| Time & API |
Arguments |
Status |
Return |
Repeated |
1619861118.033408
NtWriteFile
|
file_handle:
0x000002e0
filepath:
C:\tmpsij43m\B42FEB-Readme.txt
buffer:
Hi!
Your files are encrypted by Netwalker.
All encrypted files for this computer has extension: .b42feb
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised.
Rebooting/shutdown will cause you to lose files without the possibility of recovery.
--
Our encryption algorithms are very strong and your files are very well protected,
the only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.
For us this is just business and to prove to you our seriousness, we will decrypt you one file for free.
Just open our website, upload the encrypted file and get the decrypted file for free.
--
Steps to get access on our website:
1.Download and install tor-browser: https://torproject.org/
2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
3.Put your personal code in the input form:
{code_b42feb:
6SkMpLKyqfyd5EekjLNRKf+o8R/WDyY32C423aZOg7WaqKGyj8
zas9Z330v6t8Uy7/pbO9zrV0Vvu0GUIh3yCxkcRFxIRaoSQzaM
0nu5PtAqr1XnCRrTTSt6I+5ny4y46MERoczVVcOwjsDh8H7qzT
gJ11Q0JAp2srwzNM8eb6r1d2EVinSQWFDShHSjyqY2CpxmGg4W
ltsftL+DkupSAkYv1R3FnaS+ozdW3X1w7Gk6AQwv8gZXM2uICo
cUl62lAv+KFgdMsolo+PxmG8A2zWWdI46eU5aDqA==}
offset:
0
|
success
|
0 |
0
|
1619861121.579408
NtWriteFile
|
file_handle:
0x00000e18
filepath:
C:\Python27\B42FEB-Readme.txt
buffer:
Hi!
Your files are encrypted by Netwalker.
All encrypted files for this computer has extension: .b42feb
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised.
Rebooting/shutdown will cause you to lose files without the possibility of recovery.
--
Our encryption algorithms are very strong and your files are very well protected,
the only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.
For us this is just business and to prove to you our seriousness, we will decrypt you one file for free.
Just open our website, upload the encrypted file and get the decrypted file for free.
--
Steps to get access on our website:
1.Download and install tor-browser: https://torproject.org/
2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
3.Put your personal code in the input form:
{code_b42feb:
6SkMpLKyqfyd5EekjLNRKf+o8R/WDyY32C423aZOg7WaqKGyj8
zas9Z330v6t8Uy7/pbO9zrV0Vvu0GUIh3yCxkcRFxIRaoSQzaM
0nu5PtAqr1XnCRrTTSt6I+5ny4y46MERoczVVcOwjsDh8H7qzT
gJ11Q0JAp2srwzNM8eb6r1d2EVinSQWFDShHSjyqY2CpxmGg4W
ltsftL+DkupSAkYv1R3FnaS+ozdW3X1w7Gk6AQwv8gZXM2uICo
cUl62lAv+KFgdMsolo+PxmG8A2zWWdI46eU5aDqA==}
offset:
0
|
success
|
0 |
0
|
1619861124.361408
NtWriteFile
|
file_handle:
0x000002d8
filepath:
C:\tmpsij43m\bin\B42FEB-Readme.txt
buffer:
Hi!
Your files are encrypted by Netwalker.
All encrypted files for this computer has extension: .b42feb
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised.
Rebooting/shutdown will cause you to lose files without the possibility of recovery.
--
Our encryption algorithms are very strong and your files are very well protected,
the only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.
For us this is just business and to prove to you our seriousness, we will decrypt you one file for free.
Just open our website, upload the encrypted file and get the decrypted file for free.
--
Steps to get access on our website:
1.Download and install tor-browser: https://torproject.org/
2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
3.Put your personal code in the input form:
{code_b42feb:
6SkMpLKyqfyd5EekjLNRKf+o8R/WDyY32C423aZOg7WaqKGyj8
zas9Z330v6t8Uy7/pbO9zrV0Vvu0GUIh3yCxkcRFxIRaoSQzaM
0nu5PtAqr1XnCRrTTSt6I+5ny4y46MERoczVVcOwjsDh8H7qzT
gJ11Q0JAp2srwzNM8eb6r1d2EVinSQWFDShHSjyqY2CpxmGg4W
ltsftL+DkupSAkYv1R3FnaS+ozdW3X1w7Gk6AQwv8gZXM2uICo
cUl62lAv+KFgdMsolo+PxmG8A2zWWdI46eU5aDqA==}
offset:
0
|
success
|
0 |
0
|
1619861125.908408
NtWriteFile
|
file_handle:
0x00001cb8
filepath:
C:\ProgramData\Microsoft\User Account Pictures\B42FEB-Readme.txt
buffer:
Hi!
Your files are encrypted by Netwalker.
All encrypted files for this computer has extension: .b42feb
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised.
Rebooting/shutdown will cause you to lose files without the possibility of recovery.
--
Our encryption algorithms are very strong and your files are very well protected,
the only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover.
For us this is just business and to prove to you our seriousness, we will decrypt you one file for free.
Just open our website, upload the encrypted file and get the decrypted file for free.
--
Steps to get access on our website:
1.Download and install tor-browser: https://torproject.org/
2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
3.Put your personal code in the input form:
{code_b42feb:
6SkMpLKyqfyd5EekjLNRKf+o8R/WDyY32C423aZOg7WaqKGyj8
zas9Z330v6t8Uy7/pbO9zrV0Vvu0GUIh3yCxkcRFxIRaoSQzaM
0nu5PtAqr1XnCRrTTSt6I+5ny4y46MERoczVVcOwjsDh8H7qzT
gJ11Q0JAp2srwzNM8eb6r1d2EVinSQWFDShHSjyqY2CpxmGg4W
ltsftL+DkupSAkYv1R3FnaS+ozdW3X1w7Gk6AQwv8gZXM2uICo
cUl62lAv+KFgdMsolo+PxmG8A2zWWdI46eU5aDqA==}
offset:
0
|
success
|
0 |
0
|