# WhiteHat GrandPrix 2016 : Banh te

**Category:** Miscellaneous
**Points:** 400
**Solves:** 2
**Description:**

> I downloaded IDM from a forum, but as it's running, a lot of files are removed together with the ransom notification for decryption. The removed files are very important. Please help me to resolve. Many thanks!
> 
> Submit: WhiteHat{SHA1(flag)}
> 
> http://material.grandprix.whitehatvn.com/gp2016/Misc03_ae1197d48a3e5ca29810b7c62bea1a1bcf8aadd4.zip
> 
> http://bakmaterial.grandprix.whitehatvn.com/gp2016/Misc03_ae1197d48a3e5ca29810b7c62bea1a1bcf8aadd4.zip
> 
> Alternative server on amazon in case of low traffic:
> 
> 
> http://54.183.97.137/gp2016/Misc03_ae1197d48a3e5ca29810b7c62bea1a1bcf8aadd4.zip

**Hint:**

> 17/12/2016 19:13:20 crypto Obfuscator For .Net ft Enigma Virtual Box
> 17/12/2016 22:53:15 SET isDebuggerPresent=true
> 17/12/2016 22:53:15 crypto Obfuscator For .Net

## Write-up

(TODO)

## Other write-ups and resources

(TODO)
