ransom note

Also written: README_RESTORE.txt, HOW_TO_DECRYPT.txt

The file ransomware leaves demanding payment, often a capitalized name like HOW_TO_DECRYPT.txt. Finding one beside many renamed files is a clear sign of ransomware.