Created
May 6, 2019 11:07
-
-
Save tokudan/6223c2abca6f530c80477d5b4b291fdb to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [Init] | |
| journalmatch = _SYSTEMD_UNIT=smb.service _COMM=smbd SYSLOG_IDENTIFIER=smbd_audit | |
| [Definition] | |
| ignoreregex = | |
| failregex = | |
| IP=<HOST>\|.*\.verasto | |
| IP=<HOST>\|.*\.moresa\!Ransom | |
| IP=<HOST>\|READ_ME\.cube | |
| IP=<HOST>\|.*\.COLORIT\!Ransom | |
| IP=<HOST>\|.*\.sambo, | |
| IP=<HOST>\|HELP_BY_CROC\.TXT | |
| IP=<HOST>\|.*\.LDPR | |
| IP=<HOST>\|warning\.txt | |
| IP=<HOST>\|.*\.guesswho | |
| IP=<HOST>\|.*\.moresa | |
| IP=<HOST>\|.*\.aescrypt\!Ransom | |
| IP=<HOST>\|.*\.burn | |
| IP=<HOST>\|.*\.robinhood | |
| IP=<HOST>\|.*\.COLORIT | |
| IP=<HOST>\|.*\.SAVEYOURDATA | |
| IP=<HOST>\|.*\.aescrypt | |
| IP=<HOST>\|_HELP_INSTRUCTIONS_\.TXT | |
| IP=<HOST>\|.*lockhelp\@qq\.com | |
| IP=<HOST>\|.*\.Ryuk | |
| IP=<HOST>\|.*\.croc | |
| IP=<HOST>\|.*\.norvas | |
| IP=<HOST>\|.*\.\[absonkaine\@aol\.com\]\.phoenix | |
| IP=<HOST>\|.*\.CRABSLKT | |
| IP=<HOST>\|.*\.gotcha | |
| IP=<HOST>\|.*\.cube | |
| IP=<HOST>\|.*\.SDEN | |
| IP=<HOST>\|.*\.obagarmrk | |
| IP=<HOST>\|.*\.tater | |
| IP=<HOST>\|.*\.pumas | |
| IP=<HOST>\|.*\.browec | |
| IP=<HOST>\|.*\.hdeaf | |
| IP=<HOST>\|.*\.guvara | |
| IP=<HOST>\|.*\.tabufa | |
| IP=<HOST>\|.*\.tokog | |
| IP=<HOST>\|.*\.fuchsia | |
| IP=<HOST>\|.*\.etols | |
| IP=<HOST>\|.*\.\[velasquez\.joeli\@aol\.com\] | |
| IP=<HOST>\|.*\.gate | |
| IP=<HOST>\|.*\.langolier | |
| IP=<HOST>\|.*\.spyhunter | |
| IP=<HOST>\|.*\.cryptoid | |
| IP=<HOST>\|.*\.\[adobe\-123\@tutanota\.com\]\.ETH | |
| IP=<HOST>\|.*\.Jumper | |
| IP=<HOST>\|.*\.major | |
| IP=<HOST>\|.*\.raldug | |
| IP=<HOST>\|.*\.phoenix | |
| IP=<HOST>\|.*\.gropas | |
| IP=<HOST>\|.*\.wannacash | |
| IP=<HOST>\|.*\.NGSC | |
| IP=<HOST>\|.*\.bmps\@tutanota\.com\.major | |
| IP=<HOST>\|.*\._Crypted | |
| IP=<HOST>\|.*\.roland | |
| IP=<HOST>\|.*\.NOLOST | |
| IP=<HOST>\|.*\.Marozka | |
| IP=<HOST>\|.*\.encryptedALL | |
| IP=<HOST>\|.*\.stun | |
| IP=<HOST>\|.*\.grovas | |
| IP=<HOST>\|.*\.trosak | |
| IP=<HOST>\|.*\.tronas | |
| IP=<HOST>\|.*\.JLCW2 | |
| IP=<HOST>\|.*\.\[thedecrypt111\@qq\.com\]\.ETH | |
| IP=<HOST>\|.*\.drume | |
| IP=<HOST>\|.*\.securityP | |
| IP=<HOST>\|.*\.YYYYBJQOQDU | |
| IP=<HOST>\|ENCRYPTED\.TXT | |
| IP=<HOST>\|.*\.MDEN | |
| IP=<HOST>\|README_LOCKED\.txt | |
| IP=<HOST>\|README\-NOW\.txt | |
| IP=<HOST>\|.*\.locker | |
| IP=<HOST>\|.*\.proden | |
| IP=<HOST>\|.*\.CQQUH | |
| IP=<HOST>\|.*\[p4d\@tuta\.io\]\.com | |
| IP=<HOST>\|.*\.luceq | |
| IP=<HOST>\|.*\.chech | |
| IP=<HOST>\|.*\.\[mrpeterson\@cock\.li\]\.GFS | |
| IP=<HOST>\|.*\.suffer | |
| IP=<HOST>\|.*\.инструкция\\ по\\ оплате\.txt | |
| IP=<HOST>\|.*\.metan | |
| IP=<HOST>\|.*\.kezoz | |
| IP=<HOST>\|.*\.luces | |
| IP=<HOST>\|.*\.doples | |
| IP=<HOST>\|.*\.pdf_Axffyq_\{babyfromparadise666\@gmail\.com\}\.p3rf0rm4 | |
| IP=<HOST>\|.*\.pdf\.p3rf0rmr | |
| IP=<HOST>\|.*\.\{CALLMEGOAT\@PROTONMAIL\.COM\}CMG | |
| IP=<HOST>\|.*\.\[amber777king\@cock\.li\]\.amber | |
| IP=<HOST>\|.*\.L1LL | |
| IP=<HOST>\|.*\.charcl | |
| IP=<HOST>\|.*\.UIK1J | |
| IP=<HOST>\|.*\.kropun | |
| IP=<HOST>\|.*\.jimm | |
| IP=<HOST>\|.*\.klope | |
| IP=<HOST>\|.*\.\[payransom\@qq\.com\]\.adobe | |
| IP=<HOST>\|.*\.jamper | |
| IP=<HOST>\|\-\-\-README\-\-\-\.TXT | |
| IP=<HOST>\|.*\.\[w_decrypt24\@qq\.com\]\.zq | |
| IP=<HOST>\|.*\.Scorpion | |
| IP=<HOST>\|.*\.pulsar1 | |
| IP=<HOST>\|.*\.charck | |
| IP=<HOST>\|.*\.kroput1 | |
| IP=<HOST>\|.*\.\[btccrypthelp\@cock\.li\]\.ETH | |
| IP=<HOST>\|.*\.\[1701222381\@qq\.com\]\.ETH | |
| IP=<HOST>\|.*\.\[decryptprof\@qq\.com\]\.ETH | |
| IP=<HOST>\|.*\.\[decryptmyfiles\@qq\.com\]\.ETH | |
| IP=<HOST>\|.*\.\[helpfilerestore\@india\.com\]\.ETH | |
| IP=<HOST>\|.*\.\[MailPayment\@decoder\.com\]\.ETH | |
| IP=<HOST>\|.*\.Blower\@india\.com | |
| IP=<HOST>\|.*\.bRcrypT | |
| IP=<HOST>\|.*\.GILLETTE | |
| IP=<HOST>\|.*\.yatron | |
| IP=<HOST>\|.*\.kroput | |
| IP=<HOST>\|.*\.\[plombiren\@hotmail\.com\]\.plomb | |
| IP=<HOST>\|Restore_ICPICP_Files\.txt | |
| IP=<HOST>\|HOW\-TO\-RESTORE\-FILES\.txt | |
| IP=<HOST>\|\!\#_How_to_decrypt_files_\$\!\.txt | |
| IP=<HOST>\|_如何解密我的文件_\.txt | |
| IP=<HOST>\|How\\ to\\ decrypt\.txt | |
| IP=<HOST>\|.*\.\[help24decrypt\@cock\.li | |
| IP=<HOST>\|.*\.Neptune | |
| IP=<HOST>\|.*\.\{mattpear\@protonmail\.com\} | |
| IP=<HOST>\|.*\.promorad2 | |
| IP=<HOST>\|.*\.andymarvin | |
| IP=<HOST>\|.*\.mamasitaq | |
| IP=<HOST>\|.*\.cockista | |
| IP=<HOST>\|.*\.crabs | |
| IP=<HOST>\|.*\.dy8wud | |
| IP=<HOST>\|.*\.\[china\-decryptor\@pm\.me\] | |
| IP=<HOST>\|.*\.kitty | |
| IP=<HOST>\|.*\.CIOP | |
| IP=<HOST>\|.*\.pfanz | |
| IP=<HOST>\|.*\.jcry | |
| IP=<HOST>\|.*\.evopro | |
| IP=<HOST>\|.*\.\{mattpear\@protonmail\.com\}MTP | |
| IP=<HOST>\|.*\.Annabelle2 | |
| IP=<HOST>\|.*\.\[help24decrypt\@cock\.li\] | |
| IP=<HOST>\|.*\.promock | |
| IP=<HOST>\|.*\.promorad | |
| IP=<HOST>\|HOW\\ TO\\ DECRYPT\[1T0tO\]\.txt | |
| IP=<HOST>\|\!_\!email__\\ prusa\@goat\.si\\ __\!\.\.PAYMAN | |
| IP=<HOST>\|\!SBLOCK_INFO\!\.rtf | |
| IP=<HOST>\|.*\.Frendi | |
| IP=<HOST>\|инструкция\\ по\\ оплате\.txt | |
| IP=<HOST>\|how_to_recver_files\.txt | |
| IP=<HOST>\|.*\.aqva | |
| IP=<HOST>\|\!\#_How_to_decrypt_files_\#\! | |
| IP=<HOST>\|SECURITY\-ISSUE\-INFO\.txt | |
| IP=<HOST>\|\!\\ ПРОЧТИ\\ МЕНЯ\\ \!\.html | |
| IP=<HOST>\|.*\.cammora | |
| IP=<HOST>\|.*\.SBLOCK | |
| IP=<HOST>\|.*\.promoz | |
| IP=<HOST>\|.*\.crazy | |
| IP=<HOST>\|.*\.ARTEMY | |
| IP=<HOST>\|.*\.rontok | |
| IP=<HOST>\|.*\.crypt2019 | |
| IP=<HOST>\|.*\.\[crypted_files\@qq\.com\]\.aqva | |
| IP=<HOST>\|.*\.BlackPink | |
| IP=<HOST>\|.*\.id\..*\.crazy | |
| IP=<HOST>\|\!GBLOCK_INFO\.rtf | |
| IP=<HOST>\|.*\.GBLOCK | |
| IP=<HOST>\|.*\.cekisan | |
| IP=<HOST>\|.*\.promos | |
| IP=<HOST>\|.*\.seed | |
| IP=<HOST>\|.*\.jupstb | |
| IP=<HOST>\|.*\.KARLS | |
| IP=<HOST>\|\!PEDANt_INFO\!\.rtf | |
| IP=<HOST>\|.*\.mecury | |
| IP=<HOST>\|.*\.PLANT | |
| IP=<HOST>\|\#HELP\-DECRYPT\-FCRYPT1\.1\#\.txt | |
| IP=<HOST>\|.*\.infileshop\@gmail_com_ID44 | |
| IP=<HOST>\|.*\.shadi | |
| IP=<HOST>\|.*\.dedo | |
| IP=<HOST>\|.*\.help24decrypt\@qq\.com | |
| IP=<HOST>\|.*\.\[raphaeldupon\@aol\.com\]\.ETH | |
| IP=<HOST>\|.*\.PEDANT | |
| IP=<HOST>\|.*\.Encrypted5 | |
| IP=<HOST>\|.*\.Gefest3 | |
| IP=<HOST>\|ClopReadMe\.txt | |
| IP=<HOST>\|.*\.frend | |
| IP=<HOST>\|.*\.amber | |
| IP=<HOST>\|\!\!\!READ_IT\!\!\!\.txt | |
| IP=<HOST>\|Readme_Restore_Files\.txt | |
| IP=<HOST>\|Your\\ files\\ are\\ now\\ encrypted\.txt | |
| IP=<HOST>\|"\!ymayka\-email\@yahoo\.com\.cryptotes" | |
| IP=<HOST>\|HOW_TO_DECRYPT_MY_FILES\.txt | |
| IP=<HOST>\|.*\.snake4444 | |
| IP=<HOST>\|.*\.\[drwho888\@mail\.fr\]\.888 | |
| IP=<HOST>\|.*\.FCrypt | |
| IP=<HOST>\|.*\.Clop | |
| IP=<HOST>\|.*\.fastrecovery\.xmpp\.jp | |
| IP=<HOST>\|.*\.poyvonm | |
| IP=<HOST>\|.*\.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx | |
| IP=<HOST>\|.*\.FileSlack | |
| IP=<HOST>\|.*\.pluto | |
| IP=<HOST>\|.*\.paycoin | |
| IP=<HOST>\|.*\.blower | |
| IP=<HOST>\|.*\.nosafe | |
| IP=<HOST>\|.*\.tuki17\@qq\.com | |
| IP=<HOST>\|.*\.secure | |
| IP=<HOST>\|.*\.crypted_pony_test_build.* | |
| IP=<HOST>\|.*\.YOLO | |
| IP=<HOST>\|.*\.qwex | |
| IP=<HOST>\|.*\.DESYNC | |
| IP=<HOST>\|.*\.crash | |
| IP=<HOST>\|.*\.pennywise | |
| IP=<HOST>\|.*\.888 | |
| IP=<HOST>\|.*\..*GEFEST | |
| IP=<HOST>\|.*adobe\.gefest | |
| IP=<HOST>\|.*\.OOFNIK | |
| IP=<HOST>\|.*\.\[welesmatron\@aol\.com\]\.btc | |
| IP=<HOST>\|.*\.Mcafee | |
| IP=<HOST>\|.*\.mbrcodes | |
| IP=<HOST>\|.*\.UNIT09 | |
| IP=<HOST>\|.*\.Xcri | |
| IP=<HOST>\|.*\.telebak | |
| IP=<HOST>\|.*\.\[buy\-decryptor\@pm\.me\] | |
| IP=<HOST>\|.*\.adobee | |
| IP=<HOST>\|.*\.mafee | |
| IP=<HOST>\|.*\.\[writehere\@qq\.com\]\.btc | |
| IP=<HOST>\|.*\.GEFEST | |
| IP=<HOST>\|CRYPTOID_.* | |
| IP=<HOST>\|.*\.PC\-FunHACKED.* | |
| IP=<HOST>\|TrumpHead\.exe | |
| IP=<HOST>\|\!README_GRHAN\!\.rtf | |
| IP=<HOST>\|.*\.ppam | |
| IP=<HOST>\|.*\.vaca | |
| IP=<HOST>\|.*\.heets | |
| IP=<HOST>\|.*\.alien | |
| IP=<HOST>\|.*\.SPCT | |
| IP=<HOST>\|anatova\.txt | |
| IP=<HOST>\|anatova\.exe | |
| IP=<HOST>\|170fb7438316\.exe | |
| IP=<HOST>\|CallOfCthulhu\.exe | |
| IP=<HOST>\|.*\.cripton | |
| IP=<HOST>\|.*\.GMBN | |
| IP=<HOST>\|.*\.ddpcbi | |
| IP=<HOST>\|.*\.\[Traher\@Dr\.Com\] | |
| IP=<HOST>\|.*\.2lwnPp2B | |
| IP=<HOST>\|.*\[gomer_simpson2\@aol\.com\]\.phobos | |
| IP=<HOST>\|.*\._raphaeldupon\@aol\.com_\.btc | |
| IP=<HOST>\|.*\.RENSENWARE | |
| IP=<HOST>\|.*\.rumba | |
| IP=<HOST>\|.*\.AUF | |
| IP=<HOST>\|.*\.Tfudeq | |
| IP=<HOST>\|.*\.tfudet | |
| IP=<HOST>\|.*\.JAMES | |
| IP=<HOST>\|.*\.sdwwbrb | |
| IP=<HOST>\|.*\.ucftz.* | |
| IP=<HOST>\|.*\.xcry7684 | |
| IP=<HOST>\|.*\.eddldzor | |
| IP=<HOST>\|.*\.hncdumn | |
| IP=<HOST>\|.*\.g^od | |
| IP=<HOST>\|.*\.ezzyl | |
| IP=<HOST>\|.*\.jundmd\@cock\.li.* | |
| IP=<HOST>\|.*\.obfuscated | |
| IP=<HOST>\|.*\.rsucozxze | |
| IP=<HOST>\|.*\.mdk4y | |
| IP=<HOST>\|.*\.GRHAN | |
| IP=<HOST>\|.*\.zzzzzzzz | |
| IP=<HOST>\|.*\.bvjznsjlo | |
| IP=<HOST>\|.*\.sjjpu | |
| IP=<HOST>\|.*\.djuvq | |
| IP=<HOST>\|.*\.djvup | |
| IP=<HOST>\|.*\.djvut | |
| IP=<HOST>\|.*\.djvur | |
| IP=<HOST>\|.*\.djvus | |
| IP=<HOST>\|.*\.uudjvu | |
| IP=<HOST>\|.*\.udjvu | |
| IP=<HOST>\|.*djvuu | |
| IP=<HOST>\|.*\.tfude | |
| IP=<HOST>\|.*\.tro | |
| IP=<HOST>\|.*\{alexbanan\@tuta\.io\}\.CORP | |
| IP=<HOST>\|\.\[ti_kozel\@lashbania\.tv\]\..* | |
| IP=<HOST>\|\#RECOVERY_FILES\#\.txt | |
| IP=<HOST>\|.*id\-\.LyaS | |
| IP=<HOST>\|\$%%\!\\ NOTE\\ ABOUT\\ FILES\\ \-=\!\-\.html | |
| IP=<HOST>\|.*__\{\}\.VACv2 | |
| IP=<HOST>\|.*\.pdff | |
| IP=<HOST>\|.*\.djvuq | |
| IP=<HOST>\|.*\.INDRIK | |
| IP=<HOST>\|.*\.recovery_email__retmydata\@protonmail\.com__.*_\.aes256\.testE | |
| IP=<HOST>\|.*\.artilkilin\@tuta\.io\.wq2k | |
| IP=<HOST>\|.*\.recovery_email_\[retmydata\@protonmail\.com\].*\.aes256 | |
| IP=<HOST>\|.*\.vulston | |
| IP=<HOST>\|.*\.SATANA | |
| IP=<HOST>\|.*\[decryptdata\@qq\.com\]\.rar | |
| IP=<HOST>\|.*\.to\.dernesatiko\@mail\.com\.crypted | |
| IP=<HOST>\|.*\.ryx | |
| IP=<HOST>\|.*\.\[ti_kozel\@lashbania\.tv\]\.костя | |
| IP=<HOST>\|.*\.nostro | |
| IP=<HOST>\|.*\.\[Unlock24\@cock\.li\]\.combo | |
| IP=<HOST>\|.*\.mouse | |
| IP=<HOST>\|.*\.snatch | |
| IP=<HOST>\|.*\.bizer | |
| IP=<HOST>\|.*\.tunca | |
| IP=<HOST>\|.*\.\[decrypthelper\@protonmail\.com\]\.phobos | |
| IP=<HOST>\|.*\.locked_by_mR_Anonymous(TZ_HACKERS) | |
| IP=<HOST>\|.*\.ducueyuav | |
| IP=<HOST>\|.*\.oslawcmme | |
| IP=<HOST>\|.*\.Защищено | |
| IP=<HOST>\|.*\.Djvuu | |
| IP=<HOST>\|.*\.PRCP | |
| IP=<HOST>\|.*\.\[backtonormal\@foxmail\.com\]\.adobe | |
| IP=<HOST>\|.*\.WORMCRYPT0R | |
| IP=<HOST>\|.*\.evolution | |
| IP=<HOST>\|.*\.cmsnwned | |
| IP=<HOST>\|.*\.ironhead | |
| IP=<HOST>\|.*\.ktuhzxpi | |
| IP=<HOST>\|.*\.elpvd | |
| IP=<HOST>\|.*\.kali | |
| IP=<HOST>\|.*\.Mercury | |
| IP=<HOST>\|.*\.\[avflantuheems1984\@aol\.com\]\.adobe | |
| IP=<HOST>\|.*\.FJ7QvaR9VUmi | |
| IP=<HOST>\|.*\.gerber5 | |
| IP=<HOST>\|.*\.CRYPTR | |
| IP=<HOST>\|.*\.XY6LR | |
| IP=<HOST>\|cmdRansomware\..* | |
| IP=<HOST>\|\#RECOVERY_FILES\#\..* | |
| IP=<HOST>\|.*\.decryptgarranty | |
| IP=<HOST>\|_How\\ to\\ restore\\ files\..* | |
| IP=<HOST>\|_How_To_Decrypt_My_File_\..* | |
| IP=<HOST>\|.*\.lucky | |
| IP=<HOST>\|.*\.PERSONAL_ID.* | |
| IP=<HOST>\|.*\.garcewa | |
| IP=<HOST>\|.*\.danger | |
| IP=<HOST>\|.*\.israbye | |
| IP=<HOST>\|.*\.\[fileslocker\@pm\.me\] | |
| IP=<HOST>\|.*\.greystars\@protonmail\.com | |
| IP=<HOST>\|.*\.iaufhhhhfiles_BACK_PLS_READ\.html | |
| IP=<HOST>\|.*\.iaufhhhfiles_BACK_PLS_READ\.html | |
| IP=<HOST>\|.*\.hilegofprencrp | |
| IP=<HOST>\|.*\.wowreadfordecry | |
| IP=<HOST>\|.*\.btc\\ \-help\-you | |
| IP=<HOST>\|.*\.checkdiskenced | |
| IP=<HOST>\|.*\.iloveworld | |
| IP=<HOST>\|.*\.goforhelp | |
| IP=<HOST>\|.*\.encmywork | |
| IP=<HOST>\|.*\.\[parambingobam\@cock\.li\]\.adobe | |
| IP=<HOST>\|.*\.\[mercarinotitia\@qq\.com\]\.adobe | |
| IP=<HOST>\|.*\.crypted_bizarrio\@pay4me_in | |
| IP=<HOST>\|.*\.DeLpHiMoRiX.* | |
| IP=<HOST>\|.*\.malwarehunterteam | |
| IP=<HOST>\|.*\.demonslay335_you_cannot_decrypt_me\! | |
| IP=<HOST>\|.*\.peosajwqfk | |
| IP=<HOST>\|.*\.online24files\@airmail\.cc | |
| IP=<HOST>\|.*\.risk | |
| IP=<HOST>\|.*\.\[cyberwars\@qq\.com\]\.war | |
| IP=<HOST>\|.*\.stevenseagal\@airmail\.cc | |
| IP=<HOST>\|.*\.myjob | |
| IP=<HOST>\|.*\.lolita | |
| IP=<HOST>\|.*snowpicnic.* | |
| IP=<HOST>\|.*SIMMYWARE.* | |
| IP=<HOST>\|how\\ to\\ get\\ back\\ you\\ files\.txt | |
| IP=<HOST>\|.*\.cccmn | |
| IP=<HOST>\|aboutYourFiles\..* | |
| IP=<HOST>\|.*wall\.i | |
| IP=<HOST>\|\#RECOVERY\-PC\#\..* | |
| IP=<HOST>\|\!\-GET_MY_FILES\-\!\..* | |
| IP=<HOST>\|\@_RESTORE\-FILES_\@\..* | |
| IP=<HOST>\|.*\.Puma | |
| IP=<HOST>\|.*\.\[yoursalvations\@protonmail\.ch\]\.neverdies\@tutanota\.com | |
| IP=<HOST>\|.*\.kraussmfz | |
| IP=<HOST>\|.*\.PUMAX | |
| IP=<HOST>\|.*\.anami | |
| IP=<HOST>\|.*\.449o43 | |
| IP=<HOST>\|.*\.DeLpHiMoRiX\!\@\@\@\@_\@\@_\@_2018_\@\@\@_\@_\@_\@\@\@ | |
| IP=<HOST>\|.*\.\[stopencrypt\@qq\.com\]\.adobe | |
| IP=<HOST>\|.*\.Enter | |
| IP=<HOST>\|.*\.betta | |
| IP=<HOST>\|.*\.INFOWAIT | |
| IP=<HOST>\|.*\.FIXT | |
| IP=<HOST>\|.*\.fire | |
| IP=<HOST>\|.*\.Horsuke | |
| IP=<HOST>\|.*\.Vapor | |
| IP=<HOST>\|.*\.ispfv | |
| IP=<HOST>\|.*\.Bear | |
| IP=<HOST>\|.*\.EnyBenied | |
| IP=<HOST>\|.*\.BlackHat | |
| IP=<HOST>\|.*\.Epoblockl | |
| IP=<HOST>\|.*\.DATAWAIT | |
| IP=<HOST>\|.*\.010001 | |
| IP=<HOST>\|.*\.AUDIT | |
| IP=<HOST>\|.*\.\[papillon9275\] | |
| IP=<HOST>\|.*\.UKCZA | |
| IP=<HOST>\|.*\.YIAQDG | |
| IP=<HOST>\|.*\.CQXGPMKNR | |
| IP=<HOST>\|.*\.HHFEHIOL | |
| IP=<HOST>\|.*\.GrujaRS | |
| IP=<HOST>\|.*\.xuy | |
| IP=<HOST>\|.*\.crypted034 | |
| IP=<HOST>\|.*\.FilGZmsp | |
| IP=<HOST>\|.*\.krzffw | |
| IP=<HOST>\|.*\.impect | |
| IP=<HOST>\|.*\.fast | |
| IP=<HOST>\|.*\.Ox4444 | |
| IP=<HOST>\|.*\.6db8 | |
| IP=<HOST>\|.*\.PTGEPVEKM | |
| IP=<HOST>\|.*\.adobe | |
| IP=<HOST>\|.*\.JKOUOGVG | |
| IP=<HOST>\|.*\.mariacbc | |
| IP=<HOST>\|.*\.supportfiless24\@protonmail\.ch | |
| IP=<HOST>\|.*\.SYMMYWARE | |
| IP=<HOST>\|.*\.vendetta2 | |
| IP=<HOST>\|.*\.xxxxx | |
| IP=<HOST>\|.*\.CommonRansom | |
| IP=<HOST>\|.*\.crypt888 | |
| IP=<HOST>\|.*\.gdb | |
| IP=<HOST>\|.*\.wewillhelp\@airmail\.cc | |
| IP=<HOST>\|.*\.WAND | |
| IP=<HOST>\|.*\.\[everest\@airmail\.cc\]\.EVEREST | |
| IP=<HOST>\|.*\.FUNNY | |
| IP=<HOST>\|.*\.vanss | |
| IP=<HOST>\|.*\.SANTANA | |
| IP=<HOST>\|.*\.NOT | |
| IP=<HOST>\|.*\.beer | |
| IP=<HOST>\|.*\.SOLO | |
| IP=<HOST>\|.*\.GMPF | |
| IP=<HOST>\|.*\.W0YR8 | |
| IP=<HOST>\|.*\.charm | |
| IP=<HOST>\|.*\.birbb | |
| IP=<HOST>\|TOTALLYLEGIT\.EXE | |
| IP=<HOST>\|.*\.altdelete\@cock\.li\.district | |
| IP=<HOST>\|.*\.ctrlalt\@cock\.li\.district | |
| IP=<HOST>\|.*\.THDA | |
| IP=<HOST>\|.*\.katyusha | |
| IP=<HOST>\|.*\.LGAWPULM | |
| IP=<HOST>\|.*\.\[mixon\.constantine\@aol\.com\]\.gamma | |
| IP=<HOST>\|.*\.101 | |
| IP=<HOST>\|.*\.zlpzdel | |
| IP=<HOST>\|.*\.junked | |
| IP=<HOST>\|.*\.DQXOO | |
| IP=<HOST>\|.*\.NOBAD | |
| IP=<HOST>\|.*\.garrantydecrypt | |
| IP=<HOST>\|.*\.BAWSUOOXE | |
| IP=<HOST>\|.*\.Kg9EX | |
| IP=<HOST>\|.*\.EMAN50 | |
| IP=<HOST>\|.*\.\[crab7765\@gmx\.de\]\.crab | |
| IP=<HOST>\|\!\!\!ReadMeToDecrypt\.txt | |
| IP=<HOST>\|.*\.qweuirtksd | |
| IP=<HOST>\|\#README_GMAN\#\.rtf | |
| IP=<HOST>\|\!README_GMAN\!\.rtf | |
| IP=<HOST>\|.*\.GMAN | |
| IP=<HOST>\|.*\.boost | |
| IP=<HOST>\|.*\.ziqzqzdi | |
| IP=<HOST>\|52036F92\.tmp | |
| IP=<HOST>\|.*\.FFF | |
| IP=<HOST>\|.*\.911 | |
| IP=<HOST>\|.*\.2xx9 | |
| IP=<HOST>\|.*\.\@decrypt_2017 | |
| IP=<HOST>\|(encrypted).* | |
| IP=<HOST>\|.*zn2016 | |
| IP=<HOST>\|\#HOW_DECRYPT_FILES\#\.html | |
| IP=<HOST>\|\!back_files\!\.html | |
| IP=<HOST>\|.*\.Bill_Clinton\@derpymailorg | |
| IP=<HOST>\|.*\.nWcrypt | |
| IP=<HOST>\|.*\.needkeys | |
| IP=<HOST>\|.*\.YAYA | |
| IP=<HOST>\|.*\.write_on_email | |
| IP=<HOST>\|.*\.needdecrypt | |
| IP=<HOST>\|.*\.0402 | |
| IP=<HOST>\|.*\.NIGGA | |
| IP=<HOST>\|HOW_DECRYPT_FILES\#\.html | |
| IP=<HOST>\|.*\.eQTz | |
| IP=<HOST>\|.*\.aRpt | |
| IP=<HOST>\|.*\.3P7m | |
| IP=<HOST>\|.*\.3RNu | |
| IP=<HOST>\|.*\.rpd | |
| IP=<HOST>\|.*\.\[oron\@india\.com\]\.dharma | |
| IP=<HOST>\|HOW\\ TO\\ RECOVER\\ ENCRYPTED\\ FILES\-infovip\@airmail\.cc\.TXT | |
| IP=<HOST>\|READ_TO_DECRYPT\.html | |
| IP=<HOST>\|.*\.\[embrace\@airmail\.cc\]\.embrace | |
| IP=<HOST>\|.*\[Beamsell\@qq\.com\]\.bip | |
| IP=<HOST>\|.*\[files\.restore\@aol\.com\]\.write | |
| IP=<HOST>\|\#NEWRAR_README\#\.rtf | |
| IP=<HOST>\|Files\\ encrypted\.html | |
| IP=<HOST>\|.*\.backup | |
| IP=<HOST>\|.*\[java2018\@tuta\\ io\]\.arrow | |
| IP=<HOST>\|\!OoopsYourFilesLocked\!\.rtf | |
| IP=<HOST>\|.*\[RELOCK001\@TUTA\.IO\] | |
| IP=<HOST>\|.*\.\[btc\@fros\.cc\]\.btc | |
| IP=<HOST>\|How\\ To\\ Restore\\ Files\.txt | |
| IP=<HOST>\|.*\.bgtx | |
| IP=<HOST>\|Info\.hta | |
| IP=<HOST>\|FILES\\ ENCRYPTED\.txt | |
| IP=<HOST>\|.*\.DHDR4 | |
| IP=<HOST>\|.*\.crypted_marztoneb\@tutanota_de | |
| IP=<HOST>\|YOU_MUST_READ_ME\.rtf | |
| IP=<HOST>\|.*How\\ to\\ Decrypt\\ Files\-.*\.html | |
| IP=<HOST>\|.*\.BaLoZiN | |
| IP=<HOST>\|.*\.RJZUNA | |
| IP=<HOST>\|.*\@LOCKED | |
| IP=<HOST>\|.*\.EMAN | |
| IP=<HOST>\|.*\.firmabilgileri | |
| IP=<HOST>\|.*\-DECRYPT\.txt | |
| IP=<HOST>\|.*\.iudgkwv | |
| IP=<HOST>\|.*\.\[notopen\@countermail\.com\]\.NOT_OPEN | |
| IP=<HOST>\|ReadMe_Decryptor\.txt | |
| IP=<HOST>\|\!_HOW_RECOVERY_FILES_\!\.txt | |
| IP=<HOST>\|READ__IT\.txt | |
| IP=<HOST>\|.*\.f.*cked | |
| IP=<HOST>\|.*\-DECRYPT\.html | |
| IP=<HOST>\|.*\.\[paydecryption\@qq\.com\]\.brrr | |
| IP=<HOST>\|.*\.spaß | |
| IP=<HOST>\|.*\.olduw | |
| IP=<HOST>\|.*\.yoewy | |
| IP=<HOST>\|.*\.BDKR | |
| IP=<HOST>\|.*\.onlinesupport | |
| IP=<HOST>\|.*\.anonymous | |
| IP=<HOST>\|.*\.bkp | |
| IP=<HOST>\|.*\.ryk | |
| IP=<HOST>\|.*\.skype | |
| IP=<HOST>\|.*\.CHE808 | |
| IP=<HOST>\|.*\.parrot | |
| IP=<HOST>\|.*\.monro | |
| IP=<HOST>\|.*\.NOT_OPEN | |
| IP=<HOST>\|.*\.no_more_ransomware | |
| IP=<HOST>\|.*\.gamma | |
| IP=<HOST>\|.*\.brrr | |
| IP=<HOST>\|.*\.Nano | |
| IP=<HOST>\|.*\.ITLOCK | |
| IP=<HOST>\|.*\.SAVEfiles | |
| IP=<HOST>\|.*\.mvp | |
| IP=<HOST>\|.*\.hitler | |
| IP=<HOST>\|.*\.mammon | |
| IP=<HOST>\|.*\.SLAV | |
| IP=<HOST>\|.*\.davilarita\@mail\.com\.yyy0 | |
| IP=<HOST>\|.*\[shivamana\@seznam\.cz\]\.pip | |
| IP=<HOST>\|.*\.KOK08 | |
| IP=<HOST>\|.*\.eoeo | |
| IP=<HOST>\|.*\.FASTBOB | |
| IP=<HOST>\|.*\.lockymap | |
| IP=<HOST>\|.*\.NEWRAR | |
| IP=<HOST>\|.*\.cryptoNar | |
| IP=<HOST>\|.*\.partially\.cryptoNar | |
| IP=<HOST>\|.*\.PICO | |
| IP=<HOST>\|.*\.CYBERGOD | |
| IP=<HOST>\|.*\.rcrypted | |
| IP=<HOST>\|.*\.kvllyatprotonmaildotch | |
| IP=<HOST>\|.*\.KOK8 | |
| IP=<HOST>\|.*\.fsdfsdfsdfsdfsdfsfdsfs | |
| IP=<HOST>\|How\\ To\\ Decode\\ Files\.hta | |
| IP=<HOST>\|.*\.BadNews | |
| IP=<HOST>\|.*\.cassetto | |
| IP=<HOST>\|.*\.sophos | |
| IP=<HOST>\|.*\.\{incredible0ansha\@tuta\.io\}\.ARA | |
| IP=<HOST>\|.*\.\[backdata\@cock\.li\]\.CreamPie | |
| IP=<HOST>\|.*\.FuckedByGhost | |
| IP=<HOST>\|.*\.\#__EnCrYpTED_BY_dzikusssT3AM_ransomware\!__\# | |
| IP=<HOST>\|.*\.lockedfile | |
| IP=<HOST>\|.*\.WHY | |
| IP=<HOST>\|.*\.AlfaBlock | |
| IP=<HOST>\|\#\\ How\\ to\\ Decrypt\\ Files\.txt | |
| IP=<HOST>\|.*\-Lock\.onion | |
| IP=<HOST>\|.*\.PrOtOnIs\.VaNdElIs | |
| IP=<HOST>\|.*\.PrOtOnIs | |
| IP=<HOST>\|.*\.Armage | |
| IP=<HOST>\|.*\.rent | |
| IP=<HOST>\|.*\.fox | |
| IP=<HOST>\|.*\.pleaseCallQQ | |
| IP=<HOST>\|.*\.lockedgood | |
| IP=<HOST>\|.*\.hacked\.by\.Snaiparul | |
| IP=<HOST>\|.*\.ShutUpAndDance | |
| IP=<HOST>\|.*\.K8VfiZ | |
| IP=<HOST>\|.*\.G8xB | |
| IP=<HOST>\|.*\.cmb | |
| IP=<HOST>\|.*\.b29 | |
| IP=<HOST>\|.*\.poolezoor | |
| IP=<HOST>\|.*\.id\-.*\.cmb | |
| IP=<HOST>\|.*\.KEYPASS | |
| IP=<HOST>\|.*\.doubleoffset | |
| IP=<HOST>\|.*\.tedcrypt | |
| IP=<HOST>\|\!=How_to_decrypt_files=\!\.txt | |
| IP=<HOST>\|.*\.divine | |
| IP=<HOST>\|.*\.wannacryv2 | |
| IP=<HOST>\|.*\.anonimus\.mr\@yahoo\.com | |
| IP=<HOST>\|.*\.dragnea | |
| IP=<HOST>\|.*\.RECOVERYOURFILES | |
| IP=<HOST>\|.*\.invaded | |
| IP=<HOST>\|.*\.incpas | |
| IP=<HOST>\|.*\.BARRACUDA | |
| IP=<HOST>\|.*\.sdk | |
| IP=<HOST>\|.*\.cryptes | |
| IP=<HOST>\|.*\.like | |
| IP=<HOST>\|.*\.ukrain | |
| IP=<HOST>\|.*\.dfjhsalfhsakljfhsljkahfdjklashfdjklh | |
| IP=<HOST>\|.*\.black007 | |
| IP=<HOST>\|.*\.combo | |
| IP=<HOST>\|.*\.adapaterson\@mail\.com\.mkmk | |
| IP=<HOST>\|.*0nl1ne.* | |
| IP=<HOST>\|.*\.locked\.zip | |
| IP=<HOST>\|.*\.boris | |
| IP=<HOST>\|.*\.powerfuldecrypt | |
| IP=<HOST>\|.*\.predator | |
| IP=<HOST>\|.*\.XERO | |
| IP=<HOST>\|.*\.HYENA | |
| IP=<HOST>\|.*\.BD\.Recovery | |
| IP=<HOST>\|.*\.zzz12 | |
| IP=<HOST>\|.*king_ouroboros.* | |
| IP=<HOST>\|.*\.dyaaghemy | |
| IP=<HOST>\|.*\.\[firmabilgileri\@bk\.ru\] | |
| IP=<HOST>\|.*\.DATASTOP | |
| IP=<HOST>\|.*\.thunder | |
| IP=<HOST>\|.*\.LanRan.* | |
| IP=<HOST>\|.*\.deep | |
| IP=<HOST>\|.*\.TaRoNiS | |
| IP=<HOST>\|.*\.desu | |
| IP=<HOST>\|.*\.SHRUG2 | |
| IP=<HOST>\|.*\.\[thunderhelp\@airmail\.cc\]\.thunder | |
| IP=<HOST>\|.*\.LanRan2\.0\.5 | |
| IP=<HOST>\|.*\.\[dsupport\@protonmail\.com\] | |
| IP=<HOST>\|.*\.jewsomware | |
| IP=<HOST>\|.*\.\[Filesreturn247\@gmx\.de\]\.lock | |
| IP=<HOST>\|.*\.\#\#___POLICJA\!\!\!___TEN_PLIK_ZOSTA | |
| IP=<HOST>\|.*\.animus | |
| IP=<HOST>\|.*\.\[evil\@cock\.lu\]\.EVIL | |
| IP=<HOST>\|.*\.\[mrbin775\@gmx\.de\]\.bin | |
| IP=<HOST>\|.*\.DATA_IS_SAFE_YOU_NEED_TO_MAKE_THE_PAYMENT_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_LOST_FOREVER_PLEASE_BE_REZONABLE_IS_NOT_A_JOKE_TIME_IS_LIMITED | |
| IP=<HOST>\|.*\.XVNAW | |
| IP=<HOST>\|.*\.24H | |
| IP=<HOST>\|.*\.\[eV3rbe\@rape\.lol\]\.eV3rbe | |
| IP=<HOST>\|.*\.SHRUG | |
| IP=<HOST>\|.*\.KUAJW | |
| IP=<HOST>\|.*\.\[btc2018\@tutanota\.de\]\.meduza | |
| IP=<HOST>\|.*\.coder007\@protonmail\.com | |
| IP=<HOST>\|.*\[qmqtt\@protonmail\.ch\]\.HRM | |
| IP=<HOST>\|.*\[qrrqtt\@protonmail\.ch\]\.HRM | |
| IP=<HOST>\|.*\.choda | |
| IP=<HOST>\|.*\.ransomcrypt | |
| IP=<HOST>\|FILES\.TXT | |
| IP=<HOST>\|.*\.nozelesn | |
| IP=<HOST>\|.*\.KRAB | |
| IP=<HOST>\|.*\.Aurora | |
| IP=<HOST>\|.*\.bomber | |
| IP=<HOST>\|.*\.BtcKING | |
| IP=<HOST>\|.*\.CyberSCCP | |
| IP=<HOST>\|.*\.ssimpotashka\@gmail\.com | |
| IP=<HOST>\|.*\.PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_to_make_the_payment | |
| IP=<HOST>\|.*\@cock\.email | |
| IP=<HOST>\|.*\.recme | |
| IP=<HOST>\|.*\.king_ouroboros.* | |
| IP=<HOST>\|.*\.omerta | |
| IP=<HOST>\|.*\.\[XAVAX\@PM\.ME\]\.omerta | |
| IP=<HOST>\|.*\.donut | |
| IP=<HOST>\|.*\.volcano | |
| IP=<HOST>\|.*\.jungle\@anonymousspechcom | |
| IP=<HOST>\|.*\.Alkohol | |
| IP=<HOST>\|.*\.oneway | |
| IP=<HOST>\|.*\.ONYX | |
| IP=<HOST>\|.*\.fastsupport\@xmpp\.jp | |
| IP=<HOST>\|.*\.BIG4\+ | |
| IP=<HOST>\|.*\.leen | |
| IP=<HOST>\|.*\.horsuke\@nuke\.africa | |
| IP=<HOST>\|.*\.DiskDoctor | |
| IP=<HOST>\|.*\.qnbqw | |
| IP=<HOST>\|.*\.ssananunak1987\@protonmail\.com\.b2fr | |
| IP=<HOST>\|.*\.codyprince92\@mail\.com\.ovgm | |
| IP=<HOST>\|.*\.fastrecovery\@airmail\.cc | |
| IP=<HOST>\|.*\.reycarnasi1983\@protonmail\.com\.gw3w | |
| IP=<HOST>\|.*\.billingsupp | |
| IP=<HOST>\|.*\.ndpyhss | |
| IP=<HOST>\|.*\.SF | |
| IP=<HOST>\|.*\.digiworldhack\@tutanota\.com | |
| IP=<HOST>\|RESTORE\-SIGRUN\..* | |
| IP=<HOST>\|.*id\-.*\.BI_ID | |
| IP=<HOST>\|.*\.cryptgh0st | |
| IP=<HOST>\|.*\.emilysupp | |
| IP=<HOST>\|.*\.RedEye | |
| IP=<HOST>\|.*\.AdolfHitler | |
| IP=<HOST>\|.*\.crybrazil | |
| IP=<HOST>\|.*\.infovip\@airmail\.cc | |
| IP=<HOST>\|.*\.REBUS | |
| IP=<HOST>\|filesinfo\.txt | |
| IP=<HOST>\|\!\!\!\!RESTORE_FILES\!\!\!\.txt | |
| IP=<HOST>\|.*\.insta | |
| IP=<HOST>\|.*\.CONTACTUS | |
| IP=<HOST>\|.*\.osk | |
| IP=<HOST>\|.*\.\[pain\@cock\.lu\]\.pain | |
| IP=<HOST>\|.*\.embrace | |
| IP=<HOST>\|Decoding\\ help\.hta | |
| IP=<HOST>\|.*\.karne | |
| IP=<HOST>\|.*\.setimichas1971\@protonmail\.com\.b4wq | |
| IP=<HOST>\|.*\.decodeme666tutanota_com | |
| IP=<HOST>\|.*\.josep | |
| IP=<HOST>\|.*\.decodeme666\@tutanota_com | |
| IP=<HOST>\|.*\.cdrpt | |
| IP=<HOST>\|.*\.SEPSIS | |
| IP=<HOST>\|.*\.ransomed\@india\.com | |
| IP=<HOST>\|.*\.sigrun | |
| IP=<HOST>\|.*\.booknish | |
| IP=<HOST>\|.*\.bip | |
| IP=<HOST>\|.*\.\[Sepsis\@protonmail\.com\]\.SEPSIS | |
| IP=<HOST>\|.*\.MTXLOCK | |
| IP=<HOST>\|.*\.RansomAES | |
| IP=<HOST>\|.*\.PAUSA | |
| IP=<HOST>\|.*\.hac | |
| IP=<HOST>\|.*\.\[BaYuCheng\@yeah\.net\]\.china | |
| IP=<HOST>\|.*\.UselessFiles | |
| IP=<HOST>\|.*\.GrAnoSinSa | |
| IP=<HOST>\|.*\.rand | |
| IP=<HOST>\|HOW\\ DECRIPT\\ FILES\.hta | |
| IP=<HOST>\|.*\.kcwenc | |
| IP=<HOST>\|.*\.mich | |
| IP=<HOST>\|.*\.OBLIVION | |
| IP=<HOST>\|.*\.cryptfile | |
| IP=<HOST>\|.*\.BlackRouter | |
| IP=<HOST>\|.*\.pay2me | |
| IP=<HOST>\|.*\.Satyr | |
| IP=<HOST>\|.*\.sorry | |
| IP=<HOST>\|.*\.tron | |
| IP=<HOST>\|.*\.sky | |
| IP=<HOST>\|.*\.NMCRYPT | |
| IP=<HOST>\|.*\@tutanota\.com\] | |
| IP=<HOST>\|.*\@tuta\.io\] | |
| IP=<HOST>\|.*\.Horros | |
| IP=<HOST>\|.*\.LolSec | |
| IP=<HOST>\|Perfect\.sys | |
| IP=<HOST>\|.*\.d3g1d5 | |
| IP=<HOST>\|.*\.excuses | |
| IP=<HOST>\|.*\.cock\.email | |
| IP=<HOST>\|.*\.MOLE66 | |
| IP=<HOST>\|.*\..*\.sell | |
| IP=<HOST>\|UselessDisk\.exe | |
| IP=<HOST>\|.*\.EGG | |
| IP=<HOST>\|.*\.JFCWF | |
| IP=<HOST>\|wormDll.*\.dll | |
| IP=<HOST>\|ScreenLocker_x86\.dll | |
| IP=<HOST>\|SsExecutor_x86\.exe | |
| IP=<HOST>\|Spreader_x86\.dll | |
| IP=<HOST>\|tabDll.*\.dll | |
| IP=<HOST>\|Zenis\-.*\..* | |
| IP=<HOST>\|.*\.xwz | |
| IP=<HOST>\|.*\.Stinger | |
| IP=<HOST>\|0000\-SORRY\-FOR\-FILES\.html | |
| IP=<HOST>\|READ_ME_HELP\.png | |
| IP=<HOST>\|READ_ME_HELP\.txt | |
| IP=<HOST>\|.*\.\[restorehelp\@qq\.com\]\.java | |
| IP=<HOST>\|.*\.FRS | |
| IP=<HOST>\|Zenis\-Instructions\.html | |
| IP=<HOST>\|.*\.\[batmanbitka1\@cock\.li\]\.arena | |
| IP=<HOST>\|.*\.koreaGame | |
| IP=<HOST>\|.*\.improved | |
| IP=<HOST>\|.*\.\[volcano666\@tutanota\.de\]\.volcano | |
| IP=<HOST>\|.*\@adsoleware\.com.* | |
| IP=<HOST>\|.*\.kwaaklocked | |
| IP=<HOST>\|_XiaoBa_Info_\.hta | |
| IP=<HOST>\|.*\.XiaoBa | |
| IP=<HOST>\|.*\.cypher | |
| IP=<HOST>\|.*\.bananaCrypt | |
| IP=<HOST>\|.*BlockBax.* | |
| IP=<HOST>\|ownertrust\.txt | |
| IP=<HOST>\|qwerty\-pub\.key | |
| IP=<HOST>\|.*\.igza4c | |
| IP=<HOST>\|.*\.Nutella | |
| IP=<HOST>\|.*\.\[everbe\@airmail\.cc\]\.everbe | |
| IP=<HOST>\|.*\.Sil3nt5pring | |
| IP=<HOST>\|.*\.Crab | |
| IP=<HOST>\|.*\.jodis | |
| IP=<HOST>\|.*\.jes | |
| IP=<HOST>\|.*\.Bitconnect | |
| IP=<HOST>\|.*\.arrow | |
| IP=<HOST>\|.*\.contact\-me\-here\-for\-the\-key\-admin\@adsoleware\.com | |
| IP=<HOST>\|.*\.leenapidx | |
| IP=<HOST>\|.*\.creeper | |
| IP=<HOST>\|.*\.Encrypted\[BaYuCheng\@yeah\.net\]\.XiaBa | |
| IP=<HOST>\|.*\.styver | |
| IP=<HOST>\|.*\.leenapidx\@snakebite\.com\.hrhr | |
| IP=<HOST>\|.*\.YOU\-ARE\-FUCKED\-BY\-BALILUWARE\-(CODED\-BY\-HEROPOINT) | |
| IP=<HOST>\|.*\.frmvrlr2017 | |
| IP=<HOST>\|.*\.SUSPENDED | |
| IP=<HOST>\|Restore\\ Files\.TxT | |
| IP=<HOST>\|.*\.ANNABELLE | |
| IP=<HOST>\|.*\.messenger\-.* | |
| IP=<HOST>\|.*\.\[ID62133703\] | |
| IP=<HOST>\|.*\.nazcrypt | |
| IP=<HOST>\|.*\.THANATOS | |
| IP=<HOST>\|.*\.ransomwared | |
| IP=<HOST>\|.*\.saturn | |
| IP=<HOST>\|.*\.干物妹！ | |
| IP=<HOST>\|.*\.happyness | |
| IP=<HOST>\|.*\[ignatevv330\@gmail\.com\]\.java | |
| IP=<HOST>\|.*fuga139gh\@dr\.com.* | |
| IP=<HOST>\|.*\.Tornado | |
| IP=<HOST>\|.*\.david | |
| IP=<HOST>\|.*\.defender | |
| IP=<HOST>\|.*\.blank | |
| IP=<HOST>\|matrix\-readme\.rtf | |
| IP=<HOST>\|WhatHappenedWithFiles\.rtf | |
| IP=<HOST>\|WhatHappenedWithMyFiles\.rtf | |
| IP=<HOST>\|Readme\-Matrix\.rtf | |
| IP=<HOST>\|\#_\#WhatWrongWithMyFiles\#_\#\.rtf | |
| IP=<HOST>\|.*_\[LINERSMIK\@NAVER\.COM\]\[JINNYG\@TUTANOTA | |
| IP=<HOST>\|.*\.honor | |
| IP=<HOST>\|.*\.twist | |
| IP=<HOST>\|.*ReadMe_Decryptor\.txt | |
| IP=<HOST>\|\.\[decryptor\@cock\.li\]\.dcrtr | |
| IP=<HOST>\|.*\.blackruby | |
| IP=<HOST>\|.*\.justice | |
| IP=<HOST>\|.*\.adam | |
| IP=<HOST>\|.*\.\.\.Files\-Frozen\-NEED\-TO\-MAKE\-PAYMENT… | |
| IP=<HOST>\|.*\.\[GuardBTC\@cock\.li\]\.java | |
| IP=<HOST>\|.*\.bunny | |
| IP=<HOST>\|.*\.lockme | |
| IP=<HOST>\|.*\.DREAM | |
| IP=<HOST>\|.*\.same | |
| IP=<HOST>\|.*\.write | |
| IP=<HOST>\|.*\.b89b | |
| IP=<HOST>\|.*\.GDCB | |
| IP=<HOST>\|.*\.\[decrypthelp\@qq\.com\]\.java | |
| IP=<HOST>\|.*\.block | |
| IP=<HOST>\|.*\.DEUSCRYPT | |
| IP=<HOST>\|.*\.notfoundrans | |
| IP=<HOST>\|.*\.howcanihelpusir | |
| IP=<HOST>\|.*\.happenencedfiles | |
| IP=<HOST>\|.*\.AreYouLoveMyRansFile | |
| IP=<HOST>\|.*\.country82000 | |
| IP=<HOST>\|.*\.insane | |
| IP=<HOST>\|.*\.qwerty | |
| IP=<HOST>\|.*\.LOCKED_BY_pablukl0cker | |
| IP=<HOST>\|.*\.\[insane\@airmail\.cc\]\.insane | |
| IP=<HOST>\|.*\.velso | |
| IP=<HOST>\|.*\.\[stopstorage\@qq\.com\]\.java | |
| IP=<HOST>\|.*\.\[bacon\@oddwallps\.com\]\.java | |
| IP=<HOST>\|.*\.PLANETARY | |
| IP=<HOST>\|.*\.CryptWalker | |
| IP=<HOST>\|.*\.Infinite | |
| IP=<HOST>\|.*\.\[satan2018\@protonmail\.com\]\.java | |
| IP=<HOST>\|.*\.LTML | |
| IP=<HOST>\|.*\.\[decodingfiles\@tuta\.io\]\.java | |
| IP=<HOST>\|.*\.kryptonite | |
| IP=<HOST>\|.*\.Server | |
| IP=<HOST>\|.*\.leon | |
| IP=<HOST>\|.*\.vrmrkz | |
| IP=<HOST>\|.*\.1btc | |
| IP=<HOST>\|.*\.\[Bas_ket\@aol\.com\]\.java | |
| IP=<HOST>\|.*\.id\-02B52D6C\.\[Bas_ket\@aol\.com\]\.java | |
| IP=<HOST>\|.*\.sysdown | |
| IP=<HOST>\|.*\.gigahertz | |
| IP=<HOST>\|.*\.rapid | |
| IP=<HOST>\|.*\.triple_m | |
| IP=<HOST>\|.*\.info | |
| IP=<HOST>\|.*\.weapologize | |
| IP=<HOST>\|.*\.tastylock | |
| IP=<HOST>\|.*\.blind2 | |
| IP=<HOST>\|.*\.STOP | |
| IP=<HOST>\|.*\.wtf | |
| IP=<HOST>\|.*\.\[supp01\@arimail\.cc\]\.napoleon | |
| IP=<HOST>\|.*\.File | |
| IP=<HOST>\|.*\.\[pain\@onefinedstay\.com\]\.java | |
| IP=<HOST>\|.*\.godra | |
| IP=<HOST>\|.*\.maniac | |
| IP=<HOST>\|.*\.VENDETTA | |
| IP=<HOST>\|.*\.\[Hardcorrr\@protonmail\.com\]\.java | |
| IP=<HOST>\|.*\.\[Hardcorr\@protonmail\.com\]\.java | |
| IP=<HOST>\|.*\.satan | |
| IP=<HOST>\|.*\.fix | |
| IP=<HOST>\|.*\.GORILLA | |
| IP=<HOST>\|.*\.CHRISTMAS | |
| IP=<HOST>\|.*\.\[slaker\@india\.com\].*\.wallet | |
| IP=<HOST>\|.*\.492 | |
| IP=<HOST>\|.*\.Cyclone | |
| IP=<HOST>\|.*\.katipuneros | |
| IP=<HOST>\|.*\.styx | |
| IP=<HOST>\|.*\.RDWF | |
| IP=<HOST>\|.*\.wmfxdqz | |
| IP=<HOST>\|.*\.Work | |
| IP=<HOST>\|.*\.noblis | |
| IP=<HOST>\|.*\.DS335 | |
| IP=<HOST>\|.*\.\[skeleton\@rape\.lol\]\.skeleton | |
| IP=<HOST>\|.*\.e4m | |
| IP=<HOST>\|.*\.encencenc | |
| IP=<HOST>\|.*\.executioner | |
| IP=<HOST>\|.*\.CerBerSysLocked0009881 | |
| IP=<HOST>\|.*\.spider | |
| IP=<HOST>\|.*\.\[blind\@cock\.li\]\.blind | |
| IP=<HOST>\|.*\.0wn3dyou | |
| IP=<HOST>\|.*\.Frivolity | |
| IP=<HOST>\|.*\.lime | |
| IP=<HOST>\|.*\.\[paradisecity\@cock\.li\]\.arena | |
| IP=<HOST>\|_READ_ME_FOR_DECRYPT\.txt | |
| IP=<HOST>\|.*\.\[amagnus\@india\.com\]\.wallet | |
| IP=<HOST>\|.*\.eTeRnItY | |
| IP=<HOST>\|.*\.bit | |
| IP=<HOST>\|.*\.dxjay | |
| IP=<HOST>\|.*\.dwbiwty | |
| IP=<HOST>\|.*\.xhspythxn | |
| IP=<HOST>\|.*\.fbuvkngy | |
| IP=<HOST>\|.*\.RansomMine | |
| IP=<HOST>\|.*\.MTC | |
| IP=<HOST>\|.*\.napoleon | |
| IP=<HOST>\|.*\.dlenggrl | |
| IP=<HOST>\|.*\.TEST | |
| IP=<HOST>\|.*\.GOTYA | |
| IP=<HOST>\|.*\.maxicrypt | |
| IP=<HOST>\|.*\.\[maxicrypt\@cock\.li\]\.maxicrypt | |
| IP=<HOST>\|.*\.encrptd | |
| IP=<HOST>\|.*\.vpgvlkb | |
| IP=<HOST>\|.*\.areyoulovemyrans | |
| IP=<HOST>\|.*\.shadow | |
| IP=<HOST>\|.*\.\[suupport\@protonmail\.com\]\.scarab | |
| IP=<HOST>\|.*\.cock\.li | |
| IP=<HOST>\|.*\.aajf | |
| IP=<HOST>\|.*\.iGotYou | |
| IP=<HOST>\|.*\.Ipcrestore | |
| IP=<HOST>\|.*\.PHOBOS | |
| IP=<HOST>\|.*\.fairytail | |
| IP=<HOST>\|.*\.fucku | |
| IP=<HOST>\|.*\.basslock | |
| IP=<HOST>\|.*\.wdie | |
| IP=<HOST>\|.*\.wsmile | |
| IP=<HOST>\|.*\.wndie | |
| IP=<HOST>\|.*\.0000 | |
| IP=<HOST>\|.*\.RASTAKHIZ | |
| IP=<HOST>\|.*\.PANDA | |
| IP=<HOST>\|.*\.BIG1 | |
| IP=<HOST>\|.*\.TRUE | |
| IP=<HOST>\|.*\.am | |
| IP=<HOST>\|.*\.kill | |
| IP=<HOST>\|.*\.kimchenyn | |
| IP=<HOST>\|.*\.XZZX | |
| IP=<HOST>\|.*\.fat32 | |
| IP=<HOST>\|.*\.\#\#ENCRYPTED_BY_pablukl0cker\#\# | |
| IP=<HOST>\|.*aes_ni_gov | |
| IP=<HOST>\|.*\.aes_ni | |
| IP=<HOST>\|.*\.bloked | |
| IP=<HOST>\|.*\.cripted | |
| IP=<HOST>\|.*\.filesfucked | |
| IP=<HOST>\|.*\.cryptx.* | |
| IP=<HOST>\|.*\.how_to_recover.*\..* | |
| IP=<HOST>\|.*\.help_restore.*\..* | |
| IP=<HOST>\|.*\.restore_fi.*\..* | |
| IP=<HOST>\|.*\.ukr\.net.* | |
| IP=<HOST>\|.*\.qq_com.* | |
| IP=<HOST>\|Wo_sind_meine_Dateien\.htm.* | |
| IP=<HOST>\|.*\.fake | |
| IP=<HOST>\|.*\.cobra | |
| IP=<HOST>\|.*\]\.block | |
| IP=<HOST>\|\!\!\!GetBackData\!\!\!\.txt | |
| IP=<HOST>\|.*\.HRM | |
| IP=<HOST>\|.*\.skvtb | |
| IP=<HOST>\|.*\.game | |
| IP=<HOST>\|.*\.Losers | |
| IP=<HOST>\|.*\.gr3g | |
| IP=<HOST>\|.*\.oni | |
| IP=<HOST>\|.*\.sinta | |
| IP=<HOST>\|.*\.libbywovas\@dr\.com\.gr3g | |
| IP=<HOST>\|.*\.xiaoba33 | |
| IP=<HOST>\|.*\.xiaoba32 | |
| IP=<HOST>\|.*\.xiaoba31 | |
| IP=<HOST>\|.*\.xiaoba30 | |
| IP=<HOST>\|.*\.xiaoba29 | |
| IP=<HOST>\|.*\.xiaoba28 | |
| IP=<HOST>\|.*\.xiaoba27 | |
| IP=<HOST>\|.*\.xiaoba26 | |
| IP=<HOST>\|.*\.xiaoba25 | |
| IP=<HOST>\|.*\.xiaoba24 | |
| IP=<HOST>\|.*\.xiaoba23 | |
| IP=<HOST>\|.*\.xiaoba22 | |
| IP=<HOST>\|.*\.xiaoba21 | |
| IP=<HOST>\|.*\.xiaoba20 | |
| IP=<HOST>\|.*\.xiaoba19 | |
| IP=<HOST>\|.*\.xiaoba18 | |
| IP=<HOST>\|.*\.xiaoba17 | |
| IP=<HOST>\|.*\.xiaoba16 | |
| IP=<HOST>\|.*\.xiaoba15 | |
| IP=<HOST>\|.*\.xiaoba14 | |
| IP=<HOST>\|.*\.xiaoba13 | |
| IP=<HOST>\|.*\.xiaoba12 | |
| IP=<HOST>\|.*\.xiaoba11 | |
| IP=<HOST>\|.*\.xiaoba10 | |
| IP=<HOST>\|.*\.xiaoba9 | |
| IP=<HOST>\|.*\.xiaoba8 | |
| IP=<HOST>\|.*\.xiaoba7 | |
| IP=<HOST>\|.*\.xiaoba6 | |
| IP=<HOST>\|.*\.xiaoba5 | |
| IP=<HOST>\|.*\.xiaoba4 | |
| IP=<HOST>\|.*\.xiaoba3 | |
| IP=<HOST>\|.*\.xiaoba2 | |
| IP=<HOST>\|.*\.XiaoBa1 | |
| IP=<HOST>\|.*\.XiaoBa34 | |
| IP=<HOST>\|.*\.colecyrus\@mail\.com\.b007 | |
| IP=<HOST>\|allcry_upx\.exe | |
| IP=<HOST>\|.*\-PLIIKI\.txt | |
| IP=<HOST>\|dispci\.exe | |
| IP=<HOST>\|cscc\.dat | |
| IP=<HOST>\|infpub\.dat | |
| IP=<HOST>\|LEIA_ME\.txt | |
| IP=<HOST>\|.*\.lordofshadow | |
| IP=<HOST>\|.*\.SaherBlueEagleRansomware | |
| IP=<HOST>\|.*\.\[MAXVISION\@SECMAIL\.PRO\]\.CRIPTOGRAFADO | |
| IP=<HOST>\|\!____________DESKRYPT\@TUTAMAIL\.COM________\.rar | |
| IP=<HOST>\|How_Decrypt_Files\.hta | |
| IP=<HOST>\|.*\.Ordinal | |
| IP=<HOST>\|.*\.aes\! | |
| IP=<HOST>\|READ_ME_FOR_DECRYPT_.*\.txt | |
| IP=<HOST>\|.*\.ihsdj | |
| IP=<HOST>\|.*\.kgpvwnr | |
| IP=<HOST>\|.*\.LIN | |
| IP=<HOST>\|.*\.CHAK | |
| IP=<HOST>\|.*\.Chartogy | |
| IP=<HOST>\|.*\.viiper | |
| IP=<HOST>\|.*\.x1881 | |
| IP=<HOST>\|.*\.stroman | |
| IP=<HOST>\|.*\.asasin | |
| IP=<HOST>\|.*\.BUGWARE | |
| IP=<HOST>\|.*\.SENRUS17 | |
| IP=<HOST>\|\!\!\\ RETURN\\ FILES\\ \!\!\.txt | |
| IP=<HOST>\|.*\.loveransisgood | |
| IP=<HOST>\|.*\.PayDay | |
| IP=<HOST>\|.*\.allcry | |
| IP=<HOST>\|.*\.lockd | |
| IP=<HOST>\|.*\.PRIVAT66 | |
| IP=<HOST>\|.*\.SHARK | |
| IP=<HOST>\|005\-DO\-YOU\-WANT\-FILES\.html | |
| IP=<HOST>\|.*\.\# | |
| IP=<HOST>\|.*\.CyberSoldiersST | |
| IP=<HOST>\|.*\.wyvern | |
| IP=<HOST>\|.*\.technicy | |
| IP=<HOST>\|.*\.cyberdrill | |
| IP=<HOST>\|.*\.ZW | |
| IP=<HOST>\|.*\.myransext2017 | |
| IP=<HOST>\|.*\.ykcol | |
| IP=<HOST>\|.*\.XmdXtazX\. | |
| IP=<HOST>\|.*\.albertkerr94\@mail\.com\.m5m5 | |
| IP=<HOST>\|.*\.cryptojoker | |
| IP=<HOST>\|.*\.Doxes | |
| IP=<HOST>\|.*\.XmdXtazX | |
| IP=<HOST>\|.*\.blind | |
| IP=<HOST>\|.*\.Locked_file | |
| IP=<HOST>\|.*\.HeroesOftheStorm | |
| IP=<HOST>\|.*\.dian | |
| IP=<HOST>\|.*\.mind | |
| IP=<HOST>\|.*\.H_F_D_locked | |
| IP=<HOST>\|.*\.reaGAN | |
| IP=<HOST>\|.*\.INCANTO | |
| IP=<HOST>\|.*\.pablukCRYPT | |
| IP=<HOST>\|.*\.gocr | |
| IP=<HOST>\|.*\.revolution | |
| IP=<HOST>\|.*\.disposed2017 | |
| IP=<HOST>\|.*\.armadilo1 | |
| IP=<HOST>\|.*\.trevinomason1\@mail\.com\.vsunit | |
| IP=<HOST>\|.*\.\[Brazzers\@aolonline\.top\]\.arena | |
| IP=<HOST>\|_RECoVERY_\+.*\..* | |
| IP=<HOST>\|.*\.__dilmaV1 | |
| IP=<HOST>\|.*\.hacked | |
| IP=<HOST>\|.*\.\[assistance\@firemail\.cc\]\.nuclear | |
| IP=<HOST>\|READ_THIS_FILE_1\.TXT | |
| IP=<HOST>\|.*\.pnr | |
| IP=<HOST>\|.*\.\{ljspqk7\@aol\.com\}\.BRT92 | |
| IP=<HOST>\|.*\.ILLNEST | |
| IP=<HOST>\|.*\.OhNo\! | |
| IP=<HOST>\|.*\.akira | |
| IP=<HOST>\|.*\.\.txt | |
| IP=<HOST>\|.*\.3nCRY | |
| IP=<HOST>\|.*\.clinTON | |
| IP=<HOST>\|RESTORE_INFO\-.*\.txt | |
| IP=<HOST>\|.*\.BUSH | |
| IP=<HOST>\|.*\.\[black\.world\@tuta\.io\]\.nuclear | |
| IP=<HOST>\|.*\.CryptedOpps | |
| IP=<HOST>\|.*\.crypt12 | |
| IP=<HOST>\|.*\.OTR | |
| IP=<HOST>\|Important_Read_Me\.txt | |
| IP=<HOST>\|.*\.JezRoz | |
| IP=<HOST>\|.*\.UNLIS | |
| IP=<HOST>\|.*\.granny | |
| IP=<HOST>\|.*\.shinigami | |
| IP=<HOST>\|.*\.PA\-SIEM | |
| IP=<HOST>\|.*\.flat | |
| IP=<HOST>\|TUTORIEL\.bmp | |
| IP=<HOST>\|.*\.xolzsec | |
| IP=<HOST>\|.*\.Flux | |
| IP=<HOST>\|.*\.Blocked2 | |
| IP=<HOST>\|.*\.wooly | |
| IP=<HOST>\|.*\.nuclear | |
| IP=<HOST>\|.*\.area | |
| IP=<HOST>\|.*\.EMPTY | |
| IP=<HOST>\|.*\.arena | |
| IP=<HOST>\|lukitus\.html | |
| IP=<HOST>\|.*\.zuzya | |
| IP=<HOST>\|.*\.\{saruman7\@india\.com\}\.BRT92 | |
| IP=<HOST>\|.*\.CYRON | |
| IP=<HOST>\|.*\.\#Locky | |
| IP=<HOST>\|.*\.ERROR | |
| IP=<HOST>\|.*\.EV | |
| IP=<HOST>\|.*\.lokitus | |
| IP=<HOST>\|.*\.lukitus\-tiedostopäätettä | |
| IP=<HOST>\|.*\.fmoon | |
| IP=<HOST>\|.*\.cesar | |
| IP=<HOST>\|.*\.lukitus | |
| IP=<HOST>\|.*\.KK | |
| IP=<HOST>\|.*\.prosperous666 | |
| IP=<HOST>\|.*\.\[actum_signum\@aol\.com\]\.onion | |
| IP=<HOST>\|.*\.encrypted\[Payfordecrypt\@protonmail\.com\] | |
| IP=<HOST>\|.*\.enc | |
| IP=<HOST>\|.*\.anubi | |
| IP=<HOST>\|.*\.D2550A49BF52DFC23F2C013C5 | |
| IP=<HOST>\|.*\.LEGO | |
| IP=<HOST>\|.*\.Cerber_RansomWare\@qq\.com | |
| IP=<HOST>\|.*\.0x009d8a | |
| IP=<HOST>\|.*\.3301 | |
| IP=<HOST>\|.*\.ZABLOKOWANE | |
| IP=<HOST>\|.*\.pabluklocker | |
| IP=<HOST>\|.*\.cezar | |
| IP=<HOST>\|.*\.cnc | |
| IP=<HOST>\|.*\.trump | |
| IP=<HOST>\|.*\.Crypton | |
| IP=<HOST>\|.*\.rumblegoodboy | |
| IP=<HOST>\|.*\.BONUM | |
| IP=<HOST>\|.*\.\[cho\.dambler\@yandex\.com\] | |
| IP=<HOST>\|diablo6\-.*\.htm | |
| IP=<HOST>\|.*\.DIABLO6 | |
| IP=<HOST>\|.*\.PEDO | |
| IP=<HOST>\|.*\.HELLO | |
| IP=<HOST>\|.*\.ACTUM | |
| IP=<HOST>\|.*\.OGONIA | |
| IP=<HOST>\|.*\.WAmarlocked | |
| IP=<HOST>\|\!\#\#\\ DECRYPT\\ FILES\\ \#\#\!\.txt | |
| IP=<HOST>\|.*\.nopasaran | |
| IP=<HOST>\|.*\.gryphon | |
| IP=<HOST>\|ebay\-msg\.html | |
| IP=<HOST>\|ebay_was_here | |
| IP=<HOST>\|.*\.ebay | |
| IP=<HOST>\|.*\.491 | |
| IP=<HOST>\|.*\.mtk118 | |
| IP=<HOST>\|.*\.490 | |
| IP=<HOST>\|.*\.shutdown57 | |
| IP=<HOST>\|.*\.PIRATE | |
| IP=<HOST>\|.*\.wxdrJbgSDa | |
| IP=<HOST>\|.*\.sea | |
| IP=<HOST>\|.*\.PLIN | |
| IP=<HOST>\|.*\.726 | |
| IP=<HOST>\|.*\.SEVENDAYS | |
| IP=<HOST>\|.*\.nemesis | |
| IP=<HOST>\|.*\.ocean | |
| IP=<HOST>\|.*\.rose | |
| IP=<HOST>\|.*\.\[avalona\.toga\@aol\.com\]\.blocking | |
| IP=<HOST>\|.*\.Node0 | |
| IP=<HOST>\|.*\.supported2017 | |
| IP=<HOST>\|RECOVER\-FILES\.html | |
| IP=<HOST>\|READ_ME_ASAP\.txt | |
| IP=<HOST>\|_iWasHere\.txt | |
| IP=<HOST>\|\!\!\!SAVE\\ YOUR\\ FILES\!\.bmp | |
| IP=<HOST>\|\!\!\!\!\!SAVE\\ YOUR\\ FILES\!\!\!\!\.txt | |
| IP=<HOST>\|\@decrypt_your_files\.txt | |
| IP=<HOST>\|HowToDecryptIMPORTANT\!\.txt | |
| IP=<HOST>\|.*\.WINDOWS | |
| IP=<HOST>\|.*\.bbqb | |
| IP=<HOST>\|.*\.725 | |
| IP=<HOST>\|.*\.DG | |
| IP=<HOST>\|.*\.Srpx | |
| IP=<HOST>\|.*\.freefoam | |
| IP=<HOST>\|.*\.MyChemicalRomance4EVER | |
| IP=<HOST>\|.*\.extension\.srpx | |
| IP=<HOST>\|.*\.fuck_you_av_we_are_not_globe_fake | |
| IP=<HOST>\|.*\.BRT92 | |
| IP=<HOST>\|.*\.qwqd | |
| IP=<HOST>\|IF\\ YOU\\ WANT\\ TO\\ GET\\ ALL\\ YOUR\\ FILES\\ BACK,\\ PLEASE\\ READ\\ THIS\.TXT | |
| IP=<HOST>\|.*\.TGIF | |
| IP=<HOST>\|.*\.snake | |
| IP=<HOST>\|.*\.MOLE03 | |
| IP=<HOST>\|.*\.MOLE04 | |
| IP=<HOST>\|.*\.Petya | |
| IP=<HOST>\|.*\.HAPP | |
| IP=<HOST>\|.*\.bam\! | |
| IP=<HOST>\|.*\.Atom | |
| IP=<HOST>\|.*\.GOTHAM | |
| IP=<HOST>\|.*\.skunk | |
| IP=<HOST>\|.*\.symbiom_ransomware_locked | |
| IP=<HOST>\|.*\.CK | |
| IP=<HOST>\|.*\.HUSTONWEHAVEAPROBLEM\@KEEMAIL\.ME | |
| IP=<HOST>\|.*\.yl | |
| IP=<HOST>\|.*\.ZAYKA | |
| IP=<HOST>\|.*\.NOOB | |
| IP=<HOST>\|.*\.crptd | |
| IP=<HOST>\|Instruction\\ for\\ file\\ recovery\.txt | |
| IP=<HOST>\|.*\.\[mich78\@usa\.com\] | |
| IP=<HOST>\|.*\.Reyptson | |
| IP=<HOST>\|.*\.explorer | |
| IP=<HOST>\|.*\.au1crypt | |
| IP=<HOST>\|.*\.s1crypt | |
| IP=<HOST>\|.*\.alosia | |
| IP=<HOST>\|.*\.korea | |
| IP=<HOST>\|.*\.POHU | |
| IP=<HOST>\|.*\.Ransed | |
| IP=<HOST>\|.*\.EXTE | |
| IP=<HOST>\|_HELP_INSTRUCTION\.TXT | |
| IP=<HOST>\|.*\.Malki | |
| IP=<HOST>\|.*\.707 | |
| IP=<HOST>\|.*\.A604AF9070 | |
| IP=<HOST>\|.*\.scorpio | |
| IP=<HOST>\|.*id\-.*_\[.*\@.*\..*\]\..* | |
| IP=<HOST>\|.*\.Cry128 | |
| IP=<HOST>\|.*\.Cry36 | |
| IP=<HOST>\|.*\.Cry9 | |
| IP=<HOST>\|.*\.xz | |
| IP=<HOST>\|.*\.readme_txt | |
| IP=<HOST>\|Ransom\.rtf | |
| IP=<HOST>\|.*\.OXR | |
| IP=<HOST>\|.*\.acc | |
| IP=<HOST>\|.*\.MOLE01 | |
| IP=<HOST>\|.*\.3ncrypt3d | |
| IP=<HOST>\|.*\.AZER | |
| IP=<HOST>\|_INTERESTING_INFORMACION_FOR_DECRYPT\.TXT | |
| IP=<HOST>\|.*\.dcry | |
| IP=<HOST>\|.*\.MOLE00 | |
| IP=<HOST>\|.*\.LoveYou | |
| IP=<HOST>\|.*\.z3r0 | |
| IP=<HOST>\|.*\.4x82N | |
| IP=<HOST>\|.*\.63vc4 | |
| IP=<HOST>\|.*\.BELGIAN_COCOA | |
| IP=<HOST>\|RESTORE\-\.\-FILES\.txt | |
| IP=<HOST>\|.*\.moments2900 | |
| IP=<HOST>\|.*\.0x004867 | |
| IP=<HOST>\|.*\.MMM | |
| IP=<HOST>\|.*\.rat | |
| IP=<HOST>\|.*\.aleta | |
| IP=<HOST>\|.*\.ranrans | |
| IP=<HOST>\|.*\.lalabitch, | |
| IP=<HOST>\|.*\.gankLocked | |
| IP=<HOST>\|.*\.ipygh | |
| IP=<HOST>\|.*\.via | |
| IP=<HOST>\|dllhost\.dat | |
| IP=<HOST>\|FE04\.tmp | |
| IP=<HOST>\|027cc450ef5f8c5f653329641ec1fed9.*\..* | |
| IP=<HOST>\|petwrap\.exe | |
| IP=<HOST>\|.*\.lamo | |
| IP=<HOST>\|File_Encryption_Notice\.txt | |
| IP=<HOST>\|.*\.suppose666 | |
| IP=<HOST>\|.*\.mention9823 | |
| IP=<HOST>\|.*\.breeding123 | |
| IP=<HOST>\|.*\.sux | |
| IP=<HOST>\|.*\.cfm | |
| IP=<HOST>\|.*\.Wana\\ Decrypt0r\\ Trojan\-Syria\\ Editi0n | |
| IP=<HOST>\|Paxynok\.html | |
| IP=<HOST>\|.*\.pscrypt | |
| IP=<HOST>\|.*\.a990 | |
| IP=<HOST>\|Tempimage\.jpg | |
| IP=<HOST>\|.*\.Tesla | |
| IP=<HOST>\|WannaCry\.TXT | |
| IP=<HOST>\|.*\.kuntzware | |
| IP=<HOST>\|.*\.nsmf | |
| IP=<HOST>\|.*\.Facebook | |
| IP=<HOST>\|.*\.pizdosik | |
| IP=<HOST>\|.*\.\[resque\@plague\.desi\]\.scarab | |
| IP=<HOST>\|.*\.sux\.AES128 | |
| IP=<HOST>\|.*\.cspider | |
| IP=<HOST>\|.*\.\[teroda\@bigmir\.net\]\.masterteroda\@bigmir\.net | |
| IP=<HOST>\|.*\.zbt | |
| IP=<HOST>\|.*\.MOLE02 | |
| IP=<HOST>\|your_key\.rsa | |
| IP=<HOST>\|OkuBeni\.txt | |
| IP=<HOST>\|.*\@.*\.blocking | |
| IP=<HOST>\|.*\.ogre | |
| IP=<HOST>\|.*\.tax | |
| IP=<HOST>\|StrutterGear\.exe | |
| IP=<HOST>\|ReadMe_Important\.txt | |
| IP=<HOST>\|Sifre_Coz_Talimat\.html | |
| IP=<HOST>\|.*\.whycry | |
| IP=<HOST>\|\!READ\.htm | |
| IP=<HOST>\|\!_ИНСТРУКЦИЯ_\!\.txt | |
| IP=<HOST>\|.*\.cr020801 | |
| IP=<HOST>\|.*\.cerber6 | |
| IP=<HOST>\|.*\.netn6 | |
| IP=<HOST>\|.*\.rnsmwre | |
| IP=<HOST>\|.*\.ghost | |
| IP=<HOST>\|.*\.scarab | |
| IP=<HOST>\|IF_YOU_WANT_TO_GET_ALL_YOUR_FILES_BACK_PLEASE_READ_THIS\.TXT | |
| IP=<HOST>\|.*\.R4bb0l0ck | |
| IP=<HOST>\|.*\.TraNs | |
| IP=<HOST>\|\#HOW_TO_UNRIP\#\.txt | |
| IP=<HOST>\|.*\.BeethoveN | |
| IP=<HOST>\|.*\\ \.tdelf | |
| IP=<HOST>\|.*\.spectre | |
| IP=<HOST>\|mood\-ravishing\-hd\-wallpaper\-142943312215\.jpg | |
| IP=<HOST>\|Blooper\.exe | |
| IP=<HOST>\|SintaLocker\.exe | |
| IP=<HOST>\|SintaRun\.py | |
| IP=<HOST>\|.*\.switch | |
| IP=<HOST>\|.*\.payforunlock | |
| IP=<HOST>\|HOW\\ TO\\ RECOVER\\ ENCRYPTED\\ FILES\.TXT | |
| IP=<HOST>\|README_FOR_DECRYPT\.txt | |
| IP=<HOST>\|.*\.dolphin | |
| IP=<HOST>\|.*\.dviide | |
| IP=<HOST>\|.*\.sVn | |
| IP=<HOST>\|.*\.R3K7M9 | |
| IP=<HOST>\|.*\.BMCODE | |
| IP=<HOST>\|.*\.zilla | |
| IP=<HOST>\|.*\.RaaS | |
| IP=<HOST>\|.*\.resurrection | |
| IP=<HOST>\|.*\.lost | |
| IP=<HOST>\|.*\.ram | |
| IP=<HOST>\|.*\.master | |
| IP=<HOST>\|.*\.brickr | |
| IP=<HOST>\|READ_DECRYPT_FILES\.txt | |
| IP=<HOST>\|.*\.ramen | |
| IP=<HOST>\|.*\.TRMT | |
| IP=<HOST>\|.*\.gommemode | |
| IP=<HOST>\|.*\.andonio | |
| IP=<HOST>\|.*\.phantom | |
| IP=<HOST>\|.*\.r3store | |
| IP=<HOST>\|Read\\ me\\ for\\ help\\ thanks\.txt | |
| IP=<HOST>\|.*\.imsorry | |
| IP=<HOST>\|help_to_decrypt\.txt | |
| IP=<HOST>\|.*\.YYTO | |
| IP=<HOST>\|.*\.read_to_txt_file\.yyto | |
| IP=<HOST>\|.*\.beep | |
| IP=<HOST>\|.*\.666 | |
| IP=<HOST>\|AArI\.jpg | |
| IP=<HOST>\|.*\.crying | |
| IP=<HOST>\|.*\.antihacker2017 | |
| IP=<HOST>\|.*\.theworldisyours | |
| IP=<HOST>\|.*\.spora | |
| IP=<HOST>\|.*\.sexy | |
| IP=<HOST>\|.*\.realfs0ciety\@sigaint\.org\.fs0ciety | |
| IP=<HOST>\|.*\.pays | |
| IP=<HOST>\|.*\.payrms | |
| IP=<HOST>\|.*\.paymts | |
| IP=<HOST>\|.*\.paymrss | |
| IP=<HOST>\|.*\.paym | |
| IP=<HOST>\|.*\.lol | |
| IP=<HOST>\|.*\.madebyadam | |
| IP=<HOST>\|.*\.locklock | |
| IP=<HOST>\|.*\.lcked | |
| IP=<HOST>\|.*\.kyra | |
| IP=<HOST>\|.*\.kernel_time | |
| IP=<HOST>\|.*\.kernel_pid | |
| IP=<HOST>\|.*\.kernel_complete | |
| IP=<HOST>\|.*\.ifuckedyou | |
| IP=<HOST>\|.*\.grt | |
| IP=<HOST>\|.*\.crypte | |
| IP=<HOST>\|.*\.cbu1 | |
| IP=<HOST>\|.*\-webmafia\@asia\.com_donald\@trampo\.info | |
| IP=<HOST>\|.*\.beef | |
| IP=<HOST>\|.*\.write_us_on_email | |
| IP=<HOST>\|.*\.LIGHTNING | |
| IP=<HOST>\|.*\.xfile | |
| IP=<HOST>\|DECRYPTION\.TXT | |
| IP=<HOST>\|.*\.oled | |
| IP=<HOST>\|.*\.wtdi | |
| IP=<HOST>\|.*\.4rwcry4w | |
| IP=<HOST>\|.*\.Encrypted_By_VMola\.com | |
| IP=<HOST>\|.*\.wlu | |
| IP=<HOST>\|Restore_maysomware_files\.html | |
| IP=<HOST>\|.*\.maysomware | |
| IP=<HOST>\|.*\.damoclis | |
| IP=<HOST>\|.*\.decrypter\@tutanota\.com | |
| IP=<HOST>\|.*\.VisionCrypt | |
| IP=<HOST>\|.*\.pwned | |
| IP=<HOST>\|how_to_back_files\.html | |
| IP=<HOST>\|.*\.hNcrypt | |
| IP=<HOST>\|.*\.\~xdata\~ | |
| IP=<HOST>\|.*\.b0ff | |
| IP=<HOST>\|Galaperidol\.exe | |
| IP=<HOST>\|HOW_CAN_I_DECRYPT_MY_FILES\.txt | |
| IP=<HOST>\|.*\.xdata | |
| IP=<HOST>\|Hello\\ There\!\\ Fellow\\ \@kee\\ User\!\.txt | |
| IP=<HOST>\|.*\.kee | |
| IP=<HOST>\|.*\.grux | |
| IP=<HOST>\|Restore_your_files\.txt | |
| IP=<HOST>\|READ_ME\.html | |
| IP=<HOST>\|.*\.mordor | |
| IP=<HOST>\|.*\.die | |
| IP=<HOST>\|.*\.SaMsUnG | |
| IP=<HOST>\|\!\#_DECRYPT_\#\!\.inf | |
| IP=<HOST>\|.*\.nuke55 | |
| IP=<HOST>\|.*\.onyon | |
| IP=<HOST>\|.*\.blocked | |
| IP=<HOST>\|\!Please\\ Read\\ Me\!\.txt | |
| IP=<HOST>\|\!WannaDecryptor\!\.exe\.lnk | |
| IP=<HOST>\|.*\.DARKCRY | |
| IP=<HOST>\|.*\.wincry | |
| IP=<HOST>\|.*\.wncrypt | |
| IP=<HOST>\|WannaCrypt\\ 4\.0\.exe | |
| IP=<HOST>\|t\.wry | |
| IP=<HOST>\|.*\.vCrypt1 | |
| IP=<HOST>\|.*\.theva | |
| IP=<HOST>\|.*\.PAY | |
| IP=<HOST>\|tor\.exe | |
| IP=<HOST>\|tasksche\.exe | |
| IP=<HOST>\|wcry\.zip | |
| IP=<HOST>\|taskhsvc\.exe | |
| IP=<HOST>\|taskse\.exe | |
| IP=<HOST>\|taskdl\.exe | |
| IP=<HOST>\|.*\.pky | |
| IP=<HOST>\|.*\.eky | |
| IP=<HOST>\|wcry\.exe | |
| IP=<HOST>\|Wannacry\.exe | |
| IP=<HOST>\|\@WanaDecryptor\@\..* | |
| IP=<HOST>\|.*\.slvpawned | |
| IP=<HOST>\|.*\.WCRYT | |
| IP=<HOST>\|.*\.WRNY | |
| IP=<HOST>\|.*\.LOCKED\.txt | |
| IP=<HOST>\|.*\.wncryt | |
| IP=<HOST>\|.*\.wnry | |
| IP=<HOST>\|.*\.viki | |
| IP=<HOST>\|RESTORE\-12345\-FILES\.TXT | |
| IP=<HOST>\|.*\.donation1\@protonmail\.ch\.12345 | |
| IP=<HOST>\|.*\.block_file12 | |
| IP=<HOST>\|.*\.\@decrypt2017 | |
| IP=<HOST>\|.*\.vdul | |
| IP=<HOST>\|.*\.2cXpCihgsVxB3 | |
| IP=<HOST>\|.*\.son | |
| IP=<HOST>\|loptr\-.*\.htm | |
| IP=<HOST>\|.*\.paycyka | |
| IP=<HOST>\|.*\.medal | |
| IP=<HOST>\|.*\.bagi | |
| IP=<HOST>\|\@Please_Read_Me\@\.txt | |
| IP=<HOST>\|.*\.wncry | |
| IP=<HOST>\|_\!\!\!_README_\!\!\!_.* | |
| IP=<HOST>\|_\!\!\!_README_\!\!\!_.*_\.hta | |
| IP=<HOST>\|_\!\!\!_README_\!\!\!_.*_\\ \.txt | |
| IP=<HOST>\|.*\.news | |
| IP=<HOST>\|.*\.corrupted | |
| IP=<HOST>\|HOW_TO_DECRYPT_FILES\.html | |
| IP=<HOST>\|.*\.shifr | |
| IP=<HOST>\|DECRYPT_INFO\.txt | |
| IP=<HOST>\|.*\.FailedAccess | |
| IP=<HOST>\|Cversions\.2\.db | |
| IP=<HOST>\|.*\.helppme\@india\.com\..* | |
| IP=<HOST>\|ReadME_Decrypt_Help_.*\.html | |
| IP=<HOST>\|.*\.fartplz | |
| IP=<HOST>\|.*\\ \.vCrypt1 | |
| IP=<HOST>\|.*\.xncrypt | |
| IP=<HOST>\|.*\.Lockify | |
| IP=<HOST>\|.*\.htrs | |
| IP=<HOST>\|.*\.cryptowin | |
| IP=<HOST>\|.*\.owned | |
| IP=<HOST>\|.*\.x0lzs3c | |
| IP=<HOST>\|.*\.UIWIX | |
| IP=<HOST>\|.*\.CRYPTOBOSS | |
| IP=<HOST>\|.*\.loptr | |
| IP=<HOST>\|.*\.jaff | |
| IP=<HOST>\|.*\.bitkangoroo | |
| IP=<HOST>\|.*\.cloud | |
| IP=<HOST>\|zcrypt\.exe | |
| IP=<HOST>\|.*\.uk\-dealer\@sigaint\.org | |
| IP=<HOST>\|.*_luck | |
| IP=<HOST>\|.*\.decrypt2017 | |
| IP=<HOST>\|.*\.\[admin\@hoist\.desi\]\..*\.WALLET | |
| IP=<HOST>\|.*\.\[crysis\@life\.com\]\..*\.WALLET | |
| IP=<HOST>\|.*\.\[SHIELD0\@USA\.COM\]\..*\.WALLET | |
| IP=<HOST>\|\#_RESTORING_FILES_\#\.TXT | |
| IP=<HOST>\|.*\.haters | |
| IP=<HOST>\|.*\.anon | |
| IP=<HOST>\|.*\.amnesia | |
| IP=<HOST>\|.*\.keepcalm | |
| IP=<HOST>\|.*\.MIKOYAN | |
| IP=<HOST>\|RESTORE_FILES\.HTML | |
| IP=<HOST>\|.*\.WWW | |
| IP=<HOST>\|.*\.CRYPTED000007 | |
| IP=<HOST>\|.*\.HELPPME\@INDIA\.COM\.ID83994902 | |
| IP=<HOST>\|HOW_RETURN_FILES\.TXT | |
| IP=<HOST>\|.*\.MAYA | |
| IP=<HOST>\|.*\.CONTACT_TARINEOZA\@GMAIL\.COM | |
| IP=<HOST>\|.*\.CRYPTOBYTE | |
| IP=<HOST>\|.*\.AES | |
| IP=<HOST>\|NOTE;\!\!\!\-ODZYSKAJ\-PLIKI\-\!\!\!\.TXT | |
| IP=<HOST>\|INSTRUCTION_FOR_HELPING_FILE_RECOVERY\.txt | |
| IP=<HOST>\|.*\.ADR | |
| IP=<HOST>\|.*\.NM4 | |
| IP=<HOST>\|DesktopOsiris\..* | |
| IP=<HOST>\|OSIRIS\-.*\..* | |
| IP=<HOST>\|redchip2\.exe | |
| IP=<HOST>\|.*\.LOLI | |
| IP=<HOST>\|ATLAS_FILES\.txt | |
| IP=<HOST>\|.*\.whatthefuck | |
| IP=<HOST>\|.*\.loveyouisreal | |
| IP=<HOST>\|.*\.okokokokok | |
| IP=<HOST>\|.*\.ranranranran | |
| IP=<HOST>\|READ_IT_FOR_GET_YOUR_FILE\.txt | |
| IP=<HOST>\|.*\.psh | |
| IP=<HOST>\|.*\.GETREKT | |
| IP=<HOST>\|.*\.one | |
| IP=<HOST>\|\!\!\!\\ READ\\ THIS\\ \-\\ IMPORTANT\\ \!\!\!\.txt | |
| IP=<HOST>\|.*\.aes_ni_0day | |
| IP=<HOST>\|.*\.JEEPERS | |
| IP=<HOST>\|PAYMENT\-INSTRUCTIONS\.TXT | |
| IP=<HOST>\|.*\.LOCKOUT | |
| IP=<HOST>\|.*\.ATLAS | |
| IP=<HOST>\|.*\.FLATCHER3\@INDIA\.COM\.000G | |
| IP=<HOST>\|.*\.AES\-NI | |
| IP=<HOST>\|.*\.DEXTER | |
| IP=<HOST>\|.*\.CONFICKER | |
| IP=<HOST>\|.*\.ONION | |
| IP=<HOST>\|.*\.\[NO\.TORP3DA\@PROTONMAIL\.CH\]\.WALLET | |
| IP=<HOST>\|.*\.LCKD | |
| IP=<HOST>\|.*\.MOLE | |
| IP=<HOST>\|.*\.RANSOM | |
| IP=<HOST>\|.*\.lambda\.l0cked | |
| IP=<HOST>\|009\-READ\-FOR\-DECCCC\-FILESSS\.html | |
| IP=<HOST>\|_READ_THI\$_FILE_.* | |
| IP=<HOST>\|.*\.I'WANT\\ MONEY | |
| IP=<HOST>\|.*\.gembok | |
| IP=<HOST>\|\!Decrypt\-All\-Files\-.*\.txt | |
| IP=<HOST>\|.*\.\[GOFMEN17\@YA\.RU\],CRP | |
| IP=<HOST>\|.*\.SERP | |
| IP=<HOST>\|.*\.kilit | |
| IP=<HOST>\|0_HELP_DECRYPT_FILES\.HTM | |
| IP=<HOST>\|HUR_DEKRYPTERA_FILER\.html | |
| IP=<HOST>\|HUR_DEKRYPTERA_FILER\.txt | |
| IP=<HOST>\|.*\.LAMBDA\.LOCKED | |
| IP=<HOST>\|.*\.ADMIN\@BADADMIN\.XYZ | |
| IP=<HOST>\|.*\.SKJDTHGHH | |
| IP=<HOST>\|.*\.LOCK75 | |
| IP=<HOST>\|.*\.B10CKED | |
| IP=<HOST>\|.*\.A95436\@YA\.RU | |
| IP=<HOST>\|.*\.IWANT | |
| IP=<HOST>\|.*\.Fuck_You | |
| IP=<HOST>\|Recupere\\ seus\\ arquivos\\ aqui\.txt | |
| IP=<HOST>\|READ\\ TO\\ UNLOCK\\ FILES\.salsa\..*\.html | |
| IP=<HOST>\|.*\.SALSA222 | |
| IP=<HOST>\|.*\.NUMBERDOT | |
| IP=<HOST>\|How\\ Decrypt\\ My\\ Files\.lnk | |
| IP=<HOST>\|How_Decrypt_My_Files | |
| IP=<HOST>\|.*\.CRADLE | |
| IP=<HOST>\|.*\.ID\-7ES642406\.CRY | |
| IP=<HOST>\|READ\\ ME\\ ABOUT\\ DECRYPTION\.txt | |
| IP=<HOST>\|.*\.Do_not_change_the_file_name\.cryp | |
| IP=<HOST>\|.*\.pr0tect | |
| IP=<HOST>\|.*\.android | |
| IP=<HOST>\|.*_READ_THIS_FILE_.*_.* | |
| IP=<HOST>\|.*\.btcware | |
| IP=<HOST>\|.*drakosho_new\@aol\.com.* | |
| IP=<HOST>\|.*\.AngleWare | |
| IP=<HOST>\|.*\.zorro | |
| IP=<HOST>\|.*\.CIFGKSAFFSFYGHD | |
| IP=<HOST>\|.*\.A9V9AHU4 | |
| IP=<HOST>\|.*\.payfordecrypt | |
| IP=<HOST>\|OKU\.TXT | |
| IP=<HOST>\|ZINO_NOTE\.TXT | |
| IP=<HOST>\|.*\.ZINO | |
| IP=<HOST>\|.*\.kirked | |
| IP=<HOST>\|.*\.CRPTXXX | |
| IP=<HOST>\|HOW_TO_FIX_\!\.TXT | |
| IP=<HOST>\|.*\.\[BRAINCRYPT\@INDIA\.COM\]\.BRAINCRYPT | |
| IP=<HOST>\|.*\.pizdec | |
| IP=<HOST>\|.*\.REVENGE | |
| IP=<HOST>\|\!\!\!READ_TO_UNLOCK\!\!\!\.TXT | |
| IP=<HOST>\|.*\.openforyou\@india\.com | |
| IP=<HOST>\|.*\.warn_wallet | |
| IP=<HOST>\|.*\.nemo\-hacks\.at\.sigaint\.org | |
| IP=<HOST>\|.*\.MATRIX | |
| IP=<HOST>\|Crytp0l0cker\.Upack\.dll | |
| IP=<HOST>\|Crytp0l0cker\.dll | |
| IP=<HOST>\|Crytp0l0cker\.exe | |
| IP=<HOST>\|decrypted_files\.dat | |
| IP=<HOST>\|padcryptUninstaller\.exe | |
| IP=<HOST>\|PadCrypt\.exe | |
| IP=<HOST>\|Vape\\ Launcher\.exe | |
| IP=<HOST>\|READ_ME_\!\.txt | |
| IP=<HOST>\|.*\.enjey | |
| IP=<HOST>\|Aescrypt\.exe | |
| IP=<HOST>\|.*\.GG | |
| IP=<HOST>\|.*\.\[PINGY\@INDIA\.COM\] | |
| IP=<HOST>\|.*\.WORMKILLER\@INDIA\.COM\.XTBL | |
| IP=<HOST>\|.*\.CEBER3 | |
| IP=<HOST>\|IF_WANT_FILES_BACK_PLS_READ\.html | |
| IP=<HOST>\|.*\.iaufkakfhsaraf | |
| IP=<HOST>\|_HELP_HELP_HELP_.* | |
| IP=<HOST>\|zXz\.html | |
| IP=<HOST>\|.*\.zXz | |
| IP=<HOST>\|VictemKey_.*_.* | |
| IP=<HOST>\|HVORDAN_DU_GENDANNER_FILER\.html | |
| IP=<HOST>\|HVORDAN_DU_GENDANNER_FILER\.txt | |
| IP=<HOST>\|HELP_ME_PLEASE\.txt | |
| IP=<HOST>\|\!_RECOVERY_HELP_\!\.txt | |
| IP=<HOST>\|PLEASE\-READIT\-IF_YOU\-WANT\.html | |
| IP=<HOST>\|.*\.filegofprencrp | |
| IP=<HOST>\|COME_RIPRISTINARE_I_FILE\..* | |
| IP=<HOST>\|fattura_.*\.js | |
| IP=<HOST>\|.*_steaveiwalker\@india\.com_ | |
| IP=<HOST>\|COMO_ABRIR_ARQUIVOS\.txt | |
| IP=<HOST>\|.*info\@kraken\.cc_worldcza\@email\.cz | |
| IP=<HOST>\|.*\.kr3 | |
| IP=<HOST>\|COMO_RESTAURAR_ARCHIVOS\.txt | |
| IP=<HOST>\|COMO_RESTAURAR_ARCHIVOS\.html | |
| IP=<HOST>\|.*\.ENCR | |
| IP=<HOST>\|.*\.\[File\-Help\@India\.Com\]\.mails | |
| IP=<HOST>\|damage\@india\.com.* | |
| IP=<HOST>\|.*\.tmp\.exe | |
| IP=<HOST>\|What\\ happen\\ to\\ my\\ files\.txt | |
| IP=<HOST>\|.*\.jeepdayz\@india\.com | |
| IP=<HOST>\|.*\.BarRax | |
| IP=<HOST>\|.*\.damage | |
| IP=<HOST>\|.*\.locked\-.* | |
| IP=<HOST>\|.*\.jey | |
| IP=<HOST>\|.*\.CRYPTOSHIEL | |
| IP=<HOST>\|.*\.cfk | |
| IP=<HOST>\|ASSISTANCE_IN_RECOVERY\.txt | |
| IP=<HOST>\|\#_DECRYPT_ASSISTANCE_\#\.txt | |
| IP=<HOST>\|.*\.lfk | |
| IP=<HOST>\|_HELP_HELP_HELP_.*\.hta | |
| IP=<HOST>\|_HELP_HELP_HELP_.*\.jpg | |
| IP=<HOST>\|BTC_DECRYPT_FILES\.txt | |
| IP=<HOST>\|.*\.TheTrumpLockerp | |
| IP=<HOST>\|.*\.TheTrumpLockerf | |
| IP=<HOST>\|.*\.d4nk | |
| IP=<HOST>\|.*\.x3mpro | |
| IP=<HOST>\|READ\-READ\-READ\.html | |
| IP=<HOST>\|.*\.weencedufiles | |
| IP=<HOST>\|.*\.jse | |
| IP=<HOST>\|.*\.powned | |
| IP=<HOST>\|\[KASISKI\].* | |
| IP=<HOST>\|INSTRUCCIONES\.txt | |
| IP=<HOST>\|\@_USE_TO_FIX_.*\.txt | |
| IP=<HOST>\|.*\.happydayzz | |
| IP=<HOST>\|.*\.hasp | |
| IP=<HOST>\|001\-READ\-FOR\-DECRYPT\-FILES\.html | |
| IP=<HOST>\|DECRYPT_INFORMATION\.html | |
| IP=<HOST>\|Rans0m_N0te_Read_ME\.txt | |
| IP=<HOST>\|email\-vpupkin3\@aol\.com.* | |
| IP=<HOST>\|.*\.hnyear | |
| IP=<HOST>\|.*\.hnumkhotep\@india\.com\.hnumkhotep | |
| IP=<HOST>\|.*\.wowwhereismyfiles | |
| IP=<HOST>\|.*\.decryptional | |
| IP=<HOST>\|.*\.wowreadfordecryp | |
| IP=<HOST>\|.*\.7zipper | |
| IP=<HOST>\|.*\.youransom | |
| IP=<HOST>\|.*\.gui | |
| IP=<HOST>\|.*\.Harzhuangzi | |
| IP=<HOST>\|.*\.encryptedyourfiles | |
| IP=<HOST>\|.*HERMES | |
| IP=<HOST>\|\[amanda_sofost\@india\.com\]\.wallet | |
| IP=<HOST>\|.*\.wcry | |
| IP=<HOST>\|.*\.velikasrbija | |
| IP=<HOST>\|.*\.razarac | |
| IP=<HOST>\|.*\.serpent | |
| IP=<HOST>\|.*\.msj | |
| IP=<HOST>\|.*\.szesnl | |
| IP=<HOST>\|_DECRYPT_INFO_szesnl\.html | |
| IP=<HOST>\|000\-IF\-YOU\-WANT\-DEC\-FILES\.html | |
| IP=<HOST>\|.*\.evillock | |
| IP=<HOST>\|.*\.letmetrydecfiles | |
| IP=<HOST>\|.*\.yourransom | |
| IP=<HOST>\|.*\.lambda_l0cked | |
| IP=<HOST>\|.*\.gefickt | |
| IP=<HOST>\|.*\.HakunaMatata | |
| IP=<HOST>\|.*\.CRYPTOSHIELD | |
| IP=<HOST>\|.*\.weareyourfriends | |
| IP=<HOST>\|MERRY_I_LOVE_YOU_BRUCE\.hta | |
| IP=<HOST>\|How\\ decrypt\\ files\.hta | |
| IP=<HOST>\|unCrypte\@outlook\.com.* | |
| IP=<HOST>\|decipher_ne\@outlook\.com.* | |
| IP=<HOST>\|.*\.potato | |
| IP=<HOST>\|.*\.otherinformation | |
| IP=<HOST>\|.*\.vxLock | |
| IP=<HOST>\|.*\.rdmk | |
| IP=<HOST>\|.*\.paytounlock | |
| IP=<HOST>\|TRY\-READ\-ME\-TO\-DEC\.html | |
| IP=<HOST>\|EMAIL_.*_recipient\.zip | |
| IP=<HOST>\|.*\.sage | |
| IP=<HOST>\|.*garryweber\@protonmail\.ch | |
| IP=<HOST>\|LEER_INMEDIATAMENTE\.txt | |
| IP=<HOST>\|.*\.killedXXX | |
| IP=<HOST>\|.*\.doomed | |
| IP=<HOST>\|.*\.sifreli | |
| IP=<HOST>\|.*\.MERRY | |
| IP=<HOST>\|000\-No\-PROBLEM\-WE\-DEC\-FILES\.html | |
| IP=<HOST>\|.*\.noproblemwedecfiles | |
| IP=<HOST>\|WE\-MUST\-DEC\-FILES\.html | |
| IP=<HOST>\|.*\.powerfulldecrypt | |
| IP=<HOST>\|.*\.stn | |
| IP=<HOST>\|.*bingo\@opensourcemail\.org | |
| IP=<HOST>\|.*\.id\-3044989498_x3m | |
| IP=<HOST>\|.*\.x3m | |
| IP=<HOST>\|READ_ME_TO_DECRYPT_YOU_INFORMA\.jjj | |
| IP=<HOST>\|.*\.wuciwug | |
| IP=<HOST>\|.*\.kencf | |
| IP=<HOST>\|.*\.file0locked | |
| IP=<HOST>\|file0locked\.js | |
| IP=<HOST>\|CryptoRansomware\.exe | |
| IP=<HOST>\|.*\.VBRANSOM | |
| IP=<HOST>\|_HELP_Recover_Files_\.html | |
| IP=<HOST>\|.*\.oops | |
| IP=<HOST>\|.*\.deria | |
| IP=<HOST>\|.*\.RMCM1 | |
| IP=<HOST>\|.*\.Locked\-by\-Mafia | |
| IP=<HOST>\|.*\.кибер\\ разветвитель | |
| IP=<HOST>\|.*\-filesencrypted\.html | |
| IP=<HOST>\|decrypt_Globe.*\.exe | |
| IP=<HOST>\|.*\.hnumkhotep | |
| IP=<HOST>\|DecryptFile\.txt | |
| IP=<HOST>\|.*\.L0CKED | |
| IP=<HOST>\|NFS\-e.*1025\-7152\.exe | |
| IP=<HOST>\|firstransomware\.exe | |
| IP=<HOST>\|HELP\-ME\-ENCED\-FILES\.html | |
| IP=<HOST>\|.*\.helpmeencedfiles | |
| IP=<HOST>\|.*EdgeLocker.*\.exe | |
| IP=<HOST>\|.*\.edgel | |
| IP=<HOST>\|.*\.XBTL | |
| IP=<HOST>\|.*\.firecrypt | |
| IP=<HOST>\|YOUR_FILES_ARE_DEAD\.hta | |
| IP=<HOST>\|.*\.MRCR1 | |
| IP=<HOST>\|.*\.PEGS1 | |
| IP=<HOST>\|.*\.RARE1 | |
| IP=<HOST>\|.*\.airacropencrypted\! | |
| IP=<HOST>\|.*\[cryptsvc\@mail\.ru\]\..* | |
| IP=<HOST>\|WHERE\-YOUR\-FILES\.html | |
| IP=<HOST>\|.*\.Whereisyourfiles | |
| IP=<HOST>\|.*opentoyou\@india\.com | |
| IP=<HOST>\|C\-email\-.*\-.*\.odcodc | |
| IP=<HOST>\|.*\.maktub | |
| IP=<HOST>\|.*\.hush | |
| IP=<HOST>\|.*\.bript | |
| IP=<HOST>\|_.*_README\.hta | |
| IP=<HOST>\|_.*_README\.jpg | |
| IP=<HOST>\|HOW_OPEN_FILES\.hta | |
| IP=<HOST>\|.*\.gangbang | |
| IP=<HOST>\|GJENOPPRETTING_AV_FILER\.html | |
| IP=<HOST>\|GJENOPPRETTING_AV_FILER\.txt | |
| IP=<HOST>\|\!\!\!\\ HOW\\ TO\\ DECRYPT\\ FILES\\ \!\!\!\.txt | |
| IP=<HOST>\|.*\.braincrypt | |
| IP=<HOST>\|INSTRUCTION\\ RESTORE\\ FILE\.TXT | |
| IP=<HOST>\|.*\.lesli | |
| IP=<HOST>\|Survey\\ Locker\.exe | |
| IP=<HOST>\|\!\!\!\!\!ATENÇÃO\!\!\!\!\!\.html | |
| IP=<HOST>\|Receipt\.exe | |
| IP=<HOST>\|WindowsApplication1\.exe | |
| IP=<HOST>\|HWID\\ Lock\.exe | |
| IP=<HOST>\|VIP72\.exe | |
| IP=<HOST>\|DALE_FILES\.TXT | |
| IP=<HOST>\|.*\.DALE | |
| IP=<HOST>\|.*\.8637 | |
| IP=<HOST>\|.*\.kok | |
| IP=<HOST>\|HOW_TO_RESTORE_YOUR_DATA\.html | |
| IP=<HOST>\|.*\.paymrts | |
| IP=<HOST>\|.*\.paymds | |
| IP=<HOST>\|RESTORE_CORUPTED_FILES\.HTML | |
| IP=<HOST>\|READ\@My\.txt | |
| IP=<HOST>\|Cyber\\ SpLiTTer\\ Vbs\.exe | |
| IP=<HOST>\|.*\.flyper | |
| IP=<HOST>\|000\-PLEASE\-READ\-WE\-HELP\.html | |
| IP=<HOST>\|.*\.helpdecrypt\@india\.com | |
| IP=<HOST>\|.*\.VforVendetta | |
| IP=<HOST>\|popcorn_time\.exe | |
| IP=<HOST>\|.*\.filock | |
| IP=<HOST>\|.*\.wallet | |
| IP=<HOST>\|.*_\.rmd | |
| IP=<HOST>\|.*\.uDz2j8mv | |
| IP=<HOST>\|OSIRIS\-.*\.htm | |
| IP=<HOST>\|DesktopOsiris\.htm | |
| IP=<HOST>\|.*\[cryptservice\@inbox\.ru\].* | |
| IP=<HOST>\|.*\.no_more_ransom | |
| IP=<HOST>\|bahij2\@india\.com | |
| IP=<HOST>\|.*\.lovewindows | |
| IP=<HOST>\|.*\.osiris | |
| IP=<HOST>\|.*\.R\.i\.P | |
| IP=<HOST>\|Important\!\.txt | |
| IP=<HOST>\|\!_HOW_TO_RESTORE_.*\.txt | |
| IP=<HOST>\|HOW_TO_RESTORE_FILES\.txt | |
| IP=<HOST>\|_README_.*\.hta | |
| IP=<HOST>\|.*\.Zzzz | |
| IP=<HOST>\|.*\[lavandos\@dr\.com\]\.wallet | |
| IP=<HOST>\|.*\.coin | |
| IP=<HOST>\|.*\.crypted_file | |
| IP=<HOST>\|.*\.EncrypTile | |
| IP=<HOST>\|.*\.hcked | |
| IP=<HOST>\|_README_\.hta | |
| IP=<HOST>\|Runsome\.exe | |
| IP=<HOST>\|Payment_Advice\.mht | |
| IP=<HOST>\|lblBitcoinInfoMain\.txt | |
| IP=<HOST>\|lblFinallyText\.txt | |
| IP=<HOST>\|lblMain\.txt | |
| IP=<HOST>\|.*\.hannah | |
| IP=<HOST>\|.*\.vindows | |
| IP=<HOST>\|How\\ to\\ decrypt\\ your\\ files\.jpg | |
| IP=<HOST>\|How\\ to\\ decrypt\\ your\\ files\.txt | |
| IP=<HOST>\|How\\ to\\ get\\ data\\ back\.txt | |
| IP=<HOST>\|.*\.zycrypt | |
| IP=<HOST>\|.*\.sgood | |
| IP=<HOST>\|.*\.zzzzz | |
| IP=<HOST>\|xort\.txt | |
| IP=<HOST>\|DOSYALARINIZA\\ ULAŞMAK\\ İÇİN\\ AÇINIZ\.html | |
| IP=<HOST>\|HOWTO_RECOVER_FILES_.*\.TXT | |
| IP=<HOST>\|HELP_RESTORE_FILES_.*\.TXT | |
| IP=<HOST>\|Recovery\+.*\.html | |
| IP=<HOST>\|Recovery\+.*\.txt | |
| IP=<HOST>\|_H_e_l_p_RECOVER_INSTRUCTIONS\+.*\.png | |
| IP=<HOST>\|_H_e_l_p_RECOVER_INSTRUCTIONS\+.*\.html | |
| IP=<HOST>\|help_recover_instructions\+.*\.html | |
| IP=<HOST>\|help_recover_instructions\+.*\.BMP | |
| IP=<HOST>\|_how_recover\+.*\.html | |
| IP=<HOST>\|_how_recover\+.*\.txt | |
| IP=<HOST>\|ThxForYurTyme\.txt | |
| IP=<HOST>\|_HOW_TO_Decrypt\.bmp | |
| IP=<HOST>\|_RECOVER_INSTRUCTIONS\.ini | |
| IP=<HOST>\|\#\#\#\-READ\-FOR\-HELLPP\.html | |
| IP=<HOST>\|rtext\.txt | |
| IP=<HOST>\|DECRYPTION\\ INSTRUCTIONS\.txt | |
| IP=<HOST>\|decrypt\\ explanations\.html | |
| IP=<HOST>\|_WHAT_is\.html | |
| IP=<HOST>\|_HOWDO_text\.html | |
| IP=<HOST>\|readme_liesmich_encryptor_raas\.txt | |
| IP=<HOST>\|_Adatok_visszaallitasahoz_utasitasok\.txt | |
| IP=<HOST>\|How\\ to\\ restore\\ files\.hta | |
| IP=<HOST>\|locked\.bmp | |
| IP=<HOST>\|README_TO_RECURE_YOUR_FILES\.txt | |
| IP=<HOST>\|Your\\ files\\ encrypted\\ by\\ our\\ friends\\ \!\!\!\.txt | |
| IP=<HOST>\|ATTENTION\.url | |
| IP=<HOST>\|\@WARNING_FILES_ARE_ENCRYPTED\..*\.txt | |
| IP=<HOST>\|README\!\!\!\.txt | |
| IP=<HOST>\|\#\\ README\.hta | |
| IP=<HOST>\|\!Recovery_.*\.html | |
| IP=<HOST>\|YourID\.txt | |
| IP=<HOST>\|recover\.bmp | |
| IP=<HOST>\|recover\.txt | |
| IP=<HOST>\|README\\ HOW\\ TO\\ DECRYPT\\ YOUR\\ FILES\.HTML | |
| IP=<HOST>\|READ_IT\.txt | |
| IP=<HOST>\|.*\.lock93 | |
| IP=<HOST>\|.*\.\!emc | |
| IP=<HOST>\|.*\.adk | |
| IP=<HOST>\|svchosd\.exe | |
| IP=<HOST>\|.*\.aesir | |
| IP=<HOST>\|.*\.CHIP | |
| IP=<HOST>\|.*\.happy | |
| IP=<HOST>\|.*\.angelamerkel | |
| IP=<HOST>\|.*\.razy1337 | |
| IP=<HOST>\|.*\.zendr4 | |
| IP=<HOST>\|.*\.dharma | |
| IP=<HOST>\|.*\.locked3 | |
| IP=<HOST>\|.*\.duhust | |
| IP=<HOST>\|.*\.exploit | |
| IP=<HOST>\|.*_crypt | |
| IP=<HOST>\|.*_help_instruct.*\..* | |
| IP=<HOST>\|.*\!DMAlock.* | |
| IP=<HOST>\|.*\.GSupport3 | |
| IP=<HOST>\|.*\.rnsmwr | |
| IP=<HOST>\|.*\.dCrypt | |
| IP=<HOST>\|ransomed\.html | |
| IP=<HOST>\|.*\.Alcatraz | |
| IP=<HOST>\|.*_WHAT_is\.html | |
| IP=<HOST>\|readme\.hta | |
| IP=<HOST>\|.*\.96e2 | |
| IP=<HOST>\|.*\.thor | |
| IP=<HOST>\|.*\.dxxd | |
| IP=<HOST>\|.*\.usr0 | |
| IP=<HOST>\|.*\.shit | |
| IP=<HOST>\|.*\.coded | |
| IP=<HOST>\|.*\.raid10 | |
| IP=<HOST>\|.*\.realfs0ciety.* | |
| IP=<HOST>\|.*\.rip | |
| IP=<HOST>\|.*\.okean.* | |
| IP=<HOST>\|.*\.globe | |
| IP=<HOST>\|.*\.nuclear55 | |
| IP=<HOST>\|.*\.1txt | |
| IP=<HOST>\|.*\.kostya | |
| IP=<HOST>\|.*\.k0stya | |
| IP=<HOST>\|.*\.comrade | |
| IP=<HOST>\|.*\.exotic | |
| IP=<HOST>\|.*\.fuck | |
| IP=<HOST>\|.*\.Yakes | |
| IP=<HOST>\|.*\.Zimbra | |
| IP=<HOST>\|email\-salazar_slytherin10\@yahoo\.com\.ver\-.*\.id\-.*\-.*\.randomname\-.* | |
| IP=<HOST>\|.*\._AiraCropEncrypted\! | |
| IP=<HOST>\|README_RECOVER_FILES_.*\.txt | |
| IP=<HOST>\|README_RECOVER_FILES_.*\.png | |
| IP=<HOST>\|README_RECOVER_FILES_.*\.html | |
| IP=<HOST>\|.*\.\~HL.* | |
| IP=<HOST>\|Sarah_G\@ausi\.com___.* | |
| IP=<HOST>\|.*\.zc3791 | |
| IP=<HOST>\|.*\.venusp | |
| IP=<HOST>\|.*\.shino | |
| IP=<HOST>\|.*\.bleepYourFiles | |
| IP=<HOST>\|.*\.crashed | |
| IP=<HOST>\|.*\.amba | |
| IP=<HOST>\|.*\.7h9r | |
| IP=<HOST>\|.*\.已加密 | |
| IP=<HOST>\|.*\.암호화됨 | |
| IP=<HOST>\|.*\.b5c6 | |
| IP=<HOST>\|.*\.ap19 | |
| IP=<HOST>\|.*\.a19 | |
| IP=<HOST>\|_.*_HOWDO_text\.html | |
| IP=<HOST>\|.*_HOWDO_text\.bmp | |
| IP=<HOST>\|.*_HOWDO_text\.html | |
| IP=<HOST>\|.*\.odin | |
| IP=<HOST>\|.*\.zypto.* | |
| IP=<HOST>\|zzzzzzzzzzzzzzzzzyyy | |
| IP=<HOST>\|zycrypt\..* | |
| IP=<HOST>\|.*decrypt\\ your\\ file.*\..* | |
| IP=<HOST>\|.*_nullbyte.* | |
| IP=<HOST>\|.*\.bart | |
| IP=<HOST>\|.*\.axx | |
| IP=<HOST>\|_H_e_l_p_RECOVER_INSTRUCTIONS\+.*\.txt | |
| IP=<HOST>\|HOW\-TO\-DECRYPT\-FILES\.HTML | |
| IP=<HOST>\|HOW_TO_DECRYPT\.HTML | |
| IP=<HOST>\|exit\.hhr\.obleep | |
| IP=<HOST>\|UnblockFiles\.vbs | |
| IP=<HOST>\|README_DECRYPT_HYDRA_ID_.*\.txt | |
| IP=<HOST>\|DECRYPT_Readme\.TXT\.ReadMe | |
| IP=<HOST>\|Decrypt\\ All\\ Files\\ .*\.bmp | |
| IP=<HOST>\|HowDecrypt\.gif | |
| IP=<HOST>\|HELP_YOURFILES\.HTML | |
| IP=<HOST>\|HOW\\ TO\\ DECRYPT\\ FILES\.HTML | |
| IP=<HOST>\|BUYUNLOCKCODE | |
| IP=<HOST>\|BitCryptorFileList\.txt | |
| IP=<HOST>\|.*\.crjocker | |
| IP=<HOST>\|.*\.POSHKODER | |
| IP=<HOST>\|.*\.hydracrypt_ID_.* | |
| IP=<HOST>\|.*\.CTBL2 | |
| IP=<HOST>\|.*\.unbrecrypt_ID_.* | |
| IP=<HOST>\|.*\.padcrypt | |
| IP=<HOST>\|.*\.rekt | |
| IP=<HOST>\|.*\.CCCRRRPPP | |
| IP=<HOST>\|.*\.SecureCrypte | |
| IP=<HOST>\|.*\.windows10 | |
| IP=<HOST>\|.*\.pdcr | |
| IP=<HOST>\|.*\.keybtc\@inbox | |
| IP=<HOST>\|.*\.breaking_bad | |
| IP=<HOST>\|.*\.cryptowall | |
| IP=<HOST>\|.*\.xorist | |
| IP=<HOST>\|.*\.crypt1 | |
| IP=<HOST>\|How_to_decrypt_your_files\.jpg | |
| IP=<HOST>\|How_to_restore_files\.hta | |
| IP=<HOST>\|.*\.cerber3 | |
| IP=<HOST>\|.*\.a5zfn | |
| IP=<HOST>\|.*\.purge | |
| IP=<HOST>\|.*\.fantom | |
| IP=<HOST>\|.*\.cerber2 | |
| IP=<HOST>\|\!readme\..* | |
| IP=<HOST>\|Como\\ descriptografar\\ seus\\ arquivos\.txt | |
| IP=<HOST>\|.*\.C0rp0r\@c\@0Xr\@ | |
| IP=<HOST>\|.*\.domino | |
| IP=<HOST>\|.*cerber2 | |
| IP=<HOST>\|.*\.cawwcca | |
| IP=<HOST>\|how_to_unlock.*\..* | |
| IP=<HOST>\|\!Recovery_.*\.txt | |
| IP=<HOST>\|Read_this_file\.txt | |
| IP=<HOST>\|.*\.legion | |
| IP=<HOST>\|.*\.encoderpass | |
| IP=<HOST>\|.*\.cryptolocker | |
| IP=<HOST>\|.*\.7z\.encrypted | |
| IP=<HOST>\|ATTENTION\!\!\!\.txt | |
| IP=<HOST>\|HELP_DECRYPT\.lnk | |
| IP=<HOST>\|how\\ to\\ decrypt\\ aes\\ files\.lnk | |
| IP=<HOST>\|restore_files\.txt | |
| IP=<HOST>\|HowDecrypt\.txt | |
| IP=<HOST>\|\$RECYCLE\.BIN\.\{.*\-.*\-.*\-.*\} | |
| IP=<HOST>\|.*\.heisenberg | |
| IP=<HOST>\|.*\.breaking\\ bad | |
| IP=<HOST>\|.*\.razy | |
| IP=<HOST>\|.*\.Venusf | |
| IP=<HOST>\|\.\~ | |
| IP=<HOST>\|.*\.payfornature\@india\.com\.crypted | |
| IP=<HOST>\|winclwp\.jpg | |
| IP=<HOST>\|wie_zum_Wiederherstellen_von_Dateien\.txt | |
| IP=<HOST>\|tox\.html | |
| IP=<HOST>\|strongcrypt\.bmp | |
| IP=<HOST>\|qwer2\.html | |
| IP=<HOST>\|qwer\.html | |
| IP=<HOST>\|pronk\.txt | |
| IP=<HOST>\|paycrypt\.bmp | |
| IP=<HOST>\|maxcrypt\.bmp | |
| IP=<HOST>\|how_decrypt\.gif | |
| IP=<HOST>\|how\\ to\\ get\\ data\.txt | |
| IP=<HOST>\|help_recover_instructions.*\.txt | |
| IP=<HOST>\|help_recover_instructions.*\.html | |
| IP=<HOST>\|help_recover_instructions.*\.bmp | |
| IP=<HOST>\|help\-file\-decrypt\.enc | |
| IP=<HOST>\|enigma_encr\.txt | |
| IP=<HOST>\|enigma\.hta | |
| IP=<HOST>\|default432643264\.jpg | |
| IP=<HOST>\|default32643264\.bmp | |
| IP=<HOST>\|decypt_your_files\.html | |
| IP=<HOST>\|de_crypt_readme\.txt | |
| IP=<HOST>\|de_crypt_readme\.html | |
| IP=<HOST>\|de_crypt_readme\.bmp | |
| IP=<HOST>\|cryptinfo\.txt | |
| IP=<HOST>\|crjoker\.html | |
| IP=<HOST>\|_how_recover.*\.txt | |
| IP=<HOST>\|_how_recover.*\.html | |
| IP=<HOST>\|_Locky_recover_instructions\.bmp | |
| IP=<HOST>\|_H_e_l_p_RECOVER_INSTRUCTIONS.*\.txt | |
| IP=<HOST>\|_H_e_l_p_RECOVER_INSTRUCTIONS.*\.png | |
| IP=<HOST>\|_H_e_l_p_RECOVER_INSTRUCTIONS.*\.html | |
| IP=<HOST>\|_HELP_instructions\.txt | |
| IP=<HOST>\|_HELP_instructions\.bmp | |
| IP=<HOST>\|_DECRYPT_INFO_.*\.html | |
| IP=<HOST>\|Your\\ files\\ encrypted\\ by\\ our\\ friends\\ \!\!\!\\ txt | |
| IP=<HOST>\|Your\\ files\\ are\\ locked\\ \!\.txt | |
| IP=<HOST>\|Your\\ files\\ are\\ locked\\ \!\!\.txt | |
| IP=<HOST>\|Your\\ files\\ are\\ locked\\ \!\!\!\.txt | |
| IP=<HOST>\|Your\\ files\\ are\\ locked\\ \!\!\!\!\.txt | |
| IP=<HOST>\|YOUR_FILES_ARE_LOCKED\.txt | |
| IP=<HOST>\|YOUR_FILES_ARE_ENCRYPTED\.TXT | |
| IP=<HOST>\|YOUR_FILES_ARE_ENCRYPTED\.HTML | |
| IP=<HOST>\|YOUGOTHACKED\.TXT | |
| IP=<HOST>\|UNLOCK_FILES_INSTRUCTIONS\.txt | |
| IP=<HOST>\|UNLOCK_FILES_INSTRUCTIONS\.html | |
| IP=<HOST>\|SIFRE_COZME_TALIMATI\.html | |
| IP=<HOST>\|SHTODELATVAM\.txt | |
| IP=<HOST>\|Read\\ Me\\ (How\\ Decrypt)\\ \!\!\!\!\.txt | |
| IP=<HOST>\|RESTORE_FILES_.*\.txt | |
| IP=<HOST>\|RESTORE_FILES_.*\..* | |
| IP=<HOST>\|READ_THIS_TO_DECRYPT\.html | |
| IP=<HOST>\|README_HOW_TO_UNLOCK\.TXT | |
| IP=<HOST>\|README_HOW_TO_UNLOCK\.HTML | |
| IP=<HOST>\|README_DECRYPT_UMBRE_ID_.*\.txt | |
| IP=<HOST>\|README_DECRYPT_UMBRE_ID_.*\.jpg | |
| IP=<HOST>\|README_DECRYPT_HYRDA_ID_.*\.txt | |
| IP=<HOST>\|READ\\ ME\\ FOR\\ DECRYPT\.txt | |
| IP=<HOST>\|READ\\ IF\\ YOU\\ WANT\\ YOUR\\ FILES\\ BACK\.html | |
| IP=<HOST>\|Payment_Instructions\.jpg | |
| IP=<HOST>\|ONTSLEUTELINGS_INSTRUCTIES\.html | |
| IP=<HOST>\|OKSOWATHAPPENDTOYOURFILES\.TXT | |
| IP=<HOST>\|MENSAGEM\.txt | |
| IP=<HOST>\|KryptoLocker_README\.txt | |
| IP=<HOST>\|Instructionaga\.txt | |
| IP=<HOST>\|ISTRUZIONI_DECRITTAZIONE\.html | |
| IP=<HOST>\|INSTRUCTIONS_DE_DECRYPTAGE\.html | |
| IP=<HOST>\|INSTRUCCIONES_DESCIFRADO\.html | |
| IP=<HOST>\|INSTALL_TOR\.URL | |
| IP=<HOST>\|IMPORTANT\.README | |
| IP=<HOST>\|IMPORTANT\\ READ\\ ME\.txt | |
| IP=<HOST>\|Howto_RESTORE_FILES\.html | |
| IP=<HOST>\|How\\ to\\ decrypt\\ your\\ data\.txt | |
| IP=<HOST>\|How\\ to\\ decrypt\\ LeChiffre\\ files\.html | |
| IP=<HOST>\|Help\\ Decrypt\.html | |
| IP=<HOST>\|Hacked_Read_me_to_decrypt_files\.html | |
| IP=<HOST>\|HOW_TO_UNLOCK_FILES_README_.*\.txt | |
| IP=<HOST>\|HOW_TO_RESTORE_FILES\.html | |
| IP=<HOST>\|HOW_DECRYPT\.URL | |
| IP=<HOST>\|HOW_DECRYPT\.TXT | |
| IP=<HOST>\|HOW_DECRYPT\.HTML | |
| IP=<HOST>\|HOWTO_RECOVER_FILES_.*\..* | |
| IP=<HOST>\|HOW\\ TO\\ DECRYPT\\ FILES\.txt | |
| IP=<HOST>\|HELP_YOUR_FILES\.html | |
| IP=<HOST>\|HELP_YOUR_FILES\.PNG | |
| IP=<HOST>\|HELP_TO_SAVE_FILES\.bmp | |
| IP=<HOST>\|HELP_RESTORE_FILES_.*\..* | |
| IP=<HOST>\|HELP_DECRYPT\.URL | |
| IP=<HOST>\|HELP_DECRYPT\.PNG | |
| IP=<HOST>\|HELP_DECRYPT\.HTML | |
| IP=<HOST>\|GetYouFiles\.txt | |
| IP=<HOST>\|File\\ Decrypt\\ Help\.html | |
| IP=<HOST>\|FILES_BACK\.txt | |
| IP=<HOST>\|ENTSCHLUSSELN_HINWEISE\.html | |
| IP=<HOST>\|DecryptAllFiles.*\.txt | |
| IP=<HOST>\|DESIFROVANI_POKYNY\.html | |
| IP=<HOST>\|DECRYPT_YOUR_FILES\.txt | |
| IP=<HOST>\|DECRYPT_YOUR_FILES\.HTML | |
| IP=<HOST>\|DECRYPT_ReadMe1\.TXT | |
| IP=<HOST>\|DECRYPT_INSTRUCTIONS\.html | |
| IP=<HOST>\|DECRYPT_INSTRUCTION\.URL | |
| IP=<HOST>\|DECRYPT_INSTRUCTION\.HTML | |
| IP=<HOST>\|DECRYPTION_HOWTO\.Notepad | |
| IP=<HOST>\|Comment\\ débloquer\\ mes\\ fichiers\.txt | |
| IP=<HOST>\|BUYUNLOCKCODE\.txt | |
| IP=<HOST>\|AllFilesAreLocked.*\.bmp | |
| IP=<HOST>\|4\-14\-2016\-INFECTION\.TXT | |
| IP=<HOST>\|.*_ryp | |
| IP=<HOST>\|.*_HELP_instructions\.html | |
| IP=<HOST>\|.*\.xcrypt | |
| IP=<HOST>\|.*\.unavailable | |
| IP=<HOST>\|.*\.szf | |
| IP=<HOST>\|.*\.porno\.pornoransom | |
| IP=<HOST>\|.*\.plauge17 | |
| IP=<HOST>\|.*\.neitrino | |
| IP=<HOST>\|.*\.kimcilware\.locked | |
| IP=<HOST>\|.*\.iwanthelpuuu | |
| IP=<HOST>\|.*\.herbst | |
| IP=<HOST>\|.*\.helpdecrypt\@ukr\.net | |
| IP=<HOST>\|.*\.h3ll | |
| IP=<HOST>\|.*\.gws\.porno | |
| IP=<HOST>\|.*\.fuckyourdata | |
| IP=<HOST>\|.*\.encrypted\.locked | |
| IP=<HOST>\|.*\.cryptz | |
| IP=<HOST>\|.*\.crypttt | |
| IP=<HOST>\|.*\.cripttt | |
| IP=<HOST>\|.*\.criptokod | |
| IP=<HOST>\|.*\.criptiko | |
| IP=<HOST>\|.*\.btc\.kkk\.fun\.gws | |
| IP=<HOST>\|.*\.aga | |
| IP=<HOST>\|.*\._ryp | |
| IP=<HOST>\|.*\.Where_my_files\.txt | |
| IP=<HOST>\|.*\.Read_Me\.Txt | |
| IP=<HOST>\|.*\.RSplited | |
| IP=<HOST>\|.*\.KEYZ\.KEYH0LES | |
| IP=<HOST>\|.*\.How_To_Get_Back\.txt | |
| IP=<HOST>\|.*\.How_To_Decrypt\.txt | |
| IP=<HOST>\|.*\.Contact_Here_To_Recover_Your_Files\.txt | |
| IP=<HOST>\|.*\.31392E30362E32303136_.* | |
| IP=<HOST>\|\#\\ DECRYPT\\ MY\\ FILES\\ \#\.vbs | |
| IP=<HOST>\|\#\\ DECRYPT\\ MY\\ FILES\\ \#\.txt | |
| IP=<HOST>\|\#\\ DECRYPT\\ MY\\ FILES\\ \#\.html | |
| IP=<HOST>\|\!Where_are_my_files\!\.html | |
| IP=<HOST>\|\!\!\!README\!\!\!.*\.rtf | |
| IP=<HOST>\|\!\!\!\-WARNING\-\!\!\!\.txt | |
| IP=<HOST>\|\!\!\!\-WARNING\-\!\!\!\.html | |
| IP=<HOST>\|.*\.magic_software_syndicate | |
| IP=<HOST>\|.*maestro\@pizzacrypts\.info | |
| IP=<HOST>\|.*\.crypt | |
| IP=<HOST>\|.*\.bitstak | |
| IP=<HOST>\|.*\.wflx | |
| IP=<HOST>\|.*\.CRRRT | |
| IP=<HOST>\|howtodecryptaesfiles\.txt | |
| IP=<HOST>\|\!satana\!\.txt | |
| IP=<HOST>\|.*\.akaibvn | |
| IP=<HOST>\|.*\.cRh8 | |
| IP=<HOST>\|.*\.YTBL | |
| IP=<HOST>\|.*\.krypted | |
| IP=<HOST>\|.*\.tzu | |
| IP=<HOST>\|.*\.6FKR8d | |
| IP=<HOST>\|.*\.sshxkej | |
| IP=<HOST>\|.*\.eclr | |
| IP=<HOST>\|.*\.epic | |
| IP=<HOST>\|.*\.paybtcs | |
| IP=<HOST>\|.*\.AFD | |
| IP=<HOST>\|.*\.paymst | |
| IP=<HOST>\|.*\.payms | |
| IP=<HOST>\|.*\.isis | |
| IP=<HOST>\|.*\.zepto | |
| IP=<HOST>\|.*\.bart\.zip | |
| IP=<HOST>\|.*\.kratos | |
| IP=<HOST>\|.*\.31342E30362E32303136.* | |
| IP=<HOST>\|.*\.SecureCrypted | |
| IP=<HOST>\|.*\.crptrgr | |
| IP=<HOST>\|.*\.rtyrtyrty | |
| IP=<HOST>\|\!DMALOCK3\.0.* | |
| IP=<HOST>\|.*\.evil | |
| IP=<HOST>\|.*\.crypt38 | |
| IP=<HOST>\|.*\.asdasdasd | |
| IP=<HOST>\|.*\.ded | |
| IP=<HOST>\|.*\.bloccato | |
| IP=<HOST>\|.*\.canihelpyou | |
| IP=<HOST>\|.*\.crypz | |
| IP=<HOST>\|decrypt\-instruct.*\..* | |
| IP=<HOST>\|.*files_are_encrypted\..* | |
| IP=<HOST>\|.*decryptmyfiles.*\..* | |
| IP=<HOST>\|help_instructions\..* | |
| IP=<HOST>\|.*\-recover\-.*\..* | |
| IP=<HOST>\|de_crypt_readme\..* | |
| IP=<HOST>\|.*\!recover\!.*\..* | |
| IP=<HOST>\|.*recover\}\-.*\..* | |
| IP=<HOST>\|.*rec0ver.*\..* | |
| IP=<HOST>\|_help_instruct.*\..* | |
| IP=<HOST>\|.*_recover_.*\..* | |
| IP=<HOST>\|.*\+recover\+.*\..* | |
| IP=<HOST>\|.*warning\-\!\!.*\..* | |
| IP=<HOST>\|.*decrypt\\ my\\ file.*\..* | |
| IP=<HOST>\|help_file_.*\..* | |
| IP=<HOST>\|recovery\+.*\..* | |
| IP=<HOST>\|readme_for_decrypt.*\..* | |
| IP=<HOST>\|install_tor.*\..* | |
| IP=<HOST>\|readme_decrypt.*\..* | |
| IP=<HOST>\|howtodecrypt.*\..* | |
| IP=<HOST>\|howto_restore.*\..* | |
| IP=<HOST>\|how_to_recover.*\..* | |
| IP=<HOST>\|how_recover.*\..* | |
| IP=<HOST>\|how_to_decrypt.*\..* | |
| IP=<HOST>\|how\\ to\\ decrypt.*\..* | |
| IP=<HOST>\|help_restore.*\..* | |
| IP=<HOST>\|help_your_file.*\..* | |
| IP=<HOST>\|help_recover.*\..* | |
| IP=<HOST>\|help_decrypt.*\..* | |
| IP=<HOST>\|decrypt_instruct.*\..* | |
| IP=<HOST>\|cryptolocker\..* | |
| IP=<HOST>\|.*recover_instruction.*\..* | |
| IP=<HOST>\|.*\.hydracrypt_ID.* | |
| IP=<HOST>\|.*gmail.*\.crypt | |
| IP=<HOST>\|.*\.cryptotorlocker.* | |
| IP=<HOST>\|.*\.xxx | |
| IP=<HOST>\|.*\.xyz | |
| IP=<HOST>\|.*\.xtbl | |
| IP=<HOST>\|.*\.xort | |
| IP=<HOST>\|.*\.xrtn | |
| IP=<HOST>\|.*\.vvv | |
| IP=<HOST>\|.*\.vscrypt | |
| IP=<HOST>\|.*\.trun | |
| IP=<HOST>\|.*\.ttt | |
| IP=<HOST>\|.*\.surprise | |
| IP=<HOST>\|.*\.troyancoder\@qq_com | |
| IP=<HOST>\|.*\.sport | |
| IP=<HOST>\|.*\.scl | |
| IP=<HOST>\|.*\.ryp | |
| IP=<HOST>\|.*\.sanction | |
| IP=<HOST>\|.*\.RRK | |
| IP=<HOST>\|.*\.rokku | |
| IP=<HOST>\|.*\.remind | |
| IP=<HOST>\|.*\.relock\@qq_com | |
| IP=<HOST>\|.*\.RDM | |
| IP=<HOST>\|.*\.RADAMANT | |
| IP=<HOST>\|.*\.R5A | |
| IP=<HOST>\|.*\.R4A | |
| IP=<HOST>\|.*\.PoAr2w | |
| IP=<HOST>\|.*\.pizda\@qq_com | |
| IP=<HOST>\|.*\.p5tkjw | |
| IP=<HOST>\|.*\.oplata\@qq_com | |
| IP=<HOST>\|.*\.oshit | |
| IP=<HOST>\|.*\.oor | |
| IP=<HOST>\|.*\.one\-we_can\-help_you | |
| IP=<HOST>\|.*\.OMG\! | |
| IP=<HOST>\|.*\.nochance | |
| IP=<HOST>\|.*\.nalog\@qq_com | |
| IP=<HOST>\|.*\.micro | |
| IP=<HOST>\|.*\.LOL\! | |
| IP=<HOST>\|.*\.locky | |
| IP=<HOST>\|.*\.locked | |
| IP=<HOST>\|.*\.LeChiffre | |
| IP=<HOST>\|.*\.kraken | |
| IP=<HOST>\|.*\.korrektor | |
| IP=<HOST>\|.*\.kkk | |
| IP=<HOST>\|.*\.kimcilware | |
| IP=<HOST>\|.*\.KEYZ | |
| IP=<HOST>\|.*\.keybtc\@inbox_com | |
| IP=<HOST>\|.*\.KEYHOLES | |
| IP=<HOST>\|.*\.justbtcwillhelpyou | |
| IP=<HOST>\|.*\.infected | |
| IP=<HOST>\|.*\.helpdecrypt\@ukr_net | |
| IP=<HOST>\|.*\.hb15 | |
| IP=<HOST>\|.*\.ha3 | |
| IP=<HOST>\|.*\.gruzin\@qq_com | |
| IP=<HOST>\|.*\.gws | |
| IP=<HOST>\|.*\.fun | |
| IP=<HOST>\|.*\.fucked | |
| IP=<HOST>\|.*\.enigma | |
| IP=<HOST>\|.*\.encryptedped | |
| IP=<HOST>\|.*\.encryptedRSA | |
| IP=<HOST>\|.*\.encryptedAES | |
| IP=<HOST>\|.*\.Encrypted | |
| IP=<HOST>\|.*\.encrypt | |
| IP=<HOST>\|.*\.encedRSA | |
| IP=<HOST>\|.*\.EnCiPhErEd | |
| IP=<HOST>\|.*\.dyatel\@qq_com | |
| IP=<HOST>\|.*\.czvxce | |
| IP=<HOST>\|.*\.darkness | |
| IP=<HOST>\|.*\.ctbl | |
| IP=<HOST>\|.*\.CrySiS | |
| IP=<HOST>\|.*\.CryptoTorLocker2015\! | |
| IP=<HOST>\|.*\.crypted | |
| IP=<HOST>\|.*\.cry | |
| IP=<HOST>\|.*\.crjoker | |
| IP=<HOST>\|.*\.crinf | |
| IP=<HOST>\|.*\.crime | |
| IP=<HOST>\|.*\.coverton | |
| IP=<HOST>\|.*\.code | |
| IP=<HOST>\|.*\.clf | |
| IP=<HOST>\|.*\.chifrator\@qq_com | |
| IP=<HOST>\|.*\.cerber | |
| IP=<HOST>\|.*\.cbf | |
| IP=<HOST>\|.*\.btcbtcbtc | |
| IP=<HOST>\|.*\.btc\-help\-you | |
| IP=<HOST>\|.*\.btc | |
| IP=<HOST>\|.*\.bloc | |
| IP=<HOST>\|.*\.better_call_saul | |
| IP=<HOST>\|.*\.AES256 | |
| IP=<HOST>\|.*\.\{CRYPTENDBLACKDC\} | |
| IP=<HOST>\|.*\.73i87A | |
| IP=<HOST>\|.*\.zzz | |
| IP=<HOST>\|.*\.abc | |
| IP=<HOST>\|.*\.aaa | |
| IP=<HOST>\|vault\.txt | |
| IP=<HOST>\|vault\.key | |
| IP=<HOST>\|recovery_key\.txt | |
| IP=<HOST>\|vault\.hta | |
| IP=<HOST>\|message\.txt | |
| IP=<HOST>\|recovery_file\.txt | |
| IP=<HOST>\|confirmation\.key | |
| IP=<HOST>\|enc_files\.txt | |
| IP=<HOST>\|last_chance\.txt | |
| IP=<HOST>\|.*\.vault | |
| IP=<HOST>\|.*want\\ your\\ files\\ back\..* | |
| IP=<HOST>\|.*\.frtrss | |
| IP=<HOST>\|.*\.exx | |
| IP=<HOST>\|.*\.ezz | |
| IP=<HOST>\|.*\.ecc | |
| IP=<HOST>\|.*help_restore.*\..* | |
| IP=<HOST>\|.*how_to_recover.*\..* | |
| IP=<HOST>\|.*restore_fi.*\..* | |
| IP=<HOST>\|.*ukr\.net.* | |
| IP=<HOST>\|.*qq_com.* | |
| IP=<HOST>\|.*keemail\.me.* | |
| IP=<HOST>\|.*decipher.* | |
| IP=<HOST>\|.*install_tor.*\..* | |
| IP=<HOST>\|.*\@india\.com.* | |
| IP=<HOST>\|.*\@gmail_com_.* | |
| IP=<HOST>\|.*\..*obleep | |
| IP=<HOST>\|.*\..*exx | |
| IP=<HOST>\|.*\..*locked | |
| IP=<HOST>\|.*\..*nochance | |
| IP=<HOST>\|.*\..*kraken | |
| IP=<HOST>\|.*\..*kb15 | |
| IP=<HOST>\|.*\..*darkness | |
| IP=<HOST>\|.*\..*crypto | |
| IP=<HOST>\|.*\..*cry | |
| IP=<HOST>\|_Locky_recover_instructions\.txt | |
| IP=<HOST>\|help_recover_instructions\+.*\.txt | |
| IP=<HOST>\|recoverfile.*\.txt | |
| IP=<HOST>\|Howto_Restore_FILES\.TXT | |
| IP=<HOST>\|recoveryfile.*\.txt | |
| IP=<HOST>\|_how_recover\.txt | |
| IP=<HOST>\|howrecover\+.*\.txt | |
| IP=<HOST>\|restorefiles\.txt | |
| IP=<HOST>\|howto_recover_file\.txt | |
| IP=<HOST>\|HowtoRESTORE_FILES\.txt | |
| IP=<HOST>\|RECOVERY_FILE.*\.txt | |
| IP=<HOST>\|RECOVERY_FILES\.txt | |
| IP=<HOST>\|help_decrypt_your_files\.html | |
| IP=<HOST>\|HELPDECYPRT_YOUR_FILES\.HTML | |
| IP=<HOST>\|IHAVEYOURSECRET\.KEY | |
| IP=<HOST>\|SECRET\.KEY | |
| IP=<HOST>\|SECRETIDHERE\.KEY | |
| IP=<HOST>\|READTHISNOW\!\!\!\.TXT | |
| IP=<HOST>\|IAMREADYTOPAY\.TXT | |
| IP=<HOST>\|HELLOTHERE\.TXT | |
| IP=<HOST>\|FILESAREGONE\.TXT | |
| IP=<HOST>\|DECRYPT_ReadMe\.TXT | |
| IP=<HOST>\|Read\.txt | |
| IP=<HOST>\|About_Files\.txt | |
| IP=<HOST>\|_secret_code\.txt | |
| IP=<HOST>\|ReadDecryptFilesHere\.txt | |
| IP=<HOST>\|Coin\.Locker\.txt | |
| IP=<HOST>\|HOW_TO_DECRYPT_FILES\.TXT | |
| IP=<HOST>\|DECRYPT_INSTRUCTION\.TXT | |
| IP=<HOST>\|encryptor_raas_readme_liesmich\.txt | |
| IP=<HOST>\|Help_Decrypt\.txt | |
| IP=<HOST>\|YOUR_FILES\.url | |
| IP=<HOST>\|How_To_Recover_Files\.txt | |
| IP=<HOST>\|YOUR_FILES\.HTML | |
| IP=<HOST>\|INSTRUCCIONES_DESCIFRADO\.TXT | |
| IP=<HOST>\|DECRYPT_INSTRUCTIONS\.TXT | |
| IP=<HOST>\|HELP_TO_SAVE_FILES\.txt | |
| IP=<HOST>\|DecryptAllFiles\.txt | |
| IP=<HOST>\|HELP_RECOVER_FILES\.txt | |
| IP=<HOST>\|HELP_RESTORE_FILES\.txt | |
| IP=<HOST>\|HELP_TO_DECRYPT_YOUR_FILES\.txt | |
| IP=<HOST>\|HELP_YOUR_FILES\.TXT | |
| IP=<HOST>\|HELPDECRYPT\.TXT | |
| IP=<HOST>\|.*\.CTB2 | |
| IP=<HOST>\|.*\.SUPERCRYPT | |
| IP=<HOST>\|.*\.magic | |
| IP=<HOST>\|.*\.1999 | |
| IP=<HOST>\|.*\.toxcrypt | |
| IP=<HOST>\|.*\.bleep | |
| IP=<HOST>\|.*\.0x0 | |
| IP=<HOST>\|.*\.good | |
| IP=<HOST>\|.*\.R16M01D05 | |
| IP=<HOST>\|.*\.pzdc | |
| IP=<HOST>\|.*\.XRNT | |
| IP=<HOST>\|.*\.crypto | |
| IP=<HOST>\|.*\.ccc | |
| IP=<HOST>\|.*\.da_vinci_code | |
| IP=<HOST>\|.*\.payransom | |
| IP=<HOST>\|.*\.KEYH0LES | |
| IP=<HOST>\|oor\..* | |
| IP=<HOST>\|.*\.zyklon | |
| IP=<HOST>\|.*\.zcrypt | |
| IP=<HOST>\|.*\.Z81928819 | |
| IP=<HOST>\|.*\.Silent | |
| IP=<HOST>\|.*\.RSNSlocked | |
| IP=<HOST>\|.*\.RAD | |
| IP=<HOST>\|.*\.porno | |
| IP=<HOST>\|.*\.pornoransom | |
| IP=<HOST>\|.*\.odcodc | |
| IP=<HOST>\|_ryp | |
| IP=<HOST>\|.*\.helpdecrypt\@ukr.*\.net | |
| IP=<HOST>\|.*\.only\-we_can\-help_you | |
| IP=<HOST>\|.*\.cryp1 | |
| IP=<HOST>\|.*\.fileiscryptedhard | |
| IP=<HOST>\|.*\.blocatto | |
| IP=<HOST>\|.*\.8lock8 | |
| IP=<HOST>\|.*\.777 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [Init] | |
| journalmatch = _SYSTEMD_UNIT=smb.service _COMM=smbd SYSLOG_IDENTIFIER=smbd_audit | |
| [Definition] | |
| ignoreregex = | |
| failregex = | |
| IP=<HOST>\|\!\!\!\\ \#\#\#\#\#\\ ===\\ ReadMe\\ ===\\ \#\#\#\#\#\\ \!\!\!\.htm | |
| IP=<HOST>\|.*\.0x0 | |
| IP=<HOST>\|.*\.1999 | |
| IP=<HOST>\|.*\.CTB2 | |
| IP=<HOST>\|.*\.CTBL | |
| IP=<HOST>\|.*\.EnCiPhErEd | |
| IP=<HOST>\|.*\.HA3 | |
| IP=<HOST>\|.*\.LOL\! | |
| IP=<HOST>\|.*\.LeChiffre | |
| IP=<HOST>\|.*\.MRCR1 | |
| IP=<HOST>\|.*\.OMG\! | |
| IP=<HOST>\|.*\.PEGS1 | |
| IP=<HOST>\|.*\.R16M01D05 | |
| IP=<HOST>\|.*\.RARE1 | |
| IP=<HOST>\|.*\.RENSENWARE | |
| IP=<HOST>\|.*\.RRK | |
| IP=<HOST>\|.*\.SUPERCRYPT | |
| IP=<HOST>\|.*\.XTBL | |
| IP=<HOST>\|.*\.aaa | |
| IP=<HOST>\|.*\.abc | |
| IP=<HOST>\|.*\.aesir | |
| IP=<HOST>\|.*\.bart\.zip | |
| IP=<HOST>\|.*\.bleep | |
| IP=<HOST>\|.*\.ccc | |
| IP=<HOST>\|.*\.cerber | |
| IP=<HOST>\|.*\.cerber2 | |
| IP=<HOST>\|.*\.crab | |
| IP=<HOST>\|.*\.crinf | |
| IP=<HOST>\|.*\.crjoker | |
| IP=<HOST>\|.*\.crptrgr | |
| IP=<HOST>\|.*\.cry | |
| IP=<HOST>\|.*\.crypt | |
| IP=<HOST>\|.*\.crypto | |
| IP=<HOST>\|.*\.ded | |
| IP=<HOST>\|.*\.diablo | |
| IP=<HOST>\|.*\.diablo6 | |
| IP=<HOST>\|.*\.ecc | |
| IP=<HOST>\|.*\.encoderpass | |
| IP=<HOST>\|.*\.encrypted | |
| IP=<HOST>\|.*\.encryptedRSA | |
| IP=<HOST>\|.*\.exx | |
| IP=<HOST>\|.*\.ezz | |
| IP=<HOST>\|.*\.fantom | |
| IP=<HOST>\|.*\.filock | |
| IP=<HOST>\|.*\.firecrypt | |
| IP=<HOST>\|.*\.good | |
| IP=<HOST>\|.*\.keybtc\@inbox_com | |
| IP=<HOST>\|.*\.kirk | |
| IP=<HOST>\|.*\.kk | |
| IP=<HOST>\|.*\.krab | |
| IP=<HOST>\|.*\.locked | |
| IP=<HOST>\|.*\.lukitus | |
| IP=<HOST>\|.*\.magic | |
| IP=<HOST>\|.*\.micro | |
| IP=<HOST>\|.*\.nuclear | |
| IP=<HOST>\|.*\.odin | |
| IP=<HOST>\|.*\.osiris | |
| IP=<HOST>\|.*\.payms | |
| IP=<HOST>\|.*\.pzdc | |
| IP=<HOST>\|.*\.r5a | |
| IP=<HOST>\|.*\.thor | |
| IP=<HOST>\|.*\.toxcrypt | |
| IP=<HOST>\|.*\.ttt | |
| IP=<HOST>\|.*\.uDz.* | |
| IP=<HOST>\|.*\.vault | |
| IP=<HOST>\|.*\.vvv | |
| IP=<HOST>\|.*\.wcry | |
| IP=<HOST>\|.*\.wlu | |
| IP=<HOST>\|.*\.wncry | |
| IP=<HOST>\|.*\.wncryt | |
| IP=<HOST>\|.*\.wnry | |
| IP=<HOST>\|.*\.xort | |
| IP=<HOST>\|.*\.xrtn | |
| IP=<HOST>\|.*\.xxx | |
| IP=<HOST>\|.*\.xyz | |
| IP=<HOST>\|.*\.zepto | |
| IP=<HOST>\|.*\.zzz | |
| IP=<HOST>\|.*\.zzzzz | |
| IP=<HOST>\|Coin\.Locker\.txt | |
| IP=<HOST>\|DECRYPT_INSTRUCTION\.TXT | |
| IP=<HOST>\|DECRYPT_INSTRUCTIONS\.TXT | |
| IP=<HOST>\|DECRYPT_ReadMe\.TXT | |
| IP=<HOST>\|DecryptAllFiles\.txt | |
| IP=<HOST>\|DecryptAllFiles\.txt | |
| IP=<HOST>\|FILESAREGONE\.TXT | |
| IP=<HOST>\|HELLOTHERE\.TXT | |
| IP=<HOST>\|HELPDECRYPT\.TXT | |
| IP=<HOST>\|HELPDECYPRT_YOUR_FILES\.HTML | |
| IP=<HOST>\|HELP_RECOVER_FILES\.txt | |
| IP=<HOST>\|HELP_RESTORE_FILES\.txt | |
| IP=<HOST>\|HELP_TO_DECRYPT_YOUR_FILES\.txt | |
| IP=<HOST>\|HELP_TO_SAVE_FILES\.txt | |
| IP=<HOST>\|HELP_TO_SAVE_FILES\.txt | |
| IP=<HOST>\|HELP_YOUR_FILES\.TXT | |
| IP=<HOST>\|HOW_TO_DECRYPT_FILES\.TXT | |
| IP=<HOST>\|Help_Decrypt\.txt | |
| IP=<HOST>\|How_To_Recover_Files\.txt | |
| IP=<HOST>\|HowtoRESTORE_FILES\.txt | |
| IP=<HOST>\|HowtoRestore_FILES\.txt | |
| IP=<HOST>\|Howto_Restore_FILES\.TXT | |
| IP=<HOST>\|IAMREADYTOPAY\.TXT | |
| IP=<HOST>\|IHAVEYOURSECRET\.KEY | |
| IP=<HOST>\|INSTRUCCIONES_DESCIFRADO\.TXT | |
| IP=<HOST>\|README\.hta | |
| IP=<HOST>\|READTHISNOW\!\!\!\.TXT | |
| IP=<HOST>\|RECOVERY_FILE.*\.txt | |
| IP=<HOST>\|RECOVERY_FILE\.TXT | |
| IP=<HOST>\|RECOVERY_FILES\.txt | |
| IP=<HOST>\|RECOVERY_KEY\.txt | |
| IP=<HOST>\|ReadDecryptFilesHere\.txt | |
| IP=<HOST>\|SECRET\.KEY | |
| IP=<HOST>\|SECRETIDHERE\.KEY | |
| IP=<HOST>\|YOUR_FILES\.HTML | |
| IP=<HOST>\|YOUR_FILES\.url | |
| IP=<HOST>\|_crypt | |
| IP=<HOST>\|_how_recover\.txt | |
| IP=<HOST>\|_secret_code\.txt | |
| IP=<HOST>\|ded\.png | |
| IP=<HOST>\|encryptor_raas_readme_liesmich\.txt | |
| IP=<HOST>\|help_decrypt_your_files\.html | |
| IP=<HOST>\|help_recover_instructions\+.*\.txt | |
| IP=<HOST>\|howrecover\+.*\.txt | |
| IP=<HOST>\|howto_recover_file\.txt | |
| IP=<HOST>\|out_Files\.txt | |
| IP=<HOST>\|recoverfile.*\.txt | |
| IP=<HOST>\|recoveryfile.*\.txt | |
| IP=<HOST>\|recoveryfile.*\.txt | |
| IP=<HOST>\|restorefiles\.txt |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This is just a possible example how one can combine multiple RE's to single RE (but it is still weird and "vulnerable" and also not so fast as it could be, see my answer in original issue):