Hlas ransomware: what it is and whether .hlas files can be restored
Hlas ransomware is a STOP/Djvu variant that locks your files, adds .hlas to their names and leaves _readme.txt asking $999. Remove it first, then try Emsisoft's free decryptor on copies, because it only works if your files used an offline key.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Make sure nothing will rename more files to .hlas: an automatic scan checks the PC first.
Do it yourself · free Remove Hlas ransomware yourself 6 steps, about 18 minutes, no software needed.
Start the steps
Hlas ransomware: summary
| Type | File-encrypting ransomware (STOP/Djvu): locks the start of each file and adds .hlas |
|---|---|
| Risk | High: files are usually locked with a key only the attackers hold; password stealers may arrive with it |
| Symptoms | Files end in .hlas and will not open, _readme.txt in folders, a $999 demand |
| How to get rid of it | Disconnect, run Microsoft Defender Offline, try Emsisoft's decryptor on copies, then backups; see the plan |
| Our check | Source check on 6 October 2026 (PCrisk, Emsisoft, Microsoft Learn); we did not run the malware |
| First seen | 10 September 2024 (PCrisk); our report 16 September 2024; the STOP/Djvu family is older |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 14 more facts
| Encrypted file extension | .hlas |
|---|---|
| Ransom note | _readme.txt: $999, or $499 within 72 hours |
| Decryptor | Emsisoft's STOP Djvu decryptor, only for files locked with an offline key; not confirmed for .hlas |
| Contact | support@freshingmail.top; datarestorehelpyou@airmail.cc |
| Detection names | Microsoft: Trojan:Win32/GCleaner.ARR!MTB; Avast: Win32:BotX-gen [Trj]; Bkav Pro: W32.AIDetectMalware; ESET: A Variant Of Win32/Kryptik.HXVE; Kaspersky: HEUR:Trojan-Ransom.Win32.Stop.gen |
| Damage | Files locked at the start; stealers such as RedLine and Vidar may come with it |
| Name | Hlas ransomware |
| Evidence | One write-up by a security site; no sample analysed yet |
| Encrypted files | .hlas |
| Attacker contacts | support@freshingmail.top |
| Free decryptor | No free decryptor is known (checked 6 October 2026) |
| Microsoft Defender name | Trojan:Win32/GCleaner.ARR!MTB |
| Distribution | Typically cracked programs, keygens and game cheats, fake installers, e-mail attachments, and Remote Desktop with weak passwords in small offices |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against PCrisk's Hlas and Djvu pages, Emsisoft's STOP Djvu page, Microsoft Learn and our own 2024 screenshots. We did not run the malware.
What Hlas ransomware is
- Family
- STOP/Djvu, as PCrisk classes it
- Extension
.hlasis added after the old ending:1.jpgbecomes1.jpg.hlas- Note
_readme.txt(our 2024 report wrote it in capitals; Windows treats both the same), left in the folders that hold locked files- Price in the note
- $999, or $499 if the attackers are written to within 72 hours; no currency is named
- Sample in our screenshot
ihfk.exe, 743.00 KB, flagged by 58 of 71 engines on VirusTotal- SHA-256 of that sample
8e0af41e4df32ae3ff4b55cc8f8aedb389edb886dc65d577a5ac92aeda4a3039- First reported
- 10 September 2024 (PCrisk); our guide followed on 16 September 2024
Hlas locks personal files and asks money for a key. It is one of dozens of near-identical STOP/Djvu releases, so what happens to your files depends on the type of key it used.
How the Hlas story went
August 2019
Old and new Djvu
PCrisk describes an older version that used a built-in offline key when the PC could not reach the attackers. The encryption was changed in August 2019, and Emsisoft says its file-pair method does not apply to the new version.
18 October 2019
Emsisoft's decryptor
Emsisoft's STOP Djvu page is dated this day (version 1.0.0.5). It states that files can be decrypted if they were locked with an offline key that Emsisoft has.
Emsisoft's decryptor page as it looked in our 2024 guide: version 1.0.0.5, the Salsa20 description and the offline-key rule. 10 September 2024
PCrisk writes up .hlas, and so do we
PCrisk publishes its Hlas page on 10 September 2024 and our first report follows on 16 September 2024.
6 October 2026
Our recheck
We reread PCrisk's Hlas and Djvu pages, Emsisoft's decryptor page and the Microsoft commands used on this page, and rebuilt the guide around them.
What we checked and what we did not
Hlas ransomware · source check · 6 October 2026
- Ransom note textOur 2024 screenshot of the note in Notepad matches the text PCrisk prints.
- Sample detectionsOur VirusTotal screenshot shows 58 of 71 engines flagging
ihfk.exe, with the popular label trojan.stop/gcleaner. - Offline or online key for .hlasNot confirmed. No source we read says which key type .hlas files use, and Emsisoft's page does not list the extension.
- Shadow copies, registry, security softwareNot confirmed. No source we read says that Hlas deletes shadow copies, edits the registry or switches off security software.
- The steps on this pageNot tested by us on an infected PC. They follow Microsoft Learn and Emsisoft's own page. We did not run the malware, and a website test does not apply to ransomware.
Probably not decryptable for free Most Djvu victims have a key only the attackers hold. Treat the files as locked until Emsisoft's tool says otherwise or you restore from a backup.
What antivirus programs call Hlas ransomware
Microsoft Defender reports Hlas ransomware as Trojan:Win32/GCleaner.ARR!MTB.
In a Defender name, the part before the colon is the category, the part after it is the platform, and the part after the slash is the family Microsoft assigned. A suffix after ! is an internal Microsoft marker, not a different threat.
Generic labels such as Agent, GenericKD or Malware.AI only say that a file looks malicious, not what it does; our guide to antivirus detection names shows how to read them.
- File extension:
.hlas - Note file:
_readme.txt - Contact:
support@freshingmail.top
How Hlas ransomware behaves
What it does on the PC, step by step
- 1
You start a program that looks harmless
PCrisk says Djvu operators hide the program in pirated software, cracking tools, key generators and fake pages that offer free content such as YouTube downloads. Our old guide added e-mail attachments, ZIP archives and Office macros as routes.
- 2
A library is loaded and the code waits
PCrisk reports that the ransomware loads a library called
msim32.dll, whose purpose is unknown, uses delays and looks up Windows functions as it runs, to avoid detection. Our VirusTotal screenshot tags the samplelong-sleeps,persistenceandspreader. - 3
A copy is hidden inside another process
The technique is called process hollowing: a normal-looking process is started and the ransomware's code is run inside it.
- 4
Your files are locked
Pictures, databases, documents and other files get
.hlasadded to their names. PCrisk says Djvu encrypts only the start of a file, which is enough to make it unusable. - 5
The note is written
_readme.txtappears in each folder that holds locked files, with two e-mail addresses and an empty line for your personal ID. - 6
More malware may arrive with it
PCrisk warns that Djvu is often delivered with information stealers such as RedLine or Vidar, so saved passwords are at risk.
What the note demands
| Item | What the note says | What it means |
|---|---|---|
| Price | $999 for a private key and a decrypt tool | The note names no currency. PCrisk says ransoms of this kind are usually asked in bitcoin. |
| Discount | 50 percent off ($499) if you write in the first 72 hours | A clock meant to rush you. Nothing about your files changes after three days. |
| Free test | One encrypted file, without valuable content, is decrypted for free | At most this shows a key exists. It does not show the attackers will sell it to you. |
| Warning | Do not ask YouTube helpers or recovery sites, they may use up the free quota and scam you | The attackers want to be your only contact, so every other source of help is called a scam. |
| Contact | Two e-mail addresses, and a personal ID you must quote | Both addresses are printed in the quote below; writing to them only starts the pressure. |
| Threat | You will never restore your data without payment | Not true for every victim: backups, and rarely a free decryptor, can bring files back. |
How it reaches PCs
- High
Pirated software and cracking tools
PCrisk lists pirated software, cracking tools and key generators first. Torrent and file-sharing sites have no checks, which makes them an easy place to hide a Djvu program.
- Medium
Fake free-content pages
PCrisk names pages that offer free content such as YouTube video downloads. The program the page asks you to run is the ransomware.
- Medium
E-mail attachments and macros
An executable, a ZIP archive or an Office document with macros, sent by e-mail. Our old guide called this the most usual case; PCrisk lists attachments and links among the routes.
- Medium
Ads, outdated software and support scams
PCrisk adds malicious ads, flaws in outdated systems, technical support scams and third-party downloaders.
- Low
Trojans, worms and a fake Windows update
Our old guide said trojans or worms could let it in unseen and that it can pose as an update. We found neither in any source for Hlas, so both stay unconfirmed.
What to do in the first hour
- 1
Cut the PC off the network
Unplug the cable or turn Wi-Fi off. That stops the malware from reaching shared folders and other PCs and from talking to anything outside. Our old guide's route: type Control Panel into Windows search, open Network and Internet > Network and Sharing Center.
- 2
Open the adapter list
On the left, choose Change adapter settings.
- 3
Disable the connection
Right-click your connection, for example Ethernet or Wi-Fi, and choose Disable.
- 4
Eject drives and pause cloud sync
A backup that stays plugged in can be locked too. Eject USB drives and pause OneDrive, Dropbox or Google Drive syncing.
- 5
Keep the note and one small locked file
Copy
_readme.txtand one small.hlasfile to a USB stick. You need them for the decryptor test and for any police report. - 6
Do not write to the e-mail addresses
Writing to them starts the 72-hour clock and tells them somebody is reading.
- 7
Scan from outside Windows
Open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan and press Scan now. Save your work first: the PC restarts and the scan takes about 15 minutes (Microsoft). Do not try manual removal, which takes advanced skill and can do further damage.
System damage and stolen passwords
- 1
Change your passwords from a clean device
Start with e-mail, banking and cloud accounts and turn on two-step sign-in. PCrisk says Djvu comes with stealers like RedLine and Vidar, and they take saved passwords.
- 2
Check the hosts file
Open Notepad as administrator, open
C:\Windows\System32\drivers\etc\hostsand set the file type to All files. Lines that are not comments (#) and that point security or malware-removal sites to another address can be deleted. PCrisk's Djvu page reports such entries for some Djvu versions; no source says Hlas adds them, so this is a check, not a finding.
| Old claim | Status | Our reading |
|---|---|---|
| Installing malware causes crashes and errors | Not confirmed | No source we read describes crashes caused by Hlas. |
| A PC repair program fixes the damage | Dropped | A promotion for a product. A Defender offline scan is the documented check. |
| Security scans cannot restore the files | Correct | A scan removes the program, not the lock on your files. |
The Hlas ransomware note
ATTENTION!
Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files.
What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information.
Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you.
Our contact is emails in this text document only.
You can get and look video overview decrypt tool: [link omitted]
Price of private key and decrypt software is $999.
Discount 50% available if you contact us first 72 hours, that's price for you is $499.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.
To get this software you need write on our e-mail: support@freshingmail.top
Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc
Your personal ID: [empty in our screenshot]
Can Hlas ransomware files be decrypted?
Can .hlas files be decrypted?
| What Emsisoft's decryptor shows | What it means | Next step |
|---|---|---|
| The files are listed as decrypted | They were locked with an offline key that Emsisoft has | Copy them to another drive and open a few |
| Error: Unable to decrypt file with ID | An offline key that Emsisoft does not have yet | Keep the locked copies and try again in a few months |
| This ID appears to be an online ID, decryption is impossible | A key made for you alone and held only by the attackers | Go to backups and the recovery steps further down |
- 1
Finish the clean-up first
A program that is still on the PC can lock the files again, and a decrypted folder would be wasted.
- 2
Work on copies
Copy the
.hlasfiles to another drive before you try anything. A failed run can damage a file. - 3
Download the tool from Emsisoft only
Use the STOP Djvu page on emsisoft.com. Our 2024 guide named the downloaded file
decrypt_STOPDjvu.exe. Open it and press Yes when User Account Control asks. - 4
Accept the licence terms and the disclaimer
Press Yes on the licence terms, then OK on the disclaimer. The licence says the software comes without any warranty.
- 5
Choose the folders and press Decrypt
The tool lists the drives it found. Remove what you do not need, use Add folder for others, and press Decrypt.
Do
- Take the tool from Emsisoft's own site
- Keep the locked files until the decrypted ones open
Don't
- Do not pay anyone who sells a Hlas unlocker
- Do not rename
.hlasfiles by hand - Do not expect a scan to unlock anything
Scans, renamed files and a reinstalled Windows do not bring files back: the keys are not on your disk.
Should you pay the ransom?
- High
You can pay and get nothing
Many victims report further demands, tools that were never sent or files that stayed locked. The free test file shows only that a key exists.
- High
Your money pays for the next variant
The payment funds people who release a new Djvu extension every week or so, so paying keeps the cycle going.
- Medium
The discount is a timer
The $499 offer for the first 72 hours is built to rush you. Try backups and the free tool before you write to anyone.
How to remove Hlas ransomware
Tools you'll need
All of these are free except where noted. Download them on a clean device if the infected PC is offline.
- A USB stick: to keep the ransom note, two or three encrypted files and screenshots off the infected PC.
- Microsoft Defender Offline: built into Windows 11 and Windows 10; scans before Windows starts, so running malware cannot hide.
- Microsoft Safety Scanner: a second, portable scanner with current signatures; each download works for 10 days.
- ID Ransomware: identifies the family from the note and one encrypted file and says whether a decryptor exists.
- No More Ransom: the free decryptors from police and security companies; check it again every few months.
- Fortect (optional): scans Windows for malware and repairs the system files and settings it damaged. The free scan is in the box above.
How to remove Hlas ransomware and get your files back
Work in this order.
Disconnecting comes first, removal comes before any restore, and nothing here asks you to contact the attackers.
Step 1: Disconnect the PC and unplug backup drives
Unplug the network cable or turn off Wi-Fi, and disconnect USB drives, external disks and network shares, so Hlas ransomware cannot reach more files. Pause OneDrive, Google Drive or Dropbox sync, because synced folders upload the encrypted copies over the good ones.
Leave the PC on but offline while you read the next steps, since a restart can let the ransomware run again. This applies to Windows 11 and Windows 10 alike.
Windows 11: turn off Wi-Fi to take the PC offline. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 2: Save the ransom note and confirm the family
Your files now end in
.hlasand the instructions are in_readme.txt. Save both to a USB stick, a copy of the note and two small encrypted files, before anything else.On another device, check them with ID Ransomware or Crypto Sheriff: the family name decides which decryptor, if any, can help. Keep the note's ID and contact line for your report.
Windows 11: the ransom note and encrypted files to copy for identification. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 3: Check for a free decryptor
Our last check found that for Hlas ransomware, no free decryptor is known (checked 6 October 2026). Look again yourself in the No More Ransom list and the free decryptor pages of Emsisoft, Avast and Kaspersky, which add new families every year.
A decryptor needs the ransomware gone first, or it encrypts the files again. Keep at least one copy of the encrypted files on an external drive, even if no tool works yet.
Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 4: Remove the ransomware before you restore or decrypt
Removing Hlas ransomware does not bring the files back, but it has to come first. Start with Defender's Full scan, then the offline scan from the same Scan options page, which checks the disk before Windows loads.
If the scan cannot start, use Safe Mode with Networking. Delete the ransom notes only after you have saved a copy, because removal tools sometimes leave them behind on Windows 11 and Windows 10.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Look for shadow copies of the files
Windows keeps shadow copies for restore points and backups, and some ransomware fails to delete them.
vssadmin list shadowsin an administrator Command Prompt tells you at once whether any exist.If they do, right-click the folder that held your files, open Properties > Previous Versions, select a version from before the attack, and click Open to check it before you Restore or copy the files out. Windows 11 and Windows 10 both have the tab.
Windows 11: vssadmin list shadows shows whether shadow copies exist. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 6: Restore the files from a backup or recover deleted originals
A backup made before the attack is the surest way back. Connect it only once the PC is clean, then restore from File History, Windows Backup, OneDrive's Restore your OneDrive or your own external copies.
Without a backup, try file recovery: the originals that Hlas ransomware deleted may still be on the disk until something overwrites them. Install nothing new on the drive you want to recover from on the Windows 11 or Windows 10 PC.
Full procedure with screenshots: Recover deleted files (Recycle Bin, backups, OneDrive) On uGetFix
Report it and recover your files
Report it
Report the attack even if you do not expect the files back: insurers and banks ask for the report number, and police use the contacts in the note to link cases.
- United States
- FBI IC3 · FTC ReportFraud
- United Kingdom
- Report Fraud (formerly Action Fraud) · NCSC
- Australia
- ReportCyber (ASD)
- EU countries
- Europol: national reporting sites
Give the victim ID, the note and the date the files were encrypted. A business that holds personal data may also have to notify its data protection authority, in the EU within 72 hours.
If decryption does not work: other ways to get files back
- 1
Your own backups
Without a backup nothing is guaranteed. Use an external drive, a NAS or cloud copy that was not connected during the attack, and test a few files before you delete the locked ones.
- 2
Version history in the cloud
OneDrive, Dropbox and Google Drive keep earlier versions of files. Restore a version dated before the infection from the service's website.
- 3
Previous Versions and shadow copies
Right-click a folder, choose Properties > Previous Versions (on Windows 11 choose Show more options first). As administrator run
vssadmin list shadows; Microsoft documents it as the command that lists all existing shadow copies. If nothing is listed, there is nothing to restore. - 4
A file-recovery program on the deleted originals
Some victims told PCrisk they got part of their data back with CGSecurity's free PhotoRec. Our 2024 guide showed a commercial recovery program with the same idea: choose which folders to search, turn on Deep scan and pick the disks, wait for the scan, tick the files or search by name, then Recover them to a different drive. Expect only part of the files.
- 5
Media_Repair for audio and video
Because only the start of a Djvu file is locked, PCrisk points to DiskTuna's free Media_Repair: the start is lost, but much of the rest can play again.
- 6
Keep the locked files
Free decryptors sometimes appear later. The No More Ransom project lists them by family; check again every few months.
- 7
Report it
PCrisk lists ic3.gov and stopransomware.gov for the United States and your national police or CERT elsewhere. Keep
_readme.txtfor the report.
Back up with the 3-2-1 rule
| Number | Rule | Example |
|---|---|---|
| 3 | Three copies of every file you cannot replace | The working file plus two backups |
| 2 | Two kinds of storage | Your disk and a USB drive |
| 1 | One copy away from the PC | An unplugged drive in a drawer, or cloud storage with version history |
Do
- Back up the encrypted files themselves too, before any recovery attempt
- Unplug a USB drive after each backup
- Open a file from the backup now and then to prove it works
Don't
- Do not leave the only backup plugged in all the time
- Do not keep the backup in a folder that cloud sync mirrors without version history
How to prevent Hlas ransomware and the next attack
Do
- Download software from its maker's website or an official store
- Keep Windows, your browser and Microsoft Defender updated, with automatic updates on
- Treat an unexpected e-mail attachment or link as unsafe
- Run a full scan after you open anything unusual, because some downloads hide malware that basic checks like file size will not reveal
- Optional: G DATA's STOP/Djvu vaccine from GitHub, which PCrisk says prevents the encryption (we have not tested it)
Don't
- Do not install cracks, key generators or free copies of paid programs
- Do not use sites that offer free video downloads and ask you to run a program
- Do not use torrent or P2P sites for software
- Do not click ads, pop-ups or fake update prompts
Questions about Hlas ransomware
How do I open .hlas files?
You cannot open them as they are, because the start of each file is encrypted and renaming the file does nothing. Copy the files to another drive, remove the program with an offline Microsoft Defender scan, and then run Emsisoft's STOP Djvu decryptor on the copies.
If it reports an online ID, restore from a backup, cloud version history or Previous Versions. Some audio and video files play again after a repair tool, since only their beginning is lost. Never change the extension by hand, because that only makes the files harder to tell apart later.
Is there a free decryptor for Hlas ransomware?
Possibly, but probably not for your files. Emsisoft's tool decrypts STOP Djvu files only when they were locked with an offline key that Emsisoft already has, and PCrisk says most victims have an online key.
We found no source that says which type .hlas uses, so the only way to know is to run the tool on a copy and read its answer. Take it only from Emsisoft's site. Emsisoft also says its tools come without warranty and may not cover newer versions, so a failure today does not rule out a later tool.
Should I pay the Hlas ransom?
No, do not pay. The note asks $999, or $499 within 72 hours, and offers one free file as a guarantee.
Nothing forces the attackers to send a working key after payment, and many victims report new demands or silence. The discount exists to rush you. First clean the PC, then try Emsisoft's tool, backups, cloud versions and Previous Versions.
If nothing works, keep the locked files: a decryptor for your key type sometimes appears later. A payment also pays for the next release and marks you as a victim who pays.
How did Hlas get on my PC?
Almost certainly through a program you ran yourself. PCrisk says Djvu is hidden in pirated software, cracking tools, key generators and fake pages offering free content such as YouTube downloads, and sent in e-mail attachments or links. Our old guide also named ZIP archives and Office macros.
No source gives the exact route for Hlas, so think about what you installed or opened just before the files changed. Keep that installer if it is still there. A security researcher or the police may want it, and deleting it removes your best clue.
Were my files or passwords stolen?
Nothing we read says that files were copied out, and the note names no leak site. Passwords are a different matter. PCrisk warns that Djvu is often delivered with stealers such as RedLine or Vidar, and they take saved logins from browsers.
After the scan, change your e-mail, bank and cloud passwords from a clean device and turn on two-step sign-in. Change the same password anywhere else you used it too, and look at your bank and e-mail sign-in history for logins you do not recognise.
Do data recovery services or paid unlockers work?
Not on files with an online key, because that key is not on your disk. A recovery service can help with deleted files and failing drives, which is a different problem. Be careful with anyone who promises to unlock .hlas files for a fee: they often pay the attackers or just run the free Emsisoft tool for you.
Ask exactly what they do and what you pay if it fails. Reinstalling Windows removes the program but unlocks nothing, so copy the locked files to another drive before you wipe anything.
How is Hlas different from other Djvu ransomware?
It is the same program as the many other STOP/Djvu releases and differs mainly in the extension and the addresses in the note. Emsisoft lists .djvu, .rumba, .radman and .gero as examples of the dozens of extensions it appends. What matters for you is the key type, not the name.
A decryptor made for a different family will not work on .hlas files, and a Djvu tool covers only certain variants, so check the extension and the note name before you download anything. Other sites may call the family STOP or STOPCrypt.
Will Fortect remove Hlas ransomware?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Hlas ransomware, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- PCrisk: Hlas ransomware (read October 6, 2026)
- PCrisk: Djvu ransomware (read October 6, 2026)
- Emsisoft: STOP Djvu decryptor (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline scan (read October 6, 2026)
- Microsoft Learn: vssadmin list shadows (read October 6, 2026)
- No More Ransom Project: decryption tools (read October 6, 2026)