!
All your files, documents, photos, databases and other important files are encrypted
The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.
The server with your decryptor is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
1. Download Tor browser - https://www.torproject.org/
2. Install Tor browser
3. Open Tor Browser
4. Open link in TOR browser: http://34vm2smykaqtzzzm4bgycfzg5fwyhhksrkpahdbiswmmuwuu7hmvuvqd.onion/?501%s
5. and open ticket
----------------------------------------------------------------------------------------
Alternate communication channel here: https://yip.su/2QstD5
expand 32-byte k base_address:0x0041a000 process_identifier:2860 process_handle:0x000002a4
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ 8|)7| Gd| Gd| Gd'uDev Gd'uBeð Gd'uCen Gd·rBeY Gd·rCem Gd·rDem Gd'uFem Gd| Fdü Gd'uAe} GdúmOev GdúmEe} GdRich| Gd PE L V_9c à | 0 @ à @ ä ´ À P 8 @ 0 à .text `.rdata b 0 d $ @ @.data @ À.reloc À @ B base_address:0x00400000 process_identifier:2860 process_handle:0x000002a4
buffer:Attention!
All your files, documents, photos, databases and other important files are encrypted
The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.
The server with your decryptor is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
1. Download Tor browser - https://www.torproject.org/
2. Install Tor browser
3. Open Tor Browser
4. Open link in TOR browser: http://34vm2smykaqtzzzm4bgycfzg5fwyhhksrkpahdbiswmmuwuu7hmvuvqd.onion/?501PRSUWXZB
5. and open ticket
----------------------------------------------------------------------------------------
Alternate communication channel here: https://yip.su/2QstD5
offset:0 file_handle:0x00000124 filepath:C:\GPKI\ReadMe.txt
1
0
0
NtWriteFile
buffer:Attention!
All your files, documents, photos, databases and other important files are encrypted
The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.
The server with your decryptor is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
1. Download Tor browser - https://www.torproject.org/
2. Install Tor browser
3. Open Tor Browser
4. Open link in TOR browser: http://34vm2smykaqtzzzm4bgycfzg5fwyhhksrkpahdbiswmmuwuu7hmvuvqd.onion/?501PRSUWXZB
5. and open ticket
----------------------------------------------------------------------------------------
Alternate communication channel here: https://yip.su/2QstD5
offset:0 file_handle:0x00000160 filepath:\Device\HarddiskVolume1\Boot\cs-CZ\ReadMe.txt
1
0
0
NtWriteFile
buffer:Attention!
All your files, documents, photos, databases and other important files are encrypted
The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.
The server with your decryptor is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
1. Download Tor browser - https://www.torproject.org/
2. Install Tor browser
3. Open Tor Browser
4. Open link in TOR browser: http://34vm2smykaqtzzzm4bgycfzg5fwyhhksrkpahdbiswmmuwuu7hmvuvqd.onion/?501PRSUWXZB
5. and open ticket
----------------------------------------------------------------------------------------
Alternate communication channel here: https://yip.su/2QstD5
offset:0 file_handle:0x00000234 filepath:C:\MSOCache\All Users\{90120000-0015-0412-0000-0000000FF1CE}-C\ReadMe.txt
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ 8|)7| Gd| Gd| Gd'uDev Gd'uBeð Gd'uCen Gd·rBeY Gd·rCem Gd·rDem Gd'uFem Gd| Fdü Gd'uAe} GdúmOev GdúmEe} GdRich| Gd PE L V_9c à | 0 @ à @ ä ´ À P 8 @ 0 à .text `.rdata b 0 d $ @ @.data @ À.reloc À @ B base_address:0x00400000 process_identifier:2860 process_handle:0x000002a4
buffer:±¿DNæ@»ÿÿÿÿ ÿÿÿÿ ÿÿÿÿ èEA ¡A ¡A ¡A ¡A ¡A H¦A hHA èIA è?A ` A (¡A C abcdefghijklmnopqrstuvwxyz ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz ABCDEFGHIJKLMNOPQRSTUVWXYZ ¤ `y! ¦ß ¡¥ àü @~ü ¨ Á£Ú£ þ @þ µ Á£Ú£ þ Aþ ¶ Ï¢ä¢ å¢è¢[ þ @~¡þ Q QÚ^Ú _ÚjÚ2 ÓØÞàù 1~þ ¦A ðµA ðµA ðµA ðµA ðµA ðµA ðµA ðµA ðµA ¦A ôµA ôµA ôµA ôµA ôµA ôµA ôµA . . þÿÿÿ $ þÿÿÿ u º[$B´4¿Ï«)ݹÒï
ÈÕ=ù&<¼°ñW3CRYPTO LOCKER Attention!
All your files, documents, photos, databases and other important files are encrypted
The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.
The server with your decryptor is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
1. Download Tor browser - https://www.torproject.org/
2. Install Tor browser
3. Open Tor Browser
4. Open link in TOR browser: http://34vm2smykaqtzzzm4bgycfzg5fwyhhksrkpahdbiswmmuwuu7hmvuvqd.onion/?501%s
5. and open ticket
----------------------------------------------------------------------------------------
Alternate communication channel here: https://yip.su/2QstD5
expand 32-byte k base_address:0x0041a000 process_identifier:2860 process_handle:0x000002a4
501.exe