stuff

http://telesolutionsconsultants.com/y872ff2f
y872ff2f	:	0d0823d9a5d000b80e27090754f59ee5

C2:
83.217.8.61
31.202.130.9
91.234.35.106


Traffic_observed:
http://91.234.35.106/checkupdate

Onion:
g46mbrrzpfszonuk.onion


Delete_Shadow Copy :
    <Exec>
      <Command>C:\Windows\system32\vssadmin.exe</Command>
      <Arguments>Delete Shadows /Quiet /All</Arguments>
    </Exec>
  </Actions>
</Task>


Ransom_Note:


|~~||.._-*+=~.+-*~|
$.*=~~+
*~=$__$-=+.+_.+.=+._
            !!! IMPORTANT INFORMATION !!!!

All of your files are encrypted with RSA-2048 and AES-128 ciphers.
More information about the RSA and AES can be found here:
    http://en.wikipedia.org/wiki/RSA_(cryptosystem)
    http://en.wikipedia.org/wiki/Advanced_Encryption_Standard

Decrypting of your files is only possible with the private key and decrypt program, which is on our secret server.
To receive your private key follow one of the links:


If all of this addresses are not available, follow these steps:
    1. Download and install Tor Browser: https://www.torproject.org/download/download-easy.html
    2. After a successful installation, run the browser and wait for initialization.
    3. Type in the address bar: g46mbrrzpfszonuk.onion/ID
    4. Follow the instructions on the site.

!!! Your personal identification ID: ID !!!
--_$_**
$~*==*=_=__+_|$_-~$$

Extension:
.diablo6