SHA-256: 9c79e2ef2c6f7f374789a61233071c87b5fe3d20cc26751ea8a14613bcc728fa

Cert -> [BEAR AND CILLA LTD] Thawte
Same Signer as Dridex 
Ref -> https://twitter.com/VK_Intel/status/1141323735829504000

[BACKUPS][DRIVES][SHARES][DESKTOP][NAMES][EXTENSION]xxxinstant[/EXTENSION][TARGETS]HRM,HTML[/TARGETS][ALLFILES][MESSAGE]Your network has been penetrated.

All files on each host in the network have been encrypted with a strong algorythm.
Backups were either encrypted or deleted or backup disks were formatted.
No free decryption software is available in the public.
Do not rename the encryted or informational text files. Do not move the encrypted or informational text files.
This may lead to the impossibility of recovery of the certain files.

To get the files in your network decrypted you should pay for the decryption software.
The price for the decryptor is based on the network size, number of employees, annual revenue. 
Please feel free to contact us for amount of BTC should be paid.

Some sensetive information was stolen from the file servers and will be uploaded 
in the public in case you won't pay us.

You should get in contact with us within 3 days after you noticed the encryption. 
If this doesn't happen the price is doubled after 3 days passed.

You should pay within 7 days since we receive the first email from you. 
If this doesn't happen the price is doubled after 7 days since first email.
You have unique idkey , write it in letter when contact with us.

                                  Contact information:

                          primary email: ______@cock.li

                          reserve email: ______@tutanota.com
                              
				  Your unique idkey:
{{IDENTIFIER}}[/MESSAGE][SANDBOXES][CIS][TASKNAME]winzip.exe[/TASKNAME][AUTOEXEC][PINGURL]iplogger.info/1GWhi7.gif[/PINGURL][PINGTIME]2[/PINGTIME][README]RECOVER ENCRYPTED FILES.TXT[/README][N]F91764364C130B5579DE5C9891890B0991156282A34793C9D1445C353160BD3DC34FD643386812778901DFF0278BB9FC64EA6670457FE65918060A7C4EA24017D9C70D2FBE3A929BD9DC412262CD2EEC0D6397BDE3FB275EA1E088555B207B20E77E75A87E1C68320FDD29162B6D7BCDF3E430F28242B36C222C6CBBAF31009E09B75D8A5A305BD0349AA4E97E68E493E3F83FBBCC1503FD87E70249EB2E0B2364838C6B16B311381ABD63FD13695F8DB59601C0E7C168AE79F8987A668335EA3B743C83FE1F6524E6DAD488579D6E3EE0673C3D49331A849136BFC72BEF7692822DB794757DD11F6CF64DE10DC431C3A5AB84048ABF53CF4F73FEDF69F3DB9AF[/N][E]260D751178A33BDC5FFBA86DAD05954ACAB24F36DD29B5D45CD1941923EB7465E6B9035550E7F9E89EC1148EF8FFBFECDFAC4D50A2DBA96877EE9B4BCF5820155FD172E8C45472D85B9DBEA9D1568B2146A3FF39A2AA8982B3FBE993B8FB18C76B5A8BE2D3D28E8EDC6E22B6FCB75FF3BC4C19A9B9D14640659DA75B5F10F6461770D9236D60E9DC6CC3564977C3072C1B86B8D10E91809C967C4711577EF79139C136E7C0C1AB1AD001FCEB0503389524095B021B32D940774BDBD69638645341676E18D82BEB9F1CF26C4149AE51F3C0F9922443C331B5F4F8A03CFD0929E60A8C25A3DEF987839714667932C23C5FC9E363823380EF84DC0A142A3F7C5215B[/E]