Any files that are encrypted with CryptXXX Ransomware
will have the .crypt
extension appended to the end of the affected filename and leave files (ransom notes) named de_crypt_readme.txt, de_crypt_readme.html, de_crypt_readme.bmp, de_crypt_readme.png. CryptXXX 2.x/3.x variants will leave unique Personal ID files using random 12 hexadecimal characters with names like <id-number>.html, <id-number>.txt, <id-number>.bmp (i.e. S45CC72F3463.txt, !4AD604B8AE89.txt), !Recovery_<id-number>.html, !Recovery_<id-number>.txt, !Recovery_<id-number>.bmp (i.e. !Recovery_4582C8FAEB15.txt).
A repository of all current knowledge regarding CryptXXX / UltraDeCrypter
is provided by Grinler
(aka Lawrence Abrams), in this topic: CryptXXX Ransomware Help, Information Guide and FAQ
Rather than have everyone with individual topics, it would be best (and more manageable for staff) if you posted any more questions, comments or requests for assistance in the above support topic discussion noted by Demonslay335.
To avoid unnecessary confusion, this topic is closed.
The BC Staff