Customer called and found all of their file names changed with a file extension of a79a. Each folder contains all of the encrypted files and two files _HELP_HELP_HELP_5M6C2B8.jpg (instructions) & _HELP_HELP_HELP_5M6C2B8.hta. I've attempted to identify the ransomware using https://id-ransomware.malwarehunterteam.com/ but no success. Also reviewed the list of ransomware topic infections here: http://www.bleepingcomputer.com/forums/t/608773/list-of-ransomware-support-topics-faqs-and-news-articles/ with no luck. I cleaned the malware with bitdefender rescue disk then booting into safe mode and running malwarebytes antimalware, adwcleaner, hitmanpro. This is the first time I've seen this variant so I'm hoping someone can help identify.