{ "chat_id": "", "messages": [ { "party": "victim", "content": "hi we have crypted files,... can you help us?", "timestamp": "" }, { "party": "trinity", "content": "Hello, yes we can", "timestamp": "" }, { "party": "trinity", "content": "Price for 1 pc - 0.25 btc (bitcoin)", "timestamp": "" }, { "party": "victim", "content": "what do you need?", "timestamp": "" }, { "party": "trinity", "content": "You pay, we give you a decryption program.", "timestamp": "" }, { "party": "victim", "content": "How many just for one pc", "timestamp": "" }, { "party": "victim", "content": "How many just for one pc", "timestamp": "" }, { "party": "trinity", "content": "1 pc - 0.25 btc (bitcoin)", "timestamp": "" }, { "party": "trinity", "content": "Bitcoin wallet [redacted]", "timestamp": "" }, { "party": "victim", "content": "We are a Tunisian company", "timestamp": "" }, { "party": "victim", "content": "We do not have the support to pay in bitcoin because the tunisian state blocks this type of transaction", "timestamp": "" }, { "party": "victim", "content": "can you help us?", "timestamp": "" }, { "party": "trinity", "content": "SERVTUNISIE.[redacted].local\t[redacted]\tC:\\476 D:\\558 F:\\931\t[redacted]", "timestamp": "" }, { "party": "trinity", "content": "your coworkers have already bought two keys ask them or search for how to buy bitcoin in your country.", "timestamp": "" }, { "party": "trinity", "content": "[redacted]@gmail.com their mailing address", "timestamp": "" }, { "party": "victim", "content": "my boss is currently traveling, as soon as he returns, we will come back to you for a better solution", "timestamp": "" }, { "party": "victim", "content": "Please help us to recover some minimum documents", "timestamp": "" }, { "party": "trinity", "content": "price 0.25 bitcoin for 1 ID", "timestamp": "" }, { "party": "victim", "content": "hi, we would like \ninformation about uncrypt,, can i uncrypt file on other computer (of \ncourse if we pay) or it is only possible on orginal computer?", "timestamp": "" }, { "party": "victim", "content": "", "timestamp": "" }, { "party": "trinity", "content": "yes", "timestamp": "" }, { "party": "trinity", "content": "pay and we'll give you a decoder.", "timestamp": "" }, { "party": "trinity", "content": "the file can be decrypted on any computer", "timestamp": "" }, { "party": "victim", "content": "", "timestamp": "" }, { "party": "trinity", "content": "?", "timestamp": "" }, { "party": "trinity", "content": "when can I expect payment from you?", "timestamp": "" }, { "party": "victim", "content": "we have some problem to have bitcoin, in tunisia it is very difficult", "timestamp": "" }, { "party": "victim", "content": "and the value is very hight", "timestamp": "" }, { "party": "victim", "content": "we need only 2 files inside the PC it is possible to have only for it with discount price", "timestamp": "" }, { "party": "trinity", "content": "0.25 bitcoin minimum price", "timestamp": "" }, { "party": "trinity", "content": "wallet [redacted]", "timestamp": "" }, { "party": "victim", "content": "ok so 0.25 bitcoin is for one PC?", "timestamp": "" }, { "party": "trinity", "content": "yes", "timestamp": "" }, { "party": "victim", "content": "if i pay this evening, you send decryptor under 1 hours or no?", "timestamp": "" }, { "party": "trinity", "content": "yes", "timestamp": "" }, { "party": "victim", "content": "please confirme wallet", "timestamp": "" }, { "party": "trinity", "content": "[redacted]", "timestamp": "" }, { "party": "trinity", "content": "[redacted]", "timestamp": "" }, { "party": "victim", "content": "we have pay,...https://mempool.space/tx/[redacted]", "timestamp": "" }, { "party": "victim", "content": "we have pay,...https://mempool.space/tx/[redacted]", "timestamp": "" }, { "party": "victim", "content": "file crypted for define decryptor https://file.io/[redacted]", "timestamp": "" }, { "party": "trinity", "content": "10 min", "timestamp": "" }, { "party": "trinity", "content": "https://file.io/[redacted]", "timestamp": "" }, { "party": "trinity", "content": "password 123", "timestamp": "" }, { "party": "victim", "content": "we have problem my VHDX files are now uncrypted, but inside all files are always crypted?", "timestamp": "" }, { "party": "trinity", "content": "send me one file", "timestamp": "" }, { "party": "victim", "content": "https://file.io/[redacted]", "timestamp": "" }, { "party": "victim", "content": "please try to do fast", "timestamp": "" }, { "party": "trinity", "content": "SERVTUNISIE\t\n[redacted]\tC:\\476 D:\\558 F:\\931\t[redacted]...\t serveur-3cx\t\n[redacted]\t\t\t SERVTUNISIE\t[redacted]\tC:\\476 D:\\558 F:\\931\t\n[redacted]...\t SERVFICHIERTN\t[redacted]\tC:\\126 D:\\126 E:\\99.9 \nF:\\99.9 G:\\99.9 H:\\99.9 I:\\99.9 J:\\99.9 K:\\99.9 L:\\99.9 M:\\99.9 N:\\99.9 \nO:\\399 Q:\\99.9 R:\\2.99 T:\\109 U:\\126\t[redacted]...\t \nSERVTUNISIE.[redacted].local\t[redacted]\tC:\\476 D:\\558 F:\\931\t\n[redacted]...\t [redacted]\t[redacted]\tC:\\278 D:\\727 E:\\390 \nF:\\223 G:\\953 H:\\953 J:\\279 V\\5.4Tb\t[redacted]...\t \n[redacted]\t[redacted]\t\t\t [redacted]\t[redacted]\t\t\t \n[redacted]\t[redacted]\t\t[redacted]...\t [redacted]\t\n[redacted]\tC:\\278 D:\\727 E:\\390 F:\\223 G:\\953 H:\\953 J:\\279 V\\5.4Tb\t\n[redacted]...\t [redacted]\t[redacted]\t\t\t [redacted]\t\n[redacted]\tC:\\126\t[redacted]...\t [redacted]\t[redacted]\n\t\t\t [redacted]\t[redacted]\tC:\\126\t[redacted]...\t \nserv-data\t[redacted]\tC:\\476 D:\\279 E:\\953 F:\\1.86Tb G:\\1.86Tb H:\\250 \nI:\\109 J:\\199 K:\\126 L:\\299 M:\\59.9 O:\\558 P:\\299 Q:\\9.98 W:\\299\t\n[redacted]...\t \t\t\t\t \t\t\t\t [redacted]-[redacted]\t[redacted]\tC:\\237\t\n[redacted]...\t SERVFRANCE\t[redacted]\t\t\t FR-001\t[redacted]\t\nC:\\222\t[redacted]...\t [redacted]-[redacted]\t[redacted]\tC:\\222\t\n[redacted]...\t FR-010\t[redacted]\tC:\\137 D:\\100\t\n[redacted]...\t SERVEUR-3CX\t[redacted]\t\t\t \nPc-[redacted].[redacted].local\t[redacted]\t\t\t PC_TEST\t[redacted]\t\nC:\\140 E:\\465\t[redacted]...\t SERV-DATA\t[redacted]\t\t\t \nSERVFRANCE\t[redacted]\t\t\t Serveur-fichier\t[redacted]\t\t\t SAUVE-SERV\t\n[redacted]\tC:\\126 E:\\199\t[redacted]...\t SERVEUR-RDS\t\n[redacted]\t\t\t SERV-DATA\t[redacted]", "timestamp": "" }, { "party": "trinity", "content": "you have a lot of ID\n this file with a different key you didn't pay for it buy all remaining \nIDs at a discounted price 0.5 for all", "timestamp": "" } ] }