| Time & API |
Arguments |
Status |
Return |
Repeated |
1619345034.387026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345034.402026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\PerfLogs\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345034.402026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\PerfLogs\Admin\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345034.418026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345034.434026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345034.465026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Assistance\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345034.481026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Assistance\Client\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345034.512026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Assistance\Client\1.0\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345034.512026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Assistance\Client\1.0\zh-CN\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345034.731026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Assistance\Client\1.0\zh-CN_en-US\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345034.856026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Crypto\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345034.856026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Crypto\DSS\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345034.918026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345034.981026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Crypto\Keys\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.356026
NtWriteFile
|
file_handle:
0x00000158
filepath:
C:\ProgramData\Microsoft\Crypto\RSA\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.371026
NtWriteFile
|
file_handle:
0x00000158
filepath:
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.387026
NtWriteFile
|
file_handle:
0x00000158
filepath:
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.465026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\DRM\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.496026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\DRM\Server\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.512026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Device Stage\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.527026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Device Stage\Device\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.543026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.574026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.606026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Device Stage\Task\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.652026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.684026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\zh-CN\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.699026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.746026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\zh-CN\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.762026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\DeviceSync\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.777026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\IdentityCRL\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.809026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\IlsCache\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.934026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\MF\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.965026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Media Player\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.981026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Network\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345035.996026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Network\Connections\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345036.012026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Network\Downloader\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345036.027026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\RAC\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345036.027026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\RAC\Outbound\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345036.043026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\RAC\PublishedData\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345037.621026
NtWriteFile
|
file_handle:
0x00000158
filepath:
C:\ProgramData\Microsoft\RAC\StateData\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345037.762026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\RAC\Temp\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345037.902026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Search\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345037.949026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Search\Data\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345037.981026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Search\Data\Applications\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345038.012026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Search\Data\Temp\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345038.027026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345038.059026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\User Account Pictures\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345038.074026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345038.824026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Vault\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|
1619345038.887026
NtWriteFile
|
file_handle:
0x00000154
filepath:
C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\__________WHY FILES NOT WORK__________.txt
buffer:
Attention!
Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team!
We used nextgen strong cryptography in order to encrypt your files.
The only way to restore your files is to buy decryptor!
* You must know the worst thing is happened now and you cannot hide our successful attack!
Understand if payment is not made on time. All your company data will be permanently destroyed.
Your backups has been fatal and it is just a waste of your precious time if going to try them!
* IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW
1. Copy your Network ID and send to our email.
Network ID : DM5V6T52K4
Email : crossroads2371@protonmail.ch
2. You will receive a amount and payment order.
3. We will send you decryptor with private key to recovery your files.
* You can ask for 1 free file decryption as proof of work in the first correspondence!
* Your time for save your files has limited to one week (from first impact) before we delete our temporary email address!
* Data manipulation cause permanent loss of files!
offset:
0
|
success
|
0 |
0
|