Please reference this case SHA1: a31ccbbb428230362a74ca9dee01c6c96757bac8
we have a second case with ransomware that I do not know... I have no ransom note yet - working on that - so I can not let ID Ransomware run on it.
I only have (many) corrupted files.
When I look at the data all .pdf, .ppt, .xls and .jg are ok. The virus only encrypted .doc(x) files.
Does this ring a bell?