Grishka

Member
  • Content Count

    11
  • Joined

  • Last visited

Community Reputation

0 Neutral

About Grishka

  • Rank
    Member

Recent Profile Visitors

The recent visitors block is disabled and is not being shown to other users.

  1. @GT500 Yes, I was expecting to find it there too but the only time you can see the word Buran is when you drag the encrypted file into notepad. Anyway, here is the .reg file.
  2. @GT500 Thanks, now I get it. There's a lot of stuff under HKEY_CURRENT_USER/SOFTWARE/ . Do you want me to export it all?
  3. @GT500 I do everything you mentioned, I press windows key + R, and I get Run box where I just paste the text and press Enter. The black command prompt blinks for a split second and that's it, no file on desktop. Is there a manual way to export it?
  4. @GT500 Unfortunately nothing happened, same result. Only the black command prompt screen blinked for a split second. No file on the desktop.
  5. @GT500 Nope, still nothing. I don't think I have that line in my registry. Might be called something else.
  6. @Amigo-A I know, it was a stupid thing to do. I should have know just by how small the file size is. I'm usually very careful with what I download. And now I have some of the important work files encrypted... 😭 @GT500 I did this but nothing happened, there is no file on Desktop.
  7. I don't have the file (it was deleted from Pirate Bay). All I know it was a zip file with setup.exe in it falsely named "AutoCAD_Architecture_2018.1.1___Keygen_-_[CrackzSoft]" . The link to that torrent is gone now but all I remember was that the size of it was no more than 24MB.
  8. Thanks! Here you go, ransom and encrypted file: https://www.sendspace.com/filegroup/E%2B9VQ4eD0EMLGhuvb7ECag
  9. Do you know if there is a paid decrypter that works?
  10. OK, I dragged the encrypted file into the notepad and the word on the first line was BURAN.
  11. Sure, Here is the link: https://id-ransomware.malwarehunterteam.com/identify.php?case=642df303785c204d04f6d9dcc88aba91ed4fc820
  12. I've never seen this one before. The files have a unique ending to my ID ( 36 characters and numbers). It looks like that for example : filename.jpgXXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX I've checked everywhere but nobody seems to have an encryptor to that. The .txt that comes with it is titled !!! YOUR FILES ARE ENCRYPTED !!! Please help anyone!