Victim #266

Victim #266

You can attach a few files for test decryption by packing them into an archive with zip, rar, tar, 7zip, 7z, tar.gz extensions of no more than 10 megabytes using the attach button directly in the chat. If your archive weighs more than 10 megabytes, please use our file sharing service. http://lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion http://lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion http://lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion For security reasons we do not click on other links you send in chat. Please wait for a reply, sometimes it takes several hours due to possible time zone differences.

Mon Apr 21 2025 00:13:21 GMT+0000 (Coordinated Universal Time)

Victim #266

hello

Mon Apr 21 2025 01:46:11 GMT+0000 (Coordinated Universal Time)

Victim #266

Mon Apr 21 2025 02:03:40 GMT+0000 (Coordinated Universal Time)

Victim #266

we have 2 esxi,this is other esxi, but this ID only 2VMDK need

Mon Apr 21 2025 03:45:17 GMT+0000 (Coordinated Universal Time)

Victim #266

Their different ids

Mon Apr 21 2025 03:49:18 GMT+0000 (Coordinated Universal Time)

Victim #266

Our company is still discussing the decision on whether to make the payment, because this is not a small sum of money. We have some independent backups. In veeam, it is rather troublesome to restore them

Mon Apr 21 2025 04:07:03 GMT+0000 (Coordinated Universal Time)

Victim #266

We discovered the vmdk of more virtual machines All the documents have such problems. During the encryption period, stop the process of encrypting the file So it will cause his file suffixes to be chaotic, with a lot of garbled characters |

Mon Apr 21 2025 14:50:28 GMT+0000 (Coordinated Universal Time)

Victim #266

The current issue is not how much we pay, but that too many files were damaged during the encryption process, and the encryption process was stopped, resulting in the files not being encrypted completely?

Mon Apr 21 2025 15:07:19 GMT+0000 (Coordinated Universal Time)

Victim #266

what mean

Mon Apr 21 2025 20:20:57 GMT+0000 (Coordinated Universal Time)

Victim #266

send you some files？ Incorrect suffix？

Mon Apr 21 2025 20:34:21 GMT+0000 (Coordinated Universal Time)

Victim #266

https://gofile.io/d/Usy7A9

Mon Apr 21 2025 21:10:06 GMT+0000 (Coordinated Universal Time)

Victim #266

https://gofile.io/d/Usy7A9 this file， I have just tested this link. It can be downloaded normally and the speed is very fast. Any browser will work

Tue Apr 22 2025 02:39:08 GMT+0000 (Coordinated Universal Time)

Victim #266

Or you could give me a website where I can upload files

Tue Apr 22 2025 03:59:23 GMT+0000 (Coordinated Universal Time)

Victim #266

？

Tue Apr 22 2025 11:46:58 GMT+0000 (Coordinated Universal Time)

Victim #266

i dont understand you？

Tue Apr 22 2025 11:54:24 GMT+0000 (Coordinated Universal Time)

Victim #266

did you dowload my files ?

Tue Apr 22 2025 11:56:12 GMT+0000 (Coordinated Universal Time)

Victim #266

you mean cant download files/?

Tue Apr 22 2025 11:59:21 GMT+0000 (Coordinated Universal Time)

Victim #266

you mean i need use other upload web,to up load files?

Tue Apr 22 2025 12:04:24 GMT+0000 (Coordinated Universal Time)

Victim #266

hello

Tue Apr 22 2025 12:11:54 GMT+0000 (Coordinated Universal Time)

Victim #266

We selected two small VMDK files. Since some of them are relatively large, we uploaded this one. May I ask if you want me to change to the previous uploaded website? Or replace the uploaded file?

Tue Apr 22 2025 12:16:52 GMT+0000 (Coordinated Universal Time)

Victim #266

Do you mean that this link cannot be downloaded? Do I need to change to another upload website?

Tue Apr 22 2025 12:47:07 GMT+0000 (Coordinated Universal Time)

Victim #266

hello

Tue Apr 22 2025 12:55:48 GMT+0000 (Coordinated Universal Time)

Victim #266

did you get files?

Tue Apr 22 2025 12:59:13 GMT+0000 (Coordinated Universal Time)

Victim #266

okay , iam wait you anwser, Many of our virtual machines (large files) have different suffixes, and there are many kinds. However, for small files, their encryption suffixes are correct, but they are not important

Tue Apr 22 2025 13:03:47 GMT+0000 (Coordinated Universal Time)

Victim #266

I consulted some professionals, and they said it was very likely that the encryption was stopped during the encryption process. When encrypting files, the encryption process was terminated, resulting in file damage

Tue Apr 22 2025 13:05:26 GMT+0000 (Coordinated Universal Time)

Victim #266

Tue Apr 22 2025 13:31:17 GMT+0000 (Coordinated Universal Time)

Victim #266

may i ask you 3 esxi system Will each one have this file?

Tue Apr 22 2025 13:45:39 GMT+0000 (Coordinated Universal Time)

Victim #266

1 esxi We have reinstalled the system and lost this file. The other one couldn't be found

Tue Apr 22 2025 13:49:30 GMT+0000 (Coordinated Universal Time)

Victim #266

okay

Tue Apr 22 2025 14:18:51 GMT+0000 (Coordinated Universal Time)

Victim #266

any news

Tue Apr 22 2025 23:33:23 GMT+0000 (Coordinated Universal Time)

Victim #266

anynews？

Wed Apr 23 2025 04:23:55 GMT+0000 (Coordinated Universal Time)

Victim #266

he can decrypt？but the file was not encrypt complet， and More than 90% of VMDKS have garbled suffixes that are not fixed

Wed Apr 23 2025 04:26:20 GMT+0000 (Coordinated Universal Time)

Victim #266

More than 90% of VMDKS have garbled suffixes that are not fixed， How to solve this problem?

Wed Apr 23 2025 04:27:40 GMT+0000 (Coordinated Universal Time)

Victim #266

.4D749484 This should be with the correct suffix

Wed Apr 23 2025 04:28:49 GMT+0000 (Coordinated Universal Time)

Victim #266

ineed chackVMDK and show my boss，

Wed Apr 23 2025 04:30:34 GMT+0000 (Coordinated Universal Time)

Victim #266

Hello, I have a question to consult you. Our virtual machine has many different suffixes, and their lengths and characters are all different. However, the first few characters are the same, while the latter ones are either very poor or very short. May I ask whether to use one KEY for decryption in this situation, or if different suffixes require different keys? Sorry, I have to make a report for my boss to see. Only then will the boss decide how to handle it

Wed Apr 23 2025 04:56:04 GMT+0000 (Coordinated Universal Time)

Victim #266

In this situation, we need to first encrypt the files that were not encrypted before? And then decrypt?

Wed Apr 23 2025 05:09:52 GMT+0000 (Coordinated Universal Time)

Victim #266

I know that those VMDK files were not encrypted completely and were terminated during the encryption process

Wed Apr 23 2025 05:11:15 GMT+0000 (Coordinated Universal Time)

Victim #266

i nee make a report to my boss

Wed Apr 23 2025 05:17:35 GMT+0000 (Coordinated Universal Time)

Victim #266

get it

Wed Apr 23 2025 12:06:04 GMT+0000 (Coordinated Universal Time)

Victim #266

hello

Wed Apr 23 2025 12:10:54 GMT+0000 (Coordinated Universal Time)

Victim #266

The file you sent me, although the suffix has been removed, is still damaged

Wed Apr 23 2025 12:17:13 GMT+0000 (Coordinated Universal Time)

Victim #266

i ready check it ，bro

Wed Apr 23 2025 12:20:54 GMT+0000 (Coordinated Universal Time)

Victim #266

You can have your technicians detect it. It's exactly the same as before decryption, except that the suffix has been removed. Our technicians have compared the underlying sector code and it's exactly the same. Moreover, VMDK is unusable ,

Wed Apr 23 2025 12:22:27 GMT+0000 (Coordinated Universal Time)

Victim #266

This is very bad.

Wed Apr 23 2025 12:43:38 GMT+0000 (Coordinated Universal Time)

Victim #266

Wed Apr 23 2025 13:34:49 GMT+0000 (Coordinated Universal Time)

Victim #266

More than 90 percent of the files have this situation, and only a small amount of encryption is normal

Wed Apr 23 2025 13:36:28 GMT+0000 (Coordinated Universal Time)

Victim #266

no，The link you just sent me has been downloaded by me. It is no different from the previously encrypted and damaged file, except that there is no suffix

Wed Apr 23 2025 13:49:37 GMT+0000 (Coordinated Universal Time)

Victim #266

is still damaged

Wed Apr 23 2025 13:51:27 GMT+0000 (Coordinated Universal Time)

Victim #266

Did you see the compressed package I just sent you? It contains some virtual machines that I randomly inspected, and they all have such problems

Wed Apr 23 2025 13:52:53 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, I'm not lying to you. Over 90% of our virtual machines have such problems. They can neither be used nor decrypted. We only have a few, 5 to 6. The encryption of another branch seems normal, but the other 90% have problems

Wed Apr 23 2025 13:56:37 GMT+0000 (Coordinated Universal Time)

Victim #266

But we still have several others that we want to decrypt. Could they be cheaper

Wed Apr 23 2025 14:05:12 GMT+0000 (Coordinated Universal Time)

Victim #266

Including a NAS, which can be accessed through the windows system, but the office files inside have been encrypted by you

Wed Apr 23 2025 14:08:35 GMT+0000 (Coordinated Universal Time)

Victim #266

We just want to try our best to recover the losses

Wed Apr 23 2025 14:09:36 GMT+0000 (Coordinated Universal Time)

Victim #266

Just as we said before, some of us are normal, bro. You encrypted our data, which prevented us from working normally. But we still want to recover some losses. We are sincere

Wed Apr 23 2025 14:14:22 GMT+0000 (Coordinated Universal Time)

Victim #266

Since we have several ESXI machines, one of them seems normal, but the number of virtual machines on that one is not large. Moreover, we have a NAS with a lot of office documents that we want to decrypt. Considering the current situation, I would like to communicate sincerely with you. You take the money, and we will try to minimize the loss of some data. Is that okay

Wed Apr 23 2025 14:16:02 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, I'm very sincere and hope to reach an agreement with you. However, I hope we both need to make some concessions. Please communicate this matter with your boss and solve our problem

Wed Apr 23 2025 14:20:00 GMT+0000 (Coordinated Universal Time)

Victim #266

yes ，my friend

Wed Apr 23 2025 14:22:17 GMT+0000 (Coordinated Universal Time)

Victim #266

If I don't try my best to recover the losses, I will be fired by my boss，So I hope we can be honest with each other.I know what you need is money, but what we need is to lose as few virtual machines or files as possible It's better than losing everything, so I try my best to communicate with my boss about this matter

Wed Apr 23 2025 14:24:22 GMT+0000 (Coordinated Universal Time)

Victim #266

I know what you need is money, but what we need is to lose as few virtual machines or files as possible It's better than losing everything, so I try my best to communicate with my boss about this matter

Wed Apr 23 2025 14:25:24 GMT+0000 (Coordinated Universal Time)

Victim #266

From the very beginning, I sincerely wanted to cooperate with you. However, at present, our problem is very bad. Even though you have a lot of money and may look down upon our case, please help us. Thank you. We will keep all your affairs confidential. We just want to recover some losses

Wed Apr 23 2025 14:27:24 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, I don't want to lose my job. Also, please abide by your professional ethics and offer us help. Is that okay?

Wed Apr 23 2025 14:29:45 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, I have known some of you before. Through the Internet, you are very honest and have a good reputation.

Wed Apr 23 2025 15:01:47 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, I'm very sincere. Our boss hopes to solve some problems. Just like our previous routine, we should lose or be unable to decrypt many virtual machines. You should have seen that they cannot be decrypted.

Wed Apr 23 2025 15:03:40 GMT+0000 (Coordinated Universal Time)

Victim #266

Our boss has arranged for me to minimize the losses as much as possible. If the decryption cannot be done correctly, we will either replenish the data or create a new virtual machine. However, for those with normal suffixes, we want to decrypt them.

Wed Apr 23 2025 15:04:41 GMT+0000 (Coordinated Universal Time)

Victim #266

So, I would like to sincerely discuss with you whether a reasonable price can be set again. I don't want to be fired by the boss

Wed Apr 23 2025 15:05:43 GMT+0000 (Coordinated Universal Time)

Victim #266

We will ignore those damaged virtual machine files and try our best to recover some losses. Could you please help us，I'm also a poor wage earner

Wed Apr 23 2025 15:06:52 GMT+0000 (Coordinated Universal Time)

Victim #266

Because many of our files are damaged and I know he can't decrypt them, I beg you to reset a reasonable price. I will report to the boss again and try my best to meet your demands to reach an agreement

Wed Apr 23 2025 15:08:23 GMT+0000 (Coordinated Universal Time)

Victim #266

We have three esxi systems. Two of them have garbled file suffixes. The samples have also been sent to you. Indeed, their decryption cannot proceed normally. However, there is still one esxi whose suffix is normal. We want to decrypt it. If the price is too high, our boss will ask me to leave. So I would like to request you to reset a reasonable price. Regarding our current special circumstances,

Wed Apr 23 2025 15:11:17 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, please reply to me as soon as possible. I hope we can reach an agreement today, solve this matter, forget those bad things. You take the money and we can recover some losses

Wed Apr 23 2025 15:15:47 GMT+0000 (Coordinated Universal Time)

Victim #266

hello， ?

Wed Apr 23 2025 15:55:45 GMT+0000 (Coordinated Universal Time)

Victim #266

My boss is going to fire me. I want to reach an agreement with you as soon as possible and solve some problems. Is that okay?

Wed Apr 23 2025 16:15:10 GMT+0000 (Coordinated Universal Time)

Victim #266

hl

Wed Apr 23 2025 19:00:25 GMT+0000 (Coordinated Universal Time)

Victim #266

bro

Wed Apr 23 2025 22:07:24 GMT+0000 (Coordinated Universal Time)

Victim #266

different extensions are normal, let you send different extensions to decrypt and we will decrypt everything

Thu Apr 24 2025 02:48:02 GMT+0000 (Coordinated Universal Time)

Victim #266

Thu Apr 24 2025 02:50:06 GMT+0000 (Coordinated Universal Time)

Victim #266

However, I sent you a VMDK earlier. The file you sent back is still unusable and damaged,Our technicians compared the underlying hex code of the file. The file you sent back and decrypted is exactly the same as the original one, except that the suffix has been removed

Thu Apr 24 2025 02:51:20 GMT+0000 (Coordinated Universal Time)

Victim #266

Please check the attachment I just uploaded

Thu Apr 24 2025 02:53:24 GMT+0000 (Coordinated Universal Time)

Victim #266

We also found some issues. For some small files, their extensions are incorrect, but when I was asked to remove the file extension, it was not encrypted. However, for the large file VMDK, its extension is abnormal, and removing the file extension is bad. I sent one of them to you, but after you decrypted it, it was still the same as before and could not be used

Thu Apr 24 2025 02:55:15 GMT+0000 (Coordinated Universal Time)

Victim #266

Perhaps you are not the same person who sent the information to me earlier. Please take a look at the previous information. We have communicated and sent a VMDK virtual machine file. Its suffix is abnormal. You decrypted it and returned it, but it still cannot be used. Our technicians compared its underlying sector HEX code. It's exactly the same as before we sent it to you. The only difference is that the suffix has been removed

Thu Apr 24 2025 02:59:47 GMT+0000 (Coordinated Universal Time)

Victim #266

Please spend more time online. My boss has been scolding me

Thu Apr 24 2025 03:04:39 GMT+0000 (Coordinated Universal Time)

Victim #266

Thu Apr 24 2025 03:47:36 GMT+0000 (Coordinated Universal Time)

Victim #266

https://gofile.io/d/44I1S7 this LINK is you send me, i aready download, but files After you "decrypted" this file, it still couldn't be used. It was still damaged

Thu Apr 24 2025 03:48:52 GMT+0000 (Coordinated Universal Time)

Victim #266

So there are many problems with our encryption. We are waiting for your reply. Thank you

Thu Apr 24 2025 03:54:48 GMT+0000 (Coordinated Universal Time)

Victim #266

how long ， did you check my Two attachments

Thu Apr 24 2025 08:32:08 GMT+0000 (Coordinated Universal Time)

Victim #266

yes These two files are not encrypted. I just want to show them to you. They just have additional suffixes. Just remove them.

Thu Apr 24 2025 08:51:13 GMT+0000 (Coordinated Universal Time)

Victim #266

did you understand me? However, the VMDK you sent back yesterday was still broken after decryption. Our technician compared the hex values of its underlying sectors and found that they were exactly the same as those of the previously encrypted files, making it unusable

Thu Apr 24 2025 08:52:46 GMT+0000 (Coordinated Universal Time)

Victim #266

Moreover, for those virtual machine files with abnormal suffixes after encryption, we have retrieved the files from the VMDK disk through data recovery methods. Their underlying layer is only encrypted for approximately 700MB. Therefore, we can retrieve the data from those virtual machine disk files with abnormal encryption. However, this cannot start our original system and can only be reinstalled. So what I want to say is that this has brought us a lot of troubles.

Thu Apr 24 2025 08:56:16 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, to be honest, we have 3 to 4 ESXI servers. Among them, the suffix of one of them is normal after encryption. The virtual machine inside this esxi cannot be repaired and can only be decrypted with a secret key.

Thu Apr 24 2025 08:57:42 GMT+0000 (Coordinated Universal Time)

Victim #266

I'm very honest. The boss asked me to solve this matter. I really want to reach an agreement with you. I know that for many virtual machines, we extract the data inside through technical means ourselves, but we can't start the system. For the other one with normal encryption that cannot be repaired, we want to purchase the secret key to solve the problem. However, the number of its virtual machines is not large. Our boss wants you to make it cheaper. I'm very honest. I want to reach an agreement with you. I don't want to lose my job. Could you please reset a reasonable price for us

Thu Apr 24 2025 08:59:54 GMT+0000 (Coordinated Universal Time)

Victim #266

boss ?

Thu Apr 24 2025 09:14:40 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, we don't need to discuss the issue that the "decrypted" virtual machine file you sent back yesterday couldn't be used. Let's face a more direct problem. Let me put it directly. We have 3 to 4 esxi servers. For most of them, there are problems with their encryption. We have already started to recover the data from these vmdk files that have not been encrypted completely through a data recovery company. Among them, the virtual machine disk file encryption in one esxi server is correct. We want to buy a KEY for decryption. Besides, we also have a NAS and several windows office computers that we want to decrypt. So we want to spend a little less money.

Thu Apr 24 2025 09:23:57 GMT+0000 (Coordinated Universal Time)

Victim #266

Let's be straightforward. I'm very sincere. Please reset a reasonable price. I'll report to the boss immediately. Then if the boss agrees, we will make the payment to you. If not, I won't disturb you anymore

Thu Apr 24 2025 09:25:34 GMT+0000 (Coordinated Universal Time)

Victim #266

I will keep all your information confidential. I just want to keep my job, ok? thankyou for you reply

Thu Apr 24 2025 09:26:42 GMT+0000 (Coordinated Universal Time)

Victim #266

Let's face it bravely and sincerely, shall we

Thu Apr 24 2025 09:28:24 GMT+0000 (Coordinated Universal Time)

Victim #266

oh,

Thu Apr 24 2025 10:59:01 GMT+0000 (Coordinated Universal Time)

Victim #266

bro, Your 70K is too expensive, bro. Make it cheaper. Because many of our virtual machines do have problems. I can keep this a secret for you. I just want my boss to pay you quickly so that my work can proceed smoothly and keep my job.

Thu Apr 24 2025 11:02:53 GMT+0000 (Coordinated Universal Time)

Victim #266

After all, we will lose a lot of data. I know. I'm honest. However, I will keep these matters confidential

Thu Apr 24 2025 11:04:25 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, let's both take a step back, okay?

Thu Apr 24 2025 11:05:51 GMT+0000 (Coordinated Universal Time)

Victim #266

?

Thu Apr 24 2025 11:07:27 GMT+0000 (Coordinated Universal Time)

Victim #266

I'm not lying.

Thu Apr 24 2025 11:09:03 GMT+0000 (Coordinated Universal Time)

Victim #266

Many virtual machines are not encrypted. theny can recovery , I can allow you to view them remotely. Really.I'm just an employee of a company. There's no need for me to lie

Thu Apr 24 2025 11:10:37 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, don't misunderstand. I have no other ill intentions. It is indeed a machine with completely correct encryption.

Thu Apr 24 2025 11:13:23 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, as a staff member, if I want to solve the problem, the money is not paid by me. But I show my boss that I can indeed do something for the company. Just as I said before, but you don't believe me. Your encryption is indeed not completed, and we haven't. We have indeed fixed a lot, but some that can't be fixed want to be decrypted. Could it be cheaper? A small request

Thu Apr 24 2025 11:18:03 GMT+0000 (Coordinated Universal Time)

Victim #266

You have also seen before that some of the samples we provided did have problems after decryption. I didn't lie, nor was it necessary

Thu Apr 24 2025 11:19:36 GMT+0000 (Coordinated Universal Time)

Victim #266

bro, The last small request is 40K. If you agree, I'll report to our boss immediately,

Thu Apr 24 2025 11:22:41 GMT+0000 (Coordinated Universal Time)

Victim #266

Could you please discuss it with your boss?

Thu Apr 24 2025 11:23:47 GMT+0000 (Coordinated Universal Time)

Victim #266

Please discuss it with your boss Dear Mr. Hacker

Thu Apr 24 2025 11:44:56 GMT+0000 (Coordinated Universal Time)

Victim #266

oh, dear mr hacker, If our files with abnormal suffixes cannot be decrypted or are damaged, can we get a refund?

Thu Apr 24 2025 11:47:09 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, those income statements can be faked just to increase the company's external scale or influence.

Thu Apr 24 2025 11:48:16 GMT+0000 (Coordinated Universal Time)

Victim #266

oh, dear mr hacker, If our files with abnormal suffixes cannot be decrypted or are damaged, can we get a refund?

Thu Apr 24 2025 11:49:44 GMT+0000 (Coordinated Universal Time)

Victim #266

I know what you want is money and you are not short of it. But we are poorer than you. We are just making a small request regarding our current situation

Thu Apr 24 2025 11:50:54 GMT+0000 (Coordinated Universal Time)

Victim #266

I also hope you won't be angry. This is just a normal communication between you and me. I know you have a good credit record.

Thu Apr 24 2025 11:51:56 GMT+0000 (Coordinated Universal Time)

Victim #266

However, the encrypted vmdk we provided has not received a response from your technician. The VMDK you sent to us is still damaged and has no difference from the encrypted VMDK with garbled suffixes. It's just that its suffix has been removed

Thu Apr 24 2025 11:53:15 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, hearing you say so, you have your boss and I have mine. We are both wage earners. Of course, you might be richer and have a more stable job than me. I hope you can help me and offer a lower price so that I can settle accounts with my boss.

Thu Apr 24 2025 11:55:02 GMT+0000 (Coordinated Universal Time)

Victim #266

It's just this small request,

Thu Apr 24 2025 11:56:25 GMT+0000 (Coordinated Universal Time)

Victim #266

Mr hacker, help me, You make it symbolically cheaper.

Thu Apr 24 2025 11:57:44 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, could you please discuss it with your boss? Is 50K okay? It can't go any higher. This is our limit , If possible, we won't raise funds in time, You take the money and we decrypt the materials.

Thu Apr 24 2025 11:59:50 GMT+0000 (Coordinated Universal Time)

Victim #266

We are really sincere!

Thu Apr 24 2025 12:02:10 GMT+0000 (Coordinated Universal Time)

Victim #266

May I think that you are also the boss? Let's help each other. If possible, let's raise funds as soon as possible. This is our maximum limit

Thu Apr 24 2025 12:08:42 GMT+0000 (Coordinated Universal Time)

Victim #266

We have a little request. Could you please tell us the way you invaded, or where our vulnerability lies, and how to protect ourselves from being prevented from being attacked again by you or other ransomware

Thu Apr 24 2025 12:13:45 GMT+0000 (Coordinated Universal Time)

Victim #266

Dear Mr hacker

Thu Apr 24 2025 12:26:42 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, give us a lower price. I'll ask the boss to pay

Thu Apr 24 2025 12:40:38 GMT+0000 (Coordinated Universal Time)

Victim #266

50K ok?

Thu Apr 24 2025 12:41:53 GMT+0000 (Coordinated Universal Time)

Victim #266

i know, I know there will be a lot of losses after we decrypt it. I won't argue with you about this fact,Don't be angry either. If possible, I'll tell you the result of our decryption so that you can further correct your encryption method. He does have a little problem. Brother, you can ignore me. This is a fact, but please don't be angry

Thu Apr 24 2025 12:44:03 GMT+0000 (Coordinated Universal Time)

Victim #266

We have all discussed to this point and are almost close to reaching an agreement. Let's make a decision without hesitation. Could you please ask your boss?

Thu Apr 24 2025 12:45:27 GMT+0000 (Coordinated Universal Time)

Victim #266

I won't talk nonsense with you here. I'll try my best to make the boss meet your needs. But could you please make a little concession? I'll do my best.

Thu Apr 24 2025 12:46:39 GMT+0000 (Coordinated Universal Time)

Victim #266

55K pay think your boss or you are also reasonable people. Even if you make a concession of just one yuan, that would be your sincerity. I have already shown our sincerity!

Thu Apr 24 2025 12:49:51 GMT+0000 (Coordinated Universal Time)

Victim #266

60k, pay ,now,I know you are very busy, Nor do I want to waste each other's time,

Thu Apr 24 2025 12:51:04 GMT+0000 (Coordinated Universal Time)

Victim #266

You help me and I'll help you get the money quickly , It's that simple. Very good

Thu Apr 24 2025 12:52:28 GMT+0000 (Coordinated Universal Time)

Victim #266

i know you team ,You are very rich. it is great,

Thu Apr 24 2025 12:53:53 GMT+0000 (Coordinated Universal Time)

Victim #266

60k, pay ,now,I know you are very busy, Nor do I want to waste each other's time, Brother, this is almost close to our intention of cooperation.

Thu Apr 24 2025 12:55:02 GMT+0000 (Coordinated Universal Time)

Victim #266

We have raised from our 40K to 60K. It's sincere enough. Let's reach a cooperation.

Thu Apr 24 2025 12:56:19 GMT+0000 (Coordinated Universal Time)

Victim #266

And keep this incident absolutely confidential

Thu Apr 24 2025 12:57:26 GMT+0000 (Coordinated Universal Time)

Victim #266

Because we have comprehensively evaluated which encryption suffixes are garbled, even if you fail to decrypt them correctly, we won't cause you any trouble. If they are unable to decrypt them, I will give you feedback. Of course, we won't ask you to refund the money, nor will we damage your reputation

Thu Apr 24 2025 12:59:07 GMT+0000 (Coordinated Universal Time)

Victim #266

bro, 60K , let is do it fast, We are all straightforward people

Thu Apr 24 2025 13:00:21 GMT+0000 (Coordinated Universal Time)

Victim #266

I have told you all the big things I wanted to express. I won't do anything detrimental to your organization, and we will accept any bad results silently

Thu Apr 24 2025 13:01:26 GMT+0000 (Coordinated Universal Time)

Victim #266

let's do it my friend

Thu Apr 24 2025 13:02:32 GMT+0000 (Coordinated Universal Time)

Victim #266

okay how to pay you !

Thu Apr 24 2025 13:04:24 GMT+0000 (Coordinated Universal Time)

Victim #266

oh!

Thu Apr 24 2025 13:06:14 GMT+0000 (Coordinated Universal Time)

Victim #266

how to pay

Thu Apr 24 2025 13:07:36 GMT+0000 (Coordinated Universal Time)

Victim #266

BTC right?

Thu Apr 24 2025 13:15:58 GMT+0000 (Coordinated Universal Time)

Victim #266

0.6465 pls confrim

Thu Apr 24 2025 13:19:15 GMT+0000 (Coordinated Universal Time)

Victim #266

we We are preparing.

Thu Apr 24 2025 13:22:32 GMT+0000 (Coordinated Universal Time)

Victim #266

We have a little request. Could you please tell us the way you invaded, or where our vulnerability lies, and how to protect ourselves from being prevented from being attacked again by you or other ransomware

Thu Apr 24 2025 13:24:59 GMT+0000 (Coordinated Universal Time)

Victim #266

Could you just make a detailed report for me?

Thu Apr 24 2025 13:26:10 GMT+0000 (Coordinated Universal Time)

Victim #266

hello?

Thu Apr 24 2025 13:43:18 GMT+0000 (Coordinated Universal Time)

Victim #266

I also want to ask you. We have 3 to 4 esxi machines. It is undeniable that the first few numbers of their suffixes are the same. However, as I mentioned earlier, the suffixes of many virtual machines are chaotic and abnormal. I'd like to ask, do we need the ID in the README of each esxi server or is one readme sufficient?

Thu Apr 24 2025 13:46:31 GMT+0000 (Coordinated Universal Time)

Victim #266

I also want to ask you. We have 3 to 4 esxi machines. It is undeniable that the first few numbers of their suffixes are the same. However, as I mentioned earlier, the suffixes of many virtual machines are chaotic and abnormal. I'd like to ask, do we need the ID in the README of each esxi server or is one readme sufficient?

Thu Apr 24 2025 14:02:06 GMT+0000 (Coordinated Universal Time)

Victim #266

okay we will pay you

Thu Apr 24 2025 14:03:55 GMT+0000 (Coordinated Universal Time)

Victim #266

2 esxi readme (2IDS) 1 WINDOWS

Thu Apr 24 2025 14:07:42 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, I'll report the decryption result to you. Even though I'll pay, I still think there will be a lot of damage.

Thu Apr 24 2025 14:08:53 GMT+0000 (Coordinated Universal Time)

Victim #266

I just want to say that although we have reached a consensus, I think the documents will be damaged. This is not to deceive you and ask you to lower the price, did you understand me ?

Thu Apr 24 2025 14:10:03 GMT+0000 (Coordinated Universal Time)

Victim #266

we aready pay you, in process

Thu Apr 24 2025 14:11:05 GMT+0000 (Coordinated Universal Time)

Victim #266

i still hope you can help me,

Thu Apr 24 2025 14:15:24 GMT+0000 (Coordinated Universal Time)

Victim #266

pls check you wallet, we pay you success

Thu Apr 24 2025 14:16:33 GMT+0000 (Coordinated Universal Time)

Victim #266

What documents do I need to provide? 2 readme from 2 esxi, right, and 1 readme from windows,

Thu Apr 24 2025 14:17:35 GMT+0000 (Coordinated Universal Time)

Victim #266

pls check you wallet, we pay you success

Thu Apr 24 2025 14:19:04 GMT+0000 (Coordinated Universal Time)

Victim #266

what?

Thu Apr 24 2025 14:22:25 GMT+0000 (Coordinated Universal Time)

Victim #266

Thu Apr 24 2025 14:22:52 GMT+0000 (Coordinated Universal Time)

Victim #266

pls check ids Please check the file I just sent

Thu Apr 24 2025 14:23:56 GMT+0000 (Coordinated Universal Time)

Victim #266

no,

Thu Apr 24 2025 14:26:30 GMT+0000 (Coordinated Universal Time)

Victim #266

who is that

Thu Apr 24 2025 14:27:40 GMT+0000 (Coordinated Universal Time)

Victim #266

Vincent_Wen ? now i ready pay you , can you tell ?

Thu Apr 24 2025 14:29:01 GMT+0000 (Coordinated Universal Time)

Victim #266

The money was paid to you by me. Could you please tell me what you know?

Thu Apr 24 2025 14:30:11 GMT+0000 (Coordinated Universal Time)

Victim #266

you will be very grateful to us, we really don't have time for you I'll show you after I pay you what I mean. but this stays between you and me.

Thu Apr 24 2025 14:31:45 GMT+0000 (Coordinated Universal Time)

Victim #266

Where did you get these screenshots from?

Thu Apr 24 2025 14:36:53 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, I paid you the money. Should you tell me the truth?

Thu Apr 24 2025 14:38:04 GMT+0000 (Coordinated Universal Time)

Victim #266

so I'm very curious about what inside stories you know? Where did the screenshot come from and who is Vecent _Wen?

Thu Apr 24 2025 14:40:58 GMT+0000 (Coordinated Universal Time)

Victim #266

thank you very much my brother

Thu Apr 24 2025 14:42:06 GMT+0000 (Coordinated Universal Time)

Victim #266

you are good man bro

Thu Apr 24 2025 14:43:19 GMT+0000 (Coordinated Universal Time)

Victim #266

1740254448 $inox10ck IT d3303 but i dnt know what is this？

Thu Apr 24 2025 14:44:23 GMT+0000 (Coordinated Universal Time)

Victim #266

but i dont know what is this？

Thu Apr 24 2025 14:46:59 GMT+0000 (Coordinated Universal Time)

Victim #266

Please tell me directly. thx good man

Thu Apr 24 2025 14:48:10 GMT+0000 (Coordinated Universal Time)

Victim #266

Vencent _wen is your partner or your team ? or what?

Thu Apr 24 2025 14:49:19 GMT+0000 (Coordinated Universal Time)

Victim #266

We have already paid you. Why can't you tell me in detail? Did they register for your organization's backend and contact you?

Thu Apr 24 2025 14:51:02 GMT+0000 (Coordinated Universal Time)

Victim #266

Did you invade his computer?

Thu Apr 24 2025 14:52:10 GMT+0000 (Coordinated Universal Time)

Victim #266

So did you control his computer? And obtained some useful information?

Thu Apr 24 2025 14:53:25 GMT+0000 (Coordinated Universal Time)

Victim #266

I want to know if it was you who controlled Vencent_Wen's computer or if he contacted you?

Thu Apr 24 2025 14:54:35 GMT+0000 (Coordinated Universal Time)

Victim #266

no,no, brother, we aready pay you, dont do it,

Thu Apr 24 2025 14:55:41 GMT+0000 (Coordinated Universal Time)

Victim #266

we got to you through phishing, captured the domain, and then the admin host Vincent, I wonder if there is an insider in our company

Thu Apr 24 2025 14:56:49 GMT+0000 (Coordinated Universal Time)

Victim #266

Vincent _Wen's Has your phishing email or phishing network hit your computer?

Thu Apr 24 2025 14:58:23 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, first of all, I'm very grateful to you, but we have already spent a lot of money

Thu Apr 24 2025 15:01:46 GMT+0000 (Coordinated Universal Time)

Victim #266

thx

Thu Apr 24 2025 15:03:42 GMT+0000 (Coordinated Universal Time)

Victim #266

hi, Could you just make a detailed report for me?

Thu Apr 24 2025 15:18:17 GMT+0000 (Coordinated Universal Time)

Victim #266

We have a little request. Could you please tell us the way you invaded, or where our vulnerability lies, and how to protect ourselves from being prevented from being attacked again by you or other ransomware

Thu Apr 24 2025 15:21:14 GMT+0000 (Coordinated Universal Time)

Victim #266

can you write here?But before we made the payment, you promised us that you would tell me

Thu Apr 24 2025 15:22:29 GMT+0000 (Coordinated Universal Time)

Victim #266

I saw from the ransom letter that I could pay $777 to join you? May I ask what benefits there are after joining? What needs to be done? Could you give me some information?

Thu Apr 24 2025 15:24:01 GMT+0000 (Coordinated Universal Time)

Victim #266

i know, that we can contact boss?

Thu Apr 24 2025 15:31:06 GMT+0000 (Coordinated Universal Time)

Victim #266

thank you very much you r good man

Thu Apr 24 2025 15:33:03 GMT+0000 (Coordinated Universal Time)

Victim #266

how long time s i can get windows decryptor

Thu Apr 24 2025 15:44:24 GMT+0000 (Coordinated Universal Time)

Victim #266

hello i use the ESXI_decryptot on the linux cant decrypt May I ask if the decryptor you gave me is correct

Thu Apr 24 2025 16:07:38 GMT+0000 (Coordinated Universal Time)

Victim #266

ok i try

Thu Apr 24 2025 16:09:31 GMT+0000 (Coordinated Universal Time)

Victim #266

test done,

Thu Apr 24 2025 16:40:29 GMT+0000 (Coordinated Universal Time)

Victim #266

how long time i can get win decryptor

Thu Apr 24 2025 16:41:31 GMT+0000 (Coordinated Universal Time)

Victim #266

pls send window dectyptor to ohter chat room that is windows chat room! thx

Thu Apr 24 2025 16:53:56 GMT+0000 (Coordinated Universal Time)

Victim #266

my partner aready write you in windows chat room pls send win decrypt to that room

Thu Apr 24 2025 16:55:22 GMT+0000 (Coordinated Universal Time)

Victim #266

of cuse you can send it here thx very much my brother

Thu Apr 24 2025 16:56:36 GMT+0000 (Coordinated Universal Time)

Victim #266

any news

Thu Apr 24 2025 23:20:06 GMT+0000 (Coordinated Universal Time)

Victim #266

esxi and win not same support？

Thu Apr 24 2025 23:23:58 GMT+0000 (Coordinated Universal Time)

Victim #266

There are three situations where the suffix is incorrect. 1: The file itself is not encrypted. We can directly delete the suffix and the file can be used, or change it to the correct suffix and decrypt it without affecting its use. 2: When the encryption of a file is correct, we need to change its abnormal suffix to a normal one to decrypt it correctly. After the file is decrypted, it is normal. 3: If the file encryption process stops and the file is damaged, and we change it to a normal suffix, it will not be decrypted either, because the file itself is not fully encrypted and its encrypted information is incomplete, so it will not be decrypted

Fri Apr 25 2025 01:28:18 GMT+0000 (Coordinated Universal Time)

Victim #266

Most of our data is still damaged. Of course, this is just an objective response. The real situation is that a small amount of VMDK has been decrypted. Just as I said before, I'm not lying. I'm just giving you suggestions to update your encryption.

Fri Apr 25 2025 01:29:42 GMT+0000 (Coordinated Universal Time)

Victim #266

hi

Fri Apr 25 2025 11:16:05 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, I have obtained the encryption of the Windows system. Could you permanently close this chat window? Because there is too much information about the company in it.

Fri Apr 25 2025 11:48:17 GMT+0000 (Coordinated Universal Time)

Victim #266

hello

Fri Apr 25 2025 13:27:10 GMT+0000 (Coordinated Universal Time)

Victim #266

here？

Sat Apr 26 2025 10:46:25 GMT+0000 (Coordinated Universal Time)

Victim #266

There are three situations where the suffix is incorrect. 1: The file itself is not encrypted. We can directly delete the suffix and the file can be used, or change it to the correct suffix and decrypt it without affecting its use. 2: When the encryption of a file is correct, we need to change its abnormal suffix to a normal one to decrypt it correctly. After the file is decrypted, it is normal. 3: If the file encryption process stops and the file is damaged, and we change it to a normal suffix, it will not be decrypted either, because the file itself is not fully encrypted and its encrypted information is incomplete, so it will not be decrypted

Sat Apr 26 2025 11:10:03 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, I have obtained the encryption of the Windows system. Could y--- this

Sat Apr 26 2025 11:13:03 GMT+0000 (Coordinated Universal Time)

Victim #266

Brother, I have obtained the encryption of the Windows system. Could you permanently close this chat window? Because there is too much information about the company in it.

Sat Apr 26 2025 13:12:30 GMT+0000 (Coordinated Universal Time)

Victim #266

thanks

Sat Apr 26 2025 13:14:20 GMT+0000 (Coordinated Universal Time)

Victim #266

can you help me

Sat Apr 26 2025 13:17:54 GMT+0000 (Coordinated Universal Time)