jj1234567 0 Report post Posted January 22 MY PC EFFECTED BY RAMSON MALWARE AND THE EXTENSION IS [[email protected]].wikki Quote Share this post Link to post Share on other sites
GT500 720 Report post Posted January 23 The e-mail address has been used by the Dharma/Cezar ransomware, however sometimes more than one ransomware will use the same e-mail address. I recommend uploading a copy of the ransom note along with an encrypted file to ID Ransomware so that you can confirm whether or not this is Dharma:https://id-ransomware.malwarehunterteam.com/ You can paste a link to the results into a reply if you would like for me to review them. Quote Share this post Link to post Share on other sites
Amigo-A 81 Report post Posted January 23 The correct file extension pattern of encrypted files .id-XXXXXXXX.[[email protected] ].wiki We known this variant since October 2019. He often repeated over time. Alas. There are no real decryptors for Dharma Ransomware to decrypt files without paying a ransom. Quote Share this post Link to post Share on other sites
