Emsisoft Decrypter for NemucodAES can decrypt the NemucodAES ransomware, a newer variant of the Nemucod ransomware family.NemucodAES was written in a combination of JavaScript and PHP. It uses AES and RSA to encrypt your files. Encrypted files will keep their original file names and a ransom note called "DECRYPT.hta" can be found on your Desktop. The ransom note reads as follows:ATTENTION!All your documents, photos, databases and other important personal files were encryptedusing a combination of strong RSA-2048 and AES-128 algorithms.The only way to restore your files is to buy decryptor. Please, follow these steps:Create your Bitcoin wallet here: https://blockchain.info/wallet/newBuy 0.13066 bitcoins here: https://localbitcoins.com/buy_bitcoinsSend 0.13066 bitcoins to this address: 1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbPOpen one of the following links in your browser: http://luxe-limo.ru/counter/?1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbPhttp://musaler.ru/counter/?1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbPhttp://vinoteka28.ru/counter/?1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbPhttp://www.agrimixxshop.com/counter/?1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbPhttp://sharedocsrl.it/counter/?1FeZr4bvMpCf1QTS49VjsdhtnP6zPvMjbPDownload and run decryptor to restore your files. If Emsisoft Decrypter for NemucodAES does not find Nemucod *.db in your temp folder, it will not run. If you cleaned your drive of temporary files before becoming infected, this might be the reason why.