Core ransomware decrypt