Agos

Thank you. It would appear that we'll have to deal with the criminals and try to pay some type of ransom....any advice other than - don't do it?

Please find link attached: https://id-ransomware.malwarehunterteam.com/identify.php?case=98f6300450626bf72f806a71211423a49bb7f4d3

I do not know if this helps at all, but an outbound event triggered by BURAN - Win.Trojan.Buran (Buran.exe) on our firewall went to IP 88.99.66.31 (in Germany) at the moment the servers were infected

I am an MSP. On August 1st we had an account breach on one of our Atera (MSP Software) accounts which resulted in the propagation of this crypto virus. Any assistance would be greatly appreciated. Attached is the information from just one machine, we have 4 or 5 other we'd like to get assistance with. Thank you in advance Sean scan_190810-160007.txt Addition.txt FRST.txt