Created
October 30, 2020 13:11
-
-
Save kaywoz/254f8f703a06b084206156f1beaf9bfc to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| //Large ransomware-extension list built off of several others, no credits sorry. Kthx bai. | |
| Full ransomware extension list | |
| "*.*cry", | |
| "*.*crypto", | |
| "*.*darkness", | |
| "*.*enc*", | |
| "*.*exx", | |
| "*.*kb15", | |
| "*.*kraken", | |
| "*.*locked", | |
| "*.*nochance", | |
| "*.___xratteamLucked", | |
| "*.__AiraCropEncrypted!", | |
| "*._AiraCropEncrypted", | |
| "*._read_thi$_file*", | |
| "*.02", | |
| "*.0x0", | |
| "*.725", | |
| "*.1btc", | |
| "*.1999", | |
| "*.1cbu1", | |
| "*.1txt", | |
| "*.2ed2", | |
| "*.31392E30362E32303136_[ID-KEY]_LSBJ1", | |
| "*.73i87A", | |
| "*.726", | |
| "*.777", | |
| "*.7h9r", | |
| "*.7z.encrypted", | |
| "*.7zipper", | |
| "*.8c7f", | |
| "*.8lock8", | |
| "*.911", | |
| "*.a19", | |
| "*.a5zfn", | |
| "*.aaa ", | |
| "*.abc ", | |
| "*.adk", | |
| "*.adr", | |
| "*.adair", | |
| "*.AES", | |
| "*.aes128ctr", | |
| "*.AES256 ", | |
| "*.aes_ni", | |
| "*.aes_ni_gov", | |
| "*.aes_ni_0day ", | |
| "*.AESIR", | |
| "*.AFD", | |
| "*.aga", | |
| "*.alcatraz", | |
| "*.Aleta", | |
| "*.amba", | |
| "*.amnesia", | |
| "*.angelamerkel", | |
| "*.AngleWare", | |
| "*.antihacker2017", | |
| "*.animus", | |
| "*.ap19", | |
| "*.atlas", | |
| "*.aurora", | |
| "*.axx", | |
| "*.B6E1", | |
| "*.BarRax", | |
| "*.barracuda", | |
| "*.bart", | |
| "*.bart.zip", | |
| "*.better_call_saul", | |
| "*.bip", | |
| "*.birbb", | |
| "*.bitstak", | |
| "*.bitkangoroo", | |
| "*.boom", | |
| "*.black007", | |
| "*.bleep", | |
| "*.bleepYourFiles ", | |
| "*.bloc", | |
| "*.blocatto", | |
| "*.block", | |
| "*.braincrypt", | |
| "*.breaking_bad", | |
| "*.bript", | |
| "*.brrr", | |
| "*.btc", | |
| "*.btcbtcbtc", | |
| "*.btc-help-you", | |
| "*.cancer", | |
| "*.canihelpyou", | |
| "*.cbf", | |
| "*.ccc", | |
| "*.CCCRRRPPP", | |
| "*.cerber", | |
| "*.cerber2", | |
| "*.cerber3", | |
| "*.checkdiskenced", | |
| "*.chifrator@qq_com ", | |
| "*.CHIP ", | |
| "*.cifgksaffsfyghd", | |
| "*.clf", | |
| "*.clop", | |
| "*.cnc", | |
| "*.cobain", | |
| "*.code", | |
| "*.coded", | |
| "*.comrade", | |
| "*.coverton", | |
| "*.crashed", | |
| "*.crime", | |
| "*.crinf", | |
| "*.criptiko ", | |
| "*.crypton", | |
| "*.criptokod ", | |
| "*.cripttt ", | |
| "*.crjoker", | |
| "*.crptrgr", | |
| "*.CRRRT ", | |
| "*.cry", | |
| "*.cry_", | |
| "*.cryp1 ", | |
| "*.crypt", | |
| "*.crypt38", | |
| "*.crypted", | |
| "*.cryptes", | |
| "*.crypted_file", | |
| "*.crypto", | |
| "*.cryptolocker", | |
| "*.CRYPTOSHIEL", | |
| "*.CRYPTOSHIELD", | |
| "*.CryptoTorLocker2015!", | |
| "*.cryptowall", | |
| "*.cryptowin", | |
| "*.crypz", | |
| "*.CrySiS", | |
| "*.css", | |
| "*.ctb2", | |
| "*.CTBL", | |
| "*.czvxce", | |
| "*.d4nk", | |
| "*.da_vinci_code", | |
| "*.dale", | |
| "*.damage", | |
| "*.darkness ", | |
| "*.darkcry", | |
| "*.dCrypt", | |
| "*.decrypt2017", | |
| "*.ded", | |
| "*.deria", | |
| "*.desu", | |
| "*.dharma", | |
| "*.disappeared", | |
| "*.diablo6", | |
| "*.divine", | |
| "*.dll", | |
| "*.doubleoffset", | |
| "*.domino", | |
| "*.doomed", | |
| "*.dxxd", | |
| "*.dyatel@qq_com", | |
| "*.ecc", | |
| "*.edgel", | |
| "*.enc", | |
| "*.encedRSA", | |
| "*.EnCiPhErEd", | |
| "*.encmywork", | |
| "*.encoderpass", | |
| "*.ENCR", | |
| "*.encrypt", | |
| "*.EnCrYpTeD", | |
| "*.encryptedAES", | |
| "*.encryptedRSA", | |
| "*.encryptedyourfiles", | |
| "*.enigma", | |
| "*.epic", | |
| "*.evillock", | |
| "*.exotic", | |
| "*.exte", | |
| "*.exx", | |
| "*.ezz", | |
| "*.fantom", | |
| "*.fear", | |
| "*.FenixIloveyou!!", | |
| "*.file0locked", | |
| "*.filegofprencrp", | |
| "*.fileiscryptedhard", | |
| "*.filock", | |
| "*.firecrypt", | |
| "*.flyper", | |
| "*.frtrss", | |
| "*.fs0ciety", | |
| "*.fuck", | |
| "*.Fuck_You", | |
| "*.fucked", | |
| "*.FuckYourData ", | |
| "*.fun", | |
| "*.gamma", | |
| "*.gefickt", | |
| "*.gembok", | |
| "*.globe", | |
| "*.glutton", | |
| "*.goforhelp", | |
| "*.good", | |
| "*.gruzin@qq_com ", | |
| "*.gryphon", | |
| "*.grinch", | |
| "*.GSupport*", | |
| "*.GWS", | |
| "*.HA3", | |
| "*.hairullah@inbox.lv", | |
| "*.hakunamatata", | |
| "*.hannah", | |
| "*.haters", | |
| "*.happyday ", | |
| "*.happydayzz", | |
| "*.happydayzzz", | |
| "*.hb15", | |
| "*.helpdecrypt@ukr*.net", | |
| "*.helpmeencedfiles", | |
| "*.herbst", | |
| "*.hendrix", | |
| "*.hermes", | |
| "*.help", | |
| "*.hnumkhotep", | |
| "*.hitler", | |
| "*.howcanihelpusir", | |
| "*.html", | |
| "*.hush", | |
| "*.hydracrypt*", | |
| "*.iaufkakfhsaraf", | |
| "*.ifuckedyou", | |
| "*.iloveworld", | |
| "*.infected", | |
| "*.info", | |
| "*.invaded", | |
| "*.isis ", | |
| "*.ipYgh", | |
| "*.iwanthelpuuu", | |
| "*.jaff", | |
| "*.java", | |
| "*.JUST", | |
| "*.justbtcwillhelpyou", | |
| "*.JLQUF", | |
| "*.jnec", | |
| "*.karma", | |
| "*.kb15", | |
| "*.kencf", | |
| "*.keepcalm", | |
| "*.kernel_complete", | |
| "*.kernel_pid", | |
| "*.kernel_time", | |
| "*.keybtc@inbox_com", | |
| "*.KEYH0LES", | |
| "*.KEYZ ", | |
| "*keemail.me", | |
| "*.killedXXX", | |
| "*.kirked", | |
| "*.kimcilware", | |
| "*.KKK", | |
| "*.kk", | |
| "*.korrektor", | |
| "*.kostya", | |
| "*.kr3", | |
| "*.krab", | |
| "*.kraken", | |
| "*.kratos", | |
| "*.kyra", | |
| "*.L0cked", | |
| "*.lambda_l0cked", | |
| "*.LeChiffre", | |
| "*.legion", | |
| "*.lesli", | |
| "*.letmetrydecfiles", | |
| "*.like", | |
| "*.lock", | |
| "*.lock93", | |
| "*.locked", | |
| "*.Locked-by-Mafia", | |
| "*.locked-mafiaware", | |
| "*.locklock", | |
| "*.locky", | |
| "*.LOL!", | |
| "*.loprt", | |
| "*.lovewindows", | |
| "*.lukitus", | |
| "*.madebyadam", | |
| "*.magic", | |
| "*.maktub", | |
| "*.malki", | |
| "*.maya", | |
| "*.merry", | |
| "*.micro", | |
| "*.MRCR1", | |
| "*.MTXLOCK", | |
| "*.nalog@qq_com", | |
| "*.nemo-hacks.at.sigaint.org", | |
| "*.nobad", | |
| "*.no_more_ransom", | |
| "*.nochance", | |
| "*.nochance ", | |
| "*.nolvalid", | |
| "*.noproblemwedecfiles", | |
| "*.notfoundrans", | |
| "*.nuclear55", | |
| "*nuclear", | |
| "*.obleep", | |
| "*.odcodc", | |
| "*.odin", | |
| "*.oled", | |
| "*.OMG!", | |
| "*.only-we_can-help_you", | |
| "*.onion.to._", | |
| "*.oops", | |
| "*.openforyou@india.com", | |
| "*.oplata@qq.com ", | |
| "*.oshit", | |
| "*.osiris", | |
| "*.otherinformation", | |
| "*.oxr", | |
| "*.p5tkjw", | |
| "*.pablukcrypt", | |
| "*.padcrypt", | |
| "*.paybtcs", | |
| "*.paym", | |
| "*.paymrss", | |
| "*.payms", | |
| "*.paymst", | |
| "*.paymts", | |
| "*.payransom", | |
| "*.payrms", | |
| "*.payrmts", | |
| "*.pays", | |
| "*.paytounlock", | |
| "*.pdcr", | |
| "*.PEGS1", | |
| "*.perl", | |
| "*.pizda@qq_com", | |
| "*.PoAr2w", | |
| "*.porno", | |
| "*.potato", | |
| "*.powerfulldecrypt", | |
| "*.powned", | |
| "*.pr0tect", | |
| "*.purge", | |
| "*.pzdc", | |
| "*.R.i.P", | |
| "*.r16m*", | |
| "*.R16M01D05", | |
| "*.r3store", | |
| "*.R4A ", | |
| "*.r5a", | |
| "*.RAD ", | |
| "*.RADAMANT", | |
| "*.raid10", | |
| ".*ransomware", | |
| "*.RARE1", | |
| "*.rastakhiz", | |
| "*.razy", | |
| "*.RDM", | |
| "*.rdmk", | |
| "*.realfs0ciety@sigaint.org.fs0ciety", | |
| "*.recry1", | |
| "*.rekt", | |
| "*.relock@qq_com", | |
| "*.reyptson", | |
| "*.remind", | |
| "*.rip", | |
| "*.RMCM1", | |
| "*.rmd", | |
| "*.rnsmwr", | |
| "*.rokku", | |
| "*.rrk", | |
| "*.RSNSlocked ", | |
| "*.RSplited", | |
| "*.sage", | |
| "*.salsa222", | |
| "*.sanction", | |
| "*.scl", | |
| "*.SecureCrypted", | |
| "*.serpent", | |
| "*.sexy", | |
| "*.shino", | |
| "*.shit", | |
| "*.sifreli", | |
| "*.Silent", | |
| "*.sport", | |
| "*.stn", | |
| "*.supercrypt", | |
| "*.surprise", | |
| "*.szf", | |
| "*.t5019", | |
| "*.tedcrypt", | |
| "*.TheTrumpLockerf", | |
| "*.thda", | |
| "*.TheTrumpLockerfp", | |
| "*.theworldisyours", | |
| "*.thor", | |
| "*.toxcrypt", | |
| "*.troyancoder@qq_com", | |
| "*.trun", | |
| "*.trmt", | |
| "*.ttt", | |
| "*.tzu", | |
| "*.uk-dealer@sigaint.org", | |
| "*.unavailable", | |
| "*.vault", | |
| "*.vbransom", | |
| "*.vekanhelpu", | |
| "*.velikasrbija", | |
| "*.venusf", | |
| "*.Venusp", | |
| "*.versiegelt", | |
| "*.VforVendetta", | |
| "*.vindows", | |
| "*.viki", | |
| "*.visioncrypt", | |
| "*.vvv", | |
| "*.vxLock", | |
| "*.wallet", | |
| "*.wcry", | |
| "*.weareyourfriends", | |
| "*.weencedufiles", | |
| "*.wflx", | |
| "*.wlu", | |
| "*.Where_my_files.txt", | |
| "*.Whereisyourfiles", | |
| "*.windows10", | |
| "*.wnx", | |
| "*.WNCRY", | |
| "*.wncryt", | |
| "*.wnry", | |
| "*.wowreadfordecryp", | |
| "*.wowwhereismyfiles", | |
| "*.wuciwug", | |
| "*.www", | |
| "*.xiaoba", | |
| "*.xcri", | |
| "*.xdata", | |
| "*.xort", | |
| "*.xrnt", | |
| "*.xrtn", | |
| "*.xtbl", | |
| "*.xyz", | |
| "*.ya.ru", | |
| "*.yourransom", | |
| "*.Z81928819", | |
| "*.zc3791", | |
| "*.zcrypt", | |
| "*.zendr4", | |
| "*.zepto", | |
| "*.zorro", | |
| "*.zXz", | |
| "*.zyklon", | |
| "*.zzz ", | |
| "*.zzzzz", | |
| "*@gmail_com_*", | |
| "*@india.com*", | |
| "*_crypt ", | |
| "*_H_e_l_p_RECOVER_INSTRUCTIONS*", | |
| "*_LAST", | |
| "*_nullbyte", | |
| "*_READ_THIS_FILE_*", | |
| "*ABCXYZ11", | |
| "*cpyt*", | |
| "*crypt*", | |
| "*decipher*", | |
| "*gmail*.crypt", | |
| "*help_restore*.*", | |
| "*help_your_files*.*", | |
| "*how_to_recover*.*", | |
| "*install_tor*.*", | |
| "*keemail.me*", | |
| "*qq_com*", | |
| "*restore_fi*.*", | |
| "*ukr.net*", | |
| "*want your files back.*", | |
| "_crypt", | |
| "_DECRYPT_INFO_*", | |
| "_Locky_recover_instructions.txt", | |
| "_ryp", | |
| "_secret_code.txt", | |
| "AllFilesAreLocked*.bmp", | |
| "ASSISTANCE_IN_RECOVERY.txt", | |
| "ATTENTION!!!.txt", | |
| "confirmation.key", | |
| "Decrypt.exe", | |
| "DECRYPT_INSTRUCTION.HTML", | |
| "DECRYPT_INSTRUCTION.TXT", | |
| "DECRYPT_INSTRUCTIONS.HTML", | |
| "DECRYPT_INSTRUCTIONS.TXT", | |
| "DecryptAllFiles*.txt", | |
| "DecryptAllFiles.txt", | |
| "enc_files.txt", | |
| "HELP_DECRYPT.HTML", | |
| "HELP_DECRYPT.lnk", | |
| "HELP_DECRYPT.PNG", | |
| "HELP_DECRYPT.TXT", | |
| "HELP_RESTORE_FILES.txt", | |
| "HELP_TO_DECRYPT_YOUR_FILES.txt", | |
| "HELP_TO_SAVE_FILES.txt", | |
| "how to decrypt aes files.lnk", | |
| "How_Decrypt.html", | |
| "How_Decrypt.txt", | |
| "HowDecrypt.txt", | |
| "howrecover+*.txt", | |
| "howto_recover_file.txt", | |
| "IAMREADYTOPAY.TXT", | |
| "INSTRUCCIONES_DESCIFRADO.TXT", | |
| "last_chance.txt", | |
| "MESSAGE.txt", | |
| "oor*.", | |
| "recovery_file.txt", | |
| "RECOVERY_KEY.TXT", | |
| "restore_files*.txt", | |
| "restore_files.txt", | |
| "vault.hta", | |
| "vault.key", | |
| "vault.txt", | |
| "YOUR_FILES.HTML", | |
| "YOUR_FILES.url", | |
| "*.txd0t", | |
| "*.id[*-2987].[crioso@protonmail.com].eking", | |
| "*.UAKXC", | |
| "*.klavins", | |
| "*.fezmm", | |
| "*.WSHLP", | |
| "*.SXS", | |
| "*.[*].[akzhq808@tutanota.com].makop", | |
| "*.Mnd4", | |
| "*.CYRAT", | |
| "*.Death_Of_Shadow", | |
| "*.*GLADIUS", | |
| "*.boop", | |
| "*.Aim", | |
| "*.get", | |
| "*.Back", | |
| "*.morseop*", | |
| "*.jigsaaw", | |
| "*.ReadManual.*", | |
| "*.[XMRLocker]", | |
| "*.wannacry", | |
| "*.morseop-7j9wrqr", | |
| "*.volvo33_36_37_39__44", | |
| "*.id[*-2275].[helprecover@foxmail.com].help", | |
| "*.saved", | |
| "*.id[*-*].[mccreight.ellery@tutanota.com].eight", | |
| "*.spybuster", | |
| "*.ehre", | |
| "*.covid", | |
| "*.2spyware", | |
| "*.vari", | |
| "*.Zyr", | |
| "*.AB89", | |
| "*.xati", | |
| "*.pandemic", | |
| "*.Spade", | |
| "*.cymcrypt", | |
| "*.*.[recoverydata@qbmail.biz].data", | |
| "*.oonn", | |
| "*.0.cs", | |
| "*.0.vb", | |
| "*.djang0unchain3d", | |
| "*.week", | |
| "*.zes", | |
| ".*AgeLocker", | |
| "*.1dec", | |
| "*.nef1lim", | |
| "*.46orz", | |
| "*@pm.me*", | |
| "*.itunes", | |
| "*.rgnk", | |
| "*. tcwwasted", | |
| "*.tcwwasted", | |
| "*.ZaCaPa", | |
| "*.id-*[FileFixer@ProtonMail.com].LOCKED", | |
| "*.PPHL", | |
| "*.tools_ensikology", | |
| "*.*jalicry*", | |
| "*.GlUtEzOn.VaNoLe", | |
| "*.nile", | |
| "*.MH24", | |
| "*_out", | |
| "*.silvertor", | |
| "*.mechu4Po", | |
| "*.Ieph0uxo", | |
| "*.mnbzr", | |
| "*.deadfiles", | |
| "*.DECC", | |
| "*.tcprx", | |
| "*.RANDOM", | |
| "*.xienvkdoc", | |
| "*.kook", | |
| "*.GARMINWASTED", | |
| "*.erif", | |
| "*.pstKll", | |
| "*.[sleepme134@gmail.com][ID-*].Void", | |
| "*.eduransom", | |
| "*.RE78P", | |
| "*.Globeimposter-Alpha865qqz", | |
| "*.spare", | |
| "*.dwmapi", | |
| "*.[openpgp@foxmail.com].pgp", | |
| "*.GlobeimposterAlpha865qqz", | |
| "*.bbawasted", | |
| "*.*wasted_info", | |
| "*.kuus", | |
| "*.flowEncryption", | |
| "*.homer", | |
| "*.[TorS@Tuta.Io]", | |
| "*.beijing", | |
| "*.rlhwasted_info", | |
| "*.FastWind", | |
| "*.52pojie", | |
| "*.rlhwasted", | |
| "*.BNFD", | |
| "*.(*dungeon*-0_0)", | |
| "*.jwjs", | |
| "*prnds", | |
| "*CoronaCrypt*", | |
| "*SpartCrypt*", | |
| "*.VinDizelPux", | |
| "*.GNS", | |
| "*.AL8P", | |
| "*.gyga", | |
| "*.NHLP", | |
| "*.lxhlp", | |
| "*.felix", | |
| "*.prnds", | |
| "*.bmtf", | |
| "*.sthd2", | |
| "*.zbw", | |
| "*.hacker_decryption@protonmail.ch", | |
| "*.Drop", | |
| "*.bado", | |
| "*.XINOF", | |
| "*.smpl", | |
| "*.readme", | |
| "*.repl", | |
| "*.Try2Cry", | |
| "*.repter", | |
| "*.teamV", | |
| "*.panther", | |
| "*.SilentDeath", | |
| "*.aris", | |
| "*.maas", | |
| "*.CryCryptor", | |
| "*.wholocked", | |
| "*.*wasted", | |
| "*.encoded_PL", | |
| "*.lolkek", | |
| "*.id-*.[databack2@protonmail.com].dtbc", | |
| "*.RABBIT", | |
| "*.zida", | |
| "*.support", | |
| "*.KoxENy1Wq", | |
| "*.id-*.[Recovery@qbmail.biz].credo", | |
| "*.pykw", | |
| "*.team", | |
| "*._HE", | |
| "*._HE._LP,", | |
| "*.CRYPTBD", | |
| "*.moba", | |
| "*.crimson", | |
| "*.jsus", | |
| "*.CroNi.ZoNe", | |
| "*.7303yt", | |
| "*.gomer", | |
| "*.Email=[russiawolf09@gmail.com]ID=[*].zip", | |
| "*.EG83", | |
| "*.id-*.[savebase@aol.com].base", | |
| "*.[dungeon]-0_0", | |
| "*.vawe", | |
| "*.20dfs", | |
| "*.r3f5s", | |
| "*.mwahah*", | |
| "*.usam", | |
| "*.tabe", | |
| "*.Badboy", | |
| "*.ESCAL*", | |
| "*.TELEGRAM", | |
| "*.EG", | |
| "*.coka", | |
| "*.jpg.js*", | |
| "*.origami", | |
| "*.mwahahah", | |
| "*.hck", | |
| "*.nypd", | |
| "*.thanos", | |
| "*.zwer", | |
| "*.CrYo", | |
| "*.AG88G", | |
| "*.ZRB", | |
| "*.ElvisPresley", | |
| "*wifi*hacker*", | |
| "*.avdn", | |
| "*.club", | |
| "*.wch", | |
| "*.nm8kci", | |
| "*.kkll", | |
| "*unluckyware*", | |
| "*.dsec", | |
| "*.SIGARETA", | |
| "*.xdrop", | |
| "*.BOMBO", | |
| "*.hex911", | |
| "*.VIVELAG", | |
| "*.space", | |
| "*.Fonix", | |
| "*.nlah", | |
| "*.unwa", | |
| "*@*.banks*", | |
| "*.eight", | |
| "*.[*].bclaw", | |
| "*.pezi", | |
| "*.fuckunicorn*", | |
| "*.vfcfocxph", | |
| "*.fuckunicornhtrhrtjrj", | |
| "*.bclaw", | |
| ".111111", | |
| "*.bang", | |
| "*.id-*.[paybit@aol.com].payB", | |
| "*.payB", | |
| "*.corona-lock", | |
| "*.biglock", | |
| "*.covm", | |
| "*.proL0ck", | |
| "*.eking", | |
| "*@rape.lol*", | |
| "*.M0rphine", | |
| "*.id-*.[*@*].NET", | |
| "*.[decryptadmin@protonmail.com][ID-*].Void", | |
| "*.0day0", | |
| "*.cxk", | |
| "*.dodged", | |
| "*.pr0Lock", | |
| "*.xsmb", | |
| "*.Zekwacrypt", | |
| "*.ZeroFucks", | |
| "*.Zenis", | |
| "*.ZimbraCryptor", | |
| "*.ZeroRansom", | |
| "*.ZipLocker", | |
| "*.Zoldon", | |
| "*.ZQ", | |
| "*.ZariqaCrypt", | |
| "*.YouAreFucked", | |
| "*.XYZWare", | |
| "*.XCry", | |
| "*.XTP", | |
| "*.Wulfric", | |
| "*.WonderCrypter", | |
| "*.WinRarer", | |
| "*.Winnix", | |
| "*.WininiCrypt", | |
| "*.WildFire", | |
| "*.WhiteRose", | |
| "*.WhatAFuck", | |
| "*.Wesker", | |
| "*.WannaSpam", | |
| "*.WannaSmile", | |
| "*.WannaPeace", | |
| "*.WannaDie", | |
| "*.WannaCry*", | |
| "*.Waffle", | |
| "*.Vurten", | |
| "*.Vortex", | |
| "*.VoidCrypt", | |
| "*.VMola", | |
| "*.VindowsLocker", | |
| "*.ViACrypt", | |
| "*.Venus", | |
| "*.Venis", | |
| "*.Vega", | |
| "*.VaultCrypt", | |
| "*.V8Locker", | |
| "*.Uyari", | |
| "*.UserFilesLocker", | |
| "*.Useless", | |
| "*.Unlock92", | |
| "*.Unlock26", | |
| "*.Unknown", | |
| "*.UnblockUPC", | |
| "*.Ungluk", | |
| "*.UmbreCrypt", | |
| "*.Ukash", | |
| "*.UCCU", | |
| "*.TurkStatik", | |
| "*.TrumpLocker", | |
| "*.TrueCrypter", | |
| "*.Troldesh", | |
| "*.Trojan.Encoder.6491", | |
| "*.TowerWeb", | |
| "*.TotalWipeOut", | |
| "*.Torchwood", | |
| "*.TheDarkEncryptor", | |
| "*.TheDMR", | |
| "*.TeslaWare", | |
| "*.Teslarvng", | |
| "*.TeslaCrypt", | |
| "*.Termite", | |
| "*.TellYouThePass", | |
| "*.Telecrypt", | |
| "*.Team XRat", | |
| "*.T1Happy", | |
| "*.SZFLocker", | |
| "*.SystemCrypter", | |
| "*.SyncCrypt", | |
| "*.SynAck", | |
| "*.SuperB", | |
| "*.SunCrypt", | |
| "*.Stupid", | |
| "*.Striked", | |
| "*.Storm", | |
| "*.StorageCrypter", | |
| "*.Stampado", | |
| "*.SQ_", | |
| "*.SpartCrypt", | |
| "*.Spartacus", | |
| "*.SoFucked", | |
| "*.SNSLocker", | |
| "*.Smrss32", | |
| "*.SkyFile", | |
| "*.Skull", | |
| "*.SintaLocker", | |
| "*.Simple_Encoder", | |
| "*.SilentSpring", | |
| "*.Sigma", | |
| "*.Shujin", | |
| "*.ShkolotaCrypt", | |
| "*.ShivaGood", | |
| "*.Shigo", | |
| "*.ShellLocker", | |
| "*.SFile", | |
| "*.SerbRansom", | |
| "*.Seon", | |
| "*.ScareCrow", | |
| "*.SatanCryptor", | |
| "*.Sanctions", | |
| "*.SamSam", | |
| "*.Salsa", | |
| "*.SADStory", | |
| "*.Sadogo", | |
| "*.SadComputer", | |
| "*.SAD", | |
| "*.Russian EDA2", | |
| "*.Russenger", | |
| "*.Ruby", | |
| "*.RSAUtil", | |
| "*.RSA2048Pro", | |
| "*.RSA-NI", | |
| "*.Roza", | |
| "*.RotorCrypt", | |
| "*.RoshaLock", | |
| "*.Roga", | |
| "*.REvil", | |
| "*.RetMyData", | |
| "*.RenLocker", | |
| "*.RemindMe", | |
| "*.Relock", | |
| "*.Rektware", | |
| "*.REKTLocker", | |
| "*.RedBoot", | |
| "*.RarVault", | |
| "*.RaRansomware", | |
| "*.RansomWarrior", | |
| "*.RansomPlus", | |
| "*.Ransomnix", | |
| "*.RansomCuck", | |
| "*.Rans0m", | |
| "*.RanRan", | |
| "*.Ranion", | |
| "*.RandomLocker", | |
| "*.Random6", | |
| "*.Ragnar", | |
| "*.Radiation", | |
| "*.RackCrypt", | |
| "*.RabbitFox", | |
| "*.RAA-SEP", | |
| "*.R980", | |
| "*.QwertyCrypt", | |
| "*.Quimera", | |
| "*.QuakeWay", | |
| "*.QP", | |
| "*.qkG", | |
| "*.PyLocky", | |
| "*.PyL33T", | |
| "*.PyCL", | |
| "*.PwndLocker", | |
| "*.PureLocker", | |
| "*.PshCrypt", | |
| "*.Protected", | |
| "*.ProLock", | |
| "*.Project57", | |
| "*.Project34", | |
| "*.PrincessLocker", | |
| "*.Pr0tector", | |
| "*.PPDDDP", | |
| "*.PowerWare", | |
| "*.PowerLocky", | |
| "*.PopCornTime", | |
| "*.PonyFinal", | |
| "*.PoisonFang", | |
| "*.Plague17", | |
| "*.Pickles", | |
| "*.PhoneNumber", | |
| "*.Philadelphia", | |
| "*.PhantomChina", | |
| "*.PGPSnippet", | |
| "*.PewCrypt", | |
| "*.Petna", | |
| "*.Pendor", | |
| "*.PEC 2017", | |
| "*.PClock", | |
| "*.PaySafeGen", | |
| "*.PayPalGenerator2019", | |
| "*.Paymen45", | |
| "*.Paradise", | |
| "*.Ozoza", | |
| "*.Ouroboros", | |
| "*.Ordinypt", | |
| "*.OpJerusalem", | |
| "*.OpenToYou", | |
| "*.OnyxLocker", | |
| "*.Nyton", | |
| "*.Nx", | |
| "*.NullByte", | |
| "*.Nuke", | |
| "*.NSB", | |
| "*.NotAHero", | |
| "*.Nomikon", | |
| "*.NMoreira", | |
| "*.Nhtnwcuf", | |
| "*.NextCry", | |
| "*.NewHT", | |
| "*.Netwalker", | |
| "*.Netix", | |
| "*.NETCrypton", | |
| "*.Nemucod", | |
| "*.NegozI", | |
| "*.NCrypt", | |
| "*.NanoLocker", | |
| "*.n1n1n1", | |
| "*.Mystic", | |
| "*.MrDec", | |
| "*.MoWare", | |
| "*.MOTD", | |
| "*.MorrisBatchCrypt", | |
| "*.MoonCrypter", | |
| "*.Montserrat", | |
| "*.MongoLock", | |
| "*.Mobef", | |
| "*.MNS", | |
| "*.Mischa", | |
| "*.MireWare", | |
| "*.MirCop", | |
| "*.Minotaur", | |
| "*.MindSystem", | |
| "*.Meteoritan", | |
| "*.Mespinoza", | |
| "*.MegaLocker", | |
| "*.Medusa", | |
| "*.MCrypt2018", | |
| "*.Maykolin", | |
| "*.MauriGo", | |
| "*.MarsJoke", | |
| "*.MarraCrypt", | |
| "*.Marlboro", | |
| "*.Marduk", | |
| "*.Maoloa", | |
| "*.MalwareTech*", | |
| "*.Magniber", | |
| "*.MafiaWare", | |
| "*.MAFIA", | |
| "*.MadBit", | |
| "*.LowLevel04", | |
| "*.LoveServer", | |
| "*.Lost_Files", | |
| "*.Lortok", | |
| "*.LooCipher", | |
| "*.LonleyCrypt", | |
| "*.LongTermMemoryLoss", | |
| "*.LockTaiwan", | |
| "*.LockerGoga", | |
| "*.LockedByte", | |
| "*.Locked-In", | |
| "*.LockCrypt", | |
| "*.LockBox", | |
| "*.Lock2017", | |
| "*.LMAOxUS", | |
| "*.LLTP", | |
| "*.LittleFinger", | |
| "*.LightningCrypt", | |
| "*.LambdaLocker", | |
| "*.Ladon", | |
| "*.L33TAF", | |
| "*.KryptoLocker", | |
| "*.Kriptovor", | |
| "*.Krider", | |
| "*.KratosCrypt", | |
| "*.Kozy.Jozy", | |
| "*.Kolobo", | |
| "*.KokoKrypt", | |
| "*.Kirk", | |
| "*.KillRabbit", | |
| "*.KillerLocker", | |
| "*.KEYHolder", | |
| "*.KeyBTC", | |
| "*.Kerkoporta", | |
| "*.KeRanger", | |
| "*.KCW", | |
| "*.KawaiiLocker", | |
| "*.Kasiski", | |
| "*.Karo", | |
| "*.Karmen", | |
| "*.Karma", | |
| "*.Kaenlupuf", | |
| "*.JungleSec", | |
| "*.JuicyLemon", | |
| "*.JosepCrypt", | |
| "*.JoeGo", | |
| "*.JobCrypter", | |
| "*.JNEC.a", | |
| "*.Jigsaw", | |
| "*.Jemd", | |
| "*.JeepersCrypt", | |
| "*.JapanLocker", | |
| "*.Jager", | |
| "*.Jack.Pot", | |
| "*.JabaCrypter", | |
| "*.Ishtar", | |
| "*.Iron", | |
| "*.iRansom", | |
| "*.InsaneCrypt", | |
| "*.InfoDot", | |
| "*.InfinityLock", | |
| "*.InfiniteTear", | |
| "*.InducVirus", | |
| "*.Ims00ry", | |
| "*.ILElection2020", | |
| "*.IFN643", | |
| "*.IEncrypt", | |
| "*.HydraCrypt", | |
| "*.Hydra", | |
| "*.Hucky", | |
| "*.HPE iLO", | |
| "*.HolyCrypt", | |
| "*.HollyCrypt", | |
| "*.HKCrypt", | |
| "*.HildaCrypt", | |
| "*.HiddenTear", | |
| "*.Heropoint", | |
| "*.HelpDCFile", | |
| "*.Help50", | |
| "*.Hells", | |
| "*.Heimdall", | |
| "*.HDDCryptor", | |
| "*.hc7", | |
| "*.hc6", | |
| "*.Halloware", | |
| "*.Hakbit", | |
| "*.HadesLocker", | |
| "*.GX40", | |
| "*.GusCrypter", | |
| "*.GPGQwerty", | |
| "*.GPCode", | |
| "*.GPAA", | |
| "*.Gorgon", | |
| "*.GoRansom", | |
| "*.Gomasom", | |
| "*.GoldenEye", | |
| "*.Golden Axe", | |
| "*.GoGoogle", | |
| "*.Globe3", | |
| "*.GlobeImposter", | |
| "*.Gibon", | |
| "*.Gibberish", | |
| "*.GhostHammer", | |
| "*.GhostCrypt", | |
| "*.GetCrypt", | |
| "*.GermanWiper", | |
| "*.Gerber", | |
| "*.GC47", | |
| "*.GandCrab2", | |
| "*.GandCrab", | |
| "*.Galacti-Crypter", | |
| "*.FuxSocy", | |
| "*.FunFact", | |
| "*.FuckSociety", | |
| "*.FS0ciety", | |
| "*.FrozrLock", | |
| "*.FreeMe", | |
| "*.FLKR", | |
| "*.Flatcher3", | |
| "*.FindZip", | |
| "*.FilesLocker", | |
| "*.Fenrir", | |
| "*.FenixLocker", | |
| "*.FCT", | |
| "*.FCP", | |
| "*.Fadesoft", | |
| "*.Fabiansomware", | |
| "*.Extractor", | |
| "*.Extortion Scam", | |
| "*.Exocrypt XTC", | |
| "*.ExecutionerPlus", | |
| "*.Everbe*", | |
| "*.Eternal", | |
| "*.Estemani", | |
| "*.Erica", | |
| "*.Erebus", | |
| "*.EnkripsiPC", | |
| "*.Enjey Crypter", | |
| "*.Encryptor RaaS", | |
| "*.EncryptoJJS", | |
| "*.EncryptedBatch", | |
| "*.Enc1", | |
| "*.El Polocker", | |
| "*.EggLocker", | |
| "*.EduCrypt", | |
| "*.EdgeLocker", | |
| "*.ECLR*", | |
| "*.eCh0raix", | |
| "*.eBayWall", | |
| "*.DynA-Crypt", | |
| "*.DVPN", | |
| "*.DryCry", | |
| "*.DriedSister", | |
| "*.DoubleLocker", | |
| "*.DoNotChange", | |
| "*.Done", | |
| "*.DoggeWiper", | |
| "*.DMA Locker*", | |
| "*.District", | |
| "*.Dishwasher", | |
| "*.DirtyDecrypt", | |
| "*.DilmaLocker", | |
| "*.Digisom", | |
| "*.DeriaLock", | |
| "*.Defray777", | |
| "*.Defray", | |
| "*.DEDCryptor", | |
| "*.DecYourData", | |
| "*.DecryptIomega", | |
| "*.DeathRansom", | |
| "*.DeathNote", | |
| "*.DeathHiddenTear v2", | |
| "*.DeathHiddenTear", | |
| "*.Deadly", | |
| "*.DCry 2.0", | |
| "*.Dcrtr", | |
| "*.DavesSmith", | |
| "*.DataKeeper", | |
| "*.DarkoderCryptor", | |
| "*.Dablio", | |
| "*.CXK-NMSL", | |
| "*.CTB-Locker", | |
| "*.CTB-Faker", | |
| "*.CSP Ransomware", | |
| "*.Crystal", | |
| "*.CryPy", | |
| "*.CryptXXX 4.0", | |
| "*.CryptXXX 3.0", | |
| "*.CryptXXX 2.0", | |
| "*.CryptXXX", | |
| "*.CryptoWire", | |
| "*.CryptoWall 4.0", | |
| "*.CryptoWall 3.0", | |
| "*.CryptoWall 2.0", | |
| "*.CryptoViki", | |
| "*.CryptoTorLocker", | |
| "*.CryptoShocker", | |
| "*.CryptoRoger", | |
| "*.CryptorBit", | |
| "*.CryptoPokemon", | |
| "*.CryptoPatronum", | |
| "*.CryptoMix Wallet", | |
| "*.CryptoMix Revenge", | |
| "*.CryptoMix", | |
| "*.CryptoLuck", | |
| "*.CryptoLocky", | |
| "*.CryptoLockerEU", | |
| "*.CryptoLocker3", | |
| "*.CryptoJacky", | |
| "*.CryptoHitman", | |
| "*.CryptoHasYou", | |
| "*.CryptoGod", | |
| "*.CryptoFortress", | |
| "*.CryptoFinancial", | |
| "*.CryptoDevil", | |
| "*.CryptoDefense", | |
| "*.CryptInfinite", | |
| "*.CryptFuck", | |
| "*.CryptConsole3", | |
| "*.CryptConsole", | |
| "*.Crypt0r", | |
| "*.Crypt0L0cker", | |
| "*.Crypt0", | |
| "*.Crypren", | |
| "*.CrypMic", | |
| "*.CryLocker", | |
| "*.CryFile", | |
| "*.Cryakl", | |
| "*.Cripton7zp", | |
| "*.CreamPie", | |
| "*.CradleCore", | |
| "*.Cr1ptT0r", | |
| "*.Cossy", | |
| "*.CorruptCrypt", | |
| "*.CoronaVirus", | |
| "*.Comrade Circle", | |
| "*.Clouded", | |
| "*.CoinVault", | |
| "*.Coin Locker", | |
| "*.CockBlocker", | |
| "*.CmdRansomware", | |
| "*.ClicoCrypter", | |
| "*.ChineseRarypt", | |
| "*.ChinaYunLong", | |
| "*.Chimera", | |
| "*.ChernoLocker", | |
| "*.CerberTear", | |
| "*.Cancer", | |
| "*.id[*-*].[decphob@tuta.io].eking", | |
| "*.DoppelPaymer", | |
| "*.Bucbi", | |
| "*.Bubble", | |
| "*.BTCamant", | |
| "*.Brazilian Ransomware", | |
| "*.Booyah", | |
| "*.BoooamCrypt", | |
| "*.Blue Blackmail", | |
| "*.Blooper", | |
| "*.BlockFile12", | |
| "*.Blind 2", | |
| "*.Blackout", | |
| "*.BlackKingdom", | |
| "*.BlackHeart", | |
| "*.Black Shades", | |
| "*.Black Feather", | |
| "*.BKRansomware", | |
| "*.Bitshifter", | |
| "*.BitPyLock", | |
| "*.Bitpaymer", | |
| "*.BitCryptor", | |
| "*.BitCrypt 2.0", | |
| "*.BitCrypt", | |
| "*.Bisquilla", | |
| "*.BigBobRoss", | |
| "*.BetaSup", | |
| "*.BB Ransomware", | |
| "*.Basilisque Locker", | |
| "*.Bart v2.0", | |
| "*.BandarChor", | |
| "*.BadRabbit", | |
| "*.BadEncript", | |
| "*.BadBlock", | |
| ".restoreserver", | |
| "*.g8R4rqWIp9", | |
| "*.C4H", | |
| "*.cashdashsentme@protonmail.com", | |
| "*.cov19", | |
| "*.rbs", | |
| "*.C1H", | |
| "*.paradox", | |
| "*.qensvlcbymk", | |
| "*.6be31", | |
| "*.koti", | |
| "*.B2DR", | |
| "*.aZaZeL", | |
| "*.AxCrypter", | |
| "*.AWT", | |
| "*.Avest", | |
| "*.AVCrypt", | |
| "*.AutoWannaCryV2", | |
| "*.AutoLocky", | |
| "*.Atchbo", | |
| "*.Ataware", | |
| "*.ASN1 Encoder", | |
| "*.Arsium", | |
| "*.ArmaLocky", | |
| "*.Argus", | |
| "*.AresCrypt", | |
| "*.ApolloLocker", | |
| "*.ApocalypseVM", | |
| "*.Apocalypse (New Variant)", | |
| "*.Apocalypse", | |
| "*.Anubis", | |
| "*.AnteFrigus", | |
| "*.Annabelle 2.1", | |
| "*.AngryDuck", | |
| "*.Anatova", | |
| "*.Amnesia2", | |
| "*.Alpha", | |
| "*.Alma Locker", | |
| "*.Alfa", | |
| "*.mzlq", | |
| "*.zeronine", | |
| "*.lock2bits", | |
| "*.kupidon", | |
| "*.Lion", | |
| "*.Al-Namrood", | |
| "*.Afrodita", | |
| "*.AES256-06", | |
| "*.AES-Matrix", | |
| "*.AES_KEY_GEN_ASSIST", | |
| "*.AdamLocker", | |
| "*.ACCDFISA v2.0", | |
| "*.ABCLocker", | |
| "*.7ev3n", | |
| "*.HaCk", | |
| "*.24H Ransomware", | |
| "*.4rw5w", | |
| "*.0kilobypt", | |
| "*.vcrypt", | |
| "*.id-*.[neural.net@tuta.io].NET", | |
| "*.[ID-*]-[EMAIL-M0rphine@cock.li].M0rphine", | |
| "*.CrYo.TeOnS", | |
| "*.sqpc", | |
| "*.NEMTY_AJORCUS", | |
| "*.trix", | |
| "*.xraw", | |
| "*.[Hichkasam@protonmail.com][ID-*].Void", | |
| "*.id-*.[Helpsir@rape.lol].LOL", | |
| "*.zemblax", | |
| "*.Zv7uN", | |
| "*.projectzorgo", | |
| "*.OFFWHITE", | |
| "*.Id-*.[filerestory@gmail.com].Crypto", | |
| "*.8be1", | |
| "*.mpal", | |
| "*.GEnc", | |
| "*.geminis3", | |
| "*.pigzqbqnvbu", | |
| "*.carlos", | |
| "*.myblacksun@tuta.io", | |
| "*.rjali@protonmail.ch", | |
| "*.id-*.[im.online@aol.com].love$", | |
| "*.love$", | |
| "*.jyqji", | |
| "*.qewe", | |
| "*.id[*-2589].[backup.iso@aol.com].iso", | |
| "*.lote", | |
| "*.EAIJTP", | |
| "*.builder", | |
| "*.dec", | |
| "*.worcservice@protonmail.ch", | |
| "*.Boruta", | |
| "*.dop", | |
| "*.serpom", | |
| "*.revon", | |
| "*.likud", | |
| "*.CoronaLock", | |
| "*.corona", | |
| "*.*_RSA", | |
| "*.azor", | |
| "*.lezp", | |
| ".KEY0004", | |
| ".dec", | |
| "*.LSOBKMHG", | |
| "*.0D34E0", | |
| ".arrepiante", | |
| ".SARS-CoV-2", | |
| "*.ahegao", | |
| "*.WannaRen", | |
| "*.mbit", | |
| "*.Void", | |
| "*.rhino", | |
| "*.creepy", | |
| "*.eject", | |
| "*.KEY0004", | |
| "*.SARS-CoV-2", | |
| "*.lalo", | |
| "*.Sister", | |
| "*.Cruel", | |
| "*.bukyak", | |
| "*.mpaj", | |
| "*.~~~~", | |
| "*.id-*.[*].ccd", | |
| "*.id[*].[*].revon", | |
| "*.JOPE", | |
| "*.encS", | |
| "*.id-*.[supermetasploit@aol.com].MSPLT", | |
| "*.NEMTY_VQLGC72", | |
| "*.ZyNoXiOn", | |
| "*.Email=[*]ID=[*].Boruta", | |
| "*.id-*.[bitcoin@email.tg].ncov", | |
| "*.rogue", | |
| "*.shinya", | |
| "*.encryptedbyBB", | |
| "*.jest", | |
| "*.NEPHILIM", | |
| "*.fcfceee", | |
| "*.miblqugb", | |
| "*.[*].[*].makop", | |
| "*.mado", | |
| "*.yakuza", | |
| "*.KENS@TUTA.IO", | |
| "*.P4WN3D", | |
| "*.opqz", | |
| "*.KEKW", | |
| "*.njmhqbxu", | |
| "*.[*].yakuza", | |
| "*.[*].[*].shootlock", | |
| "*.npsk", | |
| "*.C-VIR", | |
| "*.lO8s42", | |
| "MZReverenge*", | |
| "*.petruk", | |
| "*.makop", | |
| "*Rec0very*", | |
| "*.iqy", | |
| "*.remk", | |
| "*FDFK*INFO*", | |
| "*.CULEX", | |
| "*.NEFILIM", | |
| "*.[*].teslarvng", | |
| "*.ako", | |
| "*.HR", | |
| "*.horseleader", | |
| "*.MZR", | |
| "*.javalocker", | |
| "*.javaencrypt", | |
| "*.daaefc", | |
| "*.voyager", | |
| "*.uk6ge", | |
| "*.ravack", | |
| "*.a6f2t", | |
| "*.foop", | |
| "*.lokd", | |
| "*.CNMHR", | |
| "*.id-*.[*].rxx", | |
| "*.FDFK", | |
| "*.vash", | |
| "*.kir", | |
| "*.bigdata", | |
| "*.id[*].*.dewar", | |
| "*.anon000", | |
| "*.rezm", | |
| "*.YKUP", | |
| "*.sepsys", | |
| "*.CryptoDarkRubix", | |
| "*.DEMON", | |
| "*.China", | |
| "*.Tsar", | |
| "*.pxj", | |
| "*.pwnd", | |
| "*.brick", | |
| "*.jerry_glanville_data@aol.com", | |
| "*.ragnar_*", | |
| "*.[paymentbtc@airmail.cc].Deniz_Kizi", | |
| "*.0x6A0C8", | |
| "*.[*].[test@test.tst].test", | |
| "*.[paymentbtc@yahoo.com].Deniz_Kizi", | |
| "*.[*].[buydecryptor@cock.li].makop", | |
| "*.mew767", | |
| "*.encryptedL", | |
| "*.networkmaze", | |
| "*.coom", | |
| "*.nppp", | |
| "*.mool", | |
| "*.encryptedS", | |
| "*.iwanttits", | |
| "*.sfile2", | |
| "*.Ouchachia", | |
| "*.id-*.[black@gytmail.com].self", | |
| "*.id[*-2423].[jewkeswilmer@aol.com].deal", | |
| "*.ncov", | |
| "*.blend", | |
| "*.rajar", | |
| "*.Rentyr", | |
| "*.mmnn", | |
| "*.ooss", | |
| "*.cripto", | |
| "*.*.firex3m", | |
| "*.id-*.[coronavirus@qq.com].ncov", | |
| "*.id[*-2720].[mr.helper@qq.com].dewar", | |
| "*.rooe", | |
| "*.*.*.WHY", | |
| "*.*.*.dewar", | |
| "*.ONIX", | |
| "*.egmwv", | |
| "*.btHTIb", | |
| "*.*.parrot", | |
| "*.razor", | |
| "*.#ransomwared", | |
| "*.egmwvm", | |
| "*kremez*", | |
| "*.AnubisCrypt", | |
| "*.desucrpt", | |
| "*.bboo", | |
| "*.moncrypt", | |
| "*.bhacks", | |
| "*.hellomynameisransom", | |
| "*.RYK!", | |
| "*.midwestsurinc", | |
| "*.eaaeee", | |
| "*.Devos", | |
| "*.CONTI", | |
| "*.abarcy", | |
| "*.Email=[MasterFile001@protonmail.com]ID=[*].sorena", | |
| "*.Iexei8bo", | |
| "*.id[*].[2183313275@qq.com].Devos", | |
| "*.id-*.[stopen@firemail.cc].stop", | |
| "*.id-*.[grdoks@tutanota.com].rajar", | |
| "*.ragnar_44027CDE", | |
| "*.heronpiston", | |
| "*.himr", | |
| "*.happythreechoose", | |
| "*.lockbit", | |
| "*.adv", | |
| "*.abiyq", | |
| "*.lasan", | |
| "*.Huy", | |
| "*.alka", | |
| "*.repp", | |
| "*.R2D2", | |
| "*.ENCRYPTED_RSA", | |
| "*.live", | |
| "*.Email=[Honeylock@protonmail.com]ID=[*].odveta", | |
| "*.id-*.[05250lock@tutamail.com].*", | |
| "*.*.[lucky_top@protonmail.com].Devos", | |
| "*.cryptopatronum@protonmail.com.enc", | |
| "*.npsg", | |
| "*.un1que", | |
| "*.2NEW", | |
| "*.ragnarok", | |
| "*.btos", | |
| "*.wrar", | |
| "*.*.[help.me24@protonmail.com].Z9", | |
| "*.TRSomware[is_back__New-Algorithm__By_MaMo434376]", | |
| "*.*.[theblackarrow@tuta.io].devil", | |
| "*.al1b1nal1", | |
| "*.devon", | |
| "*.fmk-ta3-7ym", | |
| "*.locker16", | |
| "*.nlocker", | |
| "Ransom*Software*.exe", | |
| "*.topi", | |
| "*.reha", | |
| "*.rams1", | |
| "*.vacv2", | |
| "*.stub", | |
| "*.nosu", | |
| "*.kodc", | |
| "*.payload", | |
| "*.sivo", | |
| "*.picocode#8523", | |
| "*.id-467C780C.[bitlocker@foxmail.com].wiki", | |
| "*.ebal", | |
| "*.njkwe", | |
| "*.2heRi1", | |
| "*.missing", | |
| "*.Deniz_kizi", | |
| "*.rag2hdst", | |
| "*.id[*-2261].[kusachi@cock.li].Adair", | |
| "*.hj36MM", | |
| "*.id-*.[sumpterzoila@aol.com].harma", | |
| "*.bitpy", | |
| "*.5ss5c", | |
| "*.[nochanse@tuta.io].aleta", | |
| "*.horsedeal", | |
| "*.ADHUBLLKA", | |
| "*.ekans", | |
| "*.grinch", | |
| "*.jenkins", | |
| "*.Indonesia.Cyborg", | |
| "*.Mkos", | |
| "*.Cl0p", | |
| "*.c0hen", | |
| "*.happy new year", | |
| "*.DMR", | |
| "*.somik1", | |
| "*.bablo", | |
| "*.2DA-1FF-401", | |
| "*.clown+", | |
| "*.slank", | |
| "*.BDDY", | |
| "*.cuba", | |
| "*.WannaScream", | |
| "*.*.[decryptfiles@qq.com].Devon", | |
| "*.devil", | |
| "*.[*][getdataback22@protonmail.com].AWT", | |
| "*.id[*-2396].[theonlyoption@qq.com].Caleb", | |
| "*.RIDIK", | |
| "*.icyoaezi", | |
| "*.dohfzdod", | |
| "*.zeoticus", | |
| "*.id[*-2542].[bexonvelia@aol.com].Dever", | |
| "*.charmant", | |
| "*.help.Ransom", | |
| "*.REBL", | |
| "*.wiki", | |
| "*.piny", | |
| "*.redl", | |
| "*.id-*.[admin@spacedatas.com].ROGER", | |
| "*.parad1gm", | |
| "*.Tor+", | |
| ".dglnl", | |
| ".ohwqg", | |
| ".googl", | |
| "*.59d49", | |
| "*.Horriblemorning", | |
| "*.support@anonymous-service.cc.ppdddp", | |
| "Unusual", | |
| "*.SaveTheQueenING", | |
| "*.[ponce.lorena@aol.com]", | |
| "*.*.[prndssdnrp@mail.fr].deuce", | |
| "*.zeppelin", | |
| "*.nbes", | |
| "*.Deniz_Kızı", | |
| "*.id-*.[asdbtc@aol.com].asd", | |
| "*.NEMTY_VFRLXV9", | |
| "*.ROGER", | |
| "*.id-*.[MerlinWebster@aol.com].harma", | |
| "*.bobelectron", | |
| "*.pysa", | |
| "*.chch", | |
| "*.MZ434376", | |
| ".hets", | |
| "*.Email=[luciferenc@tutanota.com]ID=[*].odveta", | |
| "*.Sifrelendi", | |
| "*.redrum", | |
| "*.DMR64", | |
| "*.id-*.[moncler@tutamail.com].redrum", | |
| "*.TMS5", | |
| "*.encrypted_backup", | |
| "*.gesd", | |
| "*.Rooster865qqZ", | |
| "*.merl", | |
| "*.MZ173801", | |
| "*.MaMo434376", | |
| "*.righ", | |
| "*.SpartCript", | |
| "*.b78vi7v6ri66b", | |
| "*.hets", | |
| "*.msop", | |
| "*.id-*.[backdata.company@aol.com].ROGER", | |
| "*.p3d374", | |
| "*.*.[helpnetin@protonmail.com].com", | |
| ".KRAB", | |
| "*.id[*].[backcompanyfiles@protonmail.com].Calum", | |
| "*.TR", | |
| "*.MMTeam", | |
| "*.mapo", | |
| "*.wvtr0", | |
| "*.BB4-230-*", | |
| "*.SaveTheQueen", | |
| "*.[crypto7892@gmx.de].crypto", | |
| "*.wasted", | |
| "*.yarraq", | |
| "*.id[*-2465].[keysfordecryption@airmail.cc].Calum", | |
| "*.Calum", | |
| "*.ciphered", | |
| "*.*.[kenny.sarginson@aol.com].deal", | |
| "*.zobm", | |
| "*.2048", | |
| "*.KAxoAgY", | |
| "*.*.[decrypt@files.mn].angus", | |
| "*.cr1", | |
| "*.ninja", | |
| "*.SySS", | |
| "*.kr", | |
| "*.verschlüsselt", | |
| "*qibfmkeM5*", | |
| "*Instraction*", | |
| "*qweasd*", | |
| "*@sectex*net*", | |
| "*@cock.lu*", | |
| "*.COCKROACH", | |
| "*.nytom", | |
| "*.nvram", | |
| "*.grupothermot3k", | |
| "*.wctc", | |
| "*.id-*.[teammarcy10@cock.li].kharma", | |
| "*.mbed", | |
| "*.jbptlio", | |
| "*.grod", | |
| "*.NEMTY_VFFXXXX", | |
| "*.id[*-2495].[agent5305@firemail.cc].age", | |
| "*.nhHtFWV", | |
| "*.kodg", | |
| "*.VIRUS", | |
| "USPS_Delivery.doc", | |
| "*.abcd", | |
| ".cr1", | |
| "*.jc", | |
| "*.[ID]*[ID]Look", | |
| "*.ReadTheInstructions", | |
| "*.peet", | |
| "*.ABCDEF", | |
| "*.raldge", | |
| "*.id-.[hmdjam@protonmail.com].harma", | |
| "*.id-.[clifieb@tutanota.com].nvram", | |
| "*.gоod", | |
| "*.0riz0n", | |
| "*.id[*-2497].[octopusdoc@mail.ee].octopus", | |
| "*.Rooster865qq", | |
| "*.46d7k", | |
| "*.GodLock", | |
| "*.NEMTY_*", | |
| "*.sr0yz", | |
| "*.m3g4c0rtx", | |
| "*.ex_parvis@aol.com.AIR", | |
| "*.octopus", | |
| "*.7jo22z5m", | |
| "*.lokf", | |
| "*.mosk", | |
| "*.mailto[2Hamlampampom@cock.li].82a80", | |
| "*.3v3r1s", | |
| "*.toec", | |
| "*.meka", | |
| "*.petra", | |
| "*.id-.[hobbsadelaide@aol.com].harma", | |
| "*.g0h8iwj", | |
| "*.Elder", | |
| "*.ccryptor", | |
| "*.sorryforthis", | |
| "*.sanders4!", | |
| "*.safe", | |
| "*.decrypme", | |
| "*.bot!", | |
| "*.nakw", | |
| "*.id-*.[admin@sectex.net].bot", | |
| "*.bot", | |
| "*.[cockroach@cock.lu].COCKROACH", | |
| "*.*locker*", | |
| "*.Lazarus+!", | |
| "*.id[*-2387].[gruzudo@cock.li].Barak", | |
| "svchostt.exe", | |
| "*.newlock", | |
| "*.breakingbad", | |
| "*.boroff", | |
| "*.[daves.smith@aol.com]", | |
| "*.hdmr", | |
| "*.encryptd", | |
| "*.JayTHL", | |
| "*.derp", | |
| "*.info@sharebyy[dot]com", | |
| "*.info@mymail9[dot]com", | |
| "*.skynet", | |
| "*.sapphire", | |
| "*.bguu", | |
| "*.tgmn", | |
| "*.Prt6aV9", | |
| "*.yq75w627", | |
| "*.kiss", | |
| "*.mockba", | |
| "*.coot", | |
| "*.acuna", | |
| "*.cxkdata", | |
| "*.id-*.[bitlocker@foxmail.com", | |
| "*.werd", | |
| "*.sun", | |
| "*ABAT*INFO*.*", | |
| "*.calix", | |
| "!how_to_unlock_your_file.txt", | |
| "*.nols", | |
| "*.masked", | |
| "*.hackdoor", | |
| "*.money", | |
| "*.id[*-2266].[decryptbox@airmail.cc].Adair", | |
| "*.Angus", | |
| "*.Caley", | |
| "*.CASH", | |
| "*@files.mn*", | |
| "*structsstructs*", | |
| "structsstructs.exe", | |
| "FACT. 8-9-1278104.doc", | |
| "FA_HLEH3S83AO22WO.doc", | |
| "*.bora", | |
| "*.proced", | |
| "*.id[*-*].[butters.felicio@aol.com].deal", | |
| "*.bwall", | |
| "*RANSOMED*", | |
| "msptermthemes.exe", | |
| "*.mike", | |
| "*.PO1HG", | |
| "*.odveta", | |
| "*.id-*.[admin@fentex.net].money", | |
| "*.[patern32@protonmail.com].omerta", | |
| "*.id[*-2275].[checkcheck07@qq.com].Adame", | |
| "*.CRYZP", | |
| "*.509a49", | |
| "*.clean", | |
| "*.veracrypt", | |
| "*.leto", | |
| "*.cobain", | |
| "hacked.txt", | |
| "*msptermthemes*", | |
| "!!!Readme!!!Help!!!.txt", | |
| "*.onx", | |
| "*.deal", | |
| "*ENCx45cR*", | |
| "*.reco", | |
| "*.m3ga*", | |
| "*.m3ga", | |
| "*.ABAT", | |
| "*.noos", | |
| "*.badutclowns", | |
| "*.D00mEd", | |
| "*.VIVAL", | |
| "*.xoza", | |
| "*.scrcrw", | |
| ".mike!Ransom", | |
| "*.Lost_Files_Encrypt", | |
| "*.muhstik", | |
| "*.omnisphere", | |
| "*.kuub", | |
| "*.Athena865", | |
| "*.FTCODE", | |
| ".kuub", | |
| "*.badday", | |
| "*.id[*-2423].[hanesworth.fabian@aol.com].dealemail", | |
| "*.id[*-*].[lockhelp@qq.com].acute", | |
| "*.LOCKED_PAY", | |
| "#DECP_README#.rtf", | |
| "*.m3gac0rtx", | |
| "*.id[*-2425].[*n*@cock.li].Caley", | |
| "*@tfwno.gf*", | |
| "*.id[*-1075].[lewisswaffield.a@aol.com].help", | |
| "*.Email=[jacdecr@tuta.io]ID=[*].KRONOS", | |
| "*.KRONOS", | |
| "*.id[*-1161].[member987@tutanota.com].actin", | |
| "*tflower*", | |
| "*.DECP", | |
| "*.nesa", | |
| "*.Artemis", | |
| "HILDACRYPTReadMe.html", | |
| "*.kci0n", | |
| "*.shade8", | |
| "*.pack14", | |
| "GoRansom.txt", | |
| "*.id[*-2416].[restorebackup@qq.com].Caley", | |
| "*.id[*-2315].[decrypt@files.mn].Banks", | |
| "*.LonleyEncryptedFile", | |
| "*.karl", | |
| "*.id_*_.YOUR_LAST_CHANCE!", | |
| "*.id-*.[payday@tfwno.gf].html", | |
| "*.id-*.[adm15@pr…", | |
| "*.id-*.[btcdecoding@qq.com].dqb", | |
| "*.id[*-1135].[walletwix@aol.com].actin", | |
| "*.id[*-2242].[Ke…", | |
| "*.id[*-2275", | |
| "*.id[*-2275].[supportcrypt2019@cock…", | |
| "*.id-*.[mr.hacker@tutanota.com].USA", | |
| "*.id[*-2300].[crysall.g@aol.com].banjo", | |
| "*.id[*-*].[wewillhelpyou@qq.com].adage", | |
| "*.id[*-2275].[raynorzlol@tutanota.com].Adame", | |
| "*.[ID=*2uJ][Mail=letitbedecryptedzi@gmail.com].Lazarus", | |
| "*.[ID=*][Mail=unlockme123@protonmail.com].Lazar", | |
| "*.id[*-2252].[eccentric_inventor@aol.com].adage", | |
| "*.id-*6.[3442516480@qq.com].pdf", | |
| "*.id[*-2325].[zax4444@qq.com].Banta", | |
| "*.id-*.[backdatacompany@aol.com].html", | |
| "*.id[*-2275].[recovermyfiles2019@thesecure.biz].Adame", | |
| "*.id-*.[vip76@protonmail.com].html", | |
| "*.id-*.[bitcoin1@foxmail.com].harma", | |
| "*.id[*-2299].[britt.looper@aol.com].phoenix", | |
| "*.id-*.[veracrypt@foxmail.com].adobe", | |
| "*.id[*-2394].[adagekeys@qq.com].Caleb", | |
| "*.id-*.[partfile@airmail.cc].com", | |
| "*.id-*.[karlosdecrypt@outlook.com].KARLS", | |
| "*.id[*-2345].[recoverdata@cock.li].Banta", | |
| "*.id-*E6.[3442516480@qq.com].pdf", | |
| "!_Notice_!.txt", | |
| "chilli.exe", | |
| "decoder.hta", | |
| "delog.bat", | |
| "*.gore", | |
| "*.id-*.[3442516480@qq.com].pdf", | |
| "*.[ID]*[ID]", | |
| "*.id-*.[Harmahelp73@gmx.de].harma", | |
| "*.PAY", | |
| "*.lfv77az", | |
| "*.Barak", | |
| "*.YDHM", | |
| "*.domn", | |
| "*.guarded", | |
| "*.619-300-6500", | |
| "*.fuXcF", | |
| "*.id[C4BA3647-2299].[britt.looper@aol.com].phoenix", | |
| "*.HCY!!", | |
| "*.kvag", | |
| "*.Erenahen", | |
| "*.Timestamp", | |
| "*.medsv162", | |
| "*.hermes837", | |
| "*.n3xtpharma", | |
| "*.alanwalkergod@protonmail.com", | |
| "*._NEMTY_BTKid9H_", | |
| "*.id-C4BA3647.[fox5sec@aol.com].cmd", | |
| "*.[rans0me@protonmail.com].b00m", | |
| "*.1ywsmbo4", | |
| "*.b00m", | |
| "*.moka", | |
| "*.peta", | |
| "*.BANKS", | |
| "*.group", | |
| "*.biz", | |
| "*.shariz", | |
| "*.Zeropadypt", | |
| "*.zorin", | |
| "*.Apollon865", | |
| "*.lbkut", | |
| "*.id[C4BA3647-2301].[hanesworth.fabian@aol.com].banjo", | |
| "*.ckey(RandomID).email(data1992@protonmail.com).pack14", | |
| "*.id[C4BA3647-2250].[wewillhelpyou@qq.com].adage", | |
| "*.ckey(oK5WFfTq).email(data1992@protonmail.com).pack14", | |
| "*.HILDA", | |
| "*.id[6AB8ABF5-2346].[limboshuran@cock].banta", | |
| "*.WAITING", | |
| "*._NEMTY*", | |
| "*.id-502F1F51.[mstr.hacker@protonmail.com].KICK", | |
| "*.dbger", | |
| "*.BORISHORSE…", | |
| "*.STOPDATA", | |
| "*.promoks", | |
| "*.banta", | |
| "*.tanos", | |
| "*.cetori", | |
| "*.geno", | |
| "*.try", | |
| "*.hese", | |
| "*.O67NG", | |
| "*.carote", | |
| "*.686l0tek69", | |
| "686l0tek69-HOW-TO-DECRYPT.txt", | |
| "*.gero", | |
| "*.makkonahi", | |
| "ryukreadme.html", | |
| "*.[gustafkeach@johnpino.com].ad", | |
| "*.lbiaf6c8", | |
| "*.nemty", | |
| "*.stare", | |
| "SGUARD-README.TXT", | |
| "*.sguard", | |
| "*.Qtyu8vH5wDXf6OSWAm5NuA==ObcK", | |
| "*.ObcKIn", | |
| "*.Lazarus", | |
| ". vesrato", | |
| "*.masodas", | |
| "*.vesrato", | |
| "*.nuksus", | |
| ".KARLOS", | |
| "*.pedro", | |
| "*.id[********-1161].[member987@tutanota.com].actin", | |
| "*.{25BF1879-A2DC-B66A-3CCC-XXXXXXXXXXXX}", | |
| "*.[mr.yoba@aol.com].yoba", | |
| "*.{Help557@gmx.de}.exe", | |
| "*.id_*********_.WECANHELP", | |
| "*.[grethen@tuta.io]", | |
| "*.2k19", | |
| "*.nacro", | |
| "*.Horse4444", | |
| "*.Tiger4444", | |
| "*.nasoh", | |
| "*.coharos", | |
| "*.mtogas", | |
| "*.krusop", | |
| "*.partially.cryptojoker", | |
| "*.id[C4BA3647-2271].[worldofdonkeys@protonmail.com].BORISHORSE", | |
| "*.[ID-][].JSWRM", | |
| "*.BORISHORSE", | |
| "*.OQn1B", | |
| "*.rjzR8", | |
| "*.londec", | |
| "*.AVco3", | |
| "*.08kJA", | |
| "*.Hermes666", | |
| "*.Acton.id[1AE26935-1085].[hadleeshelton@aol.com].Acton", | |
| "*.auw2w2g0", | |
| "*.megacortex", | |
| "*.id[RandomIP].[bron_lynn@aol.com].help", | |
| "*.Prandel", | |
| "*.zatrov", | |
| "*.Wx7A6", | |
| "*.syrk", | |
| "*.brusaf", | |
| "*.masok", | |
| "*.junior", | |
| "*.lotej", | |
| "*.Novosof", | |
| "*.sinopal", | |
| "*@cumallover.me*", | |
| "*.com2", | |
| "*.emsisosisoft", | |
| "*.daris", | |
| "NEWS_INGiBiToR.txt", | |
| "*.GRANIT", | |
| "*.rsalive", | |
| "*.format", | |
| "*.bgCIb", | |
| "*.cosakos", | |
| "*.nvetud", | |
| "*.kovasoh", | |
| "*.nelasod", | |
| "*.tsv", | |
| "*.Acuf2", | |
| "*.mogranos", | |
| "*.si…", | |
| "*.Hades666", | |
| "GNNCRY_Readme.txt", | |
| "*RT4BLOCK", | |
| "*.prus", | |
| "*.a800", | |
| "*.c300", | |
| "payload.dll", | |
| "HOW-TO-DECRYPT-FILES.HTM", | |
| "*.{XXXXX-EFEE-6C04-D2DC-A9EFA812DD11}!", | |
| "*.LOVE", | |
| "[*]-HOW-TO-DECRYPT.txt", | |
| "#_#ReadMe#_#.rtf", | |
| "x5gj5_gmG8.log", | |
| "*.litra", | |
| "*.TROLL", | |
| "*.lalabitch", | |
| "*.ntu", | |
| "*.TABGH", | |
| "*.banjo", | |
| "*.ntuseg", | |
| "*.[epta.mcold@gmail.com]", | |
| "*.btchelp@xmpp.jp", | |
| "*.ndarod", | |
| "*.sambo", | |
| "*.WALAN", | |
| "*.limbo", | |
| "*.actor", | |
| "*.bk666", | |
| "*.azero", | |
| ".plomb", | |
| "*.AYE", | |
| ".id-*.[*@*].air", | |
| "*.id-*.[*@*].*", | |
| "*.rencrypted", | |
| "*.MDRL", | |
| "*.btix", | |
| "*.dodoc", | |
| "*.bopador", | |
| "*.novasof", | |
| ".bxtyunh", | |
| "*.ERIS!", | |
| "*.lilocked", | |
| "*.haka", | |
| "*.Persephone666!", | |
| "*.megac0rtx", | |
| "*.Hades666!", | |
| ".zerofucks", | |
| "*.darus", | |
| "*.lurk", | |
| "*.{XXXXXXX-588E-7D5B-AED1-2CD51808DE12}", | |
| "*.madekv120", | |
| "*.sfs", | |
| "*.todar", | |
| "*.lapoi", | |
| "*.madek", | |
| "*.gusau", | |
| "*.diller13", | |
| "*.gehad", | |
| "*.vusad", | |
| "*.berosuce", | |
| "*.budak", | |
| "*.Adame", | |
| "*.YOUR_LAST_CHANCE", | |
| "_RESTORE FILES_.txt", | |
| "*.[Kromber@tutanota.com]", | |
| "*.SKYSTARS", | |
| "*.godes", | |
| "*.herad", | |
| "HOW_TO_DECRYPT.txt", | |
| "*.Pox", | |
| "*.mo7n", | |
| "*.shelbyboom", | |
| ".megac0rtx", | |
| ".[ogorman.linoel@aol.com].help", | |
| "*.basilisque@protonmail_com", | |
| "*.cizer", | |
| "*.dqb", | |
| "*.ExpBoot", | |
| "*.ExpBoot!", | |
| "*.CROWN!?", | |
| "*.o$l", | |
| "*.CROWN", | |
| "*.WHY…", | |
| "*.61yhi", | |
| "*.Acton", | |
| "*.cezor", | |
| "*.upd9ykc65v", | |
| "*.KICK", | |
| "*.popoticus", | |
| "*.lokas", | |
| "*.cs16", | |
| "*.wav_list", | |
| "*.cxk_nmsl", | |
| "*.boooam@cock_li", | |
| "*.actin", | |
| "*.besub", | |
| "*.CAGO", | |
| "*.litar", | |
| "*.isolated", | |
| "*.dcom", | |
| "*.alilibat", | |
| "*.Freezing", | |
| "*.acute", | |
| "*.1500dollars", | |
| "*.chekyshka", | |
| "*.popotic", | |
| "*.nusar", | |
| "*.craftul", | |
| "*.beets!Ransom", | |
| "*.lotep", | |
| "*.adage", | |
| "*.truke", | |
| "*.Amigo", | |
| "*.dmo", | |
| "*.cbs0z", | |
| "*.dalle", | |
| "*.hccapx", | |
| "*.WALAN,", | |
| "*.cap", | |
| "*.litra!Sample", | |
| "*.TROLL,", | |
| "*.neras", | |
| "*.DOCM!Sample", | |
| "*.COPAN", | |
| "*.middleman2020", | |
| "*.lcphr!Ransom", | |
| "*.lcphr", | |
| ".6vr378txi", | |
| "*.orion", | |
| "*.crypted!Sample", | |
| "*.bliun", | |
| "*.poof", | |
| "*.0day", | |
| "*.horon", | |
| "*.poop", | |
| "*.vesad", | |
| "*.zoh", | |
| "*.jsworm", | |
| "JSWORM-DECRYPT.hta", | |
| "*.gerosan", | |
| "*.muslat", | |
| "*.boston", | |
| "*.myskle", | |
| "*.pidom", | |
| "*.euclid", | |
| "*.heroset", | |
| "*.pidon", | |
| "*.kjh", | |
| "*.ERIS", | |
| "*.robbinhood", | |
| "*.[frazeketcham@cnidia.com].eth.hv88g2", | |
| "*.SONIC", | |
| "*.luboversova148", | |
| "*.lanset", | |
| "*.redmat", | |
| "*.dodger", | |
| "*.stone", | |
| "*.3674AD9F-5958-4F2A-5CB7-F0F56A8885EA", | |
| "*.harma", | |
| "*.[randal_inman@aol.com].help", | |
| "*.rezuc", | |
| "*.2du1mj8", | |
| "*.FEROSUS", | |
| "*.hjgdl", | |
| "*.2k19sys", | |
| "*.mogera", | |
| "*.Hermes", | |
| "*.skymap", | |
| "*.[lockhelp@qq.com].gate", | |
| "*.legacy", | |
| "*.datun", | |
| "*.rectot", | |
| "les#.TXT", | |
| "*.les#", | |
| "*.EZDZ", | |
| "*.open_readme.txt.ke3q", | |
| "*.ke3q", | |
| "*.ONYC", | |
| "*.NHCR", | |
| "*ymayka-email@yahoo.com.cryptotes", | |
| "*.[Enigma1crypt@aol.com].ETH", | |
| "*.[DonovanTudor@aol.com].bat", | |
| "*.[SSSDKVNSDFITD]", | |
| "*.Pig4444", | |
| "*.bmn63", | |
| "*.[bitcharity@protonmail.com].com", | |
| "*.[costelloh@aol.com].phoenix", | |
| "*[remarkpaul77@cock.li].JSWORM", | |
| "*.[crypt1style@aol.com].MERS", | |
| "*.n7ys81w", | |
| "*.jack", | |
| "*.ge010gic", | |
| "*.codnet1", | |
| ".codnat1", | |
| "*.codnet", | |
| ".codnat", | |
| "*.ferosas", | |
| "RESTORE_HCEEM_DATA.txt", | |
| "READ_ME.mars", | |
| "*.hceem", | |
| "*.vally", | |
| "*.mars", | |
| "Instructions with your files.txt", | |
| "*.refols", | |
| "*.carcn", | |
| "*.yum", | |
| "_CRYPTED_README.html", | |
| "*.ms13", | |
| "*.grovat", | |
| "ReadME-Prodecryptor@gmail.com.txt", | |
| "*.Mira", | |
| "*.Prodecryptor", | |
| "*.+jabber-theone@safetyjabber.com", | |
| "*.hrosas", | |
| "!QH24_INFO!.rtf", | |
| "*.QH24", | |
| "*.bkc", | |
| "*.mers", | |
| "*.wal", | |
| "*.recry1", | |
| "*.qbix", | |
| "*.aa1", | |
| "*.zoro", | |
| "Инструкция по расшифровке.TXT", | |
| "*.kes$", | |
| "*.condat", | |
| "*.dotmap", | |
| "*.4k", | |
| "*.ge0l0gic_readme.txt", | |
| "*.mamba", | |
| "*.ge0l0gic", | |
| "*.ddos", | |
| "Locked.*", | |
| ".PLUT", | |
| ".jack", | |
| "HowToBackFiles.txt", | |
| "DECRYPT-FILES.html", | |
| "*.non", | |
| "!!!INSTRUCTION_RNSMW!!!.txt", | |
| "*.drweb", | |
| "*.qbtex", | |
| "*.yG", | |
| "*.radman", | |
| "*.[epta.mcold@gmail.com],", | |
| "!INSTRUCTI0NS!.TXT", | |
| "*.666decrypt666", | |
| "*Decryptoroperator@qq.com", | |
| "*.ztsysjz", | |
| "*.lockhelp@qq.gate", | |
| "Decryptyourdata@qq.com", | |
| "*.[w_unblock24@qq.com].ws", | |
| "[Lockhelp@qq.com].Gate", | |
| "*.GGGHJMNGFD", | |
| "*.OOOKJYHCTVDF", | |
| ".eth", | |
| "*.PLUT", | |
| "*.bufas", | |
| "*.codnat1", | |
| "*.codnat", | |
| "*.fordan", | |
| "*.[blellockr@godzym.me].bkc", | |
| ".nampohyu", | |
| "*.berost", | |
| "*.forasom", | |
| "*.{Killback@protonmail.com}KBK", | |
| "*.fedasot", | |
| "*.[staRcRypt@tutanota.com].omerta", | |
| "*.sarut", | |
| "*.Navi", | |
| "*.dutan", | |
| "*.aes128ctr", | |
| "*.roldat", | |
| "*.hofos", | |
| "*.cheetah", | |
| "*.todarius", | |
| "*.FREDD", | |
| "*.Kiratos", | |
| "*.enc_robbinhood", | |
| "*.jzphmsfs", | |
| "*.[zoro4747@gmx.de].zoro", | |
| "*.verasto", | |
| "READ_ME.cube", | |
| "*.sambo,", | |
| "HELP_BY_CROC.TXT", | |
| "*.LDPR", | |
| "warning.txt", | |
| "*.guesswho", | |
| "*.moresa", | |
| "*.burn", | |
| "*.robinhood", | |
| "*.COLORIT", | |
| "*.SAVEYOURDATA", | |
| "*.aescrypt", | |
| "_HELP_INSTRUCTIONS_.TXT", | |
| "*lockhelp@qq.com", | |
| "*.Ryuk", | |
| "*.croc", | |
| "*.norvas", | |
| "*.[absonkaine@aol.com].phoenix", | |
| "*.CRABSLKT", | |
| "*.gotcha", | |
| "*.cube", | |
| "*.SDEN", | |
| "*.obagarmrk", | |
| "*.tater", | |
| "*.pumas", | |
| "*.browec", | |
| "*.hdeaf", | |
| "*.guvara", | |
| "*.tabufa", | |
| "*.tokog", | |
| "*.fuchsia", | |
| "*.etols", | |
| "*.[velasquez.joeli@aol.com]", | |
| "*.gate", | |
| "*.langolier", | |
| "*.spyhunter", | |
| "*.cryptoid", | |
| "*.[adobe-123@tutanota.com].ETH", | |
| "*.Jumper", | |
| "*.major", | |
| "*.raldug", | |
| "*.phoenix", | |
| "*.gropas", | |
| "*.wannacash", | |
| "*.NGSC", | |
| "*.bmps@tutanota.com.major", | |
| "*._Crypted", | |
| "*.roland", | |
| "*.NOLOST", | |
| "*.Marozka", | |
| "*.encryptedALL", | |
| "*.stun", | |
| "*.grovas", | |
| "*.trosak", | |
| "*.tronas", | |
| "*.JLCW2", | |
| "*.[thedecrypt111@qq.com].ETH", | |
| "*.drume", | |
| "*.securityP", | |
| "*.YYYYBJQOQDU", | |
| "ENCRYPTED.TXT", | |
| "*.MDEN", | |
| "README_LOCKED.txt", | |
| "README-NOW.txt", | |
| "*.locker", | |
| "*.proden", | |
| "*.CQQUH", | |
| "*[p4d@tuta.io].com", | |
| "*.luceq", | |
| "*.chech", | |
| "*.[mrpeterson@cock.li].GFS", | |
| "*.suffer", | |
| "*.инструкция по оплате.txt", | |
| "*.metan", | |
| "*.kezoz", | |
| "*.luces", | |
| "*.doples", | |
| "*.pdf_Axffyq_{babyfromparadise666@gmail.com}.p3rf0rm4", | |
| "*.pdf.p3rf0rmr", | |
| "*.{CALLMEGOAT@PROTONMAIL.COM}CMG", | |
| "*.[amber777king@cock.li].amber", | |
| "*.L1LL", | |
| "*.charcl", | |
| "*.UIK1J", | |
| "*.kropun", | |
| "*.jimm", | |
| "*.klope", | |
| "*.[payransom@qq.com].adobe", | |
| "*.jamper", | |
| "---README---.TXT", | |
| "*.[w_decrypt24@qq.com].zq", | |
| "*.Scorpion", | |
| "*.pulsar1", | |
| "*.charck", | |
| "*.kroput1", | |
| "*.[btccrypthelp@cock.li].ETH", | |
| "*.[1701222381@qq.com].ETH", | |
| "*.[decryptprof@qq.com].ETH", | |
| "*.[decryptmyfiles@qq.com].ETH", | |
| "*.[helpfilerestore@india.com].ETH", | |
| "*.[MailPayment@decoder.com].ETH", | |
| "*.Blower@india.com", | |
| "*.bRcrypT", | |
| "*.GILLETTE", | |
| "*.yatron", | |
| "*.kroput", | |
| "*.[plombiren@hotmail.com].plomb", | |
| "Restore_ICPICP_Files.txt", | |
| "HOW-TO-RESTORE-FILES.txt", | |
| "!#_How_to_decrypt_files_$!.txt", | |
| "_如何解密我的文件_.txt", | |
| "How to decrypt.txt", | |
| "*.[help24decrypt@cock.li", | |
| "*.Neptune", | |
| "*.{mattpear@protonmail.com}", | |
| "*.promorad2", | |
| "*.andymarvin", | |
| "*.mamasitaq", | |
| "*.cockista", | |
| "*.crabs", | |
| "*.dy8wud", | |
| "*.[china-decryptor@pm.me]", | |
| "*.kitty", | |
| "*.CIOP", | |
| "*.pfanz", | |
| "*.jcry", | |
| "*.evopro", | |
| "*.{mattpear@protonmail.com}MTP", | |
| "*.Annabelle2", | |
| "*.[help24decrypt@cock.li]", | |
| "*.promock", | |
| "*.promorad", | |
| "HOW TO DECRYPT[1T0tO].txt", | |
| "!_!email__ prusa@goat.si __!..PAYMAN", | |
| "!SBLOCK_INFO!.rtf", | |
| "*.Frendi", | |
| "инструкция по оплате.txt", | |
| "how_to_recver_files.txt", | |
| "*.aqva", | |
| "!#_How_to_decrypt_files_#!", | |
| "SECURITY-ISSUE-INFO.txt", | |
| "! ПРОЧТИ МЕНЯ !.html", | |
| "*.cammora", | |
| "*.SBLOCK", | |
| "*.promoz", | |
| "*.crazy", | |
| "*.ARTEMY", | |
| "*.rontok", | |
| "*.crypt2019", | |
| "*.[crypted_files@qq.com].aqva", | |
| "*.BlackPink", | |
| "*.id.*.crazy", | |
| "!GBLOCK_INFO.rtf", | |
| "*.GBLOCK", | |
| "*.cekisan", | |
| "*.promos", | |
| "*.seed", | |
| "*.jupstb", | |
| "*.KARLS", | |
| "!PEDANt_INFO!.rtf", | |
| "*.mecury", | |
| "*.PLANT", | |
| "#HELP-DECRYPT-FCRYPT1.1#.txt", | |
| "*.infileshop@gmail_com_ID44", | |
| "*.shadi", | |
| "*.dedo", | |
| "*.help24decrypt@qq.com", | |
| "*.[raphaeldupon@aol.com].ETH", | |
| "*.PEDANT", | |
| "*.Encrypted5", | |
| "*.Gefest3", | |
| "ClopReadMe.txt", | |
| "*.frend", | |
| "*.amber", | |
| "!!!READ_IT!!!.txt", | |
| "Readme_Restore_Files.txt", | |
| "Your files are now encrypted.txt", | |
| "HOW_TO_DECRYPT_MY_FILES.txt", | |
| "*.snake4444", | |
| "*.[drwho888@mail.fr].888", | |
| "*.FCrypt", | |
| "*.Clop", | |
| "*.fastrecovery.xmpp.jp", | |
| "*.poyvonm", | |
| "*.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx", | |
| "*.FileSlack", | |
| "*.pluto", | |
| "*.paycoin", | |
| "*.blower", | |
| "*.nosafe", | |
| "*.tuki17@qq.com", | |
| "*.secure", | |
| "*.crypted_pony_test_build*", | |
| "*.YOLO", | |
| "*.qwex", | |
| "*.DESYNC", | |
| "*.crash", | |
| "*.pennywise", | |
| "*.888", | |
| "*.*GEFEST", | |
| "*adobe.gefest", | |
| "*.OOFNIK", | |
| "*.[welesmatron@aol.com].btc", | |
| "*.Mcafee", | |
| "*.mbrcodes", | |
| "*.UNIT09", | |
| "*.Xcri", | |
| "*.telebak", | |
| "*.[buy-decryptor@pm.me]", | |
| "*.adobee", | |
| "*.mafee", | |
| "*.[writehere@qq.com].btc", | |
| "*.GEFEST", | |
| "CRYPTOID_*", | |
| "*.PC-FunHACKED*", | |
| "TrumpHead.exe", | |
| "!README_GRHAN!.rtf", | |
| "*.ppam", | |
| "*.vaca", | |
| "*.heets", | |
| "*.alien", | |
| "*.SPCT", | |
| "anatova.txt", | |
| "anatova.exe", | |
| "170fb7438316.exe", | |
| "CallOfCthulhu.exe", | |
| "*.cripton", | |
| "*.GMBN", | |
| "*.ddpcbi", | |
| "*.[Traher@Dr.Com]", | |
| "*.2lwnPp2B", | |
| "*[gomer_simpson2@aol.com].phobos", | |
| "*._raphaeldupon@aol.com_.btc", | |
| "*.RENSENWARE", | |
| "*.rumba", | |
| "*.AUF", | |
| "*.Tfudeq", | |
| "*.tfudet", | |
| "*.JAMES", | |
| "*.sdwwbrb", | |
| "*.ucftz*", | |
| "*.xcry7684", | |
| "*.eddldzor", | |
| "*.hncdumn", | |
| "*.g^od", | |
| "*.ezzyl", | |
| "*.jundmd@cock.li*", | |
| "*.obfuscated", | |
| "*.rsucozxze", | |
| "*.mdk4y", | |
| "*.GRHAN", | |
| "*.zzzzzzzz", | |
| "*.bvjznsjlo", | |
| "*.sjjpu", | |
| "*.djuvq", | |
| "*.djvup", | |
| "*.djvut", | |
| "*.djvur", | |
| "*.djvus", | |
| "*.uudjvu", | |
| "*.udjvu", | |
| "*djvuu", | |
| "*.tfude", | |
| "*.tro", | |
| "*{alexbanan@tuta.io}.CORP", | |
| ".[ti_kozel@lashbania.tv].*", | |
| "#RECOVERY_FILES#.txt", | |
| "*id-.LyaS", | |
| "$%%! NOTE ABOUT FILES -=!-.html", | |
| "*__{}.VACv2", | |
| "*.pdff", | |
| "*.djvuq", | |
| "*.INDRIK", | |
| "*.recovery_email__retmydata@protonmail.com__*_.aes256.testE", | |
| "*.artilkilin@tuta.io.wq2k", | |
| "*.recovery_email_[retmydata@protonmail.com]*.aes256", | |
| "*.vulston", | |
| "*.SATANA", | |
| "*[decryptdata@qq.com].rar", | |
| "*.to.dernesatiko@mail.com.crypted", | |
| "*.ryx", | |
| "*.[ti_kozel@lashbania.tv].костя", | |
| "*.nostro", | |
| "*.[Unlock24@cock.li].combo", | |
| "*.mouse", | |
| "*.snatch", | |
| "*.bizer", | |
| "*.tunca", | |
| "*.[decrypthelper@protonmail.com].phobos", | |
| "*.locked_by_mR_Anonymous(TZ_HACKERS)", | |
| "*.ducueyuav", | |
| "*.oslawcmme", | |
| "*.Защищено", | |
| "*.Djvuu", | |
| "*.PRCP", | |
| "*.[backtonormal@foxmail.com].adobe", | |
| "*.WORMCRYPT0R", | |
| "*.evolution", | |
| "*.cmsnwned", | |
| "*.ironhead", | |
| "*.ktuhzxpi", | |
| "*.elpvd", | |
| "*.kali", | |
| "*.Mercury", | |
| "*.[avflantuheems1984@aol.com].adobe", | |
| "*.FJ7QvaR9VUmi", | |
| "*.gerber5", | |
| "*.CRYPTR", | |
| "*.XY6LR", | |
| "cmdRansomware.*", | |
| "#RECOVERY_FILES#.*", | |
| "*.decryptgarranty", | |
| "_How to restore files.*", | |
| "_How_To_Decrypt_My_File_.*", | |
| "*.lucky", | |
| "*.PERSONAL_ID*", | |
| "*.garcewa", | |
| "*.danger", | |
| "*.israbye", | |
| "*.[fileslocker@pm.me]", | |
| "*.greystars@protonmail.com", | |
| "*.iaufhhhhfiles_BACK_PLS_READ.html", | |
| "*.iaufhhhfiles_BACK_PLS_READ.html", | |
| "*.hilegofprencrp", | |
| "*.wowreadfordecry", | |
| "*.btc -help-you", | |
| "*.checkdiskenced", | |
| "*.iloveworld", | |
| "*.goforhelp", | |
| "*.encmywork", | |
| "*.[parambingobam@cock.li].adobe", | |
| "*.[mercarinotitia@qq.com].adobe", | |
| "*.crypted_bizarrio@pay4me_in", | |
| "*.DeLpHiMoRiX*", | |
| "*.malwarehunterteam", | |
| "*.demonslay335_you_cannot_decrypt_me!", | |
| "*.peosajwqfk", | |
| "*.online24files@airmail.cc", | |
| "*.risk", | |
| "*.[cyberwars@qq.com].war", | |
| "*.stevenseagal@airmail.cc", | |
| "*.myjob", | |
| "*.lolita", | |
| "*snowpicnic*", | |
| "*SIMMYWARE*", | |
| "how to get back you files.txt", | |
| "*.cccmn", | |
| "aboutYourFiles.*", | |
| "*wall.i", | |
| "#RECOVERY-PC#.*", | |
| "!-GET_MY_FILES-!.*", | |
| "@_RESTORE-FILES_@.*", | |
| "*.Puma", | |
| "*.[yoursalvations@protonmail.ch].neverdies@tutanota.com", | |
| "*.kraussmfz", | |
| "*.PUMAX", | |
| "*.anami", | |
| "*.449o43", | |
| "*.DeLpHiMoRiX!@@@@_@@_@_2018_@@@_@_@_@@@", | |
| "*.[stopencrypt@qq.com].adobe", | |
| "*.Enter", | |
| "*.betta", | |
| "*.INFOWAIT", | |
| "*.FIXT", | |
| "*.fire", | |
| "*.Horsuke", | |
| "*.Vapor", | |
| "*.ispfv", | |
| "*.Bear", | |
| "*.EnyBenied", | |
| "*.BlackHat", | |
| "*.Epoblockl", | |
| "*.DATAWAIT", | |
| "*.010001", | |
| "*.AUDIT", | |
| "*.[papillon9275]", | |
| "*.UKCZA", | |
| "*.YIAQDG", | |
| "*.CQXGPMKNR", | |
| "*.HHFEHIOL", | |
| "*.GrujaRS", | |
| "*.xuy", | |
| "*.crypted034", | |
| "*.FilGZmsp", | |
| "*.krzffw", | |
| "*.impect", | |
| "*.fast", | |
| "*.Ox4444", | |
| "*.6db8", | |
| "*.PTGEPVEKM", | |
| "*.adobe", | |
| "*.JKOUOGVG", | |
| "*.mariacbc", | |
| "*.supportfiless24@protonmail.ch", | |
| "*.SYMMYWARE", | |
| "*.vendetta2", | |
| "*.xxxxx", | |
| "*.CommonRansom", | |
| "*.crypt888", | |
| "*.gdb", | |
| "*.wewillhelp@airmail.cc", | |
| "*.WAND", | |
| "*.[everest@airmail.cc].EVEREST", | |
| "*.FUNNY", | |
| "*.vanss", | |
| "*.SANTANA", | |
| "*.NOT", | |
| "*.beer", | |
| "*.SOLO", | |
| "*.GMPF", | |
| "*.W0YR8", | |
| "*.charm", | |
| "*.birbb", | |
| "TOTALLYLEGIT.EXE", | |
| "*.altdelete@cock.li.district", | |
| "*.ctrlalt@cock.li.district", | |
| "*.THDA", | |
| "*.katyusha", | |
| "*.LGAWPULM", | |
| "*.[mixon.constantine@aol.com].gamma", | |
| "*.101", | |
| "*.zlpzdel", | |
| "*.junked", | |
| "*.DQXOO", | |
| "*.NOBAD", | |
| "*.garrantydecrypt", | |
| "*.BAWSUOOXE", | |
| "*.Kg9EX", | |
| "*.EMAN50", | |
| "*.[crab7765@gmx.de].crab", | |
| "!!!ReadMeToDecrypt.txt", | |
| "*.qweuirtksd", | |
| "#README_GMAN#.rtf", | |
| "!README_GMAN!.rtf", | |
| "*.GMAN", | |
| "*.boost", | |
| "*.ziqzqzdi", | |
| "52036F92.tmp", | |
| "*.FFF", | |
| "*.911", | |
| "*.2xx9", | |
| "*.@decrypt_2017", | |
| "(encrypted)*", | |
| "*zn2016", | |
| "#HOW_DECRYPT_FILES#.html", | |
| "!back_files!.html", | |
| "*.Bill_Clinton@derpymailorg", | |
| "*.nWcrypt", | |
| "*.needkeys", | |
| "*.YAYA", | |
| "*.write_on_email", | |
| "*.needdecrypt", | |
| "*.0402", | |
| "*.NIGGA", | |
| "HOW_DECRYPT_FILES#.html", | |
| "*.eQTz", | |
| "*.aRpt", | |
| "*.3P7m", | |
| "*.3RNu", | |
| "*.rpd", | |
| "*.[oron@india.com].dharma", | |
| "HOW TO RECOVER ENCRYPTED FILES-infovip@airmail.cc.TXT", | |
| "READ_TO_DECRYPT.html", | |
| "*.[embrace@airmail.cc].embrace", | |
| "*[Beamsell@qq.com].bip", | |
| "*[files.restore@aol.com].write", | |
| "#NEWRAR_README#.rtf", | |
| "Files encrypted.html", | |
| "*.backup", | |
| "*[java2018@tuta io].arrow", | |
| "!OoopsYourFilesLocked!.rtf", | |
| "*[RELOCK001@TUTA.IO]", | |
| "*.[btc@fros.cc].btc", | |
| "How To Restore Files.txt", | |
| "*.bgtx", | |
| "Info.hta", | |
| "FILES ENCRYPTED.txt", | |
| "*.DHDR4", | |
| "*.crypted_marztoneb@tutanota_de", | |
| "YOU_MUST_READ_ME.rtf", | |
| "*How to Decrypt Files-*.html", | |
| "*.BaLoZiN", | |
| "*.RJZUNA", | |
| "*@LOCKED", | |
| "*.EMAN", | |
| "*.firmabilgileri", | |
| "*-DECRYPT.txt", | |
| "*.iudgkwv", | |
| "*.[notopen@countermail.com].NOT_OPEN", | |
| "ReadMe_Decryptor.txt", | |
| "!_HOW_RECOVERY_FILES_!.txt", | |
| "READ__IT.txt", | |
| "*.f*cked", | |
| "*-DECRYPT.html", | |
| "*.[paydecryption@qq.com].brrr", | |
| "*.spaß", | |
| "*.olduw", | |
| "*.yoewy", | |
| "*.BDKR", | |
| "*.onlinesupport", | |
| "*.anonymous", | |
| "*.bkp", | |
| "*.ryk", | |
| "*.skype", | |
| "*.CHE808", | |
| "*.parrot", | |
| "*.monro", | |
| "*.NOT_OPEN", | |
| "*.no_more_ransomware", | |
| "*.gamma", | |
| "*.brrr", | |
| "*.Nano", | |
| "*.ITLOCK", | |
| "*.SAVEfiles", | |
| "*.mvp", | |
| "*.hitler", | |
| "*.mammon", | |
| "*.SLAV", | |
| "*.davilarita@mail.com.yyy0", | |
| "*[shivamana@seznam.cz].pip", | |
| "*.KOK08", | |
| "*.eoeo", | |
| "*.FASTBOB", | |
| "*.lockymap", | |
| "*.NEWRAR", | |
| "*.cryptoNar", | |
| "*.partially.cryptoNar", | |
| "*.PICO", | |
| "*.CYBERGOD", | |
| "*.rcrypted", | |
| "*.kvllyatprotonmaildotch", | |
| "*.KOK8", | |
| "*.fsdfsdfsdfsdfsdfsfdsfs", | |
| "How To Decode Files.hta", | |
| "*.BadNews", | |
| "*.cassetto", | |
| "*.sophos", | |
| "*.{incredible0ansha@tuta.io}.ARA", | |
| "*.[backdata@cock.li].CreamPie", | |
| "*.FuckedByGhost", | |
| "*.#__EnCrYpTED_BY_dzikusssT3AM_ransomware!__#", | |
| "*.lockedfile", | |
| "*.WHY", | |
| "*.AlfaBlock", | |
| "# How to Decrypt Files.txt", | |
| "*-Lock.onion", | |
| "*.PrOtOnIs.VaNdElIs", | |
| "*.PrOtOnIs", | |
| "*.Armage", | |
| "*.rent", | |
| "*.fox", | |
| "*.pleaseCallQQ", | |
| "*.lockedgood", | |
| "*.hacked.by.Snaiparul", | |
| "*.ShutUpAndDance", | |
| "*.K8VfiZ", | |
| "*.G8xB", | |
| "*.cmb", | |
| "*.b29", | |
| "*.poolezoor", | |
| "*.id-*.cmb", | |
| "*.KEYPASS", | |
| "*.doubleoffset", | |
| "*.tedcrypt", | |
| "!=How_to_decrypt_files=!.txt", | |
| "*.divine", | |
| "*.wannacryv2", | |
| "*.anonimus.mr@yahoo.com", | |
| "*.dragnea", | |
| "*.RECOVERYOURFILES", | |
| "*.invaded", | |
| "*.incpas", | |
| "*.BARRACUDA", | |
| "*.sdk", | |
| "*.cryptes", | |
| "*.like", | |
| "*.ukrain", | |
| "*.dfjhsalfhsakljfhsljkahfdjklashfdjklh", | |
| "*.black007", | |
| "*.combo", | |
| "*.adapaterson@mail.com.mkmk", | |
| "*0nl1ne*", | |
| "*.locked.zip", | |
| "*.boris", | |
| "*.powerfuldecrypt", | |
| "*.predator", | |
| "*.XERO", | |
| "*.HYENA", | |
| "*.BD.Recovery", | |
| "*.zzz12", | |
| "*king_ouroboros*", | |
| "*.dyaaghemy", | |
| "*.[firmabilgileri@bk.ru]", | |
| "*.DATASTOP", | |
| "*.thunder", | |
| "*.LanRan*", | |
| "*.deep", | |
| "*.TaRoNiS", | |
| "*.desu", | |
| "*.SHRUG2", | |
| "*.[thunderhelp@airmail.cc].thunder", | |
| "*.LanRan2.0.5", | |
| "*.[dsupport@protonmail.com]", | |
| "*.jewsomware", | |
| "*.[Filesreturn247@gmx.de].lock", | |
| "*.##___POLICJA!!!___TEN_PLIK_ZOSTA", | |
| "*.animus", | |
| "*.[evil@cock.lu].EVIL", | |
| "*.[mrbin775@gmx.de].bin", | |
| "*.DATA_IS_SAFE_YOU_NEED_TO_MAKE_THE_PAYMENT_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_LOST_FOREVER_PLEASE_BE_REZONABLE_IS_NOT_A_JOKE_TIME_IS_LIMITED", | |
| "*.XVNAW", | |
| "*.24H", | |
| "*.[eV3rbe@rape.lol].eV3rbe", | |
| "*.SHRUG", | |
| "*.KUAJW", | |
| "*.[btc2018@tutanota.de].meduza", | |
| "*.coder007@protonmail.com", | |
| "*[qmqtt@protonmail.ch].HRM", | |
| "*[qrrqtt@protonmail.ch].HRM", | |
| "*.choda", | |
| "*.ransomcrypt", | |
| "FILES.TXT", | |
| "*.nozelesn", | |
| "*.KRAB", | |
| "*.Aurora", | |
| "*.bomber", | |
| "*.BtcKING", | |
| "*.CyberSCCP", | |
| "*.ssimpotashka@gmail.com", | |
| "*.PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_to_make_the_payment", | |
| "*@cock.email", | |
| "*.recme", | |
| "*.king_ouroboros*", | |
| "*.omerta", | |
| "*.[XAVAX@PM.ME].omerta", | |
| "*.donut", | |
| "*.volcano", | |
| "*.jungle@anonymousspechcom", | |
| "*.Alkohol", | |
| "*.oneway", | |
| "*.ONYX", | |
| "*.fastsupport@xmpp.jp", | |
| "*.BIG4+", | |
| "*.leen", | |
| "*.horsuke@nuke.africa", | |
| "*.DiskDoctor", | |
| "*.qnbqw", | |
| "*.ssananunak1987@protonmail.com.b2fr", | |
| "*.codyprince92@mail.com.ovgm", | |
| "*.fastrecovery@airmail.cc", | |
| "*.reycarnasi1983@protonmail.com.gw3w", | |
| "*.billingsupp", | |
| "*.ndpyhss", | |
| "*.SF", | |
| "*.digiworldhack@tutanota.com", | |
| "RESTORE-SIGRUN.*", | |
| "*id-*.BI_ID", | |
| "*.cryptgh0st", | |
| "*.emilysupp", | |
| "*.RedEye", | |
| "*.AdolfHitler", | |
| "*.crybrazil", | |
| "*.infovip@airmail.cc", | |
| "*.REBUS", | |
| "filesinfo.txt", | |
| "!!!!RESTORE_FILES!!!.txt", | |
| "*.insta", | |
| "*.CONTACTUS", | |
| "*.osk", | |
| "*.[pain@cock.lu].pain", | |
| "*.embrace", | |
| "Decoding help.hta", | |
| "*.karne", | |
| "*.setimichas1971@protonmail.com.b4wq", | |
| "*.decodeme666tutanota_com", | |
| "*.josep", | |
| "*.decodeme666@tutanota_com", | |
| "*.cdrpt", | |
| "*.SEPSIS", | |
| "*.ransomed@india.com", | |
| "*.sigrun", | |
| "*.booknish", | |
| "*.bip", | |
| "*.[Sepsis@protonmail.com].SEPSIS", | |
| "*.MTXLOCK", | |
| "*.RansomAES", | |
| "*.PAUSA", | |
| "*.hac", | |
| "*.[BaYuCheng@yeah.net].china", | |
| "*.UselessFiles", | |
| "*.GrAnoSinSa", | |
| "*.rand", | |
| "HOW DECRIPT FILES.hta", | |
| "*.kcwenc", | |
| "*.mich", | |
| "*.OBLIVION", | |
| "*.cryptfile", | |
| "*.BlackRouter", | |
| "*.pay2me", | |
| "*.Satyr", | |
| "*.sorry", | |
| "*.tron", | |
| "*.sky", | |
| "*.NMCRYPT", | |
| "*@tutanota.com]", | |
| "*@tuta.io]", | |
| "*.Horros", | |
| "*.LolSec", | |
| "Perfect.sys", | |
| "*.d3g1d5", | |
| "*.excuses", | |
| "*.cock.email", | |
| "*.MOLE66", | |
| "*.*.sell", | |
| "UselessDisk.exe", | |
| "*.EGG", | |
| "*.JFCWF", | |
| "wormDll*.dll", | |
| "ScreenLocker_x86.dll", | |
| "SsExecutor_x86.exe", | |
| "Spreader_x86.dll", | |
| "tabDll*.dll", | |
| "Zenis-*.*", | |
| "*.xwz", | |
| "*.Stinger", | |
| "0000-SORRY-FOR-FILES.html", | |
| "READ_ME_HELP.png", | |
| "READ_ME_HELP.txt", | |
| "*.[restorehelp@qq.com].java", | |
| "*.FRS", | |
| "Zenis-Instructions.html", | |
| "*.[batmanbitka1@cock.li].arena", | |
| "*.koreaGame", | |
| "*.improved", | |
| "*.[volcano666@tutanota.de].volcano", | |
| "*@adsoleware.com*", | |
| "*.kwaaklocked", | |
| "_XiaoBa_Info_.hta", | |
| "*.XiaoBa", | |
| "*.cypher", | |
| "*.bananaCrypt", | |
| "*BlockBax*", | |
| "ownertrust.txt", | |
| "qwerty-pub.key", | |
| "*.igza4c", | |
| "*.Nutella", | |
| "*.[everbe@airmail.cc].everbe", | |
| "*.Sil3nt5pring", | |
| "*.Crab", | |
| "*.jodis", | |
| "*.jes", | |
| "*.Bitconnect", | |
| "*.arrow", | |
| "*.contact-me-here-for-the-key-admin@adsoleware.com", | |
| "*.leenapidx", | |
| "*.creeper", | |
| "*.Encrypted[BaYuCheng@yeah.net].XiaBa", | |
| "*.styver", | |
| "*.leenapidx@snakebite.com.hrhr", | |
| "*.YOU-ARE-FUCKED-BY-BALILUWARE-(CODED-BY-HEROPOINT)", | |
| "*.frmvrlr2017", | |
| "*.SUSPENDED", | |
| "Restore Files.TxT", | |
| "*.ANNABELLE", | |
| "*.messenger-*", | |
| "*.[ID62133703]", | |
| "*.nazcrypt", | |
| "*.THANATOS", | |
| "*.ransomwared", | |
| "*.saturn", | |
| "*.干物妹！", | |
| "*.happyness", | |
| "*[ignatevv330@gmail.com].java", | |
| "*fuga139gh@dr.com*", | |
| "*.Tornado", | |
| "*.david", | |
| "*.defender", | |
| "*.blank", | |
| "matrix-readme.rtf", | |
| "WhatHappenedWithFiles.rtf", | |
| "WhatHappenedWithMyFiles.rtf", | |
| "Readme-Matrix.rtf", | |
| "#_#WhatWrongWithMyFiles#_#.rtf", | |
| "*_[LINERSMIK@NAVER.COM][JINNYG@TUTANOTA", | |
| "*.honor", | |
| "*.twist", | |
| "*ReadMe_Decryptor.txt", | |
| ".[decryptor@cock.li].dcrtr", | |
| "*.blackruby", | |
| "*.justice", | |
| "*.adam", | |
| "*...Files-Frozen-NEED-TO-MAKE-PAYMENT…", | |
| "*.[GuardBTC@cock.li].java", | |
| "*.bunny", | |
| "*.lockme", | |
| "*.DREAM", | |
| "*.same", | |
| "*.write", | |
| "*.b89b", | |
| "*.GDCB", | |
| "*.[decrypthelp@qq.com].java", | |
| "*.block", | |
| "*.DEUSCRYPT", | |
| "*.notfoundrans", | |
| "*.howcanihelpusir", | |
| "*.happenencedfiles", | |
| "*.AreYouLoveMyRansFile", | |
| "*.country82000", | |
| "*.insane", | |
| "*.qwerty", | |
| "*.LOCKED_BY_pablukl0cker", | |
| "*.[insane@airmail.cc].insane", | |
| "*.velso", | |
| "*.[stopstorage@qq.com].java", | |
| "*.[bacon@oddwallps.com].java", | |
| "*.PLANETARY", | |
| "*.CryptWalker", | |
| "*.Infinite", | |
| "*.[satan2018@protonmail.com].java", | |
| "*.LTML", | |
| "*.[decodingfiles@tuta.io].java", | |
| "*.kryptonite", | |
| "*.Server", | |
| "*.leon", | |
| "*.vrmrkz", | |
| "*.1btc", | |
| "*.[Bas_ket@aol.com].java", | |
| "*.id-02B52D6C.[Bas_ket@aol.com].java", | |
| "*.sysdown", | |
| "*.gigahertz", | |
| "*.rapid", | |
| "*.triple_m", | |
| "*.info", | |
| "*.weapologize", | |
| "*.tastylock", | |
| "*.blind2", | |
| "*.STOP", | |
| "*.wtf", | |
| "*.[supp01@arimail.cc].napoleon", | |
| "*.File", | |
| "*.[pain@onefinedstay.com].java", | |
| "*.godra", | |
| "*.maniac", | |
| "*.VENDETTA", | |
| "*.[Hardcorrr@protonmail.com].java", | |
| "*.[Hardcorr@protonmail.com].java", | |
| "*.satan", | |
| "*.fix", | |
| "*.GORILLA", | |
| "*.CHRISTMAS", | |
| "*.[slaker@india.com]*.wallet", | |
| "*.492", | |
| "*.Cyclone", | |
| "*.katipuneros", | |
| "*.styx", | |
| "*.RDWF", | |
| "*.wmfxdqz", | |
| "*.Work", | |
| "*.noblis", | |
| "*.DS335", | |
| "*.[skeleton@rape.lol].skeleton", | |
| "*.e4m", | |
| "*.encencenc", | |
| "*.executioner", | |
| "*.CerBerSysLocked0009881", | |
| "*.spider", | |
| "*.[blind@cock.li].blind", | |
| "*.0wn3dyou", | |
| "*.Frivolity", | |
| "*.lime", | |
| "*.[paradisecity@cock.li].arena", | |
| "_READ_ME_FOR_DECRYPT.txt", | |
| "*.[amagnus@india.com].wallet", | |
| "*.eTeRnItY", | |
| "*.bit", | |
| "*.dxjay", | |
| "*.dwbiwty", | |
| "*.xhspythxn", | |
| "*.fbuvkngy", | |
| "*.RansomMine", | |
| "*.MTC", | |
| "*.napoleon", | |
| "*.dlenggrl", | |
| "*.TEST", | |
| "*.GOTYA", | |
| "*.maxicrypt", | |
| "*.[maxicrypt@cock.li].maxicrypt", | |
| "*.encrptd", | |
| "*.vpgvlkb", | |
| "*.areyoulovemyrans", | |
| "*.shadow", | |
| "*.[suupport@protonmail.com].scarab", | |
| "*.cock.li", | |
| "*.aajf", | |
| "*.iGotYou", | |
| "*.Ipcrestore", | |
| "*.PHOBOS", | |
| "*.fairytail", | |
| "*.fucku", | |
| "*.basslock", | |
| "*.wdie", | |
| "*.wsmile", | |
| "*.wndie", | |
| "*.0000", | |
| "*.RASTAKHIZ", | |
| "*.PANDA", | |
| "*.BIG1", | |
| "*.TRUE", | |
| "*.am", | |
| "*.kill", | |
| "*.kimchenyn", | |
| "*.XZZX", | |
| "*.fat32", | |
| "*.##ENCRYPTED_BY_pablukl0cker##", | |
| "*aes_ni_gov", | |
| "*.aes_ni", | |
| "*.bloked", | |
| "*.cripted", | |
| "*.filesfucked", | |
| "*.cryptx*", | |
| "*.how_to_recover*.*", | |
| "*.help_restore*.*", | |
| "*.restore_fi*.*", | |
| "*.ukr.net*", | |
| "*.qq_com*", | |
| "Wo_sind_meine_Dateien.htm*", | |
| "*.fake", | |
| "*.cobra", | |
| "*].block", | |
| "!!!GetBackData!!!.txt", | |
| "*.HRM", | |
| "*.skvtb", | |
| "*.game", | |
| "*.Losers", | |
| "*.gr3g", | |
| "*.oni", | |
| "*.sinta", | |
| "*.libbywovas@dr.com.gr3g", | |
| "*.xiaoba33", | |
| "*.xiaoba32", | |
| "*.xiaoba31", | |
| "*.xiaoba30", | |
| "*.xiaoba29", | |
| "*.xiaoba28", | |
| "*.xiaoba27", | |
| "*.xiaoba26", | |
| "*.xiaoba25", | |
| "*.xiaoba24", | |
| "*.xiaoba23", | |
| "*.xiaoba22", | |
| "*.xiaoba21", | |
| "*.xiaoba20", | |
| "*.xiaoba19", | |
| "*.xiaoba18", | |
| "*.xiaoba17", | |
| "*.xiaoba16", | |
| "*.xiaoba15", | |
| "*.xiaoba14", | |
| "*.xiaoba13", | |
| "*.xiaoba12", | |
| "*.xiaoba11", | |
| "*.xiaoba10", | |
| "*.xiaoba9", | |
| "*.xiaoba8", | |
| "*.xiaoba7", | |
| "*.xiaoba6", | |
| "*.xiaoba5", | |
| "*.xiaoba4", | |
| "*.xiaoba3", | |
| "*.xiaoba2", | |
| "*.XiaoBa1", | |
| "*.XiaoBa34", | |
| "*.colecyrus@mail.com.b007", | |
| "allcry_upx.exe", | |
| "*-PLIIKI.txt", | |
| "dispci.exe", | |
| "cscc.dat", | |
| "infpub.dat", | |
| "LEIA_ME.txt", | |
| "*.lordofshadow", | |
| "*.SaherBlueEagleRansomware", | |
| "*.[MAXVISION@SECMAIL.PRO].CRIPTOGRAFADO", | |
| "!____________DESKRYPT@TUTAMAIL.COM________.rar", | |
| "How_Decrypt_Files.hta", | |
| "*.Ordinal", | |
| "*.aes!", | |
| "READ_ME_FOR_DECRYPT_*.txt", | |
| "*.ihsdj", | |
| "*.kgpvwnr", | |
| "*.LIN", | |
| "*.CHAK", | |
| "*.Chartogy", | |
| "*.viiper", | |
| "*.x1881", | |
| "*.stroman", | |
| "*.asasin", | |
| "*.BUGWARE", | |
| "*.SENRUS17", | |
| "!! RETURN FILES !!.txt", | |
| "*.loveransisgood", | |
| "*.PayDay", | |
| "*.allcry", | |
| "*.lockd", | |
| "*.PRIVAT66", | |
| "*.SHARK", | |
| "005-DO-YOU-WANT-FILES.html", | |
| "*.#", | |
| "*.CyberSoldiersST", | |
| "*.wyvern", | |
| "*.technicy", | |
| "*.cyberdrill", | |
| "*.ZW", | |
| "*.myransext2017", | |
| "*.ykcol", | |
| "*.XmdXtazX.", | |
| "*.albertkerr94@mail.com.m5m5", | |
| "*.cryptojoker", | |
| "*.Doxes", | |
| "*.XmdXtazX", | |
| "*.blind", | |
| "*.Locked_file", | |
| "*.HeroesOftheStorm", | |
| "*.dian", | |
| "*.mind", | |
| "*.H_F_D_locked", | |
| "*.reaGAN", | |
| "*.INCANTO", | |
| "*.pablukCRYPT", | |
| "*.gocr", | |
| "*.revolution", | |
| "*.disposed2017", | |
| "*.armadilo1", | |
| "*.trevinomason1@mail.com.vsunit", | |
| "*.[Brazzers@aolonline.top].arena", | |
| "_RECoVERY_+*.*", | |
| "*.__dilmaV1", | |
| "*.hacked", | |
| "*.[assistance@firemail.cc].nuclear", | |
| "READ_THIS_FILE_1.TXT", | |
| "*.pnr", | |
| "*.{ljspqk7@aol.com}.BRT92", | |
| "*.ILLNEST", | |
| "*.OhNo!", | |
| "*.akira", | |
| "*..txt", | |
| "*.3nCRY", | |
| "*.clinTON", | |
| "RESTORE_INFO-*.txt", | |
| "*.BUSH", | |
| "*.[black.world@tuta.io].nuclear", | |
| "*.CryptedOpps", | |
| "*.crypt12", | |
| "*.OTR", | |
| "Important_Read_Me.txt", | |
| "*.JezRoz", | |
| "*.UNLIS", | |
| "*.granny", | |
| "*.shinigami", | |
| "*.PA-SIEM", | |
| "*.flat", | |
| "TUTORIEL.bmp", | |
| "*.xolzsec", | |
| "*.Flux", | |
| "*.Blocked2", | |
| "*.wooly", | |
| "*.nuclear", | |
| "*.area", | |
| "*.EMPTY", | |
| "*.arena", | |
| "lukitus.html", | |
| "*.zuzya", | |
| "*.{saruman7@india.com}.BRT92", | |
| "*.CYRON", | |
| "*.#Locky", | |
| "*.ERROR", | |
| "*.EV", | |
| "*.lokitus", | |
| "*.lukitus-tiedostopäätettä", | |
| "*.fmoon", | |
| "*.cesar", | |
| "*.lukitus", | |
| "*.KK", | |
| "*.prosperous666", | |
| "*.[actum_signum@aol.com].onion", | |
| "*.encrypted[Payfordecrypt@protonmail.com]", | |
| "*.enc", | |
| "*.anubi", | |
| "*.D2550A49BF52DFC23F2C013C5", | |
| "*.LEGO", | |
| "*.Cerber_RansomWare@qq.com", | |
| "*.0x009d8a", | |
| "*.3301", | |
| "*.ZABLOKOWANE", | |
| "*.pabluklocker", | |
| "*.cezar", | |
| "*.cnc", | |
| "*.trump", | |
| "*.Crypton", | |
| "*.rumblegoodboy", | |
| "*.BONUM", | |
| "*.[cho.dambler@yandex.com]", | |
| "diablo6-*.htm", | |
| "*.DIABLO6", | |
| "*.PEDO", | |
| "*.HELLO", | |
| "*.ACTUM", | |
| "*.OGONIA", | |
| "*.WAmarlocked", | |
| "!## DECRYPT FILES ##!.txt", | |
| "*.nopasaran", | |
| "*.gryphon", | |
| "ebay-msg.html", | |
| "ebay_was_here", | |
| "*.ebay", | |
| "*.491", | |
| "*.mtk118", | |
| "*.490", | |
| "*.shutdown57", | |
| "*.PIRATE", | |
| "*.wxdrJbgSDa", | |
| "*.sea", | |
| "*.PLIN", | |
| "*.726", | |
| "*.SEVENDAYS", | |
| "*.nemesis", | |
| "*.ocean", | |
| "*.rose", | |
| "*.[avalona.toga@aol.com].blocking", | |
| "*.Node0", | |
| "*.supported2017", | |
| "RECOVER-FILES.html", | |
| "READ_ME_ASAP.txt", | |
| "_iWasHere.txt", | |
| "!!!SAVE YOUR FILES!.bmp", | |
| "!!!!!SAVE YOUR FILES!!!!.txt", | |
| "@decrypt_your_files.txt", | |
| "HowToDecryptIMPORTANT!.txt", | |
| "*.WINDOWS", | |
| "*.bbqb", | |
| "*.725", | |
| "*.DG", | |
| "*.Srpx", | |
| "*.freefoam", | |
| "*.MyChemicalRomance4EVER", | |
| "*.extension.srpx", | |
| "*.fuck_you_av_we_are_not_globe_fake", | |
| "*.BRT92", | |
| "*.qwqd", | |
| "IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT", | |
| "*.TGIF", | |
| "*.snake", | |
| "*.MOLE03", | |
| "*.MOLE04", | |
| "*.Petya", | |
| "*.HAPP", | |
| "*.bam!", | |
| "*.Atom", | |
| "*.GOTHAM", | |
| "*.skunk", | |
| "*.symbiom_ransomware_locked", | |
| "*.CK", | |
| "*.HUSTONWEHAVEAPROBLEM@KEEMAIL.ME", | |
| "*.yl", | |
| "*.ZAYKA", | |
| "*.NOOB", | |
| "*.crptd", | |
| "Instruction for file recovery.txt", | |
| "*.[mich78@usa.com]", | |
| "*.Reyptson", | |
| "*.explorer", | |
| "*.au1crypt", | |
| "*.s1crypt", | |
| "*.alosia", | |
| "*.korea", | |
| "*.POHU", | |
| "*.Ransed", | |
| "*.EXTE", | |
| "_HELP_INSTRUCTION.TXT", | |
| "*.Malki", | |
| "*.707", | |
| "*.A604AF9070", | |
| "*.scorpio", | |
| "*id-*_[*@*.*].*", | |
| "*.Cry128", | |
| "*.Cry36", | |
| "*.Cry9", | |
| "*.xz", | |
| "*.readme_txt", | |
| "Ransom.rtf", | |
| "*.OXR", | |
| "*.acc", | |
| "*.MOLE01", | |
| "*.3ncrypt3d", | |
| "*.AZER", | |
| "_INTERESTING_INFORMACION_FOR_DECRYPT.TXT", | |
| "*.dcry", | |
| "*.MOLE00", | |
| "*.LoveYou", | |
| "*.z3r0", | |
| "*.4x82N", | |
| "*.63vc4", | |
| "*.BELGIAN_COCOA", | |
| "RESTORE-.-FILES.txt", | |
| "*.moments2900", | |
| "*.0x004867", | |
| "*.MMM", | |
| "*.rat", | |
| "*.aleta", | |
| "*.ranrans", | |
| "*.lalabitch,", | |
| "*.gankLocked", | |
| "*.ipygh", | |
| "*.via", | |
| "dllhost.dat", | |
| "FE04.tmp", | |
| "027cc450ef5f8c5f653329641ec1fed9*.*", | |
| "petwrap.exe", | |
| "*.lamo", | |
| "File_Encryption_Notice.txt", | |
| "*.suppose666", | |
| "*.mention9823", | |
| "*.breeding123", | |
| "*.sux", | |
| "*.cfm", | |
| "*.Wana Decrypt0r Trojan-Syria Editi0n", | |
| "Paxynok.html", | |
| "*.pscrypt", | |
| "*.a990", | |
| "Tempimage.jpg", | |
| "*.Tesla", | |
| "WannaCry.TXT", | |
| "*.kuntzware", | |
| "*.nsmf", | |
| "*.Facebook", | |
| "*.pizdosik", | |
| "*.[resque@plague.desi].scarab", | |
| "*.sux.AES128", | |
| "*.cspider", | |
| "*.[teroda@bigmir.net].masterteroda@bigmir.net", | |
| "*.zbt", | |
| "*.MOLE02", | |
| "your_key.rsa", | |
| "OkuBeni.txt", | |
| "*@*.blocking", | |
| "*.ogre", | |
| "*.tax", | |
| "StrutterGear.exe", | |
| "ReadMe_Important.txt", | |
| "Sifre_Coz_Talimat.html", | |
| "*.whycry", | |
| "!READ.htm", | |
| "!_ИНСТРУКЦИЯ_!.txt", | |
| "*.cr020801", | |
| "*.cerber6", | |
| "*.netn6", | |
| "*.rnsmwre", | |
| "*.ghost", | |
| "*.scarab", | |
| "IF_YOU_WANT_TO_GET_ALL_YOUR_FILES_BACK_PLEASE_READ_THIS.TXT", | |
| "*.R4bb0l0ck", | |
| "*.TraNs", | |
| "#HOW_TO_UNRIP#.txt", | |
| "*.BeethoveN", | |
| "* .tdelf", | |
| "*.spectre", | |
| "mood-ravishing-hd-wallpaper-142943312215.jpg", | |
| "Blooper.exe", | |
| "SintaLocker.exe", | |
| "SintaRun.py", | |
| "*.switch", | |
| "*.payforunlock", | |
| "HOW TO RECOVER ENCRYPTED FILES.TXT", | |
| "README_FOR_DECRYPT.txt", | |
| "*.dolphin", | |
| "*.dviide", | |
| "*.sVn", | |
| "*.R3K7M9", | |
| "*.BMCODE", | |
| "*.zilla", | |
| "*.RaaS", | |
| "*.resurrection", | |
| "*.lost", | |
| "*.ram", | |
| "*.master", | |
| "*.brickr", | |
| "READ_DECRYPT_FILES.txt", | |
| "*.ramen", | |
| "*.TRMT", | |
| "*.gommemode", | |
| "*.andonio", | |
| "*.phantom", | |
| "*.r3store", | |
| "Read me for help thanks.txt", | |
| "*.imsorry", | |
| "help_to_decrypt.txt", | |
| "*.YYTO", | |
| "*.read_to_txt_file.yyto", | |
| "*.beep", | |
| "*.666", | |
| "AArI.jpg", | |
| "*.crying", | |
| "*.antihacker2017", | |
| "*.theworldisyours", | |
| "*.spora", | |
| "*.sexy", | |
| "*.realfs0ciety@sigaint.org.fs0ciety", | |
| "*.pays", | |
| "*.payrms", | |
| "*.paymts", | |
| "*.paymrss", | |
| "*.paym", | |
| "*.lol", | |
| "*.madebyadam", | |
| "*.locklock", | |
| "*.lcked", | |
| "*.kyra", | |
| "*.kernel_time", | |
| "*.kernel_pid", | |
| "*.kernel_complete", | |
| "*.ifuckedyou", | |
| "*.grt", | |
| "*.crypte", | |
| "*.cbu1", | |
| "*-webmafia@asia.com_donald@trampo.info", | |
| "*.beef", | |
| "*.write_us_on_email", | |
| "*.LIGHTNING", | |
| "*.xfile", | |
| "DECRYPTION.TXT", | |
| "*.oled", | |
| "*.wtdi", | |
| "*.4rwcry4w", | |
| "*.Encrypted_By_VMola.com", | |
| "*.wlu", | |
| "Restore_maysomware_files.html", | |
| "*.maysomware", | |
| "*.damoclis", | |
| "*.decrypter@tutanota.com", | |
| "*.VisionCrypt", | |
| "*.pwned", | |
| "how_to_back_files.html", | |
| "*.hNcrypt", | |
| "*.~xdata~", | |
| "*.b0ff", | |
| "Galaperidol.exe", | |
| "HOW_CAN_I_DECRYPT_MY_FILES.txt", | |
| "*.xdata", | |
| "Hello There! Fellow @kee User!.txt", | |
| "*.kee", | |
| "*.grux", | |
| "Restore_your_files.txt", | |
| "READ_ME.html", | |
| "*.mordor", | |
| "*.die", | |
| "*.SaMsUnG", | |
| "!#_DECRYPT_#!.inf", | |
| "*.nuke55", | |
| "*.onyon", | |
| "*.blocked", | |
| "!Please Read Me!.txt", | |
| "!WannaDecryptor!.exe.lnk", | |
| "*.DARKCRY", | |
| "*.wincry", | |
| "*.wncrypt", | |
| "WannaCrypt 4.0.exe", | |
| "t.wry", | |
| "*.vCrypt1", | |
| "*.theva", | |
| "tor.exe", | |
| "tasksche.exe", | |
| "wcry.zip", | |
| "taskhsvc.exe", | |
| "taskse.exe", | |
| "taskdl.exe", | |
| "*.pky", | |
| "*.eky", | |
| "wcry.exe", | |
| "Wannacry.exe", | |
| "@WanaDecryptor@.*", | |
| "*.slvpawned", | |
| "*.WCRYT", | |
| "*.WRNY", | |
| "*.LOCKED.txt", | |
| "*.wncryt", | |
| "*.wnry", | |
| "*.viki", | |
| "RESTORE-12345-FILES.TXT", | |
| "*.donation1@protonmail.ch.12345", | |
| "*.block_file12", | |
| "*.@decrypt2017", | |
| "*.vdul", | |
| "*.2cXpCihgsVxB3", | |
| "*.son", | |
| "loptr-*.htm", | |
| "*.paycyka", | |
| "*.medal", | |
| "*.bagi", | |
| "@Please_Read_Me@.txt", | |
| "*.wncry", | |
| "_!!!_README_!!!_*", | |
| "_!!!_README_!!!_*_.hta", | |
| "_!!!_README_!!!_*_ .txt", | |
| "*.news", | |
| "*.corrupted", | |
| "HOW_TO_DECRYPT_FILES.html", | |
| "*.shifr", | |
| "DECRYPT_INFO.txt", | |
| "*.FailedAccess", | |
| "Cversions.2.db", | |
| "*.helppme@india.com.*", | |
| "ReadME_Decrypt_Help_*.html", | |
| "*.fartplz", | |
| "* .vCrypt1", | |
| "*.xncrypt", | |
| "*.Lockify", | |
| "*.htrs", | |
| "*.cryptowin", | |
| "*.owned", | |
| "*.x0lzs3c", | |
| "*.UIWIX", | |
| "*.CRYPTOBOSS", | |
| "*.loptr", | |
| "*.jaff", | |
| "*.bitkangoroo", | |
| "*.cloud", | |
| "zcrypt.exe", | |
| "*.uk-dealer@sigaint.org", | |
| "*_luck", | |
| "*.decrypt2017", | |
| "*.[admin@hoist.desi].*.WALLET", | |
| "*.[crysis@life.com].*.WALLET", | |
| "*.[SHIELD0@USA.COM].*.WALLET", | |
| "#_RESTORING_FILES_#.TXT", | |
| "*.haters", | |
| "*.anon", | |
| "*.amnesia", | |
| "*.keepcalm", | |
| "*.MIKOYAN", | |
| "RESTORE_FILES.HTML", | |
| "*.WWW", | |
| "*.CRYPTED000007", | |
| "*.HELPPME@INDIA.COM.ID83994902", | |
| "HOW_RETURN_FILES.TXT", | |
| "*.MAYA", | |
| "*.CONTACT_TARINEOZA@GMAIL.COM", | |
| "*.CRYPTOBYTE", | |
| "*.AES", | |
| "NOTE;!!!-ODZYSKAJ-PLIKI-!!!.TXT", | |
| "INSTRUCTION_FOR_HELPING_FILE_RECOVERY.txt", | |
| "*.ADR", | |
| "*.NM4", | |
| "DesktopOsiris.*", | |
| "OSIRIS-*.*", | |
| "redchip2.exe", | |
| "*.LOLI", | |
| "ATLAS_FILES.txt", | |
| "*.whatthefuck", | |
| "*.loveyouisreal", | |
| "*.okokokokok", | |
| "*.ranranranran", | |
| "READ_IT_FOR_GET_YOUR_FILE.txt", | |
| "*.psh", | |
| "*.GETREKT", | |
| "!!! READ THIS - IMPORTANT !!!.txt", | |
| "*.aes_ni_0day", | |
| "*.JEEPERS", | |
| "PAYMENT-INSTRUCTIONS.TXT", | |
| "*.LOCKOUT", | |
| "*.ATLAS", | |
| "*.FLATCHER3@INDIA.COM.000G", | |
| "*.AES-NI", | |
| "*.DEXTER", | |
| "*.CONFICKER", | |
| "*.ONION", | |
| "*.[NO.TORP3DA@PROTONMAIL.CH].WALLET", | |
| "*.LCKD", | |
| "*.MOLE", | |
| "*.RANSOM", | |
| "*.lambda.l0cked", | |
| "009-READ-FOR-DECCCC-FILESSS.html", | |
| "_READ_THI$_FILE_*", | |
| "*.I'WANT MONEY", | |
| "*.gembok", | |
| "!Decrypt-All-Files-*.txt", | |
| "*.[GOFMEN17@YA.RU],CRP", | |
| "*.SERP", | |
| "*.kilit", | |
| "0_HELP_DECRYPT_FILES.HTM", | |
| "HUR_DEKRYPTERA_FILER.html", | |
| "HUR_DEKRYPTERA_FILER.txt", | |
| "*.LAMBDA.LOCKED", | |
| "*.ADMIN@BADADMIN.XYZ", | |
| "*.SKJDTHGHH", | |
| "*.LOCK75", | |
| "*.B10CKED", | |
| "*.A95436@YA.RU", | |
| "*.IWANT", | |
| "*.Fuck_You", | |
| "Recupere seus arquivos aqui.txt", | |
| "READ TO UNLOCK FILES.salsa.*.html", | |
| "*.SALSA222", | |
| "*.NUMBERDOT", | |
| "How Decrypt My Files.lnk", | |
| "How_Decrypt_My_Files", | |
| "*.CRADLE", | |
| "*.ID-7ES642406.CRY", | |
| "READ ME ABOUT DECRYPTION.txt", | |
| "*.Do_not_change_the_file_name.cryp", | |
| "*.pr0tect", | |
| "*.android", | |
| "*_READ_THIS_FILE_*_*", | |
| "*.btcware", | |
| "*drakosho_new@aol.com*", | |
| "*.AngleWare", | |
| "*.zorro", | |
| "*.CIFGKSAFFSFYGHD", | |
| "*.A9V9AHU4", | |
| "*.payfordecrypt", | |
| "OKU.TXT", | |
| "ZINO_NOTE.TXT", | |
| "*.ZINO", | |
| "*.kirked", | |
| "*.CRPTXXX", | |
| "HOW_TO_FIX_!.TXT", | |
| "*.[BRAINCRYPT@INDIA.COM].BRAINCRYPT", | |
| "*.pizdec", | |
| "*.REVENGE ", | |
| "!!!READ_TO_UNLOCK!!!.TXT", | |
| "*.openforyou@india.com", | |
| "*.warn_wallet", | |
| "*.nemo-hacks.at.sigaint.org", | |
| "*.MATRIX", | |
| "Crytp0l0cker.Upack.dll", | |
| "Crytp0l0cker.dll", | |
| "Crytp0l0cker.exe", | |
| "decrypted_files.dat", | |
| "padcryptUninstaller.exe", | |
| "PadCrypt.exe", | |
| "Vape Launcher.exe", | |
| "READ_ME_!.txt", | |
| "*.enjey", | |
| "Aescrypt.exe", | |
| "*.GG", | |
| "*.[PINGY@INDIA.COM]", | |
| "*.WORMKILLER@INDIA.COM.XTBL", | |
| "*.CEBER3", | |
| "IF_WANT_FILES_BACK_PLS_READ.html", | |
| "*.iaufkakfhsaraf", | |
| "_HELP_HELP_HELP_*", | |
| "zXz.html", | |
| "*.zXz", | |
| "VictemKey_*_*", | |
| "HVORDAN_DU_GENDANNER_FILER.html", | |
| "HVORDAN_DU_GENDANNER_FILER.txt", | |
| "HELP_ME_PLEASE.txt", | |
| "!_RECOVERY_HELP_!.txt", | |
| "PLEASE-READIT-IF_YOU-WANT.html", | |
| "*.filegofprencrp", | |
| "COME_RIPRISTINARE_I_FILE.*", | |
| "fattura_*.js", | |
| "*_steaveiwalker@india.com_", | |
| "COMO_ABRIR_ARQUIVOS.txt", | |
| "*info@kraken.cc_worldcza@email.cz", | |
| "*.kr3", | |
| "COMO_RESTAURAR_ARCHIVOS.txt", | |
| "COMO_RESTAURAR_ARCHIVOS.html", | |
| "*.ENCR", | |
| "*.[File-Help@India.Com].mails", | |
| "damage@india.com*", | |
| "*.tmp.exe", | |
| "What happen to my files.txt", | |
| "*.jeepdayz@india.com", | |
| "*.BarRax", | |
| "*.damage", | |
| "*.locked-*", | |
| "*.jey", | |
| "*.CRYPTOSHIEL", | |
| "*.cfk", | |
| "ASSISTANCE_IN_RECOVERY.txt", | |
| "#_DECRYPT_ASSISTANCE_#.txt", | |
| "*.lfk", | |
| "_HELP_HELP_HELP_*.hta", | |
| "_HELP_HELP_HELP_*.jpg", | |
| "BTC_DECRYPT_FILES.txt", | |
| "*.TheTrumpLockerp", | |
| "*.TheTrumpLockerf", | |
| "*.d4nk", | |
| "*.x3mpro", | |
| "READ-READ-READ.html", | |
| "*.weencedufiles", | |
| "*.jse", | |
| "*.powned", | |
| "[KASISKI]*", | |
| "INSTRUCCIONES.txt", | |
| "@_USE_TO_FIX_*.txt", | |
| "*.happydayzz", | |
| "*.hasp", | |
| "001-READ-FOR-DECRYPT-FILES.html", | |
| "DECRYPT_INFORMATION.html", | |
| "Rans0m_N0te_Read_ME.txt", | |
| "email-vpupkin3@aol.com*", | |
| "*.hnyear", | |
| "*.hnumkhotep@india.com.hnumkhotep", | |
| "*.wowwhereismyfiles", | |
| "*.decryptional", | |
| "*.wowreadfordecryp", | |
| "*.7zipper", | |
| "*.youransom", | |
| "*.gui", | |
| "*.Harzhuangzi", | |
| "*.encryptedyourfiles", | |
| "*HERMES", | |
| "[amanda_sofost@india.com].wallet", | |
| "*.wcry", | |
| "*.velikasrbija", | |
| "*.razarac", | |
| "*.serpent", | |
| "*.msj", | |
| "*.szesnl", | |
| "_DECRYPT_INFO_szesnl.html", | |
| "000-IF-YOU-WANT-DEC-FILES.html", | |
| "*.evillock", | |
| "*.letmetrydecfiles", | |
| "*.yourransom", | |
| "*.lambda_l0cked", | |
| "*.gefickt", | |
| "*.HakunaMatata", | |
| "*.CRYPTOSHIELD", | |
| "*.weareyourfriends", | |
| "MERRY_I_LOVE_YOU_BRUCE.hta", | |
| "How decrypt files.hta", | |
| "unCrypte@outlook.com*", | |
| "decipher_ne@outlook.com*", | |
| "*.potato", | |
| "*.otherinformation", | |
| "*.vxLock", | |
| "*.rdmk", | |
| "*.paytounlock", | |
| "TRY-READ-ME-TO-DEC.html", | |
| "EMAIL_*_recipient.zip", | |
| "*.sage", | |
| "*garryweber@protonmail.ch", | |
| "LEER_INMEDIATAMENTE.txt", | |
| "*.killedXXX", | |
| "*.doomed", | |
| "*.sifreli", | |
| "*.MERRY", | |
| "000-No-PROBLEM-WE-DEC-FILES.html", | |
| "*.noproblemwedecfiles", | |
| "WE-MUST-DEC-FILES.html", | |
| "*.powerfulldecrypt", | |
| "*.stn", | |
| "*bingo@opensourcemail.org", | |
| "*.id-3044989498_x3m", | |
| "*.x3m", | |
| "READ_ME_TO_DECRYPT_YOU_INFORMA.jjj", | |
| "*.wuciwug", | |
| "*.kencf", | |
| "*.file0locked", | |
| "file0locked.js", | |
| "CryptoRansomware.exe", | |
| "*.VBRANSOM", | |
| "_HELP_Recover_Files_.html", | |
| "*.oops", | |
| "*.deria", | |
| "*.RMCM1", | |
| "*.Locked-by-Mafia", | |
| "*.кибер разветвитель", | |
| "*-filesencrypted.html", | |
| "decrypt_Globe*.exe", | |
| "*.hnumkhotep", | |
| "DecryptFile.txt", | |
| "*.L0CKED", | |
| "NFS-e*1025-7152.exe", | |
| "firstransomware.exe", | |
| "HELP-ME-ENCED-FILES.html", | |
| "*.helpmeencedfiles", | |
| "*EdgeLocker*.exe ", | |
| "*.edgel", | |
| "*.XBTL", | |
| "*.firecrypt", | |
| "YOUR_FILES_ARE_DEAD.hta", | |
| "*.MRCR1", | |
| "*.PEGS1", | |
| "*.RARE1", | |
| "*.airacropencrypted!", | |
| "*[cryptsvc@mail.ru].*", | |
| "WHERE-YOUR-FILES.html", | |
| "*.Whereisyourfiles", | |
| "*opentoyou@india.com", | |
| "C-email-*-*.odcodc", | |
| "*.maktub", | |
| "*.hush", | |
| "*.bript", | |
| "_*_README.hta", | |
| "_*_README.jpg", | |
| "HOW_OPEN_FILES.hta", | |
| "*.gangbang", | |
| "GJENOPPRETTING_AV_FILER.html", | |
| "GJENOPPRETTING_AV_FILER.txt", | |
| "!!! HOW TO DECRYPT FILES !!!.txt", | |
| "*.braincrypt", | |
| "INSTRUCTION RESTORE FILE.TXT", | |
| "*.lesli", | |
| "Survey Locker.exe", | |
| "!!!!!ATENÇÃO!!!!!.html", | |
| "Receipt.exe", | |
| "WindowsApplication1.exe", | |
| "HWID Lock.exe", | |
| "VIP72.exe", | |
| "DALE_FILES.TXT", | |
| "*.DALE", | |
| "*.8637", | |
| "*.kok", | |
| "HOW_TO_RESTORE_YOUR_DATA.html", | |
| "*.paymrts", | |
| "*.paymds", | |
| "RESTORE_CORUPTED_FILES.HTML", | |
| "READ@My.txt", | |
| "Cyber SpLiTTer Vbs.exe", | |
| "*.flyper", | |
| "000-PLEASE-READ-WE-HELP.html", | |
| "*.helpdecrypt@india.com", | |
| "*.VforVendetta", | |
| "popcorn_time.exe", | |
| "*.filock", | |
| "*.wallet", | |
| "*_.rmd", | |
| "*.uDz2j8mv", | |
| "OSIRIS-*.htm", | |
| "DesktopOsiris.htm", | |
| "*[cryptservice@inbox.ru]*", | |
| "*.no_more_ransom", | |
| "bahij2@india.com", | |
| "*.lovewindows", | |
| "*.osiris", | |
| "*.R.i.P", | |
| "Important!.txt", | |
| "!_HOW_TO_RESTORE_*.txt", | |
| "HOW_TO_RESTORE_FILES.txt", | |
| "_README_*.hta", | |
| "*.Zzzz", | |
| "*[lavandos@dr.com].wallet", | |
| "*.coin", | |
| "*.crypted_file", | |
| "*.EncrypTile", | |
| "*.hcked", | |
| "_README_.hta", | |
| "Runsome.exe", | |
| "Payment_Advice.mht", | |
| "lblBitcoinInfoMain.txt", | |
| "lblFinallyText.txt", | |
| "lblMain.txt", | |
| "*.hannah", | |
| "*.vindows", | |
| "How to decrypt your files.jpg", | |
| "How to decrypt your files.txt", | |
| "How to get data back.txt", | |
| "*.zycrypt", | |
| "*.sgood", | |
| "*.zzzzz", | |
| "xort.txt", | |
| "DOSYALARINIZA ULAŞMAK İÇİN AÇINIZ.html", | |
| "HOWTO_RECOVER_FILES_*.TXT", | |
| "HELP_RESTORE_FILES_*.TXT", | |
| "Recovery+*.html", | |
| "Recovery+*.txt", | |
| "_H_e_l_p_RECOVER_INSTRUCTIONS+*.png", | |
| "_H_e_l_p_RECOVER_INSTRUCTIONS+*.html", | |
| "help_recover_instructions+*.html", | |
| "help_recover_instructions+*.BMP", | |
| "_how_recover+*.html", | |
| "_how_recover+*.txt", | |
| "ThxForYurTyme.txt", | |
| "_HOW_TO_Decrypt.bmp", | |
| "_RECOVER_INSTRUCTIONS.ini", | |
| "###-READ-FOR-HELLPP.html", | |
| "rtext.txt", | |
| "DECRYPTION INSTRUCTIONS.txt", | |
| "decrypt explanations.html", | |
| "_WHAT_is.html", | |
| "_HOWDO_text.html", | |
| "readme_liesmich_encryptor_raas.txt", | |
| "_Adatok_visszaallitasahoz_utasitasok.txt", | |
| "How to restore files.hta", | |
| "locked.bmp", | |
| "README_TO_RECURE_YOUR_FILES.txt", | |
| "Your files encrypted by our friends !!!.txt", | |
| "ATTENTION.url", | |
| "@WARNING_FILES_ARE_ENCRYPTED.*.txt", | |
| "README!!!.txt", | |
| "# README.hta", | |
| "!Recovery_*.html", | |
| "YourID.txt", | |
| "recover.bmp", | |
| "recover.txt", | |
| "README HOW TO DECRYPT YOUR FILES.HTML", | |
| "READ_IT.txt", | |
| "*.lock93", | |
| "*.!emc", | |
| "*.adk", | |
| "svchosd.exe", | |
| "*.aesir", | |
| "*.CHIP", | |
| "*.happy", | |
| "*.angelamerkel", | |
| "*.razy1337", | |
| "*.zendr4", | |
| "*.dharma", | |
| "*.locked3", | |
| "*.duhust", | |
| "*.exploit", | |
| "*_crypt", | |
| "*_help_instruct*.*", | |
| "*!DMAlock*", | |
| "*.GSupport3", | |
| "*.rnsmwr", | |
| "*.dCrypt", | |
| "ransomed.html", | |
| "*.Alcatraz", | |
| "*_WHAT_is.html", | |
| "readme.hta", | |
| "*.96e2", | |
| "*.thor", | |
| "*.dxxd", | |
| "*.usr0", | |
| "*.shit", | |
| "*.coded", | |
| "*.raid10", | |
| "*.realfs0ciety*", | |
| "*.rip", | |
| "*.okean*", | |
| "*.globe", | |
| "*.nuclear55", | |
| "*.1txt", | |
| "*.kostya", | |
| "*.k0stya", | |
| "*.comrade", | |
| "*.exotic", | |
| "*.fuck", | |
| "*.Yakes", | |
| "*.Zimbra", | |
| "email-salazar_slytherin10@yahoo.com.ver-*.id-*-*.randomname-*", | |
| "*._AiraCropEncrypted!", | |
| "README_RECOVER_FILES_*.txt", | |
| "README_RECOVER_FILES_*.png", | |
| "README_RECOVER_FILES_*.html", | |
| "*.~HL*", | |
| "Sarah_G@ausi.com___*", | |
| "*.zc3791", | |
| "*.venusp", | |
| "*.shino", | |
| "*.bleepYourFiles", | |
| "*.crashed", | |
| "*.amba", | |
| "*.7h9r", | |
| "*.已加密", | |
| "*.암호화됨", | |
| "*.b5c6", | |
| "*.ap19", | |
| "*.a19", | |
| "_*_HOWDO_text.html", | |
| "*_HOWDO_text.bmp", | |
| "*_HOWDO_text.html", | |
| "*.odin", | |
| "*.zypto*", | |
| "zzzzzzzzzzzzzzzzzyyy", | |
| "zycrypt.*", | |
| "*decrypt your file*.*", | |
| "*_nullbyte*", | |
| "*.bart", | |
| "*.axx", | |
| "_H_e_l_p_RECOVER_INSTRUCTIONS+*.txt", | |
| "HOW-TO-DECRYPT-FILES.HTML", | |
| "HOW_TO_DECRYPT.HTML", | |
| "exit.hhr.obleep", | |
| "UnblockFiles.vbs", | |
| "README_DECRYPT_HYDRA_ID_*.txt", | |
| "DECRYPT_Readme.TXT.ReadMe", | |
| "Decrypt All Files *.bmp", | |
| "HowDecrypt.gif", | |
| "HELP_YOURFILES.HTML", | |
| "HOW TO DECRYPT FILES.HTML", | |
| "BUYUNLOCKCODE", | |
| "BitCryptorFileList.txt", | |
| "*.crjocker", | |
| "*.POSHKODER", | |
| "*.hydracrypt_ID_*", | |
| "*.CTBL2", | |
| "*.unbrecrypt_ID_*", | |
| "*.padcrypt", | |
| "*.rekt", | |
| "*.CCCRRRPPP", | |
| "*.SecureCrypte", | |
| "*.windows10", | |
| "*.pdcr", | |
| "*.keybtc@inbox", | |
| "*.breaking_bad", | |
| "*.cryptowall", | |
| "*.xorist", | |
| "*.crypt1", | |
| "How_to_decrypt_your_files.jpg", | |
| "How_to_restore_files.hta", | |
| "*.cerber3", | |
| "*.a5zfn", | |
| "*.purge", | |
| "*.fantom", | |
| "*.cerber2", | |
| "!readme.*", | |
| "Como descriptografar seus arquivos.txt", | |
| "*.C0rp0r@c@0Xr@", | |
| "*.domino", | |
| "*cerber2", | |
| "*.cawwcca", | |
| "how_to_unlock*.*", | |
| "!Recovery_*.txt", | |
| "Read_this_file.txt", | |
| "*.legion", | |
| "*.encoderpass", | |
| "*.cryptolocker", | |
| "*.7z.encrypted", | |
| "ATTENTION!!!.txt", | |
| "HELP_DECRYPT.lnk", | |
| "how to decrypt aes files.lnk", | |
| "restore_files.txt", | |
| "HowDecrypt.txt", | |
| "$RECYCLE.BIN.{*-*-*-*}", | |
| "*.heisenberg", | |
| "*.breaking bad", | |
| "*.razy", | |
| "*.Venusf", | |
| ".~", | |
| "*.payfornature@india.com.crypted", | |
| "winclwp.jpg", | |
| "wie_zum_Wiederherstellen_von_Dateien.txt", | |
| "tox.html", | |
| "strongcrypt.bmp", | |
| "qwer2.html", | |
| "qwer.html", | |
| "pronk.txt", | |
| "paycrypt.bmp", | |
| "maxcrypt.bmp", | |
| "how_decrypt.gif", | |
| "how to get data.txt", | |
| "help_recover_instructions*.txt", | |
| "help_recover_instructions*.html", | |
| "help_recover_instructions*.bmp", | |
| "help-file-decrypt.enc", | |
| "enigma_encr.txt", | |
| "enigma.hta", | |
| "default432643264.jpg", | |
| "default32643264.bmp", | |
| "decypt_your_files.html", | |
| "de_crypt_readme.txt", | |
| "de_crypt_readme.html", | |
| "de_crypt_readme.bmp", | |
| "cryptinfo.txt", | |
| "crjoker.html", | |
| "_how_recover*.txt", | |
| "_how_recover*.html", | |
| "_Locky_recover_instructions.bmp", | |
| "_H_e_l_p_RECOVER_INSTRUCTIONS*.txt", | |
| "_H_e_l_p_RECOVER_INSTRUCTIONS*.png", | |
| "_H_e_l_p_RECOVER_INSTRUCTIONS*.html", | |
| "_HELP_instructions.txt", | |
| "_HELP_instructions.bmp", | |
| "_DECRYPT_INFO_*.html", | |
| "Your files encrypted by our friends !!! txt", | |
| "Your files are locked !.txt", | |
| "Your files are locked !!.txt", | |
| "Your files are locked !!!.txt", | |
| "Your files are locked !!!!.txt", | |
| "YOUR_FILES_ARE_LOCKED.txt", | |
| "YOUR_FILES_ARE_ENCRYPTED.TXT", | |
| "YOUR_FILES_ARE_ENCRYPTED.HTML", | |
| "YOUGOTHACKED.TXT", | |
| "UNLOCK_FILES_INSTRUCTIONS.txt", | |
| "UNLOCK_FILES_INSTRUCTIONS.html", | |
| "SIFRE_COZME_TALIMATI.html", | |
| "SHTODELATVAM.txt", | |
| "Read Me (How Decrypt) !!!!.txt", | |
| "RESTORE_FILES_*.txt", | |
| "RESTORE_FILES_*.*", | |
| "READ_THIS_TO_DECRYPT.html", | |
| "README_HOW_TO_UNLOCK.TXT", | |
| "README_HOW_TO_UNLOCK.HTML", | |
| "README_DECRYPT_UMBRE_ID_*.txt", | |
| "README_DECRYPT_UMBRE_ID_*.jpg", | |
| "README_DECRYPT_HYRDA_ID_*.txt", | |
| "READ ME FOR DECRYPT.txt", | |
| "READ IF YOU WANT YOUR FILES BACK.html", | |
| "Payment_Instructions.jpg", | |
| "ONTSLEUTELINGS_INSTRUCTIES.html", | |
| "OKSOWATHAPPENDTOYOURFILES.TXT", | |
| "MENSAGEM.txt", | |
| "KryptoLocker_README.txt", | |
| "Instructionaga.txt", | |
| "ISTRUZIONI_DECRITTAZIONE.html", | |
| "INSTRUCTIONS_DE_DECRYPTAGE.html", | |
| "INSTRUCCIONES_DESCIFRADO.html", | |
| "INSTALL_TOR.URL", | |
| "IMPORTANT.README", | |
| "IMPORTANT READ ME.txt", | |
| "Howto_RESTORE_FILES.html", | |
| "How to decrypt your data.txt", | |
| "How to decrypt LeChiffre files.html", | |
| "Help Decrypt.html", | |
| "Hacked_Read_me_to_decrypt_files.html", | |
| "HOW_TO_UNLOCK_FILES_README_*.txt", | |
| "HOW_TO_RESTORE_FILES.html", | |
| "HOW_DECRYPT.URL", | |
| "HOW_DECRYPT.TXT", | |
| "HOW_DECRYPT.HTML", | |
| "HOWTO_RECOVER_FILES_*.*", | |
| "HOW TO DECRYPT FILES.txt", | |
| "HELP_YOUR_FILES.html", | |
| "HELP_YOUR_FILES.PNG", | |
| "HELP_TO_SAVE_FILES.bmp", | |
| "HELP_RESTORE_FILES_*.*", | |
| "HELP_DECRYPT.URL", | |
| "HELP_DECRYPT.PNG", | |
| "HELP_DECRYPT.HTML", | |
| "GetYouFiles.txt", | |
| "File Decrypt Help.html", | |
| "FILES_BACK.txt", | |
| "ENTSCHLUSSELN_HINWEISE.html", | |
| "DecryptAllFiles*.txt", | |
| "DESIFROVANI_POKYNY.html", | |
| "DECRYPT_YOUR_FILES.txt", | |
| "DECRYPT_YOUR_FILES.HTML", | |
| "DECRYPT_ReadMe1.TXT", | |
| "DECRYPT_INSTRUCTIONS.html", | |
| "DECRYPT_INSTRUCTION.URL", | |
| "DECRYPT_INSTRUCTION.HTML", | |
| "DECRYPTION_HOWTO.Notepad", | |
| "Comment débloquer mes fichiers.txt", | |
| "BUYUNLOCKCODE.txt", | |
| "AllFilesAreLocked*.bmp", | |
| "4-14-2016-INFECTION.TXT", | |
| "*_ryp", | |
| "*_HELP_instructions.html", | |
| "*.xcrypt", | |
| "*.unavailable", | |
| "*.szf", | |
| "*.porno.pornoransom", | |
| "*.plauge17", | |
| "*.neitrino", | |
| "*.kimcilware.locked", | |
| "*.iwanthelpuuu", | |
| "*.herbst", | |
| "*.helpdecrypt@ukr.net", | |
| "*.h3ll", | |
| "*.gws.porno", | |
| "*.fuckyourdata", | |
| "*.encrypted.locked", | |
| "*.cryptz", | |
| "*.crypttt", | |
| "*.cripttt", | |
| "*.criptokod", | |
| "*.criptiko", | |
| "*.btc.kkk.fun.gws", | |
| "*.aga", | |
| "*._ryp", | |
| "*.Where_my_files.txt", | |
| "*.Read_Me.Txt", | |
| "*.RSplited", | |
| "*.KEYZ.KEYH0LES", | |
| "*.How_To_Get_Back.txt", | |
| "*.How_To_Decrypt.txt", | |
| "*.Contact_Here_To_Recover_Your_Files.txt", | |
| "*.31392E30362E32303136_*", | |
| "# DECRYPT MY FILES #.vbs", | |
| "# DECRYPT MY FILES #.txt", | |
| "# DECRYPT MY FILES #.html", | |
| "!Where_are_my_files!.html", | |
| "!!!README!!!*.rtf", | |
| "!!!-WARNING-!!!.txt", | |
| "!!!-WARNING-!!!.html", | |
| "*.magic_software_syndicate", | |
| "*maestro@pizzacrypts.info", | |
| "*.crypt", | |
| "*.bitstak", | |
| "*.wflx", | |
| "*.CRRRT", | |
| "howtodecryptaesfiles.txt", | |
| "!satana!.txt", | |
| "*.akaibvn", | |
| "*.cRh8", | |
| "*.YTBL", | |
| "*.krypted", | |
| "*.tzu", | |
| "*.6FKR8d", | |
| "*.sshxkej", | |
| "*.eclr", | |
| "*.epic", | |
| "*.paybtcs", | |
| "*.AFD", | |
| "*.paymst", | |
| "*.payms", | |
| "*.isis", | |
| "*.zepto", | |
| "*.bart.zip", | |
| "*.kratos", | |
| "*.31342E30362E32303136*", | |
| "*.SecureCrypted", | |
| "*.crptrgr", | |
| "*.rtyrtyrty", | |
| "!DMALOCK3.0*", | |
| "*.evil", | |
| "*.crypt38", | |
| "*.asdasdasd", | |
| "*.ded", | |
| "*.bloccato", | |
| "*.canihelpyou", | |
| "*.crypz", | |
| "decrypt-instruct*.*", | |
| "*files_are_encrypted.*", | |
| "*decryptmyfiles*.*", | |
| "help_instructions.*", | |
| "*-recover-*.*", | |
| "de_crypt_readme.*", | |
| "*!recover!*.*", | |
| "*recover}-*.*", | |
| "*rec0ver*.*", | |
| "_help_instruct*.*", | |
| "*_recover_*.*", | |
| "*+recover+*.*", | |
| "*warning-!!*.*", | |
| "*decrypt my file*.*", | |
| "help_file_*.*", | |
| "recovery+*.*", | |
| "readme_for_decrypt*.*", | |
| "install_tor*.*", | |
| "readme_decrypt*.*", | |
| "howtodecrypt*.*", | |
| "howto_restore*.*", | |
| "how_to_recover*.*", | |
| "how_recover*.*", | |
| "how_to_decrypt*.*", | |
| "how to decrypt*.*", | |
| "help_restore*.*", | |
| "help_your_file*.*", | |
| "help_recover*.*", | |
| "help_decrypt*.*", | |
| "decrypt_instruct*.*", | |
| "cryptolocker.*", | |
| "*recover_instruction*.*", | |
| "*.hydracrypt_ID*", | |
| "*gmail*.crypt", | |
| "*.cryptotorlocker*", | |
| "*.xxx", | |
| "*.xyz", | |
| "*.xtbl", | |
| "*.xort", | |
| "*.xrtn", | |
| "*.vvv", | |
| "*.vscrypt", | |
| "*.trun", | |
| "*.ttt", | |
| "*.surprise", | |
| "*.troyancoder@qq_com", | |
| "*.sport", | |
| "*.scl", | |
| "*.ryp", | |
| "*.sanction", | |
| "*.RRK", | |
| "*.rokku", | |
| "*.remind", | |
| "*.relock@qq_com", | |
| "*.RDM", | |
| "*.RADAMANT", | |
| "*.R5A", | |
| "*.R4A", | |
| "*.PoAr2w", | |
| "*.pizda@qq_com", | |
| "*.p5tkjw", | |
| "*.oplata@qq_com", | |
| "*.oshit", | |
| "*.oor", | |
| "*.one-we_can-help_you", | |
| "*.OMG!", | |
| "*.nochance", | |
| "*.nalog@qq_com", | |
| "*.micro", | |
| "*.LOL!", | |
| "*.locky", | |
| "*.locked", | |
| "*.LeChiffre", | |
| "*.kraken", | |
| "*.korrektor", | |
| "*.kkk", | |
| "*.kimcilware", | |
| "*.KEYZ", | |
| "*.keybtc@inbox_com", | |
| "*.KEYHOLES", | |
| "*.justbtcwillhelpyou", | |
| "*.infected", | |
| "*.helpdecrypt@ukr_net", | |
| "*.hb15", | |
| "*.ha3", | |
| "*.gruzin@qq_com", | |
| "*.gws", | |
| "*.fun", | |
| "*.fucked", | |
| "*.enigma", | |
| "*.encryptedped", | |
| "*.encryptedRSA", | |
| "*.encryptedAES", | |
| "*.Encrypted", | |
| "*.encrypt", | |
| "*.encedRSA", | |
| "*.EnCiPhErEd", | |
| "*.dyatel@qq_com", | |
| "*.czvxce", | |
| "*.darkness", | |
| "*.ctbl", | |
| "*.CrySiS", | |
| "*.CryptoTorLocker2015!", | |
| "*.crypted", | |
| "*.cry", | |
| "*.crjoker", | |
| "*.crinf", | |
| "*.crime", | |
| "*.coverton", | |
| "*.code", | |
| "*.clf", | |
| "*.chifrator@qq_com", | |
| "*.cerber", | |
| "*.cbf", | |
| "*.btcbtcbtc", | |
| "*.btc-help-you", | |
| "*.btc", | |
| "*.bloc", | |
| "*.better_call_saul", | |
| "*.AES256", | |
| "*.{CRYPTENDBLACKDC}", | |
| "*.73i87A", | |
| "*.zzz", | |
| "*.abc", | |
| "*.aaa", | |
| "vault.txt", | |
| "vault.key", | |
| "recovery_key.txt", | |
| "vault.hta", | |
| "message.txt", | |
| "recovery_file.txt", | |
| "confirmation.key", | |
| "enc_files.txt", | |
| "last_chance.txt", | |
| "*.vault", | |
| "*want your files back.*", | |
| "*.frtrss", | |
| "*.exx", | |
| "*.ezz", | |
| "*.ecc", | |
| "*help_restore*.*", | |
| "*how_to_recover*.*", | |
| "*restore_fi*.*", | |
| "*ukr.net*", | |
| "*qq_com*", | |
| "*keemail.me*", | |
| "*decipher*", | |
| "*install_tor*.*", | |
| "*@india.com*", | |
| "*@gmail_com_*", | |
| "*.*obleep", | |
| "*.*exx", | |
| "*.*locked", | |
| "*.*nochance", | |
| "*.*kraken", | |
| "*.*kb15", | |
| "*.*darkness", | |
| "*.*crypto", | |
| "*.*cry", | |
| "_Locky_recover_instructions.txt", | |
| "help_recover_instructions+*.txt", | |
| "recoverfile*.txt", | |
| "Howto_Restore_FILES.TXT", | |
| "recoveryfile*.txt", | |
| "_how_recover.txt", | |
| "howrecover+*.txt", | |
| "restorefiles.txt", | |
| "howto_recover_file.txt", | |
| "HowtoRESTORE_FILES.txt", | |
| "RECOVERY_FILE*.txt", | |
| "RECOVERY_FILES.txt", | |
| "help_decrypt_your_files.html", | |
| "HELPDECYPRT_YOUR_FILES.HTML", | |
| "IHAVEYOURSECRET.KEY", | |
| "SECRET.KEY", | |
| "SECRETIDHERE.KEY", | |
| "READTHISNOW!!!.TXT", | |
| "IAMREADYTOPAY.TXT", | |
| "HELLOTHERE.TXT", | |
| "FILESAREGONE.TXT", | |
| "DECRYPT_ReadMe.TXT", | |
| "Read.txt", | |
| "About_Files.txt", | |
| "_secret_code.txt", | |
| "ReadDecryptFilesHere.txt", | |
| "Coin.Locker.txt", | |
| "HOW_TO_DECRYPT_FILES.TXT", | |
| "DECRYPT_INSTRUCTION.TXT", | |
| "encryptor_raas_readme_liesmich.txt", | |
| "Help_Decrypt.txt", | |
| "YOUR_FILES.url", | |
| "How_To_Recover_Files.txt", | |
| "YOUR_FILES.HTML", | |
| "INSTRUCCIONES_DESCIFRADO.TXT", | |
| "DECRYPT_INSTRUCTIONS.TXT", | |
| "HELP_TO_SAVE_FILES.txt", | |
| "DecryptAllFiles.txt", | |
| "HELP_RECOVER_FILES.txt", | |
| "HELP_RESTORE_FILES.txt", | |
| "HELP_TO_DECRYPT_YOUR_FILES.txt", | |
| "HELP_YOUR_FILES.TXT", | |
| "HELPDECRYPT.TXT", | |
| "*.CTB2", | |
| "*.SUPERCRYPT", | |
| "*.magic", | |
| "*.1999", | |
| "*.toxcrypt", | |
| "*.bleep", | |
| "*.0x0", | |
| "*.good", | |
| "*.R16M01D05", | |
| "*.pzdc", | |
| "*.XRNT", | |
| "*.crypto", | |
| "*.ccc", | |
| "*.da_vinci_code", | |
| "*.payransom", | |
| "*.KEYH0LES", | |
| "oor.*", | |
| "*.zyklon", | |
| "*.zcrypt", | |
| "*.Z81928819", | |
| "*.Silent", | |
| "*.RSNSlocked", | |
| "*.RAD", | |
| "*.porno", | |
| "*.pornoransom", | |
| "*.odcodc", | |
| "_ryp", | |
| "*.helpdecrypt@ukr*.net", | |
| "*.only-we_can-help_you", | |
| "*.cryp1", | |
| "*.fileiscryptedhard", | |
| "*.blocatto", | |
| "*.8lock8", | |
| "*.777" | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment