RanRan Decryption Scripts
First, run the 'collect_cipher_streams.exe' against a directory of your choosing. The root drive is recommended in order to increase your odds of identifying possible streams. As an example, run the executable like so:
collect_cipher_streams.exe -d C:\ -o streams
This command will look for any suitable streams of various file size ranges, and store them within the streams\ directory. After suitable streams are found, you can then run the 'decrypt_with_cipher_streams.exe' executable.
The 'decrypt_with_cipher_streams.exe' executable requires a folder containing one or more suitable cipher streams. As an example, it can be run like so:
decrypt_with_cipher_streams.exe -d C:\ -i streams
This command will recursively search the C:\ directory looking for any .zXz files. If a cipher stream that corresponds to the file size of the .zXz is present within the streams\ directory, decryption will be attempted.