KeyHolder first hit Windows users in late 2014. File names stay the same after locking. Each affected folder gets HOW_DECRYPT.html and HOW_DECRYPT.gif, which send victims to a Tor payment page. The cipher is XOR-based. Windows personal files are its target. No leak site or data theft is linked to it. Its paid unlocking tool matches a later CryptorBit release.
Decryptor: Decryptor availability has not been recorded.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161