Corey

GlobeImposter decryptor truncating files

Recommended Posts

Am trying to clean up a GlobeImposter encryption run, several files I checked appeared to have been recovered correctly but some programs fail to start.  Investigated, found that there are a number of files which have been truncated early.  For instance SqlServer.exe.config ends:

...
            </dependentAssembly>
        </assemblyBinding>
    </runtime>
</conf

Adding the rest of the closing tag lets the SQL server run, but similar truncation has happened on other files including the master.mdf file.  Without the last few bytes of these files I am unable to run the SQL server, which is going to be a major problem as it runs the payroll, accounting and ordering databases.

Files attached include one that appears to have decrypted correctly and two which appear to be truncated.

Any assistance with this would be greatly appreciated.

GlobeImposter fail.7z

Share this post


Link to post
Share on other sites

Looks like the issue is fixed.  Thank you Fabian, saved me a heap of headaches for today.

Sorry the files in the 7z archive were all in the same place.  Rushing at nearly midnight my time.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.