{
  "chat_id": "AB0404E049514B50",
  "messages": [
    {
      "timestamp": "2025-04-10T23:16:50.760546Z",
      "content": "Where is the listing is step 1?",
      "party": "Victim"
    },
    {
      "timestamp": "2025-04-11T00:18:00.831244Z",
      "content": "tree.txt filesize:2352921",
      "party": "Attacker"
    },
    {
      "timestamp": "2025-04-11T00:18:16.513956Z",
      "content": "Here is the list of files.",
      "party": "Attacker"
    },
    {
      "timestamp": "2025-04-12T13:28:39.055759Z",
      "content": "We will work on getting you the 3 files",
      "party": "Victim"
    },
    {
      "timestamp": "2025-04-12T13:28:52.697488Z",
      "content": "How did you all get in?",
      "party": "Victim"
    },
    {
      "timestamp": "2025-04-12T13:32:40.055477Z",
      "content": "Data on the method of penetration and work within the network are provided only after successful completion of negotiations. We are waiting for your files to demonstrate the test decryption.",
      "party": "Attacker"
    },
    {
      "timestamp": "2025-04-13T03:05:19.964810Z",
      "content": "Will work on that too",
      "party": "Victim"
    },
    {
      "timestamp": "2025-04-14T18:40:51.565505Z",
      "content": "Please provide us with the following files:",
      "party": "Victim"
    },
    {
      "timestamp": "2025-04-14T18:41:07.665303Z",
      "content": "[Redacted].pdf [Redacted].xlsx [Redacted].xlsx",
      "party": "Victim"
    },
    {
      "timestamp": "2025-04-14T18:47:10.846028Z",
      "content": "[Redacted].xlsx filesize:1826490",
      "party": "Attacker"
    },
    {
      "timestamp": "2025-04-14T18:47:35.671018Z",
      "content": "[Redacted].pdf filesize:2490220",
      "party": "Attacker"
    },
    {
      "timestamp": "2025-04-14T18:48:11.168050Z",
      "content": "[Redacted].xlsx filesize:2774610",
      "party": "Attacker"
    },
    {
      "timestamp": "2025-04-14T18:48:48.901797Z",
      "content": "[Redacted].xlsx filesize:132809",
      "party": "Attacker"
    },
    {
      "timestamp": "2025-04-15T02:43:29.785757Z",
      "content": "We will check theses out.",
      "party": "Victim"
    },
    {
      "timestamp": "2025-04-15T18:57:07.383843Z",
      "content": "Is this everything you have? What are you wanting from us?",
      "party": "Victim"
    },
    {
      "timestamp": "2025-04-15T19:00:36.817314Z",
      "content": "Have you checked the decryption capability and made sure that we have the files?",
      "party": "Attacker"
    },
    {
      "timestamp": "2025-04-15T19:06:24.489669Z",
      "content": "We could only decrypt one file but it worked from what we could tell and you sent us the files we requested from the list provided.",
      "party": "Victim"
    },
    {
      "timestamp": "2025-04-15T19:09:07.493667Z",
      "content": "We can decrypt all the data back, and we will delete the data that is received from your network. The cost will be 500,000$",
      "party": "Attacker"
    },
    {
      "timestamp": "2025-04-16T16:29:53.615706Z",
      "content": "Is that file listing you sent earlier 100% of the files?",
      "party": "Victim"
    },
    {
      "timestamp": "2025-04-16T16:39:40.995198Z",
      "content": "This is the list that we have decided to share with you.",
      "party": "Attacker"
    },
    {
      "timestamp": "2025-04-17T01:53:31.530191Z",
      "content": "What percentage is it?",
      "party": "Victim"
    },
    {
      "timestamp": "2025-04-17T01:54:35.954113Z",
      "content": "This is the list that we have decided to share with you.",
      "party": "Attacker"
    },
    {
      "timestamp": "2025-04-17T15:43:03.343335Z",
      "content": "That is a lot of money when we don't know everything you have",
      "party": "Victim"
    },
    {
      "timestamp": "2025-04-17T15:51:09.306020Z",
      "content": "You have been provided with the necessary information. You can also see the countdown timer. Upon completion, the data will be published, and the decryption program will be deleted. You will not be able to recover data from recovery companies. After the timer expires, the decryptor will actually be deleted, and it will not be available for any money. These are standard terms and conditions, and you know it. The situation can be resolved quickly for the specified amount and continue working quietly. Think about it.",
      "party": "Attacker"
    },
    {
      "timestamp": "2025-04-17T18:48:28.757111Z",
      "content": "Is there any wiggle room in the amount? That would be a lot to try to produce by the time the timer reaches zero.",
      "party": "Victim"
    },
    {
      "timestamp": "2025-04-17T18:51:53.813026Z",
      "content": "Abstract conversation does not lead to success. Name the amount and the due date. And we will discuss it with you.",
      "party": "Attacker"
    },
    {
      "timestamp": "2025-04-18T19:28:05.857541Z",
      "content": "We are having internal conversations here but it would be helpful for you all to give us a better starting point on the price",
      "party": "Victim"
    },
    {
      "timestamp": "2025-04-18T19:32:21.405713Z",
      "content": "Starting point 500 000$",
      "party": "Attacker"
    }
  ]
}