Hey folks, your ransomware encrypted endpoints are EVIDENCE and need to be treated as such. PLEASE preserve copies before beginning the process of restoring operations.