Decrypting hidden tear ransomware