At its core, ransomware is a form of extortion, so the analysis begins with the ransomware payment process. After years, there remains no comprehensive depiction of the ransomware payment process from attack to cash-out. This effort illuminates the ransomware payment ecosystem to improve understanding.