Follow these steps
1
Disconnect the PC from Wi-Fi, Ethernet and shared drives immediately.
2
Do not connect backup drives or USB storage to the infected PC.
3
Take a photo of the ransom note and file extension for identification.
4
Use another clean device to check trusted ransomware-identification resources.
5
Run Microsoft Defender Offline scan or ask a professional before attempting recovery.
6
Restore files only from a known-clean backup after the infection is removed.