Login To the file server as admin.
Open Server Manager and install the File server Resource Manager role if not installed.
After installing Reboot the server.
Once up, open powershell as admin and run the following script.
# DeployCryptoBlocker.ps1
# Version: 1.1
#####
################################ USER CONFIGURATION ################################
# Names to use in FSRM
# DeployCryptoBlocker.ps1
# Version: 1.1
#####
################################ USER CONFIGURATION ################################
# Names to use in FSRM
$fileGroupName = "CryptoBlockerGroup"
$fileTemplateName = "CryptoBlockerTemplate"
# set screening type to
# Active screening: Do not allow users to save unathorized files
$fileTemplateType = "Active"
# Passive screening: Allow users to save unathorized files (use for monitoring)
#$fileTemplateType = "Passiv"
# Write the email options to the temporary file - comment out the entire block if no email notification should be set
$EmailNotification = $env:TEMP + "tmpEmail001.tmp"
"Notification=m" >> $EmailNotification
"To=[Admin Email]" >> $EmailNotification
## en
"Subject=Unauthorized file from the [Violated File Group] file group detected" >> $EmailNotification
"Message=User [Source Io Owner] attempted to save [Source File Path] to [File Screen Path] on the [Server] server. This file is in the [Violated File Group] file group, which is not permitted on the server." >> $EmailNotification
## de
#"Subject=Nicht autorisierte Datei erkannt, die mit Dateigruppe [Violated File Group] übereinstimmt" >> $EmailNotification
#"Message=Das System hat erkannt, dass Benutzer [Source Io Owner] versucht hat, die Datei [Source File Path] unter [File Screen Path] auf Server [Server] zu speichern. Diese Datei weist Übereinstimmungen mit der Dateigruppe [Violated File Group] auf, die auf dem System nicht zulässig ist." >> $EmailNotification
# Write the event log options to the temporary file - comment out the entire block if no event notification should be set
$EventNotification = $env:TEMP + "tmpEvent001.tmp"
"Notification=e" >> $EventNotification
"EventType=Warning" >> $EventNotification
## en
"Message=User [Source Io Owner] attempted to save [Source File Path] to [File Screen Path] on the [Server] server. This file is in the [Violated File Group] file group, which is not permitted on the server." >> $EventNotification
## de
#"Message=Das System hat erkannt, dass Benutzer [Source Io Owner] versucht hat, die Datei [Source File Path] unter [File Screen Path] auf Server [Server] zu speichern. Diese Datei weist Übereinstimmungen mit der Dateigruppe [Violated File Group] auf, die auf dem System nicht zulässig ist." >> $EventNotification
################################ USER CONFIGURATION ################################
################################ Functions ################################
Function ConvertFrom-Json20
{
# Deserializes JSON input into PowerShell object output
Param (
[Object] $obj
)
Add-Type -AssemblyName System.Web.Extensions
$serializer = New-Object System.Web.Script.Serialization.JavaScriptSerializer
return ,$serializer.DeserializeObject($obj)
}
Function New-CBArraySplit
{
<#
Takes an array of file extensions and checks if they would make a string >4Kb,
if so, turns it into several arrays
#>
param(
$Extensions
)
$Extensions = $Extensions | Sort-Object -Unique
$workingArray = @()
$WorkingArrayIndex = 1
$LengthOfStringsInWorkingArray = 0
# TODO - is the FSRM limit for bytes or characters?
# maybe [System.Text.Encoding]::UTF8.GetBytes($_).Count instead?
# -> in case extensions have Unicode characters in them
# and the character Length is <4Kb but the byte count is >4Kb
# Take the items from the input array and build up a
# temporary workingarray, tracking the length of the items in it and future commas
$Extensions | ForEach-Object {
if (($LengthOfStringsInWorkingArray + 1 + $_.Length) -gt 4000)
{
# Adding this item to the working array (with +1 for a comma)
# pushes the contents past the 4Kb limit
# so output the workingArray
[PSCustomObject]@{
index = $WorkingArrayIndex
FileGroupName = "$Script:FileGroupName$WorkingArrayIndex"
array = $workingArray
}
# and reset the workingArray and counters
$workingArray = @($_) # new workingArray with current Extension in it
$LengthOfStringsInWorkingArray = $_.Length
$WorkingArrayIndex++
}
else #adding this item to the workingArray is fine
{
$workingArray += $_
$LengthOfStringsInWorkingArray += (1 + $_.Length) #1 for imaginary joining comma
}
}
# The last / only workingArray won't have anything to push it past 4Kb
# and trigger outputting it, so output that one as well
[PSCustomObject]@{
index = ($WorkingArrayIndex)
FileGroupName = "$Script:FileGroupName$WorkingArrayIndex"
array = $workingArray
}
}
################################ Functions ################################
################################ Program code ################################
# Identify Windows Server version, PowerShell version and install FSRM role
$majorVer = [System.Environment]::OSVersion.Version.Major
$minorVer = [System.Environment]::OSVersion.Version.Minor
$powershellVer = $PSVersionTable.PSVersion.Major
if ($powershellVer -le 2)
{
Write-Host "`n####"
Write-Host "ERROR: PowerShell v3 or higher required."
exit
}
Write-Host "`n####"
Write-Host "Checking File Server Resource Manager.."
Import-Module ServerManager
if ($majorVer -ge 6)
{
$checkFSRM = Get-WindowsFeature -Name FS-Resource-Manager
if (($minorVer -ge 2 -or $majorVer -eq 10) -and $checkFSRM.Installed -ne "True")
{
# Server 2012 / 2016
Write-Host "`n####"
Write-Host "FSRM not found.. Installing (2012 / 2016).."
$install = Install-WindowsFeature -Name FS-Resource-Manager -IncludeManagementTools
if ($? -ne $True)
{
Write-Host "Install of FSRM failed."
exit
}
}
elseif ($minorVer -ge 1 -and $checkFSRM.Installed -ne "True")
{
# Server 2008 R2
Write-Host "`n####"
Write-Host "FSRM not found.. Installing (2008 R2).."
$install = Add-WindowsFeature FS-FileServer, FS-Resource-Manager
if ($? -ne $True)
{
Write-Host "Install of FSRM failed."
exit
}
}
elseif ($checkFSRM.Installed -ne "True")
{
# Server 2008
Write-Host "`n####"
Write-Host "FSRM not found.. Installing (2008).."
$install = &servermanagercmd -Install FS-FileServer FS-Resource-Manager
if ($? -ne $True)
{
Write-Host "Install of FSRM failed."
exit
}
}
}
else
{
# Assume Server 2003
Write-Host "`n####"
Write-Host "Unsupported version of Windows detected! Quitting.."
return
}
## Enumerate shares
Write-Host "`n####"
Write-Host "Processing ProtectList.."
### move file from C:WindowsSystem32 or whatever your relative path is to the directory of this script
if (Test-Path .ProtectList.txt)
{
Move-Item -Path .ProtectList.txt -Destination $PSScriptRootProtectList.txt -Force
}
if (Test-Path $PSScriptRootProtectList.txt)
{
$drivesContainingShares = Get-Content $PSScriptRootProtectList.txt | ForEach-Object { $_.Trim() }
}
Else {
$drivesContainingShares = @(Get-WmiObject Win32_Share |
Select Name,Path,Type |
Where-Object { $_.Type -match '0|2147483648' } |
Select -ExpandProperty Path |
Select -Unique)
}
if ($drivesContainingShares.Count -eq 0)
{
Write-Host "`n####"
Write-Host "No drives containing shares were found. Exiting.."
exit
}
Write-Host "`n####"
Write-Host "The following shares needing to be protected: $($drivesContainingShares -Join ",")"
# Download list of CryptoLocker file extensions
Write-Host "`n####"
Write-Host "Dowloading CryptoLocker file extensions list from fsrm.experiant.ca api.."
$jsonStr = Invoke-WebRequest -Uri https://fsrm.experiant.ca/api/v1/get
$monitoredExtensions = @(ConvertFrom-Json20 $jsonStr | ForEach-Object { $_.filters })
# Process SkipList.txt
Write-Host "`n####"
Write-Host "Processing SkipList.."
### move file from C:WindowsSystem32 or whatever your relative path is to the directory of this script
if (Test-Path .SkipList.txt)
{
Move-Item -Path .SkipList.txt -Destination $PSScriptRootSkipList.txt -Force
}
If (Test-Path $PSScriptRootSkipList.txt)
{
$Exclusions = Get-Content $PSScriptRootSkipList.txt | ForEach-Object { $_.Trim() }
$monitoredExtensions = $monitoredExtensions | Where-Object { $Exclusions -notcontains $_ }
}
Else
{
$emptyFile = @'
#
# Add one filescreen per line that you want to ignore
#
# For example, if *.doc files are being blocked by the list but you want
# to allow them, simply add a new line in this file that exactly matches
# the filescreen:
#
# *.doc
#
# The script will check this file every time it runs and remove these
# entries before applying the list to your FSRM implementation.
#
'@
Set-Content -Path $PSScriptRootSkipList.txt -Value $emptyFile
}
# Check to see if we have any local patterns to include
Write-Host "`n####"
Write-Host "Processing IncludeList.."
### move file from C:WindowsSystem32 or whatever your relative path is to the directory of this script
if (Test-Path .IncludeList.txt)
{
Move-Item -Path .IncludeList.txt -Destination $PSScriptRootIncludeList.txt -Force
}
If (Test-Path $PSScriptRootIncludeList.txt)
{
$includeExt = Get-Content $PSScriptRootIncludeList.txt | ForEach-Object { $_.Trim() }
$monitoredExtensions = $monitoredExtensions + $includeExt
}
# Split the $monitoredExtensions array into fileGroups of less than 4kb to allow processing by filescrn.exe
$fileGroups = @(New-CBArraySplit $monitoredExtensions)
# Perform these steps for each of the 4KB limit split fileGroups
Write-Host "`n####"
Write-Host "Adding/replacing File Groups.."
ForEach ($group in $fileGroups) {
#Write-Host "Adding/replacing File Group [$($group.fileGroupName)] with monitored file [$($group.array -Join ",")].."
Write-Host "`nFile Group [$($group.fileGroupName)] with monitored files from [$($group.array[0])] to [$($group.array[$group.array.GetUpperBound(0)])].."
&filescrn.exe filegroup Delete "/Filegroup:$($group.fileGroupName)" /Quiet
&filescrn.exe Filegroup Add "/Filegroup:$($group.fileGroupName)" "/Members:$($group.array -Join '|')"
}
# Create File Screen Template with Notification
Write-Host "`n####"
Write-Host "Adding/replacing [$fileTemplateType] File Screen Template [$fileTemplateName] with eMail Notification [$EmailNotification] and Event Notification [$EventNotification].."
&filescrn.exe Template Delete /Template:$fileTemplateName /Quiet
# Build the argument list with all required fileGroups and notifications
$screenArgs = 'Template', 'Add', "/Template:$fileTemplateName", "/Type:$fileTemplateType"
ForEach ($group in $fileGroups) {
$screenArgs += "/Add-Filegroup:$($group.fileGroupName)"
}
If ($EmailNotification -ne "") {
$screenArgs += "/Add-Notification:m,$EmailNotification"
}
If ($EventNotification -ne "") {
$screenArgs += "/Add-Notification:e,$EventNotification"
}
&filescrn.exe $screenArgs
# Create File Screens for every drive containing shares
Write-Host "`n####"
Write-Host "Adding/replacing File Screens.."
$drivesContainingShares | ForEach-Object {
Write-Host "File Screen for [$_] with Source Template [$fileTemplateName].."
&filescrn.exe Screen Delete "/Path:$_" /Quiet
&filescrn.exe Screen Add "/Path:$_" "/SourceTemplate:$fileTemplateName"
}
# Add Folder Exceptions from ExcludeList.txt
Write-Host "`n####"
Write-Host "Processing ExcludeList.."
### move file from C:WindowsSystem32 or whatever your relative path is to the directory of this script
if (Test-Path .ExcludePaths.txt)
{
Move-Item -Path .ExcludePaths.txt -Destination $PSScriptRootExcludePaths.txt -Force
}
If (Test-Path $PSScriptRootExcludePaths.txt) {
Get-Content $PSScriptRootExcludePaths.txt | ForEach-Object {
If (Test-Path $_) {
# Build the argument list with all required fileGroups
$ExclusionArgs = 'Exception', 'Add', "/Path:$_"
ForEach ($group in $fileGroups) {
$ExclusionArgs += "/Add-Filegroup:$($group.fileGroupName)"
}
&filescrn.exe $ExclusionArgs
}
}
}
# Cleanup temporary files if they were created
Write-Host "`n####"
Write-Host "Cleaning up temporary stuff.."
If ($EmailNotification -ne "") {
Remove-Item $EmailNotification -Force
}
If ($EventNotification -ne "") {
Remove-Item $EventNotification -Force
}
Write-Host "`n####"
Write-Host "Done."
Write-Host "####"
################################ Program code ################################################################ Program code ################################
The above script was originally developed by a user https://github.com/nexxai/CryptoBlocker.
- After the code is completed open File Server Resource Manager from the start menu.
- You will be able to see all the groups that are created here:
- Under File screens on the left panel you can see all the rules for each drive associated.
- To configure Email to send out alerts to: Right Click File server Resource Manager and select on Configure Options:
After that under “Email Notifications Tab”
Also review: https://samantjaitli.com/azure-sentinel/audit-active-directory-changes/
Add the SMTP server name, Add admin recipients and email address;
Now you will receive alerts whenever an extension is found which isn’t permitted on the server.
The file extensions are regularly updated. To update the kill switch just re-run the script and it will add in the new extensions.
Current Raw List
Current File Group Count: 4580
Unauthenticated API: https://fsrm.experiant.ca/api/v1/combined
*.REV
*.w2tnk
*.nooa
*.muuq
*.51yupKSuX
*.hela
*.guer
*.dance
*.Imshifau
*.aeur
*.hhqa
*.grej
*.myday
*.gudj
*.moqs
*.PcS
*.ufwj
*.teddy
*.LOWPRICE
.pause
*.gujd
*.nwji
*.pause
*.WWKA
*.nohope
*.Poteston
*.GoodMorning
*.PB
*.hive
*.givemenitro
*.rxqcpjoai
*.partydog
*.leex
*.miis
*.PIIQ*
*.lssr
*.xcss
*.avos
*.pooe
*.cryptoncrypt
*.zqqw
*.zzla
*.neer
*.mppq
*.piiq
*.Spyro
*.SplinterJoke
*.TaRRaK
*.XMEYU
*.ZIG
*.pr09
*.pahd
*.2x2d
*.SLAM
*.qscx
*.tohnichi
*.MANSORY
*.redeem
*.r44s
*.[Delta]*
*.Poliex
*.hen_ry_217
*.0xxx
*.nmc
*.ZEUS
*.snoopdog
*.ddsg
*.apis
*.iqll
*.Sspq
*.reddot
*.nermer
*.ramsome.encrypt(rsw).nat
*.v-society
*.PAYLOADBIN
*.PARTY
*.Xino
*.DELTA
*.MMTA
*.paas
*.Yqbdpevbz
*.Sal13
*.epsilonred
*.Lohodf
*.Datalock
*.Dhlp
*.poker
*.Globeimposter*
*.Oplatabtc3
*.mo2
*.Zwbowhtlni
*.505
*.ehiz
*.CGAIE
*.root
*.eye
*.nusm
*@disroot.org*
*.ever101
*.Lorenz.sz40
*.Lawvuhqjr
*.sick
*.FEEDC
*.ducky
*.igvm
*.dewar
*.LGNLCKD
*.pcqq
*.Czlock
*.lldc
*.HJAWF
*.bumcoder
*.GoNNaCry
*.henry217
*.saverswasted
*.n3tw0rm
*.BtCry_zip
*.HPJ
*.rejg
*.2122
*.XHAMSTER
*.rbhd
*.rootiunik.*-*-*
*.cum
*.wintenzz
*.encrpt3d
*.bdev
*.GFYPK
*.ALNBR
*.Hknet
*.lookfornewitguy
*.pandora
*.BENTLEY
*.combo13
*.swagkarna
*.graysuit
*.Ctpl
*.4o4
*.Greed
*.Elbie
*.wrui
*.ZoLiSoNaL
*.MailRU
*.lmas
*.charlie.j0hnson
*.gehenna
*.beaf
*.glock
*.HANTA
*.03rK
*.fdcz
*.yrnb
*.urnb
*.uniwinni.crypt
*.bagli
*.YBNT
*.ybtn
*.ytbn
*.duk
*.arch
*.stnts
*.LAZPARKING-*
*.cityzone-*
*.lpsk
*.Prom[*]
*.sandboxtest
*.Technomous*
*.SO0i
*.ekvf
*.plastic
*.PROM
*.zonecare
*.zuadr
*.Bqd2
*.pecunia
*.Alienlock
*.Enfp
*.optimus
*.oral
*.biden
*.Networklock
*.systems32x
*.IQ_IQ
*.RansomTrojanLock
*.Stealed
*.NASAcry
*.ecure
*.fsvlf4
*.fsociety
*.pirat
*.hog
*.eofyd
*.seccrypt
*.gopher
*.z8sj2c
*.usagoo
*.jojocrypt
*.tirp
*.0l0lqq
*.sarbloh
*.WKSGJ
*.covid21
*.reig
*.clman
*.perfection
*.jessy
*.p3rt4m1n4777
*.JDPR
*.vassagoh
*.lck
*.ribd
*.Snoopdoog
*.LockfilesKR
*.vjiszy1lo
*.four
*.RANZYLOCKED
*.fair
*.BK
*.arazite
*.paralock
*.paras1te
*.parasite
*.pauq
*.vassago
*.HAM
*.alumni
*.cadq
*.lola
*.kslhb
*.LOTUS
*.dark
*.TRU8
*.daddycrypt
*_HD
*.zaplat.za*
*.wcg
*.MILIHPEN
*.con30
*.lucifer
*.ygkz
*.CMLOCKER
*.tortoise
*.OVO
*.DERZKO
*.Egh9E
*.MILIHPENN
*.glkm
*.@LyDarkr
*.22btc
*.TomLe
*.Avaad
*.Cukiesi
*._enc
*.ZoToN
*.CryptPethya
*.palm
*.plam
*.cosd
*.EnCryp13d
*.NOV
*.betarasite
*.babyk
*.AXI
*.LTC
*.RSA
*.vovalex
*.dexx
*.johnborn@cock_li
*.pola
*.14x
*.cnh
*.cring
*.DeroHE
*.clock
*.boom
*.wbxd
*.judge
*.aksx
*.KKBKR
*.qlkm
*.coos
*.LIZARD
*.solaso
*.aulmhwpbpz
*.bonsoir
*.locks
*.ZIEBF_4561drgf
*.qQ6Q
*.__NIST_K571__
*.moloch
*.*.AMJIXIUS
*.encryptedQjbQpkgd.sett4545
*.xbml
*.nginxhole
*.lockedv1
*.lockerxxs
*.AMJIXIUS
*.16x
*.ziggy
*.igal
*.mijnal
*.jcrypt
*.rtcrypted
*.KLZUB
*.omfl
*.Antivirus
*.kobos
*.abstergo
*.himynameisransom
*.idgm
*.2020END
*.v316
*.booa
*.INFECTION
*.NIGG3R
*.igdm
*.GLB
*.yoAD
*.nobu
*.hacker
*.weui
*.lisp
*.bcBDBbAEDb
*.esexz
*.slgh
*.sglh
*.howareyou
*.ZqVIkE
*.vvao
*.vvoa
*.FLAMINGO
*.RexCrypt
*.FUSION
*.siliconegun@tutanota.com
*.agho
*.pay2key
*.zimba
*.stj888
*.[*].termit
*.luckyday
*.vpsh
*.CC4H
*.sext
*.Elvis
*.sz40
*.H@RM@
*.bondy
*.[*].Bang
*.jdyi
*.SNPDRGN
*.ITTZN
*.captcha
*.pizhon-*
*.ZaLtOn
*.iiss
*.BCCaEaadBA
*.see_read_me
*.Szymekk
*.Hidden
*.ALVIN
*.dme
*.gtsc
*.MERIN
*.LockDown
*.*anta
*.XNMMP
*.nypg
*.*.MadDog
*.VAGGEN
*.TJODT
*.32aa
*.efji
*.easy2lock
*.maddog
*.mmpa
*.loki
*.Bioawards
*.pepe
*.nyan
*.*.XINOF
*.TG33
*.foqe
*.XONIF
*.zxcv
*.CURATOR
*.woodrat
*.Nibiru
*.mame*vse
*.FLYU
*.fresh
*.BD
*.moss
*.zphs
*.osnoed
*.$anta
*.cve
*.HCY!
*.Persephone666
*.id_*_.YOUR_LAST_CHANCE
*.sanders4
*.hbdalna
*.Lulz
*.zhen
*.TRAPGET
*.babaxed
*.easyransom
*.lyli!
*.RNZ
*.id[*-2589].[helpisos@aol.com].isos
*.lyli
*.lina
*.Alix1011RVA
*.TAKA
*.TEREN
*.AW46
*.Dusk
*.Dusk!
*.lr
*.easyransom!
*.babaxed!
*.CryForMe
*.abkir
*.DEUS
*.copa
*.horse
*.TRAPGET!
*.*.*.[blacklivesmatter@qq.com].blm
*.FG69
*.JB88
*.paradox!
*.z3zmh
*.montana
*.RHMLM
*.zhen!
*.kolz
*.Valley
*.*.DogeCrypt
*.YOURPCISHACK16024752552658
*.sgs911
*.*.immunityyoung@aol.com.young
*.Lulz!
*.AHP
*.id-*.[pewpew@TuTa.io].abkir
*.tx_locked!
*.MEFILIN
*.npph
*.hbdalna!
*.doc!
*.Consciousness
*.ogdo
*.sgs911-*
*.UGMH
*mlagham.exe
*@criptext.com*
*.BG85
*.xp10-ransom
*.z3enc
*.J91D
*.Fappy
*.FDFK22
*.Id-*.secure
*.S996
*.hnx911
*.reimageplus
*.bmd
*.tx_locked
*.txd0t!
*.ILMWL
*.kasp
*.txd0t
*.id[*-2987].[crioso@protonmail.com].eking
*.UAKXC
*.klavins
*.fezmm
*.WSHLP
*.SXS
*.[*].[akzhq808@tutanota.com].makop
*.Mnd4
*.CYRAT
*.Death_Of_Shadow
*.*GLADIUS
*.boop
*.Aim
*.get
*.Back
*.morseop*
*.jigsaaw
*.ReadManual.*
*.[XMRLocker]
*.wannacry
*.morseop-7j9wrqr
*.volvo33_36_37_39__44
*.id[*-2275].[helprecover@foxmail.com].help
*.saved
*.id[*-*].[mccreight.ellery@tutanota.com].eight
*.spybuster
*.ehre
*.covid
*.2spyware
*.vari
*.Zyr
*.AB89
*.xati
*.pandemic
*.Spade
*.cymcrypt
*.*.[recoverydata@qbmail.biz].data
*.oonn
*.0.cs
*.0.vb
*.djang0unchain3d
*.week
*.zes
.*AgeLocker
*.1dec
*.nef1lim
*.46orz
*@pm.me*
*.itunes
*.rgnk
*. tcwwasted
*.tcwwasted
*.ZaCaPa
*.id-*[FileFixer@ProtonMail.com].LOCKED
*.PPHL
*.tools_ensikology
*.*jalicry*
*.GlUtEzOn.VaNoLe
*.nile
*.MH24
*_out
*.silvertor
*.mechu4Po
*.Ieph0uxo
*.mnbzr
*.deadfiles
*.DECC
*.tcprx
*.RANDOM
*.xienvkdoc
*.kook
*.GARMINWASTED
*.erif
*.pstKll
*.[sleepme134@gmail.com][ID-*].Void
*.eduransom
*.RE78P
*.Globeimposter-Alpha865qqz
*.spare
*.dwmapi
*.[openpgp@foxmail.com].pgp
*.GlobeimposterAlpha865qqz
*.bbawasted
*.*wasted_info
*.kuus
*.flowEncryption
*.homer
*.[TorS@Tuta.Io]
*.beijing
*.rlhwasted_info
*.FastWind
*.52pojie
*.rlhwasted
*.BNFD
*.(*dungeon*-0_0)
*.jwjs
*prnds
*CoronaCrypt*
*SpartCrypt*
*.VinDizelPux
*.GNS
*.AL8P
*.gyga
*.NHLP
*.lxhlp
*.felix
*.prnds
*.bmtf
*.sthd2
*.zbw
*.hacker_decryption@protonmail.ch
*.Drop
*.bado
*.XINOF
*.smpl
*.readme
*.repl
*.Try2Cry
*.repter
*.teamV
*.panther
*.SilentDeath
*.aris
*.maas
*.CryCryptor
*.wholocked
*.*wasted
*.encoded_PL
*.lolkek
*.id-*.[databack2@protonmail.com].dtbc
*.RABBIT
*.zida
*.support
*.KoxENy1Wq
*.id-*.[Recovery@qbmail.biz].credo
*.pykw
*.team
*._HE
*._HE._LP,
*.CRYPTBD
*.moba
*.crimson
*.jsus
*.CroNi.ZoNe
*.7303yt
*.gomer
*.Email=[russiawolf09@gmail.com]ID=[*].zip
*.EG83
*.id-*.[savebase@aol.com].base
*.[dungeon]-0_0
*.vawe
*.20dfs
*.r3f5s
*.mwahah*
*.usam
*.tabe
*.Badboy
*.ESCAL*
*.TELEGRAM
*.EG
*.coka
*.jpg.js*
*.origami
*.mwahahah
*.hck
*.nypd
*.thanos
*.zwer
*.CrYo
*.AG88G
*.ZRB
*.ElvisPresley
*wifi*hacker*
*.avdn
*.club
*.wch
*.nm8kci
*.kkll
*unluckyware*
*.dsec
*.SIGARETA
*.xdrop
*.BOMBO
*.hex911
*.VIVELAG
*.space
*.Fonix
*.nlah
*.unwa
*@*.banks*
*.eight
*.[*].bclaw
*.pezi
*.fuckunicorn*
*.vfcfocxph
*.fuckunicornhtrhrtjrj
*.bclaw
.111111
*.bang
*.id-*.[paybit@aol.com].payB
*.payB
*.corona-lock
*.biglock
*.covm
*.proL0ck
*.eking
*@rape.lol*
*.M0rphine
*.id-*.[*@*].NET
*.[decryptadmin@protonmail.com][ID-*].Void
*.0day0
*.cxk
*.dodged
*.pr0Lock
*.xsmb
*.Zekwacrypt
*.ZeroFucks
*.Zenis
*.ZimbraCryptor
*.ZeroRansom
*.ZipLocker
*.Zoldon
*.ZQ
*.ZariqaCrypt
*.YouAreFucked
*.XYZWare
*.XCry
*.XTP
*.Wulfric
*.WonderCrypter
*.WinRarer
*.Winnix
*.WininiCrypt
*.WildFire
*.WhiteRose
*.WhatAFuck
*.Wesker
*.WannaSpam
*.WannaSmile
*.WannaPeace
*.WannaDie
*.WannaCry*
*.Waffle
*.Vurten
*.Vortex
*.VoidCrypt
*.VMola
*.VindowsLocker
*.ViACrypt
*.Venus
*.Venis
*.Vega
*.VaultCrypt
*.V8Locker
*.Uyari
*.UserFilesLocker
*.Useless
*.Unlock92
*.Unlock26
*.Unknown
*.UnblockUPC
*.Ungluk
*.UmbreCrypt
*.Ukash
*.UCCU
*.TurkStatik
*.TrumpLocker
*.TrueCrypter
*.Troldesh
*.Trojan.Encoder.6491
*.TowerWeb
*.TotalWipeOut
*.Torchwood
*.TheDarkEncryptor
*.TheDMR
*.TeslaWare
*.Teslarvng
*.TeslaCrypt
*.Termite
*.TellYouThePass
*.Telecrypt
*.Team XRat
*.T1Happy
*.SZFLocker
*.SystemCrypter
*.SyncCrypt
*.SynAck
*.SuperB
*.SunCrypt
*.Stupid
*.Striked
*.Storm
*.StorageCrypter
*.Stampado
*.SQ_
*.SpartCrypt
*.Spartacus
*.SoFucked
*.SNSLocker
*.Smrss32
*.SkyFile
*.Skull
*.SintaLocker
*.Simple_Encoder
*.SilentSpring
*.Sigma
*.Shujin
*.ShkolotaCrypt
*.ShivaGood
*.Shigo
*.ShellLocker
*.SFile
*.SerbRansom
*.Seon
*.ScareCrow
*.SatanCryptor
*.Sanctions
*.SamSam
*.Salsa
*.SADStory
*.Sadogo
*.SadComputer
*.SAD
*.Russian EDA2
*.Russenger
*.Ruby
*.RSAUtil
*.RSA2048Pro
*.RSA-NI
*.Roza
*.RotorCrypt
*.RoshaLock
*.Roga
*.REvil
*.RetMyData
*.RenLocker
*.RemindMe
*.Relock
*.Rektware
*.REKTLocker
*.RedBoot
*.RarVault
*.RaRansomware
*.RansomWarrior
*.RansomPlus
*.Ransomnix
*.RansomCuck
*.Rans0m
*.RanRan
*.Ranion
*.RandomLocker
*.Random6
*.Ragnar
*.Radiation
*.RackCrypt
*.RabbitFox
*.RAA-SEP
*.R980
*.QwertyCrypt
*.Quimera
*.QuakeWay
*.QP
*.qkG
*.PyLocky
*.PyL33T
*.PyCL
*.PwndLocker
*.PureLocker
*.PshCrypt
*.Protected
*.ProLock
*.Project57
*.Project34
*.PrincessLocker
*.Pr0tector
*.PPDDDP
*.PowerWare
*.PowerLocky
*.PopCornTime
*.PonyFinal
*.PoisonFang
*.Plague17
*.Pickles
*.PhoneNumber
*.Philadelphia
*.PhantomChina
*.PGPSnippet
*.PewCrypt
*.Petna
*.Pendor
*.PEC 2017
*.PClock
*.PaySafeGen
*.PayPalGenerator2019
*.Paymen45
*.Paradise
*.Ozoza
*.Ouroboros
*.Ordinypt
*.OpJerusalem
*.OpenToYou
*.OnyxLocker
*.Nyton
*.Nx
*.NullByte
*.Nuke
*.NSB
*.NotAHero
*.Nomikon
*.NMoreira
*.Nhtnwcuf
*.NextCry
*.NewHT
*.Netwalker
*.Netix
*.NETCrypton
*.Nemucod
*.NegozI
*.NCrypt
*.NanoLocker
*.n1n1n1
*.Mystic
*.MrDec
*.MoWare
*.MOTD
*.MorrisBatchCrypt
*.MoonCrypter
*.Montserrat
*.MongoLock
*.Mobef
*.MNS
*.Mischa
*.MireWare
*.MirCop
*.Minotaur
*.MindSystem
*.Meteoritan
*.Mespinoza
*.MegaLocker
*.Medusa
*.MCrypt2018
*.Maykolin
*.MauriGo
*.MarsJoke
*.MarraCrypt
*.Marlboro
*.Marduk
*.Maoloa
*.MalwareTech*
*.Magniber
*.MafiaWare
*.MAFIA
*.MadBit
*.LowLevel04
*.LoveServer
*.Lost_Files
*.Lortok
*.LooCipher
*.LonleyCrypt
*.LongTermMemoryLoss
*.LockTaiwan
*.LockerGoga
*.LockedByte
*.Locked-In
*.LockCrypt
*.LockBox
*.Lock2017
*.LMAOxUS
*.LLTP
*.LittleFinger
*.LightningCrypt
*.LambdaLocker
*.Ladon
*.L33TAF
*.KryptoLocker
*.Kriptovor
*.Krider
*.KratosCrypt
*.Kozy.Jozy
*.Kolobo
*.KokoKrypt
*.Kirk
*.KillRabbit
*.KillerLocker
*.KEYHolder
*.KeyBTC
*.Kerkoporta
*.KeRanger
*.KCW
*.KawaiiLocker
*.Kasiski
*.Karo
*.Karmen
*.Karma
*.Kaenlupuf
*.JungleSec
*.JuicyLemon
*.JosepCrypt
*.JoeGo
*.JobCrypter
*.JNEC.a
*.Jigsaw
*.Jemd
*.JeepersCrypt
*.JapanLocker
*.Jager
*.Jack.Pot
*.JabaCrypter
*.Ishtar
*.Iron
*.iRansom
*.InsaneCrypt
*.InfoDot
*.InfinityLock
*.InfiniteTear
*.InducVirus
*.Ims00ry
*.ILElection2020
*.IFN643
*.IEncrypt
*.HydraCrypt
*.Hydra
*.Hucky
*.HPE iLO
*.HolyCrypt
*.HollyCrypt
*.HKCrypt
*.HildaCrypt
*.HiddenTear
*.Heropoint
*.HelpDCFile
*.Help50
*.Hells
*.Heimdall
*.HDDCryptor
*.hc7
*.hc6
*.Halloware
*.Hakbit
*.HadesLocker
*.GX40
*.GusCrypter
*.GPGQwerty
*.GPCode
*.GPAA
*.Gorgon
*.GoRansom
*.Gomasom
*.GoldenEye
*.Golden Axe
*.GoGoogle
*.Globe3
*.GlobeImposter
*.Gibon
*.Gibberish
*.GhostHammer
*.GhostCrypt
*.GetCrypt
*.GermanWiper
*.Gerber
*.GC47
*.GandCrab2
*.GandCrab
*.Galacti-Crypter
*.FuxSocy
*.FunFact
*.FuckSociety
*.FS0ciety
*.FrozrLock
*.FreeMe
*.FLKR
*.Flatcher3
*.FindZip
*.FilesLocker
*.Fenrir
*.FenixLocker
*.FCT
*.FCP
*.Fadesoft
*.Fabiansomware
*.Extractor
*.Extortion Scam
*.Exocrypt XTC
*.ExecutionerPlus
*.Everbe*
*.Eternal
*.Estemani
*.Erica
*.Erebus
*.EnkripsiPC
*.Enjey Crypter
*.Encryptor RaaS
*.EncryptoJJS
*.EncryptedBatch
*.Enc1
*.El Polocker
*.EggLocker
*.EduCrypt
*.EdgeLocker
*.ECLR*
*.eCh0raix
*.eBayWall
*.DynA-Crypt
*.DVPN
*.DryCry
*.DriedSister
*.DoubleLocker
*.DoNotChange
*.Done
*.DoggeWiper
*.DMA Locker*
*.District
*.Dishwasher
*.DirtyDecrypt
*.DilmaLocker
*.Digisom
*.DeriaLock
*.Defray777
*.Defray
*.DEDCryptor
*.DecYourData
*.DecryptIomega
*.DeathRansom
*.DeathNote
*.DeathHiddenTear v2
*.DeathHiddenTear
*.Deadly
*.DCry 2.0
*.Dcrtr
*.DavesSmith
*.DataKeeper
*.DarkoderCryptor
*.Dablio
*.CXK-NMSL
*.CTB-Locker
*.CTB-Faker
*.CSP Ransomware
*.Crystal
*.CryPy
*.CryptXXX 4.0
*.CryptXXX 3.0
*.CryptXXX 2.0
*.CryptXXX
*.CryptoWire
*.CryptoWall 4.0
*.CryptoWall 3.0
*.CryptoWall 2.0
*.CryptoViki
*.CryptoTorLocker
*.CryptoShocker
*.CryptoRoger
*.CryptorBit
*.CryptoPokemon
*.CryptoPatronum
*.CryptoMix Wallet
*.CryptoMix Revenge
*.CryptoMix
*.CryptoLuck
*.CryptoLocky
*.CryptoLockerEU
*.CryptoLocker3
*.CryptoJacky
*.CryptoHitman
*.CryptoHasYou
*.CryptoGod
*.CryptoFortress
*.CryptoFinancial
*.CryptoDevil
*.CryptoDefense
*.CryptInfinite
*.CryptFuck
*.CryptConsole3
*.CryptConsole
*.Crypt0r
*.Crypt0L0cker
*.Crypt0
*.Crypren
*.CrypMic
*.CryLocker
*.CryFile
*.Cryakl
*.Cripton7zp
*.CreamPie
*.CradleCore
*.Cr1ptT0r
*.Cossy
*.CorruptCrypt
*.CoronaVirus
*.Comrade Circle
*.Clouded
*.CoinVault
*.Coin Locker
*.CockBlocker
*.CmdRansomware
*.ClicoCrypter
*.ChineseRarypt
*.ChinaYunLong
*.Chimera
*.ChernoLocker
*.CerberTear
*.Cancer
*.id[*-*].[decphob@tuta.io].eking
*.DoppelPaymer
*.Bucbi
*.Bubble
*.BTCamant
*.Brazilian Ransomware
*.Booyah
*.BoooamCrypt
*.Blue Blackmail
*.Blooper
*.BlockFile12
*.Blind 2
*.Blackout
*.BlackKingdom
*.BlackHeart
*.Black Shades
*.Black Feather
*.BKRansomware
*.Bitshifter
*.BitPyLock
*.Bitpaymer
*.BitCryptor
*.BitCrypt 2.0
*.BitCrypt
*.Bisquilla
*.BigBobRoss
*.BetaSup
*.BB Ransomware
*.Basilisque Locker
*.Bart v2.0
*.BandarChor
*.BadRabbit
*.BadEncript
*.BadBlock
.restoreserver
*.g8R4rqWIp9
*.C4H
*.cashdashsentme@protonmail.com
*.cov19
*.rbs
*.C1H
*.paradox
*.qensvlcbymk
*.6be31
*.koti
*.B2DR
*.aZaZeL
*.AxCrypter
*.AWT
*.Avest
*.AVCrypt
*.AutoWannaCryV2
*.AutoLocky
*.Atchbo
*.Ataware
*.ASN1 Encoder
*.Arsium
*.ArmaLocky
*.Argus
*.AresCrypt
*.ApolloLocker
*.ApocalypseVM
*.Apocalypse (New Variant)
*.Apocalypse
*.Anubis
*.AnteFrigus
*.Annabelle 2.1
*.AngryDuck
*.Anatova
*.Amnesia2
*.Alpha
*.Alma Locker
*.Alfa
*.mzlq
*.zeronine
*.lock2bits
*.kupidon
*.Lion
*.Al-Namrood
*.Afrodita
*.AES256-06
*.AES-Matrix
*.AES_KEY_GEN_ASSIST
*.AdamLocker
*.ACCDFISA v2.0
*.ABCLocker
*.7ev3n
*.HaCk
*.24H Ransomware
*.4rw5w
*.0kilobypt
*.vcrypt
*.id-*.[neural.net@tuta.io].NET
*.[ID-*]-[EMAIL-M0rphine@cock.li].M0rphine
*.CrYo.TeOnS
*.sqpc
*.NEMTY_AJORCUS
*.trix
*.xraw
*.[Hichkasam@protonmail.com][ID-*].Void
*.id-*.[Helpsir@rape.lol].LOL
*.zemblax
*.Zv7uN
*.projectzorgo
*.OFFWHITE
*.Id-*.[filerestory@gmail.com].Crypto
*.8be1
*.mpal
*.GEnc
*.geminis3
*.pigzqbqnvbu
*.carlos
*.myblacksun@tuta.io
*.rjali@protonmail.ch
*.id-*.[im.online@aol.com].love$
*.love$
*.jyqji
*.qewe
*.id[*-2589].[backup.iso@aol.com].iso
*.lote
*.EAIJTP
*.builder
*.dec
*.worcservice@protonmail.ch
*.Boruta
*.dop
*.serpom
*.revon
*.likud
*.CoronaLock
*.corona
*.*_RSA
*.azor
*.lezp
.KEY0004
.dec
*.LSOBKMHG
*.0D34E0
.arrepiante
.SARS-CoV-2
*.ahegao
*.WannaRen
*.mbit
*.Void
*.rhino
*.creepy
*.eject
*.KEY0004
*.SARS-CoV-2
*.lalo
*.Sister
*.Cruel
*.bukyak
*.mpaj
*.~~~~
*.id-*.[*].ccd
*.id[*].[*].revon
*.JOPE
*.encS
*.id-*.[supermetasploit@aol.com].MSPLT
*.NEMTY_VQLGC72
*.ZyNoXiOn
*.Email=[*]ID=[*].Boruta
*.id-*.[bitcoin@email.tg].ncov
*.rogue
*.shinya
*.encryptedbyBB
*.jest
*.NEPHILIM
*.fcfceee
*.miblqugb
*.[*].[*].makop
*.mado
*.yakuza
*.KENS@TUTA.IO
*.P4WN3D
*.opqz
*.KEKW
*.njmhqbxu
*.[*].yakuza
*.[*].[*].shootlock
*.npsk
*.C-VIR
*.lO8s42
MZReverenge*
*.petruk
*.makop
*Rec0very*
*.iqy
*.remk
*FDFK*INFO*
*.CULEX
*.NEFILIM
*.[*].teslarvng
*.ako
*.HR
*.horseleader
*.MZR
*.javalocker
*.javaencrypt
*.daaefc
*.voyager
*.uk6ge
*.ravack
*.a6f2t
*.foop
*.lokd
*.CNMHR
*.id-*.[*].rxx
*.FDFK
*.vash
*.kir
*.bigdata
*.id[*].*.dewar
*.anon000
*.rezm
*.YKUP
*.sepsys
*.CryptoDarkRubix
*.DEMON
*.China
*.Tsar
*.pxj
*.pwnd
*.brick
*.jerry_glanville_data@aol.com
*.ragnar_*
*.[paymentbtc@airmail.cc].Deniz_Kizi
*.0x6A0C8
*.[*].[test@test.tst].test
*.[paymentbtc@yahoo.com].Deniz_Kizi
*.[*].[buydecryptor@cock.li].makop
*.mew767
*.encryptedL
*.networkmaze
*.coom
*.nppp
*.mool
*.encryptedS
*.iwanttits
*.sfile2
*.Ouchachia
*.id-*.[black@gytmail.com].self
*.id[*-2423].[jewkeswilmer@aol.com].deal
*.ncov
*.blend
*.rajar
*.Rentyr
*.mmnn
*.ooss
*.cripto
*.*.firex3m
*.id-*.[coronavirus@qq.com].ncov
*.id[*-2720].[mr.helper@qq.com].dewar
*.rooe
*.*.*.WHY
*.*.*.dewar
*.ONIX
*.egmwv
*.btHTIb
*.*.parrot
*.razor
*.#ransomwared
*.egmwvm
*kremez*
*.AnubisCrypt
*.desucrpt
*.bboo
*.moncrypt
*.bhacks
*.hellomynameisransom
*.RYK!
*.midwestsurinc
*.eaaeee
*.Devos
*.CONTI
*.abarcy
*.Email=[MasterFile001@protonmail.com]ID=[*].sorena
*.Iexei8bo
*.id[*].[2183313275@qq.com].Devos
*.id-*.[stopen@firemail.cc].stop
*.id-*.[grdoks@tutanota.com].rajar
*.ragnar_44027CDE
*.heronpiston
*.himr
*.happythreechoose
*.lockbit
*.adv
*.abiyq
*.lasan
*.Huy
*.alka
*.repp
*.R2D2
*.ENCRYPTED_RSA
*.live
*.Email=[Honeylock@protonmail.com]ID=[*].odveta
*.id-*.[05250lock@tutamail.com].*
*.*.[lucky_top@protonmail.com].Devos
*.cryptopatronum@protonmail.com.enc
*.npsg
*.un1que
*.2NEW
*.ragnarok
*.btos
*.wrar
*.*.[help.me24@protonmail.com].Z9
*.TRSomware[is_back__New-Algorithm__By_MaMo434376]
*.*.[theblackarrow@tuta.io].devil
*.al1b1nal1
*.devon
*.fmk-ta3-7ym
*.locker16
*.nlocker
Ransom*Software*.exe
*.topi
*.reha
*.rams1
*.vacv2
*.stub
*.nosu
*.kodc
*.payload
*.sivo
*.picocode#8523
*.id-467C780C.[bitlocker@foxmail.com].wiki
*.ebal
*.njkwe
*.2heRi1
*.missing
*.Deniz_kizi
*.rag2hdst
*.id[*-2261].[kusachi@cock.li].Adair
*.hj36MM
*.id-*.[sumpterzoila@aol.com].harma
*.bitpy
*.5ss5c
*.[nochanse@tuta.io].aleta
*.horsedeal
*.ADHUBLLKA
*.ekans
*.grinch
*.jenkins
*.Indonesia.Cyborg
*.Mkos
*.Cl0p
*.c0hen
*.happy new year
*.DMR
*.somik1
*.bablo
*.2DA-1FF-401
*.clown+
*.slank
*.BDDY
*.cuba
*.WannaScream
*.*.[decryptfiles@qq.com].Devon
*.devil
*.[*][getdataback22@protonmail.com].AWT
*.id[*-2396].[theonlyoption@qq.com].Caleb
*.RIDIK
*.icyoaezi
*.dohfzdod
*.zeoticus
*.id[*-2542].[bexonvelia@aol.com].Dever
*.charmant
*.help.Ransom
*.REBL
*.wiki
*.piny
*.redl
*.id-*.[admin@spacedatas.com].ROGER
*.parad1gm
*.Tor+
.dglnl
.ohwqg
.googl
*.59d49
*.Horriblemorning
*.support@anonymous-service.cc.ppdddp
Unusual
*.SaveTheQueenING
*.[ponce.lorena@aol.com]
*.*.[prndssdnrp@mail.fr].deuce
*.zeppelin
*.nbes
*.Deniz_Kızı
*.id-*.[asdbtc@aol.com].asd
*.NEMTY_VFRLXV9
*.ROGER
*.id-*.[MerlinWebster@aol.com].harma
*.bobelectron
*.pysa
*.chch
*.MZ434376
.hets
*.Email=[luciferenc@tutanota.com]ID=[*].odveta
*.Sifrelendi
*.redrum
*.DMR64
*.id-*.[moncler@tutamail.com].redrum
*.TMS5
*.encrypted_backup
*.gesd
*.Rooster865qqZ
*.merl
*.MZ173801
*.MaMo434376
*.righ
*.SpartCript
*.b78vi7v6ri66b
*.hets
*.msop
*.id-*.[backdata.company@aol.com].ROGER
*.p3d374
*.*.[helpnetin@protonmail.com].com
.KRAB
*.id[*].[backcompanyfiles@protonmail.com].Calum
*.TR
*.MMTeam
*.mapo
*.wvtr0
*.BB4-230-*
*.SaveTheQueen
*.[crypto7892@gmx.de].crypto
*.wasted
*.yarraq
*.id[*-2465].[keysfordecryption@airmail.cc].Calum
*.Calum
*.ciphered
*.*.[kenny.sarginson@aol.com].deal
*.zobm
*.2048
*.KAxoAgY
*.*.[decrypt@files.mn].angus
*.cr1
*.ninja
*.SySS
*.kr
*.verschlüsselt
*qibfmkeM5*
*Instraction*
*qweasd*
*@sectex*net*
*@cock.lu*
*.COCKROACH
*.nytom
*.nvram
*.grupothermot3k
*.wctc
*.id-*.[teammarcy10@cock.li].kharma
*.mbed
*.jbptlio
*.grod
*.NEMTY_VFFXXXX
*.id[*-2495].[agent5305@firemail.cc].age
*.nhHtFWV
*.kodg
*.VIRUS
USPS_Delivery.doc
*.abcd
.cr1
*.jc
*.[ID]*[ID]Look
*.ReadTheInstructions
*.peet
*.ABCDEF
*.raldge
*.id-.[hmdjam@protonmail.com].harma
*.id-.[clifieb@tutanota.com].nvram
*.gоod
*.0riz0n
*.id[*-2497].[octopusdoc@mail.ee].octopus
*.Rooster865qq
*.46d7k
*.GodLock
*.NEMTY_*
*.sr0yz
*.m3g4c0rtx
*.ex_parvis@aol.com.AIR
*.octopus
*.7jo22z5m
*.lokf
*.mosk
*.mailto[2Hamlampampom@cock.li].82a80
*.3v3r1s
*.toec
*.meka
*.petra
*.id-.[hobbsadelaide@aol.com].harma
*.g0h8iwj
*.Elder
*.ccryptor
*.sorryforthis
*.sanders4!
*.safe
*.decrypme
*.bot!
*.nakw
*.id-*.[admin@sectex.net].bot
*.bot
*.[cockroach@cock.lu].COCKROACH
*.*locker*
*.Lazarus+!
*.id[*-2387].[gruzudo@cock.li].Barak
svchostt.exe
*.newlock
*.breakingbad
*.boroff
*.[daves.smith@aol.com]
*.hdmr
*.encryptd
*.JayTHL
*.derp
*.info@sharebyy[dot]com
*.info@mymail9[dot]com
*.skynet
*.sapphire
*.bguu
*.tgmn
*.Prt6aV9
*.yq75w627
*.kiss
*.mockba
*.coot
*.acuna
*.cxkdata
*.id-*.[bitlocker@foxmail.com
*.werd
*.sun
*ABAT*INFO*.*
*.calix
!how_to_unlock_your_file.txt
*.nols
*.masked
*.hackdoor
*.money
*.id[*-2266].[decryptbox@airmail.cc].Adair
*.Angus
*.Caley
*.CASH
*@files.mn*
*structsstructs*
structsstructs.exe
FACT. 8-9-1278104.doc
FA_HLEH3S83AO22WO.doc
*.bora
*.proced
*.id[*-*].[butters.felicio@aol.com].deal
*.bwall
*RANSOMED*
msptermthemes.exe
*.mike
*.PO1HG
*.odveta
*.id-*.[admin@fentex.net].money
*.[patern32@protonmail.com].omerta
*.id[*-2275].[checkcheck07@qq.com].Adame
*.CRYZP
*.509a49
*.clean
*.veracrypt
*.leto
*.cobain
hacked.txt
*msptermthemes*
!!!Readme!!!Help!!!.txt
*.onx
*.deal
*ENCx45cR*
*.reco
*.m3ga*
*.m3ga
*.ABAT
*.noos
*.badutclowns
*.D00mEd
*.VIVAL
*.xoza
*.scrcrw
.mike!Ransom
*.Lost_Files_Encrypt
*.muhstik
*.omnisphere
*.kuub
*.Athena865
*.FTCODE
.kuub
*.badday
*.id[*-2423].[hanesworth.fabian@aol.com].dealemail
*.id[*-*].[lockhelp@qq.com].acute
*.LOCKED_PAY
#DECP_README#.rtf
*.m3gac0rtx
*.id[*-2425].[*n*@cock.li].Caley
*@tfwno.gf*
*.id[*-1075].[lewisswaffield.a@aol.com].help
*.Email=[jacdecr@tuta.io]ID=[*].KRONOS
*.KRONOS
*.id[*-1161].[member987@tutanota.com].actin
*tflower*
*.DECP
*.nesa
*.Artemis
HILDACRYPTReadMe.html
*.kci0n
*.shade8
*.pack14
GoRansom.txt
*.id[*-2416].[restorebackup@qq.com].Caley
*.id[*-2315].[decrypt@files.mn].Banks
*.LonleyEncryptedFile
*.karl
*.id_*_.YOUR_LAST_CHANCE!
*.id-*.[payday@tfwno.gf].html
*.id-*.[adm15@pr…
*.id-*.[btcdecoding@qq.com].dqb
*.id[*-1135].[walletwix@aol.com].actin
*.id[*-2242].[Ke…
*.id[*-2275
*.id[*-2275].[supportcrypt2019@cock…
*.id-*.[mr.hacker@tutanota.com].USA
*.id[*-2300].[crysall.g@aol.com].banjo
*.id[*-*].[wewillhelpyou@qq.com].adage
*.id[*-2275].[raynorzlol@tutanota.com].Adame
*.[ID=*2uJ][Mail=letitbedecryptedzi@gmail.com].Lazarus
*.[ID=*][Mail=unlockme123@protonmail.com].Lazar
*.id[*-2252].[eccentric_inventor@aol.com].adage
*.id-*6.[3442516480@qq.com].pdf
*.id[*-2325].[zax4444@qq.com].Banta
*.id-*.[backdatacompany@aol.com].html
*.id[*-2275].[recovermyfiles2019@thesecure.biz].Adame
*.id-*.[vip76@protonmail.com].html
*.id-*.[bitcoin1@foxmail.com].harma
*.id[*-2299].[britt.looper@aol.com].phoenix
*.id-*.[veracrypt@foxmail.com].adobe
*.id[*-2394].[adagekeys@qq.com].Caleb
*.id-*.[partfile@airmail.cc].com
*.id-*.[karlosdecrypt@outlook.com].KARLS
*.id[*-2345].[recoverdata@cock.li].Banta
*.id-*E6.[3442516480@qq.com].pdf
!_Notice_!.txt
chilli.exe
decoder.hta
delog.bat
*.gore
*.id-*.[3442516480@qq.com].pdf
*.[ID]*[ID]
*.id-*.[Harmahelp73@gmx.de].harma
*.PAY
*.lfv77az
*.Barak
*.YDHM
*.domn
*.guarded
*.619-300-6500
*.fuXcF
*.id[C4BA3647-2299].[britt.looper@aol.com].phoenix
*.HCY!!
*.kvag
*.Erenahen
*.Timestamp
*.medsv162
*.hermes837
*.n3xtpharma
*.alanwalkergod@protonmail.com
*._NEMTY_BTKid9H_
*.id-C4BA3647.[fox5sec@aol.com].cmd
*.[rans0me@protonmail.com].b00m
*.1ywsmbo4
*.b00m
*.moka
*.peta
*.BANKS
*.group
*.biz
*.shariz
*.Zeropadypt
*.zorin
*.Apollon865
*.lbkut
*.id[C4BA3647-2301].[hanesworth.fabian@aol.com].banjo
*.ckey(RandomID).email(data1992@protonmail.com).pack14
*.id[C4BA3647-2250].[wewillhelpyou@qq.com].adage
*.ckey(oK5WFfTq).email(data1992@protonmail.com).pack14
*.HILDA
*.id[6AB8ABF5-2346].[limboshuran@cock].banta
*.WAITING
*._NEMTY*
*.id-502F1F51.[mstr.hacker@protonmail.com].KICK
*.dbger
*.BORISHORSE…
*.STOPDATA
*.promoks
*.banta
*.tanos
*.cetori
*.geno
*.try
*.hese
*.O67NG
*.carote
*.686l0tek69
686l0tek69-HOW-TO-DECRYPT.txt
*.gero
*.makkonahi
ryukreadme.html
*.[gustafkeach@johnpino.com].ad
*.lbiaf6c8
*.nemty
*.stare
SGUARD-README.TXT
*.sguard
*.Qtyu8vH5wDXf6OSWAm5NuA==ObcK
*.ObcKIn
*.Lazarus
. vesrato
*.masodas
*.vesrato
*.nuksus
.KARLOS
*.pedro
*.id[********-1161].[member987@tutanota.com].actin
*.{25BF1879-A2DC-B66A-3CCC-XXXXXXXXXXXX}
*.[mr.yoba@aol.com].yoba
*.{Help557@gmx.de}.exe
*.id_*********_.WECANHELP
*.[grethen@tuta.io]
*.2k19
*.nacro
*.Horse4444
*.Tiger4444
*.nasoh
*.coharos
*.mtogas
*.krusop
*.partially.cryptojoker
*.id[C4BA3647-2271].[worldofdonkeys@protonmail.com].BORISHORSE
*.[ID-][].JSWRM
*.BORISHORSE
*.OQn1B
*.rjzR8
*.londec
*.AVco3
*.08kJA
*.Hermes666
*.Acton.id[1AE26935-1085].[hadleeshelton@aol.com].Acton
*.auw2w2g0
*.megacortex
*.id[RandomIP].[bron_lynn@aol.com].help
*.Prandel
*.zatrov
*.Wx7A6
*.syrk
*.brusaf
*.masok
*.junior
*.lotej
*.Novosof
*.sinopal
*@cumallover.me*
*.com2
*.emsisosisoft
*.daris
NEWS_INGiBiToR.txt
*.GRANIT
*.rsalive
*.format
*.bgCIb
*.cosakos
*.nvetud
*.kovasoh
*.nelasod
*.tsv
*.Acuf2
*.mogranos
*.si…
*.Hades666
GNNCRY_Readme.txt
*RT4BLOCK
*.prus
*.a800
*.c300
payload.dll
HOW-TO-DECRYPT-FILES.HTM
*.{XXXXX-EFEE-6C04-D2DC-A9EFA812DD11}!
*.LOVE
[*]-HOW-TO-DECRYPT.txt
#_#ReadMe#_#.rtf
x5gj5_gmG8.log
*.litra
*.TROLL
*.lalabitch
*.ntu
*.TABGH
*.banjo
*.ntuseg
*.[epta.mcold@gmail.com]
*.btchelp@xmpp.jp
*.ndarod
*.sambo
*.WALAN
*.limbo
*.actor
*.bk666
*.azero
.plomb
*.AYE
.id-*.[*@*].air
*.id-*.[*@*].*
*.rencrypted
*.MDRL
*.btix
*.dodoc
*.bopador
*.novasof
.bxtyunh
*.ERIS!
*.lilocked
*.haka
*.Persephone666!
*.megac0rtx
*.Hades666!
.zerofucks
*.darus
*.lurk
*.{XXXXXXX-588E-7D5B-AED1-2CD51808DE12}
*.madekv120
*.sfs
*.todar
*.lapoi
*.madek
*.gusau
*.diller13
*.gehad
*.vusad
*.berosuce
*.budak
*.Adame
*.YOUR_LAST_CHANCE
_RESTORE FILES_.txt
*.[Kromber@tutanota.com]
*.SKYSTARS
*.godes
*.herad
HOW_TO_DECRYPT.txt
*.Pox
*.mo7n
*.shelbyboom
.megac0rtx
.[ogorman.linoel@aol.com].help
*.basilisque@protonmail_com
*.cizer
*.dqb
*.ExpBoot
*.ExpBoot!
*.CROWN!?
*.o$l
*.CROWN
*.WHY…
*.61yhi
*.Acton
*.cezor
*.upd9ykc65v
*.KICK
*.popoticus
*.lokas
*.cs16
*.wav_list
*.cxk_nmsl
*.boooam@cock_li
*.actin
*.besub
*.CAGO
*.litar
*.isolated
*.dcom
*.alilibat
*.Freezing
*.acute
*.1500dollars
*.chekyshka
*.popotic
*.nusar
*.craftul
*.beets!Ransom
*.lotep
*.adage
*.truke
*.Amigo
*.dmo
*.cbs0z
*.dalle
*.hccapx
*.WALAN,
*.cap
*.litra!Sample
*.TROLL,
*.neras
*.DOCM!Sample
*.COPAN
*.middleman2020
*.lcphr!Ransom
*.lcphr
.6vr378txi
*.orion
*.crypted!Sample
*.bliun
*.poof
*.0day
*.horon
*.poop
*.vesad
*.zoh
*.jsworm
JSWORM-DECRYPT.hta
*.gerosan
*.muslat
*.boston
*.myskle
*.pidom
*.euclid
*.heroset
*.pidon
*.kjh
*.ERIS
*.robbinhood
*.[frazeketcham@cnidia.com].eth.hv88g2
*.SONIC
*.luboversova148
*.lanset
*.redmat
*.dodger
*.stone
*.3674AD9F-5958-4F2A-5CB7-F0F56A8885EA
*.harma
*.[randal_inman@aol.com].help
*.rezuc
*.2du1mj8
*.FEROSUS
*.hjgdl
*.2k19sys
*.mogera
*.Hermes
*.skymap
*.[lockhelp@qq.com].gate
*.legacy
*.datun
*.rectot
les#.TXT
*.les#
*.EZDZ
*.open_readme.txt.ke3q
*.ke3q
*.ONYC
*.NHCR
*ymayka-email@yahoo.com.cryptotes
*.[Enigma1crypt@aol.com].ETH
*.[DonovanTudor@aol.com].bat
*.[SSSDKVNSDFITD]
*.Pig4444
*.bmn63
*.[bitcharity@protonmail.com].com
*.[costelloh@aol.com].phoenix
*[remarkpaul77@cock.li].JSWORM
*.[crypt1style@aol.com].MERS
*.n7ys81w
*.jack
*.ge010gic
*.codnet1
.codnat1
*.codnet
.codnat
*.ferosas
RESTORE_HCEEM_DATA.txt
READ_ME.mars
*.hceem
*.vally
*.mars
Instructions with your files.txt
*.refols
*.carcn
*.yum
_CRYPTED_README.html
*.ms13
*.grovat
ReadME-Prodecryptor@gmail.com.txt
*.Mira
*.Prodecryptor
*.+jabber-theone@safetyjabber.com
*.hrosas
!QH24_INFO!.rtf
*.QH24
*.bkc
*.mers
*.wal
*.recry1
*.qbix
*.aa1
*.zoro
Инструкция по расшифровке.TXT
*.kes$
*.condat
*.dotmap
*.4k
*.ge0l0gic_readme.txt
*.mamba
*.ge0l0gic
*.ddos
Locked.*
.PLUT
.jack
HowToBackFiles.txt
DECRYPT-FILES.html
*.non
!!!INSTRUCTION_RNSMW!!!.txt
*.drweb
*.qbtex
*.yG
*.radman
*.[epta.mcold@gmail.com],
!INSTRUCTI0NS!.TXT
*.666decrypt666
*Decryptoroperator@qq.com
*.ztsysjz
*.lockhelp@qq.gate
Decryptyourdata@qq.com
*.[w_unblock24@qq.com].ws
[Lockhelp@qq.com].Gate
*.GGGHJMNGFD
*.OOOKJYHCTVDF
.eth
*.PLUT
*.bufas
*.codnat1
*.codnat
*.fordan
*.[blellockr@godzym.me].bkc
.nampohyu
*.berost
*.forasom
*.{Killback@protonmail.com}KBK
*.fedasot
*.[staRcRypt@tutanota.com].omerta
*.sarut
*.Navi
*.dutan
*.aes128ctr
*.roldat
*.hofos
*.cheetah
*.todarius
*.FREDD
*.Kiratos
*.enc_robbinhood
*.jzphmsfs
*.[zoro4747@gmx.de].zoro
*.verasto
READ_ME.cube
*.sambo,
HELP_BY_CROC.TXT
*.LDPR
warning.txt
*.guesswho
*.moresa
*.burn
*.robinhood
*.COLORIT
*.SAVEYOURDATA
*.aescrypt
_HELP_INSTRUCTIONS_.TXT
*lockhelp@qq.com
*.Ryuk
*.croc
*.norvas
*.[absonkaine@aol.com].phoenix
*.CRABSLKT
*.gotcha
*.cube
*.SDEN
*.obagarmrk
*.tater
*.pumas
*.browec
*.hdeaf
*.guvara
*.tabufa
*.tokog
*.fuchsia
*.etols
*.[velasquez.joeli@aol.com]
*.gate
*.langolier
*.spyhunter
*.cryptoid
*.[adobe-123@tutanota.com].ETH
*.Jumper
*.major
*.raldug
*.phoenix
*.gropas
*.wannacash
*.NGSC
*.bmps@tutanota.com.major
*._Crypted
*.roland
*.NOLOST
*.Marozka
*.encryptedALL
*.stun
*.grovas
*.trosak
*.tronas
*.JLCW2
*.[thedecrypt111@qq.com].ETH
*.drume
*.securityP
*.YYYYBJQOQDU
ENCRYPTED.TXT
*.MDEN
README_LOCKED.txt
README-NOW.txt
*.locker
*.proden
*.CQQUH
*[p4d@tuta.io].com
*.luceq
*.chech
*.[mrpeterson@cock.li].GFS
*.suffer
*.инструкция по оплате.txt
*.metan
*.kezoz
*.luces
*.doples
*.pdf_Axffyq_{babyfromparadise666@gmail.com}.p3rf0rm4
*.pdf.p3rf0rmr
*.{CALLMEGOAT@PROTONMAIL.COM}CMG
*.[amber777king@cock.li].amber
*.L1LL
*.charcl
*.UIK1J
*.kropun
*.jimm
*.klope
*.[payransom@qq.com].adobe
*.jamper
---README---.TXT
*.[w_decrypt24@qq.com].zq
*.Scorpion
*.pulsar1
*.charck
*.kroput1
*.[btccrypthelp@cock.li].ETH
*.[1701222381@qq.com].ETH
*.[decryptprof@qq.com].ETH
*.[decryptmyfiles@qq.com].ETH
*.[helpfilerestore@india.com].ETH
*.[MailPayment@decoder.com].ETH
*.Blower@india.com
*.bRcrypT
*.GILLETTE
*.yatron
*.kroput
*.[plombiren@hotmail.com].plomb
Restore_ICPICP_Files.txt
HOW-TO-RESTORE-FILES.txt
!#_How_to_decrypt_files_$!.txt
_如何解密我的文件_.txt
How to decrypt.txt
*.[help24decrypt@cock.li
*.Neptune
*.{mattpear@protonmail.com}
*.promorad2
*.andymarvin
*.mamasitaq
*.cockista
*.crabs
*.dy8wud
*.[china-decryptor@pm.me]
*.kitty
*.CIOP
*.pfanz
*.jcry
*.evopro
*.{mattpear@protonmail.com}MTP
*.Annabelle2
*.[help24decrypt@cock.li]
*.promock
*.promorad
HOW TO DECRYPT[1T0tO].txt
!_!email__ prusa@goat.si __!..PAYMAN
!SBLOCK_INFO!.rtf
*.Frendi
инструкция по оплате.txt
how_to_recver_files.txt
*.aqva
!#_How_to_decrypt_files_#!
SECURITY-ISSUE-INFO.txt
! ПРОЧТИ МЕНЯ !.html
*.cammora
*.SBLOCK
*.promoz
*.crazy
*.ARTEMY
*.rontok
*.crypt2019
*.[crypted_files@qq.com].aqva
*.BlackPink
*.id.*.crazy
!GBLOCK_INFO.rtf
*.GBLOCK
*.cekisan
*.promos
*.seed
*.jupstb
*.KARLS
!PEDANt_INFO!.rtf
*.mecury
*.PLANT
#HELP-DECRYPT-FCRYPT1.1#.txt
*.infileshop@gmail_com_ID44
*.shadi
*.dedo
*.help24decrypt@qq.com
*.[raphaeldupon@aol.com].ETH
*.PEDANT
*.Encrypted5
*.Gefest3
ClopReadMe.txt
*.frend
*.amber
!!!READ_IT!!!.txt
Readme_Restore_Files.txt
Your files are now encrypted.txt
HOW_TO_DECRYPT_MY_FILES.txt
*.snake4444
*.[drwho888@mail.fr].888
*.FCrypt
*.Clop
*.fastrecovery.xmpp.jp
*.poyvonm
*.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx
*.FileSlack
*.pluto
*.paycoin
*.blower
*.nosafe
*.tuki17@qq.com
*.secure
*.crypted_pony_test_build*
*.YOLO
*.qwex
*.DESYNC
*.crash
*.pennywise
*.888
*.*GEFEST
*adobe.gefest
*.OOFNIK
*.[welesmatron@aol.com].btc
*.Mcafee
*.mbrcodes
*.UNIT09
*.Xcri
*.telebak
*.[buy-decryptor@pm.me]
*.adobee
*.mafee
*.[writehere@qq.com].btc
*.GEFEST
CRYPTOID_*
*.PC-FunHACKED*
TrumpHead.exe
!README_GRHAN!.rtf
*.ppam
*.vaca
*.heets
*.alien
*.SPCT
anatova.txt
anatova.exe
170fb7438316.exe
CallOfCthulhu.exe
*.cripton
*.GMBN
*.ddpcbi
*.[Traher@Dr.Com]
*.2lwnPp2B
*[gomer_simpson2@aol.com].phobos
*._raphaeldupon@aol.com_.btc
*.RENSENWARE
*.rumba
*.AUF
*.Tfudeq
*.tfudet
*.JAMES
*.sdwwbrb
*.ucftz*
*.xcry7684
*.eddldzor
*.hncdumn
*.g^od
*.ezzyl
*.jundmd@cock.li*
*.obfuscated
*.rsucozxze
*.mdk4y
*.GRHAN
*.zzzzzzzz
*.bvjznsjlo
*.sjjpu
*.djuvq
*.djvup
*.djvut
*.djvur
*.djvus
*.uudjvu
*.udjvu
*djvuu
*.tfude
*.tro
*{alexbanan@tuta.io}.CORP
.[ti_kozel@lashbania.tv].*
#RECOVERY_FILES#.txt
*id-.LyaS
$%%! NOTE ABOUT FILES -=!-.html
*__{}.VACv2
*.pdff
*.djvuq
*.INDRIK
*.recovery_email__retmydata@protonmail.com__*_.aes256.testE
*.artilkilin@tuta.io.wq2k
*.recovery_email_[retmydata@protonmail.com]*.aes256
*.vulston
*.SATANA
*[decryptdata@qq.com].rar
*.to.dernesatiko@mail.com.crypted
*.ryx
*.[ti_kozel@lashbania.tv].костя
*.nostro
*.[Unlock24@cock.li].combo
*.mouse
*.snatch
*.bizer
*.tunca
*.[decrypthelper@protonmail.com].phobos
*.locked_by_mR_Anonymous(TZ_HACKERS)
*.ducueyuav
*.oslawcmme
*.Защищено
*.Djvuu
*.PRCP
*.[backtonormal@foxmail.com].adobe
*.WORMCRYPT0R
*.evolution
*.cmsnwned
*.ironhead
*.ktuhzxpi
*.elpvd
*.kali
*.Mercury
*.[avflantuheems1984@aol.com].adobe
*.FJ7QvaR9VUmi
*.gerber5
*.CRYPTR
*.XY6LR
cmdRansomware.*
#RECOVERY_FILES#.*
*.decryptgarranty
_How to restore files.*
_How_To_Decrypt_My_File_.*
*.lucky
*.PERSONAL_ID*
*.garcewa
*.danger
*.israbye
*.[fileslocker@pm.me]
*.greystars@protonmail.com
*.iaufhhhhfiles_BACK_PLS_READ.html
*.iaufhhhfiles_BACK_PLS_READ.html
*.hilegofprencrp
*.wowreadfordecry
*.btc -help-you
*.checkdiskenced
*.iloveworld
*.goforhelp
*.encmywork
*.[parambingobam@cock.li].adobe
*.[mercarinotitia@qq.com].adobe
*.crypted_bizarrio@pay4me_in
*.DeLpHiMoRiX*
*.malwarehunterteam
*.demonslay335_you_cannot_decrypt_me!
*.peosajwqfk
*.online24files@airmail.cc
*.risk
*.[cyberwars@qq.com].war
*.stevenseagal@airmail.cc
*.myjob
*.lolita
*snowpicnic*
*SIMMYWARE*
how to get back you files.txt
*.cccmn
aboutYourFiles.*
*wall.i
#RECOVERY-PC#.*
!-GET_MY_FILES-!.*
@_RESTORE-FILES_@.*
*.Puma
*.[yoursalvations@protonmail.ch].neverdies@tutanota.com
*.kraussmfz
*.PUMAX
*.anami
*.449o43
*.DeLpHiMoRiX!@@@@_@@_@_2018_@@@_@_@_@@@
*.[stopencrypt@qq.com].adobe
*.Enter
*.betta
*.INFOWAIT
*.FIXT
*.fire
*.Horsuke
*.Vapor
*.ispfv
*.Bear
*.EnyBenied
*.BlackHat
*.Epoblockl
*.DATAWAIT
*.010001
*.AUDIT
*.[papillon9275]
*.UKCZA
*.YIAQDG
*.CQXGPMKNR
*.HHFEHIOL
*.GrujaRS
*.xuy
*.crypted034
*.FilGZmsp
*.krzffw
*.impect
*.fast
*.Ox4444
*.6db8
*.PTGEPVEKM
*.adobe
*.JKOUOGVG
*.mariacbc
*.supportfiless24@protonmail.ch
*.SYMMYWARE
*.vendetta2
*.xxxxx
*.CommonRansom
*.crypt888
*.gdb
*.wewillhelp@airmail.cc
*.WAND
*.[everest@airmail.cc].EVEREST
*.FUNNY
*.vanss
*.SANTANA
*.NOT
*.beer
*.SOLO
*.GMPF
*.W0YR8
*.charm
*.birbb
TOTALLYLEGIT.EXE
*.altdelete@cock.li.district
*.ctrlalt@cock.li.district
*.THDA
*.katyusha
*.LGAWPULM
*.[mixon.constantine@aol.com].gamma
*.101
*.zlpzdel
*.junked
*.DQXOO
*.NOBAD
*.garrantydecrypt
*.BAWSUOOXE
*.Kg9EX
*.EMAN50
*.[crab7765@gmx.de].crab
!!!ReadMeToDecrypt.txt
*.qweuirtksd
#README_GMAN#.rtf
!README_GMAN!.rtf
*.GMAN
*.boost
*.ziqzqzdi
52036F92.tmp
*.FFF
*.911
*.2xx9
*.@decrypt_2017
(encrypted)*
*zn2016
#HOW_DECRYPT_FILES#.html
!back_files!.html
*.Bill_Clinton@derpymailorg
*.nWcrypt
*.needkeys
*.YAYA
*.write_on_email
*.needdecrypt
*.0402
*.NIGGA
HOW_DECRYPT_FILES#.html
*.eQTz
*.aRpt
*.3P7m
*.3RNu
*.rpd
*.[oron@india.com].dharma
HOW TO RECOVER ENCRYPTED FILES-infovip@airmail.cc.TXT
READ_TO_DECRYPT.html
*.[embrace@airmail.cc].embrace
*[Beamsell@qq.com].bip
*[files.restore@aol.com].write
#NEWRAR_README#.rtf
Files encrypted.html
*.backup
*[java2018@tuta io].arrow
!OoopsYourFilesLocked!.rtf
*[RELOCK001@TUTA.IO]
*.[btc@fros.cc].btc
How To Restore Files.txt
*.bgtx
Info.hta
FILES ENCRYPTED.txt
*.DHDR4
*.crypted_marztoneb@tutanota_de
YOU_MUST_READ_ME.rtf
*How to Decrypt Files-*.html
*.BaLoZiN
*.RJZUNA
*@LOCKED
*.EMAN
*.firmabilgileri
*-DECRYPT.txt
*.iudgkwv
*.[notopen@countermail.com].NOT_OPEN
ReadMe_Decryptor.txt
!_HOW_RECOVERY_FILES_!.txt
READ__IT.txt
*.f*cked
*-DECRYPT.html
*.[paydecryption@qq.com].brrr
*.spaß
*.olduw
*.yoewy
*.BDKR
*.onlinesupport
*.anonymous
*.bkp
*.ryk
*.skype
*.CHE808
*.parrot
*.monro
*.NOT_OPEN
*.no_more_ransomware
*.gamma
*.brrr
*.Nano
*.ITLOCK
*.SAVEfiles
*.mvp
*.hitler
*.mammon
*.SLAV
*.davilarita@mail.com.yyy0
*[shivamana@seznam.cz].pip
*.KOK08
*.eoeo
*.FASTBOB
*.lockymap
*.NEWRAR
*.cryptoNar
*.partially.cryptoNar
*.PICO
*.CYBERGOD
*.rcrypted
*.kvllyatprotonmaildotch
*.KOK8
*.fsdfsdfsdfsdfsdfsfdsfs
How To Decode Files.hta
*.BadNews
*.cassetto
*.sophos
*.{incredible0ansha@tuta.io}.ARA
*.[backdata@cock.li].CreamPie
*.FuckedByGhost
*.#__EnCrYpTED_BY_dzikusssT3AM_ransomware!__#
*.lockedfile
*.WHY
*.AlfaBlock
# How to Decrypt Files.txt
*-Lock.onion
*.PrOtOnIs.VaNdElIs
*.PrOtOnIs
*.Armage
*.rent
*.fox
*.pleaseCallQQ
*.lockedgood
*.hacked.by.Snaiparul
*.ShutUpAndDance
*.K8VfiZ
*.G8xB
*.cmb
*.b29
*.poolezoor
*.id-*.cmb
*.KEYPASS
*.doubleoffset
*.tedcrypt
!=How_to_decrypt_files=!.txt
*.divine
*.wannacryv2
*.anonimus.mr@yahoo.com
*.dragnea
*.RECOVERYOURFILES
*.invaded
*.incpas
*.BARRACUDA
*.sdk
*.cryptes
*.like
*.ukrain
*.dfjhsalfhsakljfhsljkahfdjklashfdjklh
*.black007
*.combo
*.adapaterson@mail.com.mkmk
*0nl1ne*
*.locked.zip
*.boris
*.powerfuldecrypt
*.predator
*.XERO
*.HYENA
*.BD.Recovery
*.zzz12
*king_ouroboros*
*.dyaaghemy
*.[firmabilgileri@bk.ru]
*.DATASTOP
*.thunder
*.LanRan*
*.deep
*.TaRoNiS
*.desu
*.SHRUG2
*.[thunderhelp@airmail.cc].thunder
*.LanRan2.0.5
*.[dsupport@protonmail.com]
*.jewsomware
*.[Filesreturn247@gmx.de].lock
*.##___POLICJA!!!___TEN_PLIK_ZOSTA
*.animus
*.[evil@cock.lu].EVIL
*.[mrbin775@gmx.de].bin
*.DATA_IS_SAFE_YOU_NEED_TO_MAKE_THE_PAYMENT_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_LOST_FOREVER_PLEASE_BE_REZONABLE_IS_NOT_A_JOKE_TIME_IS_LIMITED
*.XVNAW
*.24H
*.[eV3rbe@rape.lol].eV3rbe
*.SHRUG
*.KUAJW
*.[btc2018@tutanota.de].meduza
*.coder007@protonmail.com
*[qmqtt@protonmail.ch].HRM
*[qrrqtt@protonmail.ch].HRM
*.choda
*.ransomcrypt
FILES.TXT
*.nozelesn
*.KRAB
*.Aurora
*.bomber
*.BtcKING
*.CyberSCCP
*.ssimpotashka@gmail.com
*.PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_to_make_the_payment
*@cock.email
*.recme
*.king_ouroboros*
*.omerta
*.[XAVAX@PM.ME].omerta
*.donut
*.volcano
*.jungle@anonymousspechcom
*.Alkohol
*.oneway
*.ONYX
*.fastsupport@xmpp.jp
*.BIG4+
*.leen
*.horsuke@nuke.africa
*.DiskDoctor
*.qnbqw
*.ssananunak1987@protonmail.com.b2fr
*.codyprince92@mail.com.ovgm
*.fastrecovery@airmail.cc
*.reycarnasi1983@protonmail.com.gw3w
*.billingsupp
*.ndpyhss
*.SF
*.digiworldhack@tutanota.com
RESTORE-SIGRUN.*
*id-*.BI_ID
*.cryptgh0st
*.emilysupp
*.RedEye
*.AdolfHitler
*.crybrazil
*.infovip@airmail.cc
*.REBUS
filesinfo.txt
!!!!RESTORE_FILES!!!.txt
*.insta
*.CONTACTUS
*.osk
*.[pain@cock.lu].pain
*.embrace
Decoding help.hta
*.karne
*.setimichas1971@protonmail.com.b4wq
*.decodeme666tutanota_com
*.josep
*.decodeme666@tutanota_com
*.cdrpt
*.SEPSIS
*.ransomed@india.com
*.sigrun
*.booknish
*.bip
*.[Sepsis@protonmail.com].SEPSIS
*.MTXLOCK
*.RansomAES
*.PAUSA
*.hac
*.[BaYuCheng@yeah.net].china
*.UselessFiles
*.GrAnoSinSa
*.rand
HOW DECRIPT FILES.hta
*.kcwenc
*.mich
*.OBLIVION
*.cryptfile
*.BlackRouter
*.pay2me
*.Satyr
*.sorry
*.tron
*.sky
*.NMCRYPT
*@tutanota.com]
*@tuta.io]
*.Horros
*.LolSec
Perfect.sys
*.d3g1d5
*.excuses
*.cock.email
*.MOLE66
*.*.sell
UselessDisk.exe
*.EGG
*.JFCWF
wormDll*.dll
ScreenLocker_x86.dll
SsExecutor_x86.exe
Spreader_x86.dll
tabDll*.dll
Zenis-*.*
*.xwz
*.Stinger
0000-SORRY-FOR-FILES.html
READ_ME_HELP.png
READ_ME_HELP.txt
*.[restorehelp@qq.com].java
*.FRS
Zenis-Instructions.html
*.[batmanbitka1@cock.li].arena
*.koreaGame
*.improved
*.[volcano666@tutanota.de].volcano
*@adsoleware.com*
*.kwaaklocked
_XiaoBa_Info_.hta
*.XiaoBa
*.cypher
*.bananaCrypt
*BlockBax*
ownertrust.txt
qwerty-pub.key
*.igza4c
*.Nutella
*.[everbe@airmail.cc].everbe
*.Sil3nt5pring
*.Crab
*.jodis
*.jes
*.Bitconnect
*.arrow
*.contact-me-here-for-the-key-admin@adsoleware.com
*.leenapidx
*.creeper
*.Encrypted[BaYuCheng@yeah.net].XiaBa
*.styver
*.leenapidx@snakebite.com.hrhr
*.YOU-ARE-FUCKED-BY-BALILUWARE-(CODED-BY-HEROPOINT)
*.frmvrlr2017
*.SUSPENDED
Restore Files.TxT
*.ANNABELLE
*.messenger-*
*.[ID62133703]
*.nazcrypt
*.THANATOS
*.ransomwared
*.saturn
*.干物妹！
*.happyness
*[ignatevv330@gmail.com].java
*fuga139gh@dr.com*
*.Tornado
*.david
*.defender
*.blank
matrix-readme.rtf
WhatHappenedWithFiles.rtf
WhatHappenedWithMyFiles.rtf
Readme-Matrix.rtf
#_#WhatWrongWithMyFiles#_#.rtf
*_[LINERSMIK@NAVER.COM][JINNYG@TUTANOTA
*.honor
*.twist
*ReadMe_Decryptor.txt
.[decryptor@cock.li].dcrtr
*.blackruby
*.justice
*.adam
*...Files-Frozen-NEED-TO-MAKE-PAYMENT…
*.[GuardBTC@cock.li].java
*.bunny
*.lockme
*.DREAM
*.same
*.write
*.b89b
*.GDCB
*.[decrypthelp@qq.com].java
*.block
*.DEUSCRYPT
*.notfoundrans
*.howcanihelpusir
*.happenencedfiles
*.AreYouLoveMyRansFile
*.country82000
*.insane
*.qwerty
*.LOCKED_BY_pablukl0cker
*.[insane@airmail.cc].insane
*.velso
*.[stopstorage@qq.com].java
*.[bacon@oddwallps.com].java
*.PLANETARY
*.CryptWalker
*.Infinite
*.[satan2018@protonmail.com].java
*.LTML
*.[decodingfiles@tuta.io].java
*.kryptonite
*.Server
*.leon
*.vrmrkz
*.1btc
*.[Bas_ket@aol.com].java
*.id-02B52D6C.[Bas_ket@aol.com].java
*.sysdown
*.gigahertz
*.rapid
*.triple_m
*.info
*.weapologize
*.tastylock
*.blind2
*.STOP
*.wtf
*.[supp01@arimail.cc].napoleon
*.File
*.[pain@onefinedstay.com].java
*.godra
*.maniac
*.VENDETTA
*.[Hardcorrr@protonmail.com].java
*.[Hardcorr@protonmail.com].java
*.satan
*.fix
*.GORILLA
*.CHRISTMAS
*.[slaker@india.com]*.wallet
*.492
*.Cyclone
*.katipuneros
*.styx
*.RDWF
*.wmfxdqz
*.Work
*.noblis
*.DS335
*.[skeleton@rape.lol].skeleton
*.e4m
*.encencenc
*.executioner
*.CerBerSysLocked0009881
*.spider
*.[blind@cock.li].blind
*.0wn3dyou
*.Frivolity
*.lime
*.[paradisecity@cock.li].arena
_READ_ME_FOR_DECRYPT.txt
*.[amagnus@india.com].wallet
*.eTeRnItY
*.bit
*.dxjay
*.dwbiwty
*.xhspythxn
*.fbuvkngy
*.RansomMine
*.MTC
*.napoleon
*.dlenggrl
*.TEST
*.GOTYA
*.maxicrypt
*.[maxicrypt@cock.li].maxicrypt
*.encrptd
*.vpgvlkb
*.areyoulovemyrans
*.shadow
*.[suupport@protonmail.com].scarab
*.cock.li
*.aajf
*.iGotYou
*.Ipcrestore
*.PHOBOS
*.fairytail
*.fucku
*.basslock
*.wdie
*.wsmile
*.wndie
*.0000
*.RASTAKHIZ
*.PANDA
*.BIG1
*.TRUE
*.am
*.kill
*.kimchenyn
*.XZZX
*.fat32
*.##ENCRYPTED_BY_pablukl0cker##
*aes_ni_gov
*.aes_ni
*.bloked
*.cripted
*.filesfucked
*.cryptx*
*.how_to_recover*.*
*.help_restore*.*
*.restore_fi*.*
*.ukr.net*
*.qq_com*
Wo_sind_meine_Dateien.htm*
*.fake
*.cobra
*].block
!!!GetBackData!!!.txt
*.HRM
*.skvtb
*.game
*.Losers
*.gr3g
*.oni
*.sinta
*.libbywovas@dr.com.gr3g
*.xiaoba33
*.xiaoba32
*.xiaoba31
*.xiaoba30
*.xiaoba29
*.xiaoba28
*.xiaoba27
*.xiaoba26
*.xiaoba25
*.xiaoba24
*.xiaoba23
*.xiaoba22
*.xiaoba21
*.xiaoba20
*.xiaoba19
*.xiaoba18
*.xiaoba17
*.xiaoba16
*.xiaoba15
*.xiaoba14
*.xiaoba13
*.xiaoba12
*.xiaoba11
*.xiaoba10
*.xiaoba9
*.xiaoba8
*.xiaoba7
*.xiaoba6
*.xiaoba5
*.xiaoba4
*.xiaoba3
*.xiaoba2
*.XiaoBa1
*.XiaoBa34
*.colecyrus@mail.com.b007
allcry_upx.exe
*-PLIIKI.txt
dispci.exe
cscc.dat
infpub.dat
LEIA_ME.txt
*.lordofshadow
*.SaherBlueEagleRansomware
*.[MAXVISION@SECMAIL.PRO].CRIPTOGRAFADO
!____________DESKRYPT@TUTAMAIL.COM________.rar
How_Decrypt_Files.hta
*.Ordinal
*.aes!
READ_ME_FOR_DECRYPT_*.txt
*.ihsdj
*.kgpvwnr
*.LIN
*.CHAK
*.Chartogy
*.viiper
*.x1881
*.stroman
*.asasin
*.BUGWARE
*.SENRUS17
!! RETURN FILES !!.txt
*.loveransisgood
*.PayDay
*.allcry
*.lockd
*.PRIVAT66
*.SHARK
005-DO-YOU-WANT-FILES.html
*.#
*.CyberSoldiersST
*.wyvern
*.technicy
*.cyberdrill
*.ZW
*.myransext2017
*.ykcol
*.XmdXtazX.
*.albertkerr94@mail.com.m5m5
*.cryptojoker
*.Doxes
*.XmdXtazX
*.blind
*.Locked_file
*.HeroesOftheStorm
*.dian
*.mind
*.H_F_D_locked
*.reaGAN
*.INCANTO
*.pablukCRYPT
*.gocr
*.revolution
*.disposed2017
*.armadilo1
*.trevinomason1@mail.com.vsunit
*.[Brazzers@aolonline.top].arena
_RECoVERY_+*.*
*.__dilmaV1
*.hacked
*.[assistance@firemail.cc].nuclear
READ_THIS_FILE_1.TXT
*.pnr
*.{ljspqk7@aol.com}.BRT92
*.ILLNEST
*.OhNo!
*.akira
*..txt
*.3nCRY
*.clinTON
RESTORE_INFO-*.txt
*.BUSH
*.[black.world@tuta.io].nuclear
*.CryptedOpps
*.crypt12
*.OTR
Important_Read_Me.txt
*.JezRoz
*.UNLIS
*.granny
*.shinigami
*.PA-SIEM
*.flat
TUTORIEL.bmp
*.xolzsec
*.Flux
*.Blocked2
*.wooly
*.nuclear
*.area
*.EMPTY
*.arena
lukitus.html
*.zuzya
*.{saruman7@india.com}.BRT92
*.CYRON
*.#Locky
*.ERROR
*.EV
*.lokitus
*.lukitus-tiedostopäätettä
*.fmoon
*.cesar
*.lukitus
*.KK
*.prosperous666
*.[actum_signum@aol.com].onion
*.encrypted[Payfordecrypt@protonmail.com]
*.enc
*.anubi
*.D2550A49BF52DFC23F2C013C5
*.LEGO
*.Cerber_RansomWare@qq.com
*.0x009d8a
*.3301
*.ZABLOKOWANE
*.pabluklocker
*.cezar
*.cnc
*.trump
*.Crypton
*.rumblegoodboy
*.BONUM
*.[cho.dambler@yandex.com]
diablo6-*.htm
*.DIABLO6
*.PEDO
*.HELLO
*.ACTUM
*.OGONIA
*.WAmarlocked
!## DECRYPT FILES ##!.txt
*.nopasaran
*.gryphon
ebay-msg.html
ebay_was_here
*.ebay
*.491
*.mtk118
*.490
*.shutdown57
*.PIRATE
*.wxdrJbgSDa
*.sea
*.PLIN
*.726
*.SEVENDAYS
*.nemesis
*.ocean
*.rose
*.[avalona.toga@aol.com].blocking
*.Node0
*.supported2017
RECOVER-FILES.html
READ_ME_ASAP.txt
_iWasHere.txt
!!!SAVE YOUR FILES!.bmp
!!!!!SAVE YOUR FILES!!!!.txt
@decrypt_your_files.txt
HowToDecryptIMPORTANT!.txt
*.WINDOWS
*.bbqb
*.725
*.DG
*.Srpx
*.freefoam
*.MyChemicalRomance4EVER
*.extension.srpx
*.fuck_you_av_we_are_not_globe_fake
*.BRT92
*.qwqd
IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
*.TGIF
*.snake
*.MOLE03
*.MOLE04
*.Petya
*.HAPP
*.bam!
*.Atom
*.GOTHAM
*.skunk
*.symbiom_ransomware_locked
*.CK
*.HUSTONWEHAVEAPROBLEM@KEEMAIL.ME
*.yl
*.ZAYKA
*.NOOB
*.crptd
Instruction for file recovery.txt
*.[mich78@usa.com]
*.Reyptson
*.explorer
*.au1crypt
*.s1crypt
*.alosia
*.korea
*.POHU
*.Ransed
*.EXTE
_HELP_INSTRUCTION.TXT
*.Malki
*.707
*.A604AF9070
*.scorpio
*id-*_[*@*.*].*
*.Cry128
*.Cry36
*.Cry9
*.xz
*.readme_txt
Ransom.rtf
*.OXR
*.acc
*.MOLE01
*.3ncrypt3d
*.AZER
_INTERESTING_INFORMACION_FOR_DECRYPT.TXT
*.dcry
*.MOLE00
*.LoveYou
*.z3r0
*.4x82N
*.63vc4
*.BELGIAN_COCOA
RESTORE-.-FILES.txt
*.moments2900
*.0x004867
*.MMM
*.rat
*.aleta
*.ranrans
*.lalabitch,
*.gankLocked
*.ipygh
*.via
dllhost.dat
FE04.tmp
027cc450ef5f8c5f653329641ec1fed9*.*
petwrap.exe
*.lamo
File_Encryption_Notice.txt
*.suppose666
*.mention9823
*.breeding123
*.sux
*.cfm
*.Wana Decrypt0r Trojan-Syria Editi0n
Paxynok.html
*.pscrypt
*.a990
Tempimage.jpg
*.Tesla
WannaCry.TXT
*.kuntzware
*.nsmf
*.Facebook
*.pizdosik
*.[resque@plague.desi].scarab
*.sux.AES128
*.cspider
*.[teroda@bigmir.net].masterteroda@bigmir.net
*.zbt
*.MOLE02
your_key.rsa
OkuBeni.txt
*@*.blocking
*.ogre
*.tax
StrutterGear.exe
ReadMe_Important.txt
Sifre_Coz_Talimat.html
*.whycry
!READ.htm
!_ИНСТРУКЦИЯ_!.txt
*.cr020801
*.cerber6
*.netn6
*.rnsmwre
*.ghost
*.scarab
IF_YOU_WANT_TO_GET_ALL_YOUR_FILES_BACK_PLEASE_READ_THIS.TXT
*.R4bb0l0ck
*.TraNs
#HOW_TO_UNRIP#.txt
*.BeethoveN
* .tdelf
*.spectre
mood-ravishing-hd-wallpaper-142943312215.jpg
Blooper.exe
SintaLocker.exe
SintaRun.py
*.switch
*.payforunlock
HOW TO RECOVER ENCRYPTED FILES.TXT
README_FOR_DECRYPT.txt
*.dolphin
*.dviide
*.sVn
*.R3K7M9
*.BMCODE
*.zilla
*.RaaS
*.resurrection
*.lost
*.ram
*.master
*.brickr
READ_DECRYPT_FILES.txt
*.ramen
*.TRMT
*.gommemode
*.andonio
*.phantom
*.r3store
Read me for help thanks.txt
*.imsorry
help_to_decrypt.txt
*.YYTO
*.read_to_txt_file.yyto
*.beep
*.666
AArI.jpg
*.crying
*.antihacker2017
*.theworldisyours
*.spora
*.sexy
*.realfs0ciety@sigaint.org.fs0ciety
*.pays
*.payrms
*.paymts
*.paymrss
*.paym
*.lol
*.madebyadam
*.locklock
*.lcked
*.kyra
*.kernel_time
*.kernel_pid
*.kernel_complete
*.ifuckedyou
*.grt
*.crypte
*.cbu1
*-webmafia@asia.com_donald@trampo.info
*.beef
*.write_us_on_email
*.LIGHTNING
*.xfile
DECRYPTION.TXT
*.oled
*.wtdi
*.4rwcry4w
*.Encrypted_By_VMola.com
*.wlu
Restore_maysomware_files.html
*.maysomware
*.damoclis
*.decrypter@tutanota.com
*.VisionCrypt
*.pwned
how_to_back_files.html
*.hNcrypt
*.~xdata~
*.b0ff
Galaperidol.exe
HOW_CAN_I_DECRYPT_MY_FILES.txt
*.xdata
Hello There! Fellow @kee User!.txt
*.kee
*.grux
Restore_your_files.txt
READ_ME.html
*.mordor
*.die
*.SaMsUnG
!#_DECRYPT_#!.inf
*.nuke55
*.onyon
*.blocked
!Please Read Me!.txt
!WannaDecryptor!.exe.lnk
*.DARKCRY
*.wincry
*.wncrypt
WannaCrypt 4.0.exe
t.wry
*.vCrypt1
*.theva
tor.exe
tasksche.exe
wcry.zip
taskhsvc.exe
taskse.exe
taskdl.exe
*.pky
*.eky
wcry.exe
Wannacry.exe
@WanaDecryptor@.*
*.slvpawned
*.WCRYT
*.WRNY
*.LOCKED.txt
*.wncryt
*.wnry
*.viki
RESTORE-12345-FILES.TXT
*.donation1@protonmail.ch.12345
*.block_file12
*.@decrypt2017
*.vdul
*.2cXpCihgsVxB3
*.son
loptr-*.htm
*.paycyka
*.medal
*.bagi
@Please_Read_Me@.txt
*.wncry
_!!!_README_!!!_*
_!!!_README_!!!_*_.hta
_!!!_README_!!!_*_ .txt
*.news
*.corrupted
HOW_TO_DECRYPT_FILES.html
*.shifr
DECRYPT_INFO.txt
*.FailedAccess
Cversions.2.db
*.helppme@india.com.*
ReadME_Decrypt_Help_*.html
*.fartplz
* .vCrypt1
*.xncrypt
*.Lockify
*.htrs
*.cryptowin
*.owned
*.x0lzs3c
*.UIWIX
*.CRYPTOBOSS
*.loptr
*.jaff
*.bitkangoroo
*.cloud
zcrypt.exe
*.uk-dealer@sigaint.org
*_luck
*.decrypt2017
*.[admin@hoist.desi].*.WALLET
*.[crysis@life.com].*.WALLET
*.[SHIELD0@USA.COM].*.WALLET
#_RESTORING_FILES_#.TXT
*.haters
*.anon
*.amnesia
*.keepcalm
*.MIKOYAN
RESTORE_FILES.HTML
*.WWW
*.CRYPTED000007
*.HELPPME@INDIA.COM.ID83994902
HOW_RETURN_FILES.TXT
*.MAYA
*.CONTACT_TARINEOZA@GMAIL.COM
*.CRYPTOBYTE
*.AES
NOTE;!!!-ODZYSKAJ-PLIKI-!!!.TXT
INSTRUCTION_FOR_HELPING_FILE_RECOVERY.txt
*.ADR
*.NM4
DesktopOsiris.*
OSIRIS-*.*
redchip2.exe
*.LOLI
ATLAS_FILES.txt
*.whatthefuck
*.loveyouisreal
*.okokokokok
*.ranranranran
READ_IT_FOR_GET_YOUR_FILE.txt
*.psh
*.GETREKT
!!! READ THIS - IMPORTANT !!!.txt
*.aes_ni_0day
*.JEEPERS
PAYMENT-INSTRUCTIONS.TXT
*.LOCKOUT
*.ATLAS
*.FLATCHER3@INDIA.COM.000G
*.AES-NI
*.DEXTER
*.CONFICKER
*.ONION
*.[NO.TORP3DA@PROTONMAIL.CH].WALLET
*.LCKD
*.MOLE
*.RANSOM
*.lambda.l0cked
009-READ-FOR-DECCCC-FILESSS.html
_READ_THI$_FILE_*
*.I'WANT MONEY
*.gembok
!Decrypt-All-Files-*.txt
*.[GOFMEN17@YA.RU],CRP
*.SERP
*.kilit
0_HELP_DECRYPT_FILES.HTM
HUR_DEKRYPTERA_FILER.html
HUR_DEKRYPTERA_FILER.txt
*.LAMBDA.LOCKED
*.ADMIN@BADADMIN.XYZ
*.SKJDTHGHH
*.LOCK75
*.B10CKED
*.A95436@YA.RU
*.IWANT
*.Fuck_You
Recupere seus arquivos aqui.txt
READ TO UNLOCK FILES.salsa.*.html
*.SALSA222
*.NUMBERDOT
How Decrypt My Files.lnk
How_Decrypt_My_Files
*.CRADLE
*.ID-7ES642406.CRY
READ ME ABOUT DECRYPTION.txt
*.Do_not_change_the_file_name.cryp
*.pr0tect
*.android
*_READ_THIS_FILE_*_*
*.btcware
*drakosho_new@aol.com*
*.AngleWare
*.zorro
*.CIFGKSAFFSFYGHD
*.A9V9AHU4
*.payfordecrypt
OKU.TXT
ZINO_NOTE.TXT
*.ZINO
*.kirked
*.CRPTXXX
HOW_TO_FIX_!.TXT
*.[BRAINCRYPT@INDIA.COM].BRAINCRYPT
*.pizdec
*.REVENGE
!!!READ_TO_UNLOCK!!!.TXT
*.openforyou@india.com
*.warn_wallet
*.nemo-hacks.at.sigaint.org
*.MATRIX
Crytp0l0cker.Upack.dll
Crytp0l0cker.dll
Crytp0l0cker.exe
decrypted_files.dat
padcryptUninstaller.exe
PadCrypt.exe
Vape Launcher.exe
READ_ME_!.txt
*.enjey
Aescrypt.exe
*.GG
*.[PINGY@INDIA.COM]
*.WORMKILLER@INDIA.COM.XTBL
*.CEBER3
IF_WANT_FILES_BACK_PLS_READ.html
*.iaufkakfhsaraf
_HELP_HELP_HELP_*
zXz.html
*.zXz
VictemKey_*_*
HVORDAN_DU_GENDANNER_FILER.html
HVORDAN_DU_GENDANNER_FILER.txt
HELP_ME_PLEASE.txt
!_RECOVERY_HELP_!.txt
PLEASE-READIT-IF_YOU-WANT.html
*.filegofprencrp
COME_RIPRISTINARE_I_FILE.*
fattura_*.js
*_steaveiwalker@india.com_
COMO_ABRIR_ARQUIVOS.txt
*info@kraken.cc_worldcza@email.cz
*.kr3
COMO_RESTAURAR_ARCHIVOS.txt
COMO_RESTAURAR_ARCHIVOS.html
*.ENCR
*.[File-Help@India.Com].mails
damage@india.com*
*.tmp.exe
What happen to my files.txt
*.jeepdayz@india.com
*.BarRax
*.damage
*.locked-*
*.jey
*.CRYPTOSHIEL
*.cfk
ASSISTANCE_IN_RECOVERY.txt
#_DECRYPT_ASSISTANCE_#.txt
*.lfk
_HELP_HELP_HELP_*.hta
_HELP_HELP_HELP_*.jpg
BTC_DECRYPT_FILES.txt
*.TheTrumpLockerp
*.TheTrumpLockerf
*.d4nk
*.x3mpro
READ-READ-READ.html
*.weencedufiles
*.jse
*.powned
[KASISKI]*
INSTRUCCIONES.txt
@_USE_TO_FIX_*.txt
*.happydayzz
*.hasp
001-READ-FOR-DECRYPT-FILES.html
DECRYPT_INFORMATION.html
Rans0m_N0te_Read_ME.txt
email-vpupkin3@aol.com*
*.hnyear
*.hnumkhotep@india.com.hnumkhotep
*.wowwhereismyfiles
*.decryptional
*.wowreadfordecryp
*.7zipper
*.youransom
*.gui
*.Harzhuangzi
*.encryptedyourfiles
*HERMES
[amanda_sofost@india.com].wallet
*.wcry
*.velikasrbija
*.razarac
*.serpent
*.msj
*.szesnl
_DECRYPT_INFO_szesnl.html
000-IF-YOU-WANT-DEC-FILES.html
*.evillock
*.letmetrydecfiles
*.yourransom
*.lambda_l0cked
*.gefickt
*.HakunaMatata
*.CRYPTOSHIELD
*.weareyourfriends
MERRY_I_LOVE_YOU_BRUCE.hta
How decrypt files.hta
unCrypte@outlook.com*
decipher_ne@outlook.com*
*.potato
*.otherinformation
*.vxLock
*.rdmk
*.paytounlock
TRY-READ-ME-TO-DEC.html
EMAIL_*_recipient.zip
*.sage
*garryweber@protonmail.ch
LEER_INMEDIATAMENTE.txt
*.killedXXX
*.doomed
*.sifreli
*.MERRY
000-No-PROBLEM-WE-DEC-FILES.html
*.noproblemwedecfiles
WE-MUST-DEC-FILES.html
*.powerfulldecrypt
*.stn
*bingo@opensourcemail.org
*.id-3044989498_x3m
*.x3m
READ_ME_TO_DECRYPT_YOU_INFORMA.jjj
*.wuciwug
*.kencf
*.file0locked
file0locked.js
CryptoRansomware.exe
*.VBRANSOM
_HELP_Recover_Files_.html
*.oops
*.deria
*.RMCM1
*.Locked-by-Mafia
*.кибер разветвитель
*-filesencrypted.html
decrypt_Globe*.exe
*.hnumkhotep
DecryptFile.txt
*.L0CKED
NFS-e*1025-7152.exe
firstransomware.exe
HELP-ME-ENCED-FILES.html
*.helpmeencedfiles
*EdgeLocker*.exe
*.edgel
*.XBTL
*.firecrypt
YOUR_FILES_ARE_DEAD.hta
*.MRCR1
*.PEGS1
*.RARE1
*.airacropencrypted!
*[cryptsvc@mail.ru].*
WHERE-YOUR-FILES.html
*.Whereisyourfiles
*opentoyou@india.com
C-email-*-*.odcodc
*.maktub
*.hush
*.bript
_*_README.hta
_*_README.jpg
HOW_OPEN_FILES.hta
*.gangbang
GJENOPPRETTING_AV_FILER.html
GJENOPPRETTING_AV_FILER.txt
!!! HOW TO DECRYPT FILES !!!.txt
*.braincrypt
INSTRUCTION RESTORE FILE.TXT
*.lesli
Survey Locker.exe
!!!!!ATENÇÃO!!!!!.html
Receipt.exe
WindowsApplication1.exe
HWID Lock.exe
VIP72.exe
DALE_FILES.TXT
*.DALE
*.8637
*.kok
HOW_TO_RESTORE_YOUR_DATA.html
*.paymrts
*.paymds
RESTORE_CORUPTED_FILES.HTML
READ@My.txt
Cyber SpLiTTer Vbs.exe
*.flyper
000-PLEASE-READ-WE-HELP.html
*.helpdecrypt@india.com
*.VforVendetta
popcorn_time.exe
*.filock
*.wallet
*_.rmd
*.uDz2j8mv
OSIRIS-*.htm
DesktopOsiris.htm
*[cryptservice@inbox.ru]*
*.no_more_ransom
bahij2@india.com
*.lovewindows
*.osiris
*.R.i.P
Important!.txt
!_HOW_TO_RESTORE_*.txt
HOW_TO_RESTORE_FILES.txt
_README_*.hta
*.Zzzz
*[lavandos@dr.com].wallet
*.coin
*.crypted_file
*.EncrypTile
*.hcked
_README_.hta
Runsome.exe
Payment_Advice.mht
lblBitcoinInfoMain.txt
lblFinallyText.txt
lblMain.txt
*.hannah
*.vindows
How to decrypt your files.jpg
How to decrypt your files.txt
How to get data back.txt
*.zycrypt
*.sgood
*.zzzzz
xort.txt
DOSYALARINIZA ULAŞMAK İÇİN AÇINIZ.html
HOWTO_RECOVER_FILES_*.TXT
HELP_RESTORE_FILES_*.TXT
Recovery+*.html
Recovery+*.txt
_H_e_l_p_RECOVER_INSTRUCTIONS+*.png
_H_e_l_p_RECOVER_INSTRUCTIONS+*.html
help_recover_instructions+*.html
help_recover_instructions+*.BMP
_how_recover+*.html
_how_recover+*.txt
ThxForYurTyme.txt
_HOW_TO_Decrypt.bmp
_RECOVER_INSTRUCTIONS.ini
###-READ-FOR-HELLPP.html
rtext.txt
DECRYPTION INSTRUCTIONS.txt
decrypt explanations.html
_WHAT_is.html
_HOWDO_text.html
readme_liesmich_encryptor_raas.txt
_Adatok_visszaallitasahoz_utasitasok.txt
How to restore files.hta
locked.bmp
README_TO_RECURE_YOUR_FILES.txt
Your files encrypted by our friends !!!.txt
ATTENTION.url
@WARNING_FILES_ARE_ENCRYPTED.*.txt
README!!!.txt
# README.hta
!Recovery_*.html
YourID.txt
recover.bmp
recover.txt
README HOW TO DECRYPT YOUR FILES.HTML
READ_IT.txt
*.lock93
*.!emc
*.adk
svchosd.exe
*.aesir
*.CHIP
*.happy
*.angelamerkel
*.razy1337
*.zendr4
*.dharma
*.locked3
*.duhust
*.exploit
*_crypt
*_help_instruct*.*
*!DMAlock*
*.GSupport3
*.rnsmwr
*.dCrypt
ransomed.html
*.Alcatraz
*_WHAT_is.html
readme.hta
*.96e2
*.thor
*.dxxd
*.usr0
*.shit
*.coded
*.raid10
*.realfs0ciety*
*.rip
*.okean*
*.globe
*.nuclear55
*.1txt
*.kostya
*.k0stya
*.comrade
*.exotic
*.fuck
*.Yakes
*.Zimbra
email-salazar_slytherin10@yahoo.com.ver-*.id-*-*.randomname-*
*._AiraCropEncrypted!
README_RECOVER_FILES_*.txt
README_RECOVER_FILES_*.png
README_RECOVER_FILES_*.html
*.~HL*
Sarah_G@ausi.com___*
*.zc3791
*.venusp
*.shino
*.bleepYourFiles
*.crashed
*.amba
*.7h9r
*.已加密
*.암호화됨
*.b5c6
*.ap19
*.a19
_*_HOWDO_text.html
*_HOWDO_text.bmp
*_HOWDO_text.html
*.odin
*.zypto*
zzzzzzzzzzzzzzzzzyyy
zycrypt.*
*decrypt your file*.*
*_nullbyte*
*.bart
*.axx
_H_e_l_p_RECOVER_INSTRUCTIONS+*.txt
HOW-TO-DECRYPT-FILES.HTML
HOW_TO_DECRYPT.HTML
exit.hhr.obleep
UnblockFiles.vbs
README_DECRYPT_HYDRA_ID_*.txt
DECRYPT_Readme.TXT.ReadMe
Decrypt All Files *.bmp
HowDecrypt.gif
HELP_YOURFILES.HTML
HOW TO DECRYPT FILES.HTML
BUYUNLOCKCODE
BitCryptorFileList.txt
*.crjocker
*.POSHKODER
*.hydracrypt_ID_*
*.CTBL2
*.unbrecrypt_ID_*
*.padcrypt
*.rekt
*.CCCRRRPPP
*.SecureCrypte
*.windows10
*.pdcr
*.keybtc@inbox
*.breaking_bad
*.cryptowall
*.xorist
*.crypt1
How_to_decrypt_your_files.jpg
How_to_restore_files.hta
*.cerber3
*.a5zfn
*.purge
*.fantom
*.cerber2
!readme.*
Como descriptografar seus arquivos.txt
*.C0rp0r@c@0Xr@
*.domino
*cerber2
*.cawwcca
how_to_unlock*.*
!Recovery_*.txt
Read_this_file.txt
*.legion
*.encoderpass
*.cryptolocker
*.7z.encrypted
ATTENTION!!!.txt
HELP_DECRYPT.lnk
how to decrypt aes files.lnk
restore_files.txt
HowDecrypt.txt
$RECYCLE.BIN.{*-*-*-*}
*.heisenberg
*.breaking bad
*.razy
*.Venusf
.~
*.payfornature@india.com.crypted
winclwp.jpg
wie_zum_Wiederherstellen_von_Dateien.txt
tox.html
strongcrypt.bmp
qwer2.html
qwer.html
pronk.txt
paycrypt.bmp
maxcrypt.bmp
how_decrypt.gif
how to get data.txt
help_recover_instructions*.txt
help_recover_instructions*.html
help_recover_instructions*.bmp
help-file-decrypt.enc
enigma_encr.txt
enigma.hta
default432643264.jpg
default32643264.bmp
decypt_your_files.html
de_crypt_readme.txt
de_crypt_readme.html
de_crypt_readme.bmp
cryptinfo.txt
crjoker.html
_how_recover*.txt
_how_recover*.html
_Locky_recover_instructions.bmp
_H_e_l_p_RECOVER_INSTRUCTIONS*.txt
_H_e_l_p_RECOVER_INSTRUCTIONS*.png
_H_e_l_p_RECOVER_INSTRUCTIONS*.html
_HELP_instructions.txt
_HELP_instructions.bmp
_DECRYPT_INFO_*.html
Your files encrypted by our friends !!! txt
Your files are locked !.txt
Your files are locked !!.txt
Your files are locked !!!.txt
Your files are locked !!!!.txt
YOUR_FILES_ARE_LOCKED.txt
YOUR_FILES_ARE_ENCRYPTED.TXT
YOUR_FILES_ARE_ENCRYPTED.HTML
YOUGOTHACKED.TXT
UNLOCK_FILES_INSTRUCTIONS.txt
UNLOCK_FILES_INSTRUCTIONS.html
SIFRE_COZME_TALIMATI.html
SHTODELATVAM.txt
Read Me (How Decrypt) !!!!.txt
RESTORE_FILES_*.txt
RESTORE_FILES_*.*
READ_THIS_TO_DECRYPT.html
README_HOW_TO_UNLOCK.TXT
README_HOW_TO_UNLOCK.HTML
README_DECRYPT_UMBRE_ID_*.txt
README_DECRYPT_UMBRE_ID_*.jpg
README_DECRYPT_HYRDA_ID_*.txt
READ ME FOR DECRYPT.txt
READ IF YOU WANT YOUR FILES BACK.html
Payment_Instructions.jpg
ONTSLEUTELINGS_INSTRUCTIES.html
OKSOWATHAPPENDTOYOURFILES.TXT
MENSAGEM.txt
KryptoLocker_README.txt
Instructionaga.txt
ISTRUZIONI_DECRITTAZIONE.html
INSTRUCTIONS_DE_DECRYPTAGE.html
INSTRUCCIONES_DESCIFRADO.html
INSTALL_TOR.URL
IMPORTANT.README
IMPORTANT READ ME.txt
Howto_RESTORE_FILES.html
How to decrypt your data.txt
How to decrypt LeChiffre files.html
Help Decrypt.html
Hacked_Read_me_to_decrypt_files.html
HOW_TO_UNLOCK_FILES_README_*.txt
HOW_TO_RESTORE_FILES.html
HOW_DECRYPT.URL
HOW_DECRYPT.TXT
HOW_DECRYPT.HTML
HOWTO_RECOVER_FILES_*.*
HOW TO DECRYPT FILES.txt
HELP_YOUR_FILES.html
HELP_YOUR_FILES.PNG
HELP_TO_SAVE_FILES.bmp
HELP_RESTORE_FILES_*.*
HELP_DECRYPT.URL
HELP_DECRYPT.PNG
HELP_DECRYPT.HTML
GetYouFiles.txt
File Decrypt Help.html
FILES_BACK.txt
ENTSCHLUSSELN_HINWEISE.html
DecryptAllFiles*.txt
DESIFROVANI_POKYNY.html
DECRYPT_YOUR_FILES.txt
DECRYPT_YOUR_FILES.HTML
DECRYPT_ReadMe1.TXT
DECRYPT_INSTRUCTIONS.html
DECRYPT_INSTRUCTION.URL
DECRYPT_INSTRUCTION.HTML
DECRYPTION_HOWTO.Notepad
Comment débloquer mes fichiers.txt
BUYUNLOCKCODE.txt
AllFilesAreLocked*.bmp
4-14-2016-INFECTION.TXT
*_ryp
*_HELP_instructions.html
*.xcrypt
*.unavailable
*.szf
*.porno.pornoransom
*.plauge17
*.neitrino
*.kimcilware.locked
*.iwanthelpuuu
*.herbst
*.helpdecrypt@ukr.net
*.h3ll
*.gws.porno
*.fuckyourdata
*.encrypted.locked
*.cryptz
*.crypttt
*.cripttt
*.criptokod
*.criptiko
*.btc.kkk.fun.gws
*.aga
*._ryp
*.Where_my_files.txt
*.Read_Me.Txt
*.RSplited
*.KEYZ.KEYH0LES
*.How_To_Get_Back.txt
*.How_To_Decrypt.txt
*.Contact_Here_To_Recover_Your_Files.txt
*.31392E30362E32303136_*
# DECRYPT MY FILES #.vbs
# DECRYPT MY FILES #.txt
# DECRYPT MY FILES #.html
!Where_are_my_files!.html
!!!README!!!*.rtf
!!!-WARNING-!!!.txt
!!!-WARNING-!!!.html
*.magic_software_syndicate
*maestro@pizzacrypts.info
*.crypt
*.bitstak
*.wflx
*.CRRRT
howtodecryptaesfiles.txt
!satana!.txt
*.akaibvn
*.cRh8
*.YTBL
*.krypted
*.tzu
*.6FKR8d
*.sshxkej
*.eclr
*.epic
*.paybtcs
*.AFD
*.paymst
*.payms
*.isis
*.zepto
*.bart.zip
*.kratos
*.31342E30362E32303136*
*.SecureCrypted
*.crptrgr
*.rtyrtyrty
!DMALOCK3.0*
*.evil
*.crypt38
*.asdasdasd
*.ded
*.bloccato
*.canihelpyou
*.crypz
decrypt-instruct*.*
*files_are_encrypted.*
*decryptmyfiles*.*
help_instructions.*
*-recover-*.*
de_crypt_readme.*
*!recover!*.*
*recover}-*.*
*rec0ver*.*
_help_instruct*.*
*_recover_*.*
*+recover+*.*
*warning-!!*.*
*decrypt my file*.*
help_file_*.*
recovery+*.*
readme_for_decrypt*.*
install_tor*.*
readme_decrypt*.*
howtodecrypt*.*
howto_restore*.*
how_to_recover*.*
how_recover*.*
how_to_decrypt*.*
how to decrypt*.*
help_restore*.*
help_your_file*.*
help_recover*.*
help_decrypt*.*
decrypt_instruct*.*
cryptolocker.*
*recover_instruction*.*
*.hydracrypt_ID*
*gmail*.crypt
*.cryptotorlocker*
*.xxx
*.xyz
*.xtbl
*.xort
*.xrtn
*.vvv
*.vscrypt
*.trun
*.ttt
*.surprise
*.troyancoder@qq_com
*.sport
*.scl
*.ryp
*.sanction
*.RRK
*.rokku
*.remind
*.relock@qq_com
*.RDM
*.RADAMANT
*.R5A
*.R4A
*.PoAr2w
*.pizda@qq_com
*.p5tkjw
*.oplata@qq_com
*.oshit
*.oor
*.one-we_can-help_you
*.OMG!
*.nochance
*.nalog@qq_com
*.micro
*.LOL!
*.locky
*.locked
*.LeChiffre
*.kraken
*.korrektor
*.kkk
*.kimcilware
*.KEYZ
*.keybtc@inbox_com
*.KEYHOLES
*.justbtcwillhelpyou
*.infected
*.helpdecrypt@ukr_net
*.hb15
*.ha3
*.gruzin@qq_com
*.gws
*.fun
*.fucked
*.enigma
*.encryptedped
*.encryptedRSA
*.encryptedAES
*.Encrypted
*.encrypt
*.encedRSA
*.EnCiPhErEd
*.dyatel@qq_com
*.czvxce
*.darkness
*.ctbl
*.CrySiS
*.CryptoTorLocker2015!
*.crypted
*.cry
*.crjoker
*.crinf
*.crime
*.coverton
*.code
*.clf
*.chifrator@qq_com
*.cerber
*.cbf
*.btcbtcbtc
*.btc-help-you
*.btc
*.bloc
*.better_call_saul
*.AES256
*.{CRYPTENDBLACKDC}
*.73i87A
*.zzz
*.abc
*.aaa
vault.txt
vault.key
recovery_key.txt
vault.hta
message.txt
recovery_file.txt
confirmation.key
enc_files.txt
last_chance.txt
*.vault
*want your files back.*
*.frtrss
*.exx
*.ezz
*.ecc
*help_restore*.*
*how_to_recover*.*
*restore_fi*.*
*ukr.net*
*qq_com*
*keemail.me*
*decipher*
*install_tor*.*
*@india.com*
*@gmail_com_*
*.*obleep
*.*exx
*.*locked
*.*nochance
*.*kraken
*.*kb15
*.*darkness
*.*crypto
*.*cry
_Locky_recover_instructions.txt
help_recover_instructions+*.txt
recoverfile*.txt
Howto_Restore_FILES.TXT
recoveryfile*.txt
_how_recover.txt
howrecover+*.txt
restorefiles.txt
howto_recover_file.txt
HowtoRESTORE_FILES.txt
RECOVERY_FILE*.txt
RECOVERY_FILES.txt
help_decrypt_your_files.html
HELPDECYPRT_YOUR_FILES.HTML
IHAVEYOURSECRET.KEY
SECRET.KEY
SECRETIDHERE.KEY
READTHISNOW!!!.TXT
IAMREADYTOPAY.TXT
HELLOTHERE.TXT
FILESAREGONE.TXT
DECRYPT_ReadMe.TXT
Read.txt
About_Files.txt
_secret_code.txt
ReadDecryptFilesHere.txt
Coin.Locker.txt
HOW_TO_DECRYPT_FILES.TXT
DECRYPT_INSTRUCTION.TXT
encryptor_raas_readme_liesmich.txt
Help_Decrypt.txt
YOUR_FILES.url
How_To_Recover_Files.txt
YOUR_FILES.HTML
INSTRUCCIONES_DESCIFRADO.TXT
DECRYPT_INSTRUCTIONS.TXT
HELP_TO_SAVE_FILES.txt
DecryptAllFiles.txt
HELP_RECOVER_FILES.txt
HELP_RESTORE_FILES.txt
HELP_TO_DECRYPT_YOUR_FILES.txt
HELP_YOUR_FILES.TXT
HELPDECRYPT.TXT
*.CTB2
*.SUPERCRYPT
*.magic
*.1999
*.toxcrypt
*.bleep
*.0x0
*.good
*.R16M01D05
*.pzdc
*.XRNT
*.crypto
*.ccc
*.da_vinci_code
*.payransom
*.KEYH0LES
oor.*
*.zyklon
*.zcrypt
*.Z81928819
*.Silent
*.RSNSlocked
*.RAD
*.porno
*.pornoransom
*.odcodc
_ryp
*.helpdecrypt@ukr*.net
*.only-we_can-help_you
*.cryp1
*.fileiscryptedhard
*.blocatto
*.8lock8
*.777