Emsisoft Decrypter for NemucodAES can decrypt the NemucodAES ransomware, a newer variant of the Nemucod ransomware family.

NemucodAES was written in a combination of JavaScript and PHP. It uses AES and RSA to encrypt your files. Encrypted files will keep their original file names and a ransom note called "DECRYPT.hta" can be found on your Desktop. The ransom note reads as follows:



If Emsisoft Decrypter for NemucodAES does not find Nemucod *.db in your temp folder, it will not run. If you cleaned your drive of temporary files before becoming infected, this might be the reason why.