List of notes

INC-README2.txt

Inc. Ransomware

We have hacked you and downloaded all confidential data of your company and its clients.
It can be spread out to people and media. Your reputation will be ruined.
Do not hesitate and save your business.

Please, contact us via:
http://incpaysp74dphcbjyvg2eepxnl3tkgt5mq5vd4tnjusoissz342bdnad.onion/

Your personal ID:
[snip]

We're the ones who can quickly recover your systems with no losses. Do not try to devalue our tool - nothing will come of it.

Starting from now, you have 72 hours to contact us if you don't want your sensitive data being published in our blog:
http://incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion/

You should be informed, in our business reputation - is a basic condition of the success.

Inc provides a deal. After successfull negotiations you will be provided:
1. Decryption assistance;
2. Initial access;
3. How to secure your network;
4. Evidence of deletion of internal documents;
5. Guarantees not to attack you in the future.

Instruction how to get to chat page:
1. Download TOR Browser from official website (https://www.torproject.org/download/);
2. Install TOR Browser and open it;
3. Copy chat link and press enter;
4. On the page you will need to register your account using your personal ID;
5. Use this ID and your password to get chat page again.

INC-README.html

<html>
<head>
<title>Inc. Ransomware</title>
</head>
<body style="width: 100%; height: 100%; display: flex; flex-direction: column; justify-content: center; align-items: center; overflow: auto;">
<div style="max-width: 500px; ">
<h1 style="text-align: center;">Inc. Ransomware</h1>
<div>
<p>We have hacked you and downloaded all confidential data of your company and its clients. It can be spread out to people and media. Your reputation will be ruined. Do not hesitate and save your business.</p>
<p>Please, contact us via:</p>
<p style="margin-left: 32px;">http://incpaysp74dphcbjyvg2eepxnl3tkgt5mq5vd4tnjusoissz342bdnad.onion/</p>
<div>
<div>
<p>Your personal ID:</p>
<p style="margin-left: 32px;">[snip]</p>
<div>
<div>
<p>We're the ones who can quickly recover your systems with no losses. Do not try to devalue our tool - nothing will come of it.</p>
<p>Starting from now, you have 72 hours to contact us if you don't want your sensitive data being published in our blog:</p>
<p style="margin-left: 32px;">http://incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion/</p>
<p>You should be informed, in our business reputation - is a basic condition of the success.</p>
<div>
<div>
<p>Inc provides a deal. After successfull negotiations you will be provided:</p>
<ol>
<li>Decryption assistance;</li>
<li>Initial access;</li>
<li>How to secure your network;</li>
<li>Evidence of deletion of internal documents.</li>
</ol>
<div>
</div>
</body>
</html>

INC-README.txt

Inc. Ransomware

We have hacked you and downloaded all confidential data of your company and its clients.
It can be spread out to people and media. Your reputation will be ruined.
Do not hesitate and save your business.

Please, contact us via:
http://incpaysp74dphcbjyvg2eepxnl3tkgt5mq5vd4tnjusoissz342bdnad.onion/

Your personal ID:
[snip]

We're the ones who can quickly recover your systems with no losses. Do not try to devalue our tool - nothing will come of it.

Starting from now, you have 72 hours to contact us if you don't want your sensitive data being published in our blog:

http://incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion/

You should be informed, in our business reputation - is a basic condition of the success.

Inc provides a deal. After successfull negotiations you will be provided:

1. Decryption assistance;
2. Initial access;
3. How to secure your network;
4. Evidence of deletion of internal documents;
5. Guarantees not to attack you in the future.