Emsisoft Decrypter for NMoreira can decrypt files that have been renamed to either *.maktub or *.__AiraCropEncrypted! or if you find a ransom note named either "Recupere seus arquivos. Leia-me!.txt" or "How to decrypt your files.txt" on your system.

By default, the decrypter will pre-populate the locations to decrypt with the currently connected drives and network drives. Additional locations can be added using the “Add” button. Also, the object list accepts files and locations to be added via drag and drop.

Decrypters typically offer various options depending on the particular malware family. The available options are located in the Options tab and can be enabled or disabled there. You can find a detailed list of the available Options below.

After you added all the locations you want to decrypt to the list, click “Decrypt” to start the decryption process. The screen will switch to a status view, informing you about the current process and decryption status of your files:

The decrypter will inform you once the decryption process is finished.

If you require the report for your personal records, you can save it by clicking the “Save log” button. You can also copy it straight to your clipboard to paste it into emails or forum posts if you are asked to.