Core ransomware decryption