├── scripts ├── __load__.zeek └── check-for-ransomware-filenames.zeek ├── zkg.meta ├── LICENSE ├── download-list.py ├── README.md └── inputs └── fsrm_patterns_for_zeek.tsv /scripts/__load__.zeek: -------------------------------------------------------------------------------- 1 | @load ./check-for-ransomware-filenames.zeek 2 | -------------------------------------------------------------------------------- /zkg.meta: -------------------------------------------------------------------------------- 1 | [package] 2 | description = Watch SMB transactions for files whose filename matches patterns known to be used by ransomware 3 | script_dir = scripts 4 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Copyright (c) 2019, Corelight, Inc. All rights reserved. 2 | 3 | Redistribution and use in source and binary forms, with or without 4 | modification, are permitted provided that the following conditions are 5 | met: 6 | 7 | (1) Redistributions of source code must retain the above copyright 8 | notice, this list of conditions and the following disclaimer. 9 | 10 | (2) Redistributions in binary form must reproduce the above copyright 11 | notice, this list of conditions and the following disclaimer in 12 | the documentation and/or other materials provided with the 13 | distribution. 14 | 15 | (3) Neither the name of Corelight nor the names of any contributors 16 | may be used to endorse or promote products derived from this 17 | software without specific prior written permission. 18 | 19 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 | "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 | LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 22 | A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 23 | OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 24 | SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 25 | LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 26 | DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 27 | THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 28 | (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 29 | OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 30 | -------------------------------------------------------------------------------- /download-list.py: -------------------------------------------------------------------------------- 1 | import requests 2 | import json 3 | 4 | # URL that the search patterns are hosted at 5 | url = "https://fsrm.experiant.ca/api/v1/combined" 6 | filename = "inputs/fsrm_patterns_for_zeek.tsv" 7 | 8 | # Download the (JSON-formatted) list 9 | try: 10 | print("Getting %s" % url) 11 | response = requests.get(url) 12 | except: 13 | print("Failed to get %s" % url) 14 | quit(1) 15 | 16 | # Read the list into a JSON object 17 | try: 18 | print("Parsing JSON response") 19 | json_structure = json.loads(response.text) 20 | except: 21 | print("Error parsing JSON") 22 | quit(1) 23 | 24 | # Open the output file 25 | try: 26 | print("Opening output file %s" % filename) 27 | outfile = open(filename, "w+") 28 | except: 29 | print("Error opening output file %s" % filename) 30 | quit(1) 31 | 32 | # Add the header information 33 | try: 34 | print("Writing header to file") 35 | outfile.write("#fields" + "\t" + "index" + "\t" + "rw_pattern" + "\n") 36 | except: 37 | print("Error writing header to file") 38 | quit(1) 39 | 40 | # Prep the index 41 | index = 0 42 | 43 | # Iterate through the list of filters (patterns) 44 | try: 45 | print("Writing filters to output file") 46 | for filter in json_structure["filters"]: 47 | # Escape certain literals []? in the string, because Paraglob 48 | # uses them to break up the strings into meta-words 49 | filter = filter.replace("[", "\[") 50 | filter = filter.replace("]", "\]") 51 | filter = filter.replace("?", "\?") 52 | # Hack to deal with one of the records that has an unexpected \n in it 53 | for filter2 in filter.split("\n"): 54 | # Write out the reformatted filter as a new line in the file 55 | outfile.write(str(index) + "\t" + filter2 + "\n") 56 | index += 1 57 | except: 58 | print("Failed to write filters to output file") 59 | quit(1) 60 | 61 | # Close the file 62 | try: 63 | print("Closing output file") 64 | outfile.close() 65 | except: 66 | print("Failed to close output file") 67 | quit(1) 68 | 69 | quit(0) 70 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Detect Ransomware Filenames 2 | 3 | This package/script watches SMB transactions to look for known bad filenames 4 | that ransomware is known to use. It rides on top of the Anti-Ransomware File 5 | System Resource Manager Lists maintained [here](https://fsrm.experiant.ca/). 6 | 7 | ## How to use 8 | 9 | A Python script (`download-list.py`) is included to be able to refresh the 10 | list periodically. By default, it will download the new file to the `inputs/` 11 | folder. 12 | 13 | ## Installing 14 | 15 | This package is available via `zkg`, however since it has two parts (the script 16 | and the input file), it's often better to install it manually. 17 | 18 | ### For Zeek 19 | 20 | For Zeek, place the `scripts/check-for-ransomware-filenames.zeek` script and 21 | `inputs/fsrm_patterns_for_zeek.tsv` files into a directory together, then edit 22 | your `local.zeek` file to add a line like the following: 23 | 24 | `@load /path/to/check-for-ransomware-filenames.zeek` 25 | 26 | ### For Corelight 27 | 28 | For a Corelight appliance, use `zkg` to add this repository to a custom bundle, 29 | with any other custom packages that you want to load. Use `corelight-client` to 30 | install this bundle. 31 | 32 | Then, use `corelight-client` to load the Input file, like so: 33 | 34 | `corelight-client -b bro input upload --name fsrm_patterns_for_zeek.tsv --file fsrm_patterns_for_zeek.tsv` 35 | 36 | ## Sample Output 37 | 38 | The script generates notices like the following: 39 | 40 | ``` 41 | { 42 | "_path": "notice", 43 | "_system_name": "bas-cl-swsensor-01", 44 | "_write_ts": "2020-04-27T21:40:10.494579Z", 45 | "_node": "worker-02", 46 | "ts": "2020-04-27T21:40:10.494579Z", 47 | "uid": "CNhUff2G2TzzRoQi45", 48 | "note": "Ransomware::KnownBadFilename", 49 | "msg": "Detected potential ransomware! Known bad file name: test3.hj36MM in use by client 10.0.2.51 on file server 172.16.4.66", 50 | "src": "10.0.2.51", 51 | "dst": "172.16.4.66", 52 | "peer_descr": "worker-02", 53 | "actions": [ 54 | "Notice::ACTION_LOG" 55 | ], 56 | "suppress_for": 3600 57 | } 58 | ``` 59 | 60 | If/when you get a notice, investigate, ideally as quickly as possible! 61 | 62 | ## License 63 | 64 | Please read the license file [here](./LICENSE) for information about the license 65 | for this software. 66 | -------------------------------------------------------------------------------- /scripts/check-for-ransomware-filenames.zeek: -------------------------------------------------------------------------------- 1 | # @load policy/protocols/smb 2 | 3 | # This script loads a file fsrm_patterns_for_zeek.tsv and then watches SMB file 4 | # transactions to see if any file transactions use any known filenames/patterns 5 | # that are known to be associated with ransomware. 6 | # 7 | # May need to tweak the path of the fsrm_patterns_for_zeek.tsv filename below 8 | # depending on how you're using this. For example, put the script and the tsv 9 | # into /etc/corelight on a software sensor, and adjust the filename below to 10 | # use the absolute path /etc/corelight/fsrm_filenames_for_zeek.tsv 11 | 12 | module checkforransomwarefilenames; 13 | 14 | type Idx: record { 15 | index: count; 16 | }; 17 | 18 | # Value type 19 | type Val: record { 20 | rw_pattern: string; 21 | }; 22 | 23 | export { 24 | redef enum Notice::Type += { 25 | Ransomware::KnownBadFilename 26 | }; 27 | } 28 | 29 | # Initialize table for Input Framework 30 | global ransomware_filename_patterns_table: table[count] of Val; 31 | # Initialize global Paraglob object 32 | global ransomware_filename_patterns_paraglob : opaque of paraglob; 33 | 34 | event zeek_init() 35 | { 36 | Input::add_table([$source="fsrm_patterns_for_zeek.tsv", $name="ransomware_patterns", $idx=Idx, $val=Val, $destination=ransomware_filename_patterns_table, $mode=Input::REREAD]); 37 | # Justin says Input::remove is unnecessary, so taking this out for now 38 | #Input::remove("ransomware_patterns"); 39 | } 40 | 41 | event Input::end_of_data(name: string, source: string) 42 | { 43 | # Skip any files that aren't relevant to this script 44 | if (name != "ransomware_patterns") 45 | return; 46 | 47 | # Now all data is in the table 48 | # Build the vector that will be used to initialize the paraglob structure 49 | 50 | # Initialize vector (for Paraglob) 51 | local ransomware_filename_patterns_vector: vector of string; 52 | # Populate the vector with the records from the table 53 | for (idx in ransomware_filename_patterns_table) 54 | { 55 | ransomware_filename_patterns_vector += ransomware_filename_patterns_table[idx]$rw_pattern; 56 | } 57 | # Initialize the paraglob structure 58 | ransomware_filename_patterns_paraglob = paraglob_init(ransomware_filename_patterns_vector); 59 | } 60 | 61 | # We will use the Files::log_files event to determine when there is a file entry to inspect 62 | event Files::log_files(rec: Files::Info) 63 | { 64 | # Skip any files not in SMB/Windows File Sharing or without filenames 65 | if ( rec$source != "SMB" || !rec?$filename) 66 | return; 67 | 68 | # Test for matches in the paraglob set 69 | local num_matches = |paraglob_match(ransomware_filename_patterns_paraglob, rec$filename)|; 70 | 71 | # Have to test the Zeek version since the files.log changed in v5 72 | # See here: https://docs.zeek.org/en/master/scripts/policy/frameworks/files/deprecated-txhosts-rxhosts-connuids.zeek.html 73 | @if (( Version::info$major >= 5 && Version::info$minor >= 1 ) || ( Version::info$major >= 6 )) 74 | # Handle the v5 files log 75 | # see if there were any matches 76 | if ( num_matches > 0 ) 77 | { 78 | # Handle the alert (Zeek >= 5) 79 | NOTICE([$note=Ransomware::KnownBadFilename, 80 | $msg=fmt("Detected potential ransomware! Known bad file name: %s detected in connection [id.orig_h: %s, id.resp_h: %s, uid: %s]", rec$filename, rec$id$orig_h, rec$id$resp_h, rec$uid), 81 | $src=rec$id$orig_h, $dst=rec$id$resp_h, $uid=rec$uid]); 82 | } 83 | @else 84 | # Handle the v4 and below files log 85 | # see if there were any matches 86 | if ( num_matches > 0 ) 87 | { 88 | if ( rec?$tx_hosts && rec?$rx_hosts ) 89 | { 90 | for (tx_host in rec$tx_hosts) 91 | { 92 | for (cuid in rec$conn_uids) 93 | { 94 | for (rx_host in rec$rx_hosts) 95 | { 96 | NOTICE([$note=Ransomware::KnownBadFilename, 97 | $msg=fmt("Detected potential ransomware! Known bad file name: %s in use by client %s on file server %s", rec$filename, tx_host, rx_host), 98 | $src=tx_host, $dst=rx_host, $uid=cuid]); 99 | } 100 | } 101 | } 102 | return; 103 | } 104 | } 105 | @endif 106 | } 107 | -------------------------------------------------------------------------------- /inputs/fsrm_patterns_for_zeek.tsv: -------------------------------------------------------------------------------- 1 | #fields index rw_pattern 2 | 0 *.covid 3 | 1 *.2spyware 4 | 2 *.vari 5 | 3 *.Zyr 6 | 4 *.AB89 7 | 5 *.xati 8 | 6 *.pandemic 9 | 7 *.Spade 10 | 8 *.cymcrypt 11 | 9 *.*.\[recoverydata@qbmail.biz\].data 12 | 10 *.oonn 13 | 11 *.0.cs 14 | 12 *.0.vb 15 | 13 *.djang0unchain3d 16 | 14 *.week 17 | 15 *.zes 18 | 16 .*AgeLocker 19 | 17 *.1dec 20 | 18 *.nef1lim 21 | 19 *.46orz 22 | 20 *@pm.me* 23 | 21 *.itunes 24 | 22 *.rgnk 25 | 23 *. tcwwasted 26 | 24 *.tcwwasted 27 | 25 *.ZaCaPa 28 | 26 *.id-*\[FileFixer@ProtonMail.com\].LOCKED 29 | 27 *.PPHL 30 | 28 *.tools_ensikology 31 | 29 *.*jalicry* 32 | 30 *.GlUtEzOn.VaNoLe 33 | 31 *.nile 34 | 32 *.MH24 35 | 33 *_out 36 | 34 *.silvertor 37 | 35 *.mechu4Po 38 | 36 *.Ieph0uxo 39 | 37 *.mnbzr 40 | 38 *.deadfiles 41 | 39 *.DECC 42 | 40 *.tcprx 43 | 41 *.RANDOM 44 | 42 *.xienvkdoc 45 | 43 *.kook 46 | 44 *.GARMINWASTED 47 | 45 *.erif 48 | 46 *.pstKll 49 | 47 *.\[sleepme134@gmail.com\]\[ID-*\].Void 50 | 48 *.eduransom 51 | 49 *.RE78P 52 | 50 *.Globeimposter-Alpha865qqz 53 | 51 *.spare 54 | 52 *.dwmapi 55 | 53 *.\[openpgp@foxmail.com\].pgp 56 | 54 *.GlobeimposterAlpha865qqz 57 | 55 *.bbawasted 58 | 56 *.*wasted_info 59 | 57 *.kuus 60 | 58 *.flowEncryption 61 | 59 *.homer 62 | 60 *.\[TorS@Tuta.Io\] 63 | 61 *.beijing 64 | 62 *.rlhwasted_info 65 | 63 *.FastWind 66 | 64 *.52pojie 67 | 65 *.rlhwasted 68 | 66 *.BNFD 69 | 67 *.(*dungeon*-0_0) 70 | 68 *.jwjs 71 | 69 *prnds 72 | 70 *CoronaCrypt* 73 | 71 *SpartCrypt* 74 | 72 *.VinDizelPux 75 | 73 *.GNS 76 | 74 *.AL8P 77 | 75 *.gyga 78 | 76 *.NHLP 79 | 77 *.lxhlp 80 | 78 *.felix 81 | 79 *.prnds 82 | 80 *.bmtf 83 | 81 *.sthd2 84 | 82 *.zbw 85 | 83 *.hacker_decryption@protonmail.ch 86 | 84 *.Drop 87 | 85 *.bado 88 | 86 *.XINOF 89 | 87 *.smpl 90 | 88 *.readme 91 | 89 *.repl 92 | 90 *.Try2Cry 93 | 91 *.repter 94 | 92 *.teamV 95 | 93 *.panther 96 | 94 *.SilentDeath 97 | 95 *.aris 98 | 96 *.maas 99 | 97 *.CryCryptor 100 | 98 *.wholocked 101 | 99 *.*wasted 102 | 100 *.encoded_PL 103 | 101 *.lolkek 104 | 102 *.id-*.\[databack2@protonmail.com\].dtbc 105 | 103 *.RABBIT 106 | 104 *.zida 107 | 105 *.support 108 | 106 *.KoxENy1Wq 109 | 107 *.id-*.\[Recovery@qbmail.biz\].credo 110 | 108 *.pykw 111 | 109 *.team 112 | 110 *._HE 113 | 111 *._HE._LP, 114 | 112 *.CRYPTBD 115 | 113 *.moba 116 | 114 *.crimson 117 | 115 *.jsus 118 | 116 *.CroNi.ZoNe 119 | 117 *.7303yt 120 | 118 *.gomer 121 | 119 *.Email=\[russiawolf09@gmail.com\]ID=\[*\].zip 122 | 120 *.EG83 123 | 121 *.id-*.\[savebase@aol.com\].base 124 | 122 *.\[dungeon\]-0_0 125 | 123 *.vawe 126 | 124 *.20dfs 127 | 125 *.r3f5s 128 | 126 *.mwahah* 129 | 127 *.usam 130 | 128 *.tabe 131 | 129 *.Badboy 132 | 130 *.ESCAL* 133 | 131 *.TELEGRAM 134 | 132 *.EG 135 | 133 *.coka 136 | 134 *.jpg.js* 137 | 135 *.origami 138 | 136 *.mwahahah 139 | 137 *.hck 140 | 138 *.nypd 141 | 139 *.thanos 142 | 140 *.zwer 143 | 141 *.CrYo 144 | 142 *.AG88G 145 | 143 *.ZRB 146 | 144 *.ElvisPresley 147 | 145 *wifi*hacker* 148 | 146 *.avdn 149 | 147 *.club 150 | 148 *.wch 151 | 149 *.nm8kci 152 | 150 *.kkll 153 | 151 *unluckyware* 154 | 152 *.dsec 155 | 153 *.SIGARETA 156 | 154 *.xdrop 157 | 155 *.BOMBO 158 | 156 *.hex911 159 | 157 *.VIVELAG 160 | 158 *.space 161 | 159 *.Fonix 162 | 160 *.nlah 163 | 161 *.unwa 164 | 162 *@*.banks* 165 | 163 *.eight 166 | 164 *.\[*\].bclaw 167 | 165 *.pezi 168 | 166 *.fuckunicorn* 169 | 167 *.vfcfocxph 170 | 168 *.fuckunicornhtrhrtjrj 171 | 169 *.bclaw 172 | 170 .111111 173 | 171 *.bang 174 | 172 *.id-*.\[paybit@aol.com\].payB 175 | 173 *.payB 176 | 174 *.corona-lock 177 | 175 *.biglock 178 | 176 *.covm 179 | 177 *.proL0ck 180 | 178 *.eking 181 | 179 *@rape.lol* 182 | 180 *.M0rphine 183 | 181 *.id-*.\[*@*\].NET 184 | 182 *.\[decryptadmin@protonmail.com\]\[ID-*\].Void 185 | 183 *.0day0 186 | 184 *.cxk 187 | 185 *.dodged 188 | 186 *.pr0Lock 189 | 187 *.xsmb 190 | 188 *.Zekwacrypt 191 | 189 *.ZeroFucks 192 | 190 *.Zenis 193 | 191 *.ZimbraCryptor 194 | 192 *.ZeroRansom 195 | 193 *.ZipLocker 196 | 194 *.Zoldon 197 | 195 *.ZQ 198 | 196 *.ZariqaCrypt 199 | 197 *.YouAreFucked 200 | 198 *.XYZWare 201 | 199 *.XCry 202 | 200 *.XTP 203 | 201 *.Wulfric 204 | 202 *.WonderCrypter 205 | 203 *.WinRarer 206 | 204 *.Winnix 207 | 205 *.WininiCrypt 208 | 206 *.WildFire 209 | 207 *.WhiteRose 210 | 208 *.WhatAFuck 211 | 209 *.Wesker 212 | 210 *.WannaSpam 213 | 211 *.WannaSmile 214 | 212 *.WannaPeace 215 | 213 *.WannaDie 216 | 214 *.WannaCry* 217 | 215 *.Waffle 218 | 216 *.Vurten 219 | 217 *.Vortex 220 | 218 *.VoidCrypt 221 | 219 *.VMola 222 | 220 *.VindowsLocker 223 | 221 *.ViACrypt 224 | 222 *.Venus 225 | 223 *.Venis 226 | 224 *.Vega 227 | 225 *.VaultCrypt 228 | 226 *.V8Locker 229 | 227 *.Uyari 230 | 228 *.UserFilesLocker 231 | 229 *.Useless 232 | 230 *.Unlock92 233 | 231 *.Unlock26 234 | 232 *.Unknown 235 | 233 *.UnblockUPC 236 | 234 *.Ungluk 237 | 235 *.UmbreCrypt 238 | 236 *.Ukash 239 | 237 *.UCCU 240 | 238 *.TurkStatik 241 | 239 *.TrumpLocker 242 | 240 *.TrueCrypter 243 | 241 *.Troldesh 244 | 242 *.Trojan.Encoder.6491 245 | 243 *.TowerWeb 246 | 244 *.TotalWipeOut 247 | 245 *.Torchwood 248 | 246 *.TheDarkEncryptor 249 | 247 *.TheDMR 250 | 248 *.TeslaWare 251 | 249 *.Teslarvng 252 | 250 *.TeslaCrypt 253 | 251 *.Termite 254 | 252 *.TellYouThePass 255 | 253 *.Telecrypt 256 | 254 *.Team XRat 257 | 255 *.T1Happy 258 | 256 *.SZFLocker 259 | 257 *.SystemCrypter 260 | 258 *.SyncCrypt 261 | 259 *.SynAck 262 | 260 *.SuperB 263 | 261 *.SunCrypt 264 | 262 *.Stupid 265 | 263 *.Striked 266 | 264 *.Storm 267 | 265 *.StorageCrypter 268 | 266 *.Stampado 269 | 267 *.SQ_ 270 | 268 *.SpartCrypt 271 | 269 *.Spartacus 272 | 270 *.SoFucked 273 | 271 *.SNSLocker 274 | 272 *.Smrss32 275 | 273 *.SkyFile 276 | 274 *.Skull 277 | 275 *.SintaLocker 278 | 276 *.Simple_Encoder 279 | 277 *.SilentSpring 280 | 278 *.Sigma 281 | 279 *.Shujin 282 | 280 *.ShkolotaCrypt 283 | 281 *.ShivaGood 284 | 282 *.Shigo 285 | 283 *.ShellLocker 286 | 284 *.SFile 287 | 285 *.SerbRansom 288 | 286 *.Seon 289 | 287 *.ScareCrow 290 | 288 *.SatanCryptor 291 | 289 *.Sanctions 292 | 290 *.SamSam 293 | 291 *.Salsa 294 | 292 *.SADStory 295 | 293 *.Sadogo 296 | 294 *.SadComputer 297 | 295 *.SAD 298 | 296 *.Russian EDA2 299 | 297 *.Russenger 300 | 298 *.Ruby 301 | 299 *.RSAUtil 302 | 300 *.RSA2048Pro 303 | 301 *.RSA-NI 304 | 302 *.Roza 305 | 303 *.RotorCrypt 306 | 304 *.RoshaLock 307 | 305 *.Roga 308 | 306 *.REvil 309 | 307 *.RetMyData 310 | 308 *.RenLocker 311 | 309 *.RemindMe 312 | 310 *.Relock 313 | 311 *.Rektware 314 | 312 *.REKTLocker 315 | 313 *.RedBoot 316 | 314 *.RarVault 317 | 315 *.RaRansomware 318 | 316 *.RansomWarrior 319 | 317 *.RansomPlus 320 | 318 *.Ransomnix 321 | 319 *.RansomCuck 322 | 320 *.Rans0m 323 | 321 *.RanRan 324 | 322 *.Ranion 325 | 323 *.RandomLocker 326 | 324 *.Random6 327 | 325 *.Ragnar 328 | 326 *.Radiation 329 | 327 *.RackCrypt 330 | 328 *.RabbitFox 331 | 329 *.RAA-SEP 332 | 330 *.R980 333 | 331 *.QwertyCrypt 334 | 332 *.Quimera 335 | 333 *.QuakeWay 336 | 334 *.QP 337 | 335 *.qkG 338 | 336 *.PyLocky 339 | 337 *.PyL33T 340 | 338 *.PyCL 341 | 339 *.PwndLocker 342 | 340 *.PureLocker 343 | 341 *.PshCrypt 344 | 342 *.Protected 345 | 343 *.ProLock 346 | 344 *.Project57 347 | 345 *.Project34 348 | 346 *.PrincessLocker 349 | 347 *.Pr0tector 350 | 348 *.PPDDDP 351 | 349 *.PowerWare 352 | 350 *.PowerLocky 353 | 351 *.PopCornTime 354 | 352 *.PonyFinal 355 | 353 *.PoisonFang 356 | 354 *.Plague17 357 | 355 *.Pickles 358 | 356 *.PhoneNumber 359 | 357 *.Philadelphia 360 | 358 *.PhantomChina 361 | 359 *.PGPSnippet 362 | 360 *.PewCrypt 363 | 361 *.Petna 364 | 362 *.Pendor 365 | 363 *.PEC 2017 366 | 364 *.PClock 367 | 365 *.PaySafeGen 368 | 366 *.PayPalGenerator2019 369 | 367 *.Paymen45 370 | 368 *.Paradise 371 | 369 *.Ozoza 372 | 370 *.Ouroboros 373 | 371 *.Ordinypt 374 | 372 *.OpJerusalem 375 | 373 *.OpenToYou 376 | 374 *.OnyxLocker 377 | 375 *.Nyton 378 | 376 *.Nx 379 | 377 *.NullByte 380 | 378 *.Nuke 381 | 379 *.NSB 382 | 380 *.NotAHero 383 | 381 *.Nomikon 384 | 382 *.NMoreira 385 | 383 *.Nhtnwcuf 386 | 384 *.NextCry 387 | 385 *.NewHT 388 | 386 *.Netwalker 389 | 387 *.Netix 390 | 388 *.NETCrypton 391 | 389 *.Nemucod 392 | 390 *.NegozI 393 | 391 *.NCrypt 394 | 392 *.NanoLocker 395 | 393 *.n1n1n1 396 | 394 *.Mystic 397 | 395 *.MrDec 398 | 396 *.MoWare 399 | 397 *.MOTD 400 | 398 *.MorrisBatchCrypt 401 | 399 *.MoonCrypter 402 | 400 *.Montserrat 403 | 401 *.MongoLock 404 | 402 *.Mobef 405 | 403 *.MNS 406 | 404 *.Mischa 407 | 405 *.MireWare 408 | 406 *.MirCop 409 | 407 *.Minotaur 410 | 408 *.MindSystem 411 | 409 *.Meteoritan 412 | 410 *.Mespinoza 413 | 411 *.MegaLocker 414 | 412 *.Medusa 415 | 413 *.MCrypt2018 416 | 414 *.Maykolin 417 | 415 *.MauriGo 418 | 416 *.MarsJoke 419 | 417 *.MarraCrypt 420 | 418 *.Marlboro 421 | 419 *.Marduk 422 | 420 *.Maoloa 423 | 421 *.MalwareTech* 424 | 422 *.Magniber 425 | 423 *.MafiaWare 426 | 424 *.MAFIA 427 | 425 *.MadBit 428 | 426 *.LowLevel04 429 | 427 *.LoveServer 430 | 428 *.Lost_Files 431 | 429 *.Lortok 432 | 430 *.LooCipher 433 | 431 *.LonleyCrypt 434 | 432 *.LongTermMemoryLoss 435 | 433 *.LockTaiwan 436 | 434 *.LockerGoga 437 | 435 *.LockedByte 438 | 436 *.Locked-In 439 | 437 *.LockCrypt 440 | 438 *.LockBox 441 | 439 *.Lock2017 442 | 440 *.LMAOxUS 443 | 441 *.LLTP 444 | 442 *.LittleFinger 445 | 443 *.LightningCrypt 446 | 444 *.LambdaLocker 447 | 445 *.Ladon 448 | 446 *.L33TAF 449 | 447 *.KryptoLocker 450 | 448 *.Kriptovor 451 | 449 *.Krider 452 | 450 *.KratosCrypt 453 | 451 *.Kozy.Jozy 454 | 452 *.Kolobo 455 | 453 *.KokoKrypt 456 | 454 *.Kirk 457 | 455 *.KillRabbit 458 | 456 *.KillerLocker 459 | 457 *.KEYHolder 460 | 458 *.KeyBTC 461 | 459 *.Kerkoporta 462 | 460 *.KeRanger 463 | 461 *.KCW 464 | 462 *.KawaiiLocker 465 | 463 *.Kasiski 466 | 464 *.Karo 467 | 465 *.Karmen 468 | 466 *.Karma 469 | 467 *.Kaenlupuf 470 | 468 *.JungleSec 471 | 469 *.JuicyLemon 472 | 470 *.JosepCrypt 473 | 471 *.JoeGo 474 | 472 *.JobCrypter 475 | 473 *.JNEC.a 476 | 474 *.Jigsaw 477 | 475 *.Jemd 478 | 476 *.JeepersCrypt 479 | 477 *.JapanLocker 480 | 478 *.Jager 481 | 479 *.Jack.Pot 482 | 480 *.JabaCrypter 483 | 481 *.Ishtar 484 | 482 *.Iron 485 | 483 *.iRansom 486 | 484 *.InsaneCrypt 487 | 485 *.InfoDot 488 | 486 *.InfinityLock 489 | 487 *.InfiniteTear 490 | 488 *.InducVirus 491 | 489 *.Ims00ry 492 | 490 *.ILElection2020 493 | 491 *.IFN643 494 | 492 *.IEncrypt 495 | 493 *.HydraCrypt 496 | 494 *.Hydra 497 | 495 *.Hucky 498 | 496 *.HPE iLO 499 | 497 *.HolyCrypt 500 | 498 *.HollyCrypt 501 | 499 *.HKCrypt 502 | 500 *.HildaCrypt 503 | 501 *.HiddenTear 504 | 502 *.Heropoint 505 | 503 *.HelpDCFile 506 | 504 *.Help50 507 | 505 *.Hells 508 | 506 *.Heimdall 509 | 507 *.HDDCryptor 510 | 508 *.hc7 511 | 509 *.hc6 512 | 510 *.Halloware 513 | 511 *.Hakbit 514 | 512 *.HadesLocker 515 | 513 *.GX40 516 | 514 *.GusCrypter 517 | 515 *.GPGQwerty 518 | 516 *.GPCode 519 | 517 *.GPAA 520 | 518 *.Gorgon 521 | 519 *.GoRansom 522 | 520 *.Gomasom 523 | 521 *.GoldenEye 524 | 522 *.Golden Axe 525 | 523 *.GoGoogle 526 | 524 *.Globe3 527 | 525 *.GlobeImposter 528 | 526 *.Gibon 529 | 527 *.Gibberish 530 | 528 *.GhostHammer 531 | 529 *.GhostCrypt 532 | 530 *.GetCrypt 533 | 531 *.GermanWiper 534 | 532 *.Gerber 535 | 533 *.GC47 536 | 534 *.GandCrab2 537 | 535 *.GandCrab 538 | 536 *.Galacti-Crypter 539 | 537 *.FuxSocy 540 | 538 *.FunFact 541 | 539 *.FuckSociety 542 | 540 *.FS0ciety 543 | 541 *.FrozrLock 544 | 542 *.FreeMe 545 | 543 *.FLKR 546 | 544 *.Flatcher3 547 | 545 *.FindZip 548 | 546 *.FilesLocker 549 | 547 *.Fenrir 550 | 548 *.FenixLocker 551 | 549 *.FCT 552 | 550 *.FCP 553 | 551 *.Fadesoft 554 | 552 *.Fabiansomware 555 | 553 *.Extractor 556 | 554 *.Extortion Scam 557 | 555 *.Exocrypt XTC 558 | 556 *.ExecutionerPlus 559 | 557 *.Everbe* 560 | 558 *.Eternal 561 | 559 *.Estemani 562 | 560 *.Erica 563 | 561 *.Erebus 564 | 562 *.EnkripsiPC 565 | 563 *.Enjey Crypter 566 | 564 *.Encryptor RaaS 567 | 565 *.EncryptoJJS 568 | 566 *.EncryptedBatch 569 | 567 *.Enc1 570 | 568 *.El Polocker 571 | 569 *.EggLocker 572 | 570 *.EduCrypt 573 | 571 *.EdgeLocker 574 | 572 *.ECLR* 575 | 573 *.eCh0raix 576 | 574 *.eBayWall 577 | 575 *.DynA-Crypt 578 | 576 *.DVPN 579 | 577 *.DryCry 580 | 578 *.DriedSister 581 | 579 *.DoubleLocker 582 | 580 *.DoNotChange 583 | 581 *.Done 584 | 582 *.DoggeWiper 585 | 583 *.DMA Locker* 586 | 584 *.District 587 | 585 *.Dishwasher 588 | 586 *.DirtyDecrypt 589 | 587 *.DilmaLocker 590 | 588 *.Digisom 591 | 589 *.DeriaLock 592 | 590 *.Defray777 593 | 591 *.Defray 594 | 592 *.DEDCryptor 595 | 593 *.DecYourData 596 | 594 *.DecryptIomega 597 | 595 *.DeathRansom 598 | 596 *.DeathNote 599 | 597 *.DeathHiddenTear v2 600 | 598 *.DeathHiddenTear 601 | 599 *.Deadly 602 | 600 *.DCry 2.0 603 | 601 *.Dcrtr 604 | 602 *.DavesSmith 605 | 603 *.DataKeeper 606 | 604 *.DarkoderCryptor 607 | 605 *.Dablio 608 | 606 *.CXK-NMSL 609 | 607 *.CTB-Locker 610 | 608 *.CTB-Faker 611 | 609 *.CSP Ransomware 612 | 610 *.Crystal 613 | 611 *.CryPy 614 | 612 *.CryptXXX 4.0 615 | 613 *.CryptXXX 3.0 616 | 614 *.CryptXXX 2.0 617 | 615 *.CryptXXX 618 | 616 *.CryptoWire 619 | 617 *.CryptoWall 4.0 620 | 618 *.CryptoWall 3.0 621 | 619 *.CryptoWall 2.0 622 | 620 *.CryptoViki 623 | 621 *.CryptoTorLocker 624 | 622 *.CryptoShocker 625 | 623 *.CryptoRoger 626 | 624 *.CryptorBit 627 | 625 *.CryptoPokemon 628 | 626 *.CryptoPatronum 629 | 627 *.CryptoMix Wallet 630 | 628 *.CryptoMix Revenge 631 | 629 *.CryptoMix 632 | 630 *.CryptoLuck 633 | 631 *.CryptoLocky 634 | 632 *.CryptoLockerEU 635 | 633 *.CryptoLocker3 636 | 634 *.CryptoJacky 637 | 635 *.CryptoHitman 638 | 636 *.CryptoHasYou 639 | 637 *.CryptoGod 640 | 638 *.CryptoFortress 641 | 639 *.CryptoFinancial 642 | 640 *.CryptoDevil 643 | 641 *.CryptoDefense 644 | 642 *.CryptInfinite 645 | 643 *.CryptFuck 646 | 644 *.CryptConsole3 647 | 645 *.CryptConsole 648 | 646 *.Crypt0r 649 | 647 *.Crypt0L0cker 650 | 648 *.Crypt0 651 | 649 *.Crypren 652 | 650 *.CrypMic 653 | 651 *.CryLocker 654 | 652 *.CryFile 655 | 653 *.Cryakl 656 | 654 *.Cripton7zp 657 | 655 *.CreamPie 658 | 656 *.CradleCore 659 | 657 *.Cr1ptT0r 660 | 658 *.Cossy 661 | 659 *.CorruptCrypt 662 | 660 *.CoronaVirus 663 | 661 *.Comrade Circle 664 | 662 *.Clouded 665 | 663 *.CoinVault 666 | 664 *.Coin Locker 667 | 665 *.CockBlocker 668 | 666 *.CmdRansomware 669 | 667 *.ClicoCrypter 670 | 668 *.ChineseRarypt 671 | 669 *.ChinaYunLong 672 | 670 *.Chimera 673 | 671 *.ChernoLocker 674 | 672 *.CerberTear 675 | 673 *.Cancer 676 | 674 *.id\[*-*\].\[decphob@tuta.io\].eking 677 | 675 *.DoppelPaymer 678 | 676 *.Bucbi 679 | 677 *.Bubble 680 | 678 *.BTCamant 681 | 679 *.Brazilian Ransomware 682 | 680 *.Booyah 683 | 681 *.BoooamCrypt 684 | 682 *.Blue Blackmail 685 | 683 *.Blooper 686 | 684 *.BlockFile12 687 | 685 *.Blind 2 688 | 686 *.Blackout 689 | 687 *.BlackKingdom 690 | 688 *.BlackHeart 691 | 689 *.Black Shades 692 | 690 *.Black Feather 693 | 691 *.BKRansomware 694 | 692 *.Bitshifter 695 | 693 *.BitPyLock 696 | 694 *.Bitpaymer 697 | 695 *.BitCryptor 698 | 696 *.BitCrypt 2.0 699 | 697 *.BitCrypt 700 | 698 *.Bisquilla 701 | 699 *.BigBobRoss 702 | 700 *.BetaSup 703 | 701 *.BB Ransomware 704 | 702 *.Basilisque Locker 705 | 703 *.Bart v2.0 706 | 704 *.BandarChor 707 | 705 *.BadRabbit 708 | 706 *.BadEncript 709 | 707 *.BadBlock 710 | 708 .restoreserver 711 | 709 *.g8R4rqWIp9 712 | 710 *.C4H 713 | 711 *.cashdashsentme@protonmail.com 714 | 712 *.cov19 715 | 713 *.rbs 716 | 714 *.C1H 717 | 715 *.paradox 718 | 716 *.qensvlcbymk 719 | 717 *.6be31 720 | 718 *.koti 721 | 719 *.B2DR 722 | 720 *.aZaZeL 723 | 721 *.AxCrypter 724 | 722 *.AWT 725 | 723 *.Avest 726 | 724 *.AVCrypt 727 | 725 *.AutoWannaCryV2 728 | 726 *.AutoLocky 729 | 727 *.Atchbo 730 | 728 *.Ataware 731 | 729 *.ASN1 Encoder 732 | 730 *.Arsium 733 | 731 *.ArmaLocky 734 | 732 *.Argus 735 | 733 *.AresCrypt 736 | 734 *.ApolloLocker 737 | 735 *.ApocalypseVM 738 | 736 *.Apocalypse (New Variant) 739 | 737 *.Apocalypse 740 | 738 *.Anubis 741 | 739 *.AnteFrigus 742 | 740 *.Annabelle 2.1 743 | 741 *.AngryDuck 744 | 742 *.Anatova 745 | 743 *.Amnesia2 746 | 744 *.Alpha 747 | 745 *.Alma Locker 748 | 746 *.Alfa 749 | 747 *.mzlq 750 | 748 *.zeronine 751 | 749 *.lock2bits 752 | 750 *.kupidon 753 | 751 *.Lion 754 | 752 *.Al-Namrood 755 | 753 *.Afrodita 756 | 754 *.AES256-06 757 | 755 *.AES-Matrix 758 | 756 *.AES_KEY_GEN_ASSIST 759 | 757 *.AdamLocker 760 | 758 *.ACCDFISA v2.0 761 | 759 *.ABCLocker 762 | 760 *.7ev3n 763 | 761 *.HaCk 764 | 762 *.24H Ransomware 765 | 763 *.4rw5w 766 | 764 *.0kilobypt 767 | 765 *.vcrypt 768 | 766 *.id-*.\[neural.net@tuta.io\].NET 769 | 767 *.\[ID-*\]-\[EMAIL-M0rphine@cock.li\].M0rphine 770 | 768 *.CrYo.TeOnS 771 | 769 *.sqpc 772 | 770 *.NEMTY_AJORCUS 773 | 771 *.trix 774 | 772 *.xraw 775 | 773 *.\[Hichkasam@protonmail.com\]\[ID-*\].Void 776 | 774 *.id-*.\[Helpsir@rape.lol\].LOL 777 | 775 *.zemblax 778 | 776 *.Zv7uN 779 | 777 *.projectzorgo 780 | 778 *.OFFWHITE 781 | 779 *.Id-*.\[filerestory@gmail.com\].Crypto 782 | 780 *.8be1 783 | 781 *.mpal 784 | 782 *.GEnc 785 | 783 *.geminis3 786 | 784 *.pigzqbqnvbu 787 | 785 *.carlos 788 | 786 *.myblacksun@tuta.io 789 | 787 *.rjali@protonmail.ch 790 | 788 *.id-*.\[im.online@aol.com\].love$ 791 | 789 *.love$ 792 | 790 *.jyqji 793 | 791 *.qewe 794 | 792 *.id\[*-2589\].\[backup.iso@aol.com\].iso 795 | 793 *.lote 796 | 794 *.EAIJTP 797 | 795 *.builder 798 | 796 *.dec 799 | 797 *.worcservice@protonmail.ch 800 | 798 *.Boruta 801 | 799 *.dop 802 | 800 *.serpom 803 | 801 *.revon 804 | 802 *.likud 805 | 803 *.CoronaLock 806 | 804 *.corona 807 | 805 *.*_RSA 808 | 806 *.azor 809 | 807 *.lezp 810 | 808 .KEY0004 811 | 809 .dec 812 | 810 *.LSOBKMHG 813 | 811 *.0D34E0 814 | 812 .arrepiante 815 | 813 .SARS-CoV-2 816 | 814 *.ahegao 817 | 815 *.WannaRen 818 | 816 *.mbit 819 | 817 *.Void 820 | 818 *.rhino 821 | 819 *.creepy 822 | 820 *.eject 823 | 821 *.KEY0004 824 | 822 *.SARS-CoV-2 825 | 823 *.lalo 826 | 824 *.Sister 827 | 825 *.Cruel 828 | 826 *.bukyak 829 | 827 *.mpaj 830 | 828 *.~~~~ 831 | 829 *.id-*.\[*\].ccd 832 | 830 *.id\[*\].\[*\].revon 833 | 831 *.JOPE 834 | 832 *.encS 835 | 833 *.id-*.\[supermetasploit@aol.com\].MSPLT 836 | 834 *.NEMTY_VQLGC72 837 | 835 *.ZyNoXiOn 838 | 836 *.Email=\[*\]ID=\[*\].Boruta 839 | 837 *.id-*.\[bitcoin@email.tg\].ncov 840 | 838 *.rogue 841 | 839 *.shinya 842 | 840 *.encryptedbyBB 843 | 841 *.jest 844 | 842 *.NEPHILIM 845 | 843 *.fcfceee 846 | 844 *.miblqugb 847 | 845 *.\[*\].\[*\].makop 848 | 846 *.mado 849 | 847 *.yakuza 850 | 848 *.KENS@TUTA.IO 851 | 849 *.P4WN3D 852 | 850 *.opqz 853 | 851 *.KEKW 854 | 852 *.njmhqbxu 855 | 853 *.\[*\].yakuza 856 | 854 *.\[*\].\[*\].shootlock 857 | 855 *.npsk 858 | 856 *.C-VIR 859 | 857 *.lO8s42 860 | 858 MZReverenge* 861 | 859 *.petruk 862 | 860 *.makop 863 | 861 *Rec0very* 864 | 862 *.iqy 865 | 863 *.remk 866 | 864 *FDFK*INFO* 867 | 865 *.CULEX 868 | 866 *.NEFILIM 869 | 867 *.\[*\].teslarvng 870 | 868 *.ako 871 | 869 *.HR 872 | 870 *.horseleader 873 | 871 *.MZR 874 | 872 *.javalocker 875 | 873 *.javaencrypt 876 | 874 *.daaefc 877 | 875 *.voyager 878 | 876 *.uk6ge 879 | 877 *.ravack 880 | 878 *.a6f2t 881 | 879 *.foop 882 | 880 *.lokd 883 | 881 *.CNMHR 884 | 882 *.id-*.\[*\].rxx 885 | 883 *.FDFK 886 | 884 *.vash 887 | 885 *.kir 888 | 886 *.bigdata 889 | 887 *.id\[*\].*.dewar 890 | 888 *.anon000 891 | 889 *.rezm 892 | 890 *.YKUP 893 | 891 *.sepsys 894 | 892 *.CryptoDarkRubix 895 | 893 *.DEMON 896 | 894 *.China 897 | 895 *.Tsar 898 | 896 *.pxj 899 | 897 *.pwnd 900 | 898 *.brick 901 | 899 *.jerry_glanville_data@aol.com 902 | 900 *.ragnar_* 903 | 901 *.\[paymentbtc@airmail.cc\].Deniz_Kizi 904 | 902 *.0x6A0C8 905 | 903 *.\[*\].\[test@test.tst\].test 906 | 904 *.\[paymentbtc@yahoo.com\].Deniz_Kizi 907 | 905 *.\[*\].\[buydecryptor@cock.li\].makop 908 | 906 *.mew767 909 | 907 *.encryptedL 910 | 908 *.networkmaze 911 | 909 *.coom 912 | 910 *.nppp 913 | 911 *.mool 914 | 912 *.encryptedS 915 | 913 *.iwanttits 916 | 914 *.sfile2 917 | 915 *.Ouchachia 918 | 916 *.id-*.\[black@gytmail.com\].self 919 | 917 *.id\[*-2423\].\[jewkeswilmer@aol.com\].deal 920 | 918 *.ncov 921 | 919 *.blend 922 | 920 *.rajar 923 | 921 *.Rentyr 924 | 922 *.mmnn 925 | 923 *.ooss 926 | 924 *.cripto 927 | 925 *.*.firex3m 928 | 926 *.id-*.\[coronavirus@qq.com\].ncov 929 | 927 *.id\[*-2720\].\[mr.helper@qq.com\].dewar 930 | 928 *.rooe 931 | 929 *.*.*.WHY 932 | 930 *.*.*.dewar 933 | 931 *.ONIX 934 | 932 *.egmwv 935 | 933 *.btHTIb 936 | 934 *.*.parrot 937 | 935 *.razor 938 | 936 *.#ransomwared 939 | 937 *.egmwvm 940 | 938 *kremez* 941 | 939 *.AnubisCrypt 942 | 940 *.desucrpt 943 | 941 *.bboo 944 | 942 *.moncrypt 945 | 943 *.bhacks 946 | 944 *.hellomynameisransom 947 | 945 *.RYK! 948 | 946 *.midwestsurinc 949 | 947 *.eaaeee 950 | 948 *.Devos 951 | 949 *.CONTI 952 | 950 *.abarcy 953 | 951 *.Email=\[MasterFile001@protonmail.com\]ID=\[*\].sorena 954 | 952 *.Iexei8bo 955 | 953 *.id\[*\].\[2183313275@qq.com\].Devos 956 | 954 *.id-*.\[stopen@firemail.cc\].stop 957 | 955 *.id-*.\[grdoks@tutanota.com\].rajar 958 | 956 *.ragnar_44027CDE 959 | 957 *.heronpiston 960 | 958 *.himr 961 | 959 *.happythreechoose 962 | 960 *.lockbit 963 | 961 *.adv 964 | 962 *.abiyq 965 | 963 *.lasan 966 | 964 *.Huy 967 | 965 *.alka 968 | 966 *.repp 969 | 967 *.R2D2 970 | 968 *.ENCRYPTED_RSA 971 | 969 *.live 972 | 970 *.Email=\[Honeylock@protonmail.com\]ID=\[*\].odveta 973 | 971 *.id-*.\[05250lock@tutamail.com\].* 974 | 972 *.*.\[lucky_top@protonmail.com\].Devos 975 | 973 *.cryptopatronum@protonmail.com.enc 976 | 974 *.npsg 977 | 975 *.un1que 978 | 976 *.2NEW 979 | 977 *.ragnarok 980 | 978 *.btos 981 | 979 *.wrar 982 | 980 *.*.\[help.me24@protonmail.com\].Z9 983 | 981 *.TRSomware\[is_back__New-Algorithm__By_MaMo434376\] 984 | 982 *.*.\[theblackarrow@tuta.io\].devil 985 | 983 *.al1b1nal1 986 | 984 *.devon 987 | 985 *.fmk-ta3-7ym 988 | 986 *.locker16 989 | 987 *.nlocker 990 | 988 Ransom*Software*.exe 991 | 989 *.topi 992 | 990 *.reha 993 | 991 *.rams1 994 | 992 *.vacv2 995 | 993 *.stub 996 | 994 *.nosu 997 | 995 *.kodc 998 | 996 *.payload 999 | 997 *.sivo 1000 | 998 *.picocode#8523 1001 | 999 *.id-467C780C.\[bitlocker@foxmail.com\].wiki 1002 | 1000 *.ebal 1003 | 1001 *.njkwe 1004 | 1002 *.2heRi1 1005 | 1003 *.missing 1006 | 1004 *.Deniz_kizi 1007 | 1005 *.rag2hdst 1008 | 1006 *.id\[*-2261\].\[kusachi@cock.li\].Adair 1009 | 1007 *.hj36MM 1010 | 1008 *.id-*.\[sumpterzoila@aol.com\].harma 1011 | 1009 *.bitpy 1012 | 1010 *.5ss5c 1013 | 1011 *.\[nochanse@tuta.io\].aleta 1014 | 1012 *.horsedeal 1015 | 1013 *.ADHUBLLKA 1016 | 1014 *.ekans 1017 | 1015 *.grinch 1018 | 1016 *.jenkins 1019 | 1017 *.Indonesia.Cyborg 1020 | 1018 *.Mkos 1021 | 1019 *.Cl0p 1022 | 1020 *.c0hen 1023 | 1021 *.happy new year 1024 | 1022 *.DMR 1025 | 1023 *.somik1 1026 | 1024 *.bablo 1027 | 1025 *.2DA-1FF-401 1028 | 1026 *.clown+ 1029 | 1027 *.slank 1030 | 1028 *.BDDY 1031 | 1029 *.cuba 1032 | 1030 *.WannaScream 1033 | 1031 *.*.\[decryptfiles@qq.com\].Devon 1034 | 1032 *.devil 1035 | 1033 *.\[*\]\[getdataback22@protonmail.com\].AWT 1036 | 1034 *.id\[*-2396\].\[theonlyoption@qq.com\].Caleb 1037 | 1035 *.RIDIK 1038 | 1036 *.icyoaezi 1039 | 1037 *.dohfzdod 1040 | 1038 *.zeoticus 1041 | 1039 *.id\[*-2542\].\[bexonvelia@aol.com\].Dever 1042 | 1040 *.charmant 1043 | 1041 *.help.Ransom 1044 | 1042 *.REBL 1045 | 1043 *.wiki 1046 | 1044 *.piny 1047 | 1045 *.redl 1048 | 1046 *.id-*.\[admin@spacedatas.com\].ROGER 1049 | 1047 *.parad1gm 1050 | 1048 *.Tor+ 1051 | 1049 .dglnl 1052 | 1050 .ohwqg 1053 | 1051 .googl 1054 | 1052 *.59d49 1055 | 1053 *.Horriblemorning 1056 | 1054 *.support@anonymous-service.cc.ppdddp 1057 | 1055 Unusual 1058 | 1056 *.SaveTheQueenING 1059 | 1057 *.\[ponce.lorena@aol.com\] 1060 | 1058 *.*.\[prndssdnrp@mail.fr\].deuce 1061 | 1059 *.zeppelin 1062 | 1060 *.nbes 1063 | 1061 *.Deniz_Kızı 1064 | 1062 *.id-*.\[asdbtc@aol.com\].asd 1065 | 1063 *.NEMTY_VFRLXV9 1066 | 1064 *.ROGER 1067 | 1065 *.id-*.\[MerlinWebster@aol.com\].harma 1068 | 1066 *.bobelectron 1069 | 1067 *.pysa 1070 | 1068 *.chch 1071 | 1069 *.MZ434376 1072 | 1070 .hets 1073 | 1071 *.Email=\[luciferenc@tutanota.com\]ID=\[*\].odveta 1074 | 1072 *.Sifrelendi 1075 | 1073 *.redrum 1076 | 1074 *.DMR64 1077 | 1075 *.id-*.\[moncler@tutamail.com\].redrum 1078 | 1076 *.TMS5 1079 | 1077 *.encrypted_backup 1080 | 1078 *.gesd 1081 | 1079 *.Rooster865qqZ 1082 | 1080 *.merl 1083 | 1081 *.MZ173801 1084 | 1082 *.MaMo434376 1085 | 1083 *.righ 1086 | 1084 *.SpartCript 1087 | 1085 *.b78vi7v6ri66b 1088 | 1086 *.hets 1089 | 1087 *.msop 1090 | 1088 *.id-*.\[backdata.company@aol.com\].ROGER 1091 | 1089 *.p3d374 1092 | 1090 *.*.\[helpnetin@protonmail.com\].com 1093 | 1091 .KRAB 1094 | 1092 *.id\[*\].\[backcompanyfiles@protonmail.com\].Calum 1095 | 1093 *.TR 1096 | 1094 *.MMTeam 1097 | 1095 *.mapo 1098 | 1096 *.wvtr0 1099 | 1097 *.BB4-230-* 1100 | 1098 *.SaveTheQueen 1101 | 1099 *.\[crypto7892@gmx.de\].crypto 1102 | 1100 *.wasted 1103 | 1101 *.yarraq 1104 | 1102 *.id\[*-2465\].\[keysfordecryption@airmail.cc\].Calum 1105 | 1103 *.Calum 1106 | 1104 *.ciphered 1107 | 1105 *.*.\[kenny.sarginson@aol.com\].deal 1108 | 1106 *.zobm 1109 | 1107 *.2048 1110 | 1108 *.KAxoAgY 1111 | 1109 *.*.\[decrypt@files.mn\].angus 1112 | 1110 *.cr1 1113 | 1111 *.ninja 1114 | 1112 *.SySS 1115 | 1113 *.kr 1116 | 1114 *.verschlüsselt 1117 | 1115 *qibfmkeM5* 1118 | 1116 *Instraction* 1119 | 1117 *qweasd* 1120 | 1118 *@sectex*net* 1121 | 1119 *@cock.lu* 1122 | 1120 *.COCKROACH 1123 | 1121 *.nytom 1124 | 1122 *.nvram 1125 | 1123 *.grupothermot3k 1126 | 1124 *.wctc 1127 | 1125 *.id-*.\[teammarcy10@cock.li\].kharma 1128 | 1126 *.mbed 1129 | 1127 *.jbptlio 1130 | 1128 *.grod 1131 | 1129 *.NEMTY_VFFXXXX 1132 | 1130 *.id\[*-2495\].\[agent5305@firemail.cc\].age 1133 | 1131 *.nhHtFWV 1134 | 1132 *.kodg 1135 | 1133 *.VIRUS 1136 | 1134 USPS_Delivery.doc 1137 | 1135 *.abcd 1138 | 1136 .cr1 1139 | 1137 *.jc 1140 | 1138 *.\[ID\]*\[ID\]Look 1141 | 1139 *.ReadTheInstructions 1142 | 1140 *.peet 1143 | 1141 *.ABCDEF 1144 | 1142 *.raldge 1145 | 1143 *.id-.\[hmdjam@protonmail.com\].harma 1146 | 1144 *.id-.\[clifieb@tutanota.com\].nvram 1147 | 1145 *.gоod 1148 | 1146 *.0riz0n 1149 | 1147 *.id\[*-2497\].\[octopusdoc@mail.ee\].octopus 1150 | 1148 *.Rooster865qq 1151 | 1149 *.46d7k 1152 | 1150 *.GodLock 1153 | 1151 *.NEMTY_* 1154 | 1152 *.sr0yz 1155 | 1153 *.m3g4c0rtx 1156 | 1154 *.ex_parvis@aol.com.AIR 1157 | 1155 *.octopus 1158 | 1156 *.7jo22z5m 1159 | 1157 *.lokf 1160 | 1158 *.mosk 1161 | 1159 *.mailto\[2Hamlampampom@cock.li\].82a80 1162 | 1160 *.3v3r1s 1163 | 1161 *.toec 1164 | 1162 *.meka 1165 | 1163 *.petra 1166 | 1164 *.id-.\[hobbsadelaide@aol.com\].harma 1167 | 1165 *.g0h8iwj 1168 | 1166 *.Elder 1169 | 1167 *.ccryptor 1170 | 1168 *.sorryforthis 1171 | 1169 *.sanders4! 1172 | 1170 *.safe 1173 | 1171 *.decrypme 1174 | 1172 *.bot! 1175 | 1173 *.nakw 1176 | 1174 *.id-*.\[admin@sectex.net\].bot 1177 | 1175 *.bot 1178 | 1176 *.\[cockroach@cock.lu\].COCKROACH 1179 | 1177 *.*locker* 1180 | 1178 *.Lazarus+! 1181 | 1179 *.id\[*-2387\].\[gruzudo@cock.li\].Barak 1182 | 1180 svchostt.exe 1183 | 1181 *.newlock 1184 | 1182 *.breakingbad 1185 | 1183 *.boroff 1186 | 1184 *.\[daves.smith@aol.com\] 1187 | 1185 *.hdmr 1188 | 1186 *.encryptd 1189 | 1187 *.JayTHL 1190 | 1188 *.derp 1191 | 1189 *.info@sharebyy\[dot\]com 1192 | 1190 *.info@mymail9\[dot\]com 1193 | 1191 *.skynet 1194 | 1192 *.sapphire 1195 | 1193 *.bguu 1196 | 1194 *.tgmn 1197 | 1195 *.Prt6aV9 1198 | 1196 *.yq75w627 1199 | 1197 *.kiss 1200 | 1198 *.mockba 1201 | 1199 *.coot 1202 | 1200 *.acuna 1203 | 1201 *.cxkdata 1204 | 1202 *.id-*.\[bitlocker@foxmail.com 1205 | 1203 *.werd 1206 | 1204 *.sun 1207 | 1205 *ABAT*INFO*.* 1208 | 1206 *.calix 1209 | 1207 !how_to_unlock_your_file.txt 1210 | 1208 *.nols 1211 | 1209 *.masked 1212 | 1210 *.hackdoor 1213 | 1211 *.money 1214 | 1212 *.id\[*-2266\].\[decryptbox@airmail.cc\].Adair 1215 | 1213 *.Angus 1216 | 1214 *.Caley 1217 | 1215 *.CASH 1218 | 1216 *@files.mn* 1219 | 1217 *structsstructs* 1220 | 1218 structsstructs.exe 1221 | 1219 FACT. 8-9-1278104.doc 1222 | 1220 FA_HLEH3S83AO22WO.doc 1223 | 1221 *.bora 1224 | 1222 *.proced 1225 | 1223 *.id\[*-*\].\[butters.felicio@aol.com\].deal 1226 | 1224 *.bwall 1227 | 1225 *RANSOMED* 1228 | 1226 msptermthemes.exe 1229 | 1227 *.mike 1230 | 1228 *.PO1HG 1231 | 1229 *.odveta 1232 | 1230 *.id-*.\[admin@fentex.net\].money 1233 | 1231 *.\[patern32@protonmail.com\].omerta 1234 | 1232 *.id\[*-2275\].\[checkcheck07@qq.com\].Adame 1235 | 1233 *.CRYZP 1236 | 1234 *.509a49 1237 | 1235 *.clean 1238 | 1236 *.veracrypt 1239 | 1237 *.leto 1240 | 1238 *.cobain 1241 | 1239 hacked.txt 1242 | 1240 *msptermthemes* 1243 | 1241 !!!Readme!!!Help!!!.txt 1244 | 1242 *.onx 1245 | 1243 *.deal 1246 | 1244 *ENCx45cR* 1247 | 1245 *.reco 1248 | 1246 *.m3ga* 1249 | 1247 *.m3ga 1250 | 1248 *.ABAT 1251 | 1249 *.noos 1252 | 1250 *.badutclowns 1253 | 1251 *.D00mEd 1254 | 1252 *.VIVAL 1255 | 1253 *.xoza 1256 | 1254 *.scrcrw 1257 | 1255 .mike!Ransom 1258 | 1256 *.Lost_Files_Encrypt 1259 | 1257 *.muhstik 1260 | 1258 *.omnisphere 1261 | 1259 *.kuub 1262 | 1260 *.Athena865 1263 | 1261 *.FTCODE 1264 | 1262 .kuub 1265 | 1263 *.badday 1266 | 1264 *.id\[*-2423\].\[hanesworth.fabian@aol.com\].dealemail 1267 | 1265 *.id\[*-*\].\[lockhelp@qq.com\].acute 1268 | 1266 *.LOCKED_PAY 1269 | 1267 #DECP_README#.rtf 1270 | 1268 *.m3gac0rtx 1271 | 1269 *.id\[*-2425\].\[*n*@cock.li\].Caley 1272 | 1270 *@tfwno.gf* 1273 | 1271 *.id\[*-1075\].\[lewisswaffield.a@aol.com\].help 1274 | 1272 *.Email=\[jacdecr@tuta.io\]ID=\[*\].KRONOS 1275 | 1273 *.KRONOS 1276 | 1274 *.id\[*-1161\].\[member987@tutanota.com\].actin 1277 | 1275 *tflower* 1278 | 1276 *.DECP 1279 | 1277 *.nesa 1280 | 1278 *.Artemis 1281 | 1279 HILDACRYPTReadMe.html 1282 | 1280 *.kci0n 1283 | 1281 *.shade8 1284 | 1282 *.pack14 1285 | 1283 GoRansom.txt 1286 | 1284 *.id\[*-2416\].\[restorebackup@qq.com\].Caley 1287 | 1285 *.id\[*-2315\].\[decrypt@files.mn\].Banks 1288 | 1286 *.LonleyEncryptedFile 1289 | 1287 *.karl 1290 | 1288 *.id_*_.YOUR_LAST_CHANCE! 1291 | 1289 *.id-*.\[payday@tfwno.gf\].html 1292 | 1290 *.id-*.\[adm15@pr… 1293 | 1291 *.id-*.\[btcdecoding@qq.com\].dqb 1294 | 1292 *.id\[*-1135\].\[walletwix@aol.com\].actin 1295 | 1293 *.id\[*-2242\].\[Ke… 1296 | 1294 *.id\[*-2275 1297 | 1295 *.id\[*-2275\].\[supportcrypt2019@cock… 1298 | 1296 *.id-*.\[mr.hacker@tutanota.com\].USA 1299 | 1297 *.id\[*-2300\].\[crysall.g@aol.com\].banjo 1300 | 1298 *.id\[*-*\].\[wewillhelpyou@qq.com\].adage 1301 | 1299 *.id\[*-2275\].\[raynorzlol@tutanota.com\].Adame 1302 | 1300 *.\[ID=*2uJ\]\[Mail=letitbedecryptedzi@gmail.com\].Lazarus 1303 | 1301 *.\[ID=*\]\[Mail=unlockme123@protonmail.com\].Lazar 1304 | 1302 *.id\[*-2252\].\[eccentric_inventor@aol.com\].adage 1305 | 1303 *.id-*6.\[3442516480@qq.com\].pdf 1306 | 1304 *.id\[*-2325\].\[zax4444@qq.com\].Banta 1307 | 1305 *.id-*.\[backdatacompany@aol.com\].html 1308 | 1306 *.id\[*-2275\].\[recovermyfiles2019@thesecure.biz\].Adame 1309 | 1307 *.id-*.\[vip76@protonmail.com\].html 1310 | 1308 *.id-*.\[bitcoin1@foxmail.com\].harma 1311 | 1309 *.id\[*-2299\].\[britt.looper@aol.com\].phoenix 1312 | 1310 *.id-*.\[veracrypt@foxmail.com\].adobe 1313 | 1311 *.id\[*-2394\].\[adagekeys@qq.com\].Caleb 1314 | 1312 *.id-*.\[partfile@airmail.cc\].com 1315 | 1313 *.id-*.\[karlosdecrypt@outlook.com\].KARLS 1316 | 1314 *.id\[*-2345\].\[recoverdata@cock.li\].Banta 1317 | 1315 *.id-*E6.\[3442516480@qq.com\].pdf 1318 | 1316 !_Notice_!.txt 1319 | 1317 chilli.exe 1320 | 1318 decoder.hta 1321 | 1319 delog.bat 1322 | 1320 *.gore 1323 | 1321 *.id-*.\[3442516480@qq.com\].pdf 1324 | 1322 *.\[ID\]*\[ID\] 1325 | 1323 *.id-*.\[Harmahelp73@gmx.de\].harma 1326 | 1324 *.PAY 1327 | 1325 *.lfv77az 1328 | 1326 *.Barak 1329 | 1327 *.YDHM 1330 | 1328 *.domn 1331 | 1329 *.guarded 1332 | 1330 *.619-300-6500 1333 | 1331 *.fuXcF 1334 | 1332 *.id\[C4BA3647-2299\].\[britt.looper@aol.com\].phoenix 1335 | 1333 *.HCY!! 1336 | 1334 *.kvag 1337 | 1335 *.Erenahen 1338 | 1336 *.Timestamp 1339 | 1337 *.medsv162 1340 | 1338 *.hermes837 1341 | 1339 *.n3xtpharma 1342 | 1340 *.alanwalkergod@protonmail.com 1343 | 1341 *._NEMTY_BTKid9H_ 1344 | 1342 *.id-C4BA3647.\[fox5sec@aol.com\].cmd 1345 | 1343 *.\[rans0me@protonmail.com\].b00m 1346 | 1344 *.1ywsmbo4 1347 | 1345 *.b00m 1348 | 1346 *.moka 1349 | 1347 *.peta 1350 | 1348 *.BANKS 1351 | 1349 *.group 1352 | 1350 *.biz 1353 | 1351 *.shariz 1354 | 1352 *.Zeropadypt 1355 | 1353 *.zorin 1356 | 1354 *.Apollon865 1357 | 1355 *.lbkut 1358 | 1356 *.id\[C4BA3647-2301\].\[hanesworth.fabian@aol.com\].banjo 1359 | 1357 *.ckey(RandomID).email(data1992@protonmail.com).pack14 1360 | 1358 *.id\[C4BA3647-2250\].\[wewillhelpyou@qq.com\].adage 1361 | 1359 *.ckey(oK5WFfTq).email(data1992@protonmail.com).pack14 1362 | 1360 *.HILDA 1363 | 1361 *.id\[6AB8ABF5-2346\].\[limboshuran@cock\].banta 1364 | 1362 *.WAITING 1365 | 1363 *._NEMTY* 1366 | 1364 *.id-502F1F51.\[mstr.hacker@protonmail.com\].KICK 1367 | 1365 *.dbger 1368 | 1366 *.BORISHORSE… 1369 | 1367 *.STOPDATA 1370 | 1368 *.promoks 1371 | 1369 *.banta 1372 | 1370 *.tanos 1373 | 1371 *.cetori 1374 | 1372 *.geno 1375 | 1373 *.try 1376 | 1374 *.hese 1377 | 1375 *.O67NG 1378 | 1376 *.carote 1379 | 1377 *.686l0tek69 1380 | 1378 686l0tek69-HOW-TO-DECRYPT.txt 1381 | 1379 *.gero 1382 | 1380 *.makkonahi 1383 | 1381 ryukreadme.html 1384 | 1382 *.\[gustafkeach@johnpino.com\].ad 1385 | 1383 *.lbiaf6c8 1386 | 1384 *.nemty 1387 | 1385 *.stare 1388 | 1386 SGUARD-README.TXT 1389 | 1387 *.sguard 1390 | 1388 *.Qtyu8vH5wDXf6OSWAm5NuA==ObcK 1391 | 1389 *.ObcKIn 1392 | 1390 *.Lazarus 1393 | 1391 . vesrato 1394 | 1392 *.masodas 1395 | 1393 *.vesrato 1396 | 1394 *.nuksus 1397 | 1395 .KARLOS 1398 | 1396 *.pedro 1399 | 1397 *.id\[********-1161\].\[member987@tutanota.com\].actin 1400 | 1398 *.{25BF1879-A2DC-B66A-3CCC-XXXXXXXXXXXX} 1401 | 1399 *.\[mr.yoba@aol.com\].yoba 1402 | 1400 *.{Help557@gmx.de}.exe 1403 | 1401 *.id_*********_.WECANHELP 1404 | 1402 *.\[grethen@tuta.io\] 1405 | 1403 *.2k19 1406 | 1404 *.nacro 1407 | 1405 *.Horse4444 1408 | 1406 *.Tiger4444 1409 | 1407 *.nasoh 1410 | 1408 *.coharos 1411 | 1409 *.mtogas 1412 | 1410 *.krusop 1413 | 1411 *.partially.cryptojoker 1414 | 1412 *.id\[C4BA3647-2271\].\[worldofdonkeys@protonmail.com\].BORISHORSE 1415 | 1413 *.\[ID-\]\[\].JSWRM 1416 | 1414 *.BORISHORSE 1417 | 1415 *.OQn1B 1418 | 1416 *.rjzR8 1419 | 1417 *.londec 1420 | 1418 *.AVco3 1421 | 1419 *.08kJA 1422 | 1420 *.Hermes666 1423 | 1421 *.Acton.id\[1AE26935-1085\].\[hadleeshelton@aol.com\].Acton 1424 | 1422 *.auw2w2g0 1425 | 1423 *.megacortex 1426 | 1424 *.id\[RandomIP\].\[bron_lynn@aol.com\].help 1427 | 1425 *.Prandel 1428 | 1426 *.zatrov 1429 | 1427 *.Wx7A6 1430 | 1428 *.syrk 1431 | 1429 *.brusaf 1432 | 1430 *.masok 1433 | 1431 *.junior 1434 | 1432 *.lotej 1435 | 1433 *.Novosof 1436 | 1434 *.sinopal 1437 | 1435 *@cumallover.me* 1438 | 1436 *.com2 1439 | 1437 *.emsisosisoft 1440 | 1438 *.daris 1441 | 1439 NEWS_INGiBiToR.txt 1442 | 1440 *.GRANIT 1443 | 1441 *.rsalive 1444 | 1442 *.format 1445 | 1443 *.bgCIb 1446 | 1444 *.cosakos 1447 | 1445 *.nvetud 1448 | 1446 *.kovasoh 1449 | 1447 *.nelasod 1450 | 1448 *.tsv 1451 | 1449 *.Acuf2 1452 | 1450 *.mogranos 1453 | 1451 *.si… 1454 | 1452 *.Hades666 1455 | 1453 GNNCRY_Readme.txt 1456 | 1454 *RT4BLOCK 1457 | 1455 *.prus 1458 | 1456 *.a800 1459 | 1457 *.c300 1460 | 1458 payload.dll 1461 | 1459 HOW-TO-DECRYPT-FILES.HTM 1462 | 1460 *.{XXXXX-EFEE-6C04-D2DC-A9EFA812DD11}! 1463 | 1461 *.LOVE 1464 | 1462 \[*\]-HOW-TO-DECRYPT.txt 1465 | 1463 #_#ReadMe#_#.rtf 1466 | 1464 x5gj5_gmG8.log 1467 | 1465 *.litra 1468 | 1466 *.TROLL 1469 | 1467 *.lalabitch 1470 | 1468 *.ntu 1471 | 1469 *.TABGH 1472 | 1470 *.banjo 1473 | 1471 *.ntuseg 1474 | 1472 *.\[epta.mcold@gmail.com\] 1475 | 1473 *.btchelp@xmpp.jp 1476 | 1474 *.ndarod 1477 | 1475 *.sambo 1478 | 1476 *.WALAN 1479 | 1477 *.limbo 1480 | 1478 *.actor 1481 | 1479 *.bk666 1482 | 1480 *.azero 1483 | 1481 .plomb 1484 | 1482 *.AYE 1485 | 1483 .id-*.\[*@*\].air 1486 | 1484 *.id-*.\[*@*\].* 1487 | 1485 *.rencrypted 1488 | 1486 *.MDRL 1489 | 1487 *.btix 1490 | 1488 *.dodoc 1491 | 1489 *.bopador 1492 | 1490 *.novasof 1493 | 1491 .bxtyunh 1494 | 1492 *.ERIS! 1495 | 1493 *.lilocked 1496 | 1494 *.haka 1497 | 1495 *.Persephone666! 1498 | 1496 *.megac0rtx 1499 | 1497 *.Hades666! 1500 | 1498 .zerofucks 1501 | 1499 *.darus 1502 | 1500 *.lurk 1503 | 1501 *.{XXXXXXX-588E-7D5B-AED1-2CD51808DE12} 1504 | 1502 *.madekv120 1505 | 1503 *.sfs 1506 | 1504 *.todar 1507 | 1505 *.lapoi 1508 | 1506 *.madek 1509 | 1507 *.gusau 1510 | 1508 *.diller13 1511 | 1509 *.gehad 1512 | 1510 *.vusad 1513 | 1511 *.berosuce 1514 | 1512 *.budak 1515 | 1513 *.Adame 1516 | 1514 *.YOUR_LAST_CHANCE 1517 | 1515 _RESTORE FILES_.txt 1518 | 1516 *.\[Kromber@tutanota.com\] 1519 | 1517 *.SKYSTARS 1520 | 1518 *.godes 1521 | 1519 *.herad 1522 | 1520 HOW_TO_DECRYPT.txt 1523 | 1521 *.Pox 1524 | 1522 *.mo7n 1525 | 1523 *.shelbyboom 1526 | 1524 .megac0rtx 1527 | 1525 .\[ogorman.linoel@aol.com\].help 1528 | 1526 *.basilisque@protonmail_com 1529 | 1527 *.cizer 1530 | 1528 *.dqb 1531 | 1529 *.ExpBoot 1532 | 1530 *.ExpBoot! 1533 | 1531 *.CROWN!\? 1534 | 1532 *.o$l 1535 | 1533 *.CROWN 1536 | 1534 *.WHY… 1537 | 1535 *.61yhi 1538 | 1536 *.Acton 1539 | 1537 *.cezor 1540 | 1538 *.upd9ykc65v 1541 | 1539 *.KICK 1542 | 1540 *.popoticus 1543 | 1541 *.lokas 1544 | 1542 *.cs16 1545 | 1543 *.wav_list 1546 | 1544 *.cxk_nmsl 1547 | 1545 *.boooam@cock_li 1548 | 1546 *.actin 1549 | 1547 *.besub 1550 | 1548 *.CAGO 1551 | 1549 *.litar 1552 | 1550 *.isolated 1553 | 1551 *.dcom 1554 | 1552 *.alilibat 1555 | 1553 *.Freezing 1556 | 1554 *.acute 1557 | 1555 *.1500dollars 1558 | 1556 *.chekyshka 1559 | 1557 *.popotic 1560 | 1558 *.nusar 1561 | 1559 *.craftul 1562 | 1560 *.beets!Ransom 1563 | 1561 *.lotep 1564 | 1562 *.adage 1565 | 1563 *.truke 1566 | 1564 *.Amigo 1567 | 1565 *.dmo 1568 | 1566 *.cbs0z 1569 | 1567 *.dalle 1570 | 1568 *.hccapx 1571 | 1569 *.WALAN, 1572 | 1570 *.cap 1573 | 1571 *.litra!Sample 1574 | 1572 *.TROLL, 1575 | 1573 *.neras 1576 | 1574 *.DOCM!Sample 1577 | 1575 *.COPAN 1578 | 1576 *.middleman2020 1579 | 1577 *.lcphr!Ransom 1580 | 1578 *.lcphr 1581 | 1579 .6vr378txi 1582 | 1580 *.orion 1583 | 1581 *.crypted!Sample 1584 | 1582 *.bliun 1585 | 1583 *.poof 1586 | 1584 *.0day 1587 | 1585 *.horon 1588 | 1586 *.poop 1589 | 1587 *.vesad 1590 | 1588 *.zoh 1591 | 1589 *.jsworm 1592 | 1590 JSWORM-DECRYPT.hta 1593 | 1591 *.gerosan 1594 | 1592 *.muslat 1595 | 1593 *.boston 1596 | 1594 *.myskle 1597 | 1595 *.pidom 1598 | 1596 *.euclid 1599 | 1597 *.heroset 1600 | 1598 *.pidon 1601 | 1599 *.kjh 1602 | 1600 *.ERIS 1603 | 1601 *.robbinhood 1604 | 1602 *.\[frazeketcham@cnidia.com\].eth.hv88g2 1605 | 1603 *.SONIC 1606 | 1604 *.luboversova148 1607 | 1605 *.lanset 1608 | 1606 *.redmat 1609 | 1607 *.dodger 1610 | 1608 *.stone 1611 | 1609 *.3674AD9F-5958-4F2A-5CB7-F0F56A8885EA 1612 | 1610 *.harma 1613 | 1611 *.\[randal_inman@aol.com\].help 1614 | 1612 *.rezuc 1615 | 1613 *.2du1mj8 1616 | 1614 *.FEROSUS 1617 | 1615 *.hjgdl 1618 | 1616 *.2k19sys 1619 | 1617 *.mogera 1620 | 1618 *.Hermes 1621 | 1619 *.skymap 1622 | 1620 *.\[lockhelp@qq.com\].gate 1623 | 1621 *.legacy 1624 | 1622 *.datun 1625 | 1623 *.rectot 1626 | 1624 les#.TXT 1627 | 1625 *.les# 1628 | 1626 *.EZDZ 1629 | 1627 *.open_readme.txt.ke3q 1630 | 1628 *.ke3q 1631 | 1629 *.ONYC 1632 | 1630 *.NHCR 1633 | 1631 *ymayka-email@yahoo.com.cryptotes 1634 | 1632 *.\[Enigma1crypt@aol.com\].ETH 1635 | 1633 *.\[DonovanTudor@aol.com\].bat 1636 | 1634 *.\[SSSDKVNSDFITD\] 1637 | 1635 *.Pig4444 1638 | 1636 *.bmn63 1639 | 1637 *.\[bitcharity@protonmail.com\].com 1640 | 1638 *.\[costelloh@aol.com\].phoenix 1641 | 1639 *\[remarkpaul77@cock.li\].JSWORM 1642 | 1640 *.\[crypt1style@aol.com\].MERS 1643 | 1641 *.n7ys81w 1644 | 1642 *.jack 1645 | 1643 *.ge010gic 1646 | 1644 *.codnet1 1647 | 1645 .codnat1 1648 | 1646 *.codnet 1649 | 1647 .codnat 1650 | 1648 *.ferosas 1651 | 1649 RESTORE_HCEEM_DATA.txt 1652 | 1650 READ_ME.mars 1653 | 1651 *.hceem 1654 | 1652 *.vally 1655 | 1653 *.mars 1656 | 1654 Instructions with your files.txt 1657 | 1655 *.refols 1658 | 1656 *.carcn 1659 | 1657 *.yum 1660 | 1658 _CRYPTED_README.html 1661 | 1659 *.ms13 1662 | 1660 *.grovat 1663 | 1661 ReadME-Prodecryptor@gmail.com.txt 1664 | 1662 *.Mira 1665 | 1663 *.Prodecryptor 1666 | 1664 *.+jabber-theone@safetyjabber.com 1667 | 1665 *.hrosas 1668 | 1666 !QH24_INFO!.rtf 1669 | 1667 *.QH24 1670 | 1668 *.bkc 1671 | 1669 *.mers 1672 | 1670 *.wal 1673 | 1671 *.recry1 1674 | 1672 *.qbix 1675 | 1673 *.aa1 1676 | 1674 *.zoro 1677 | 1675 Инструкция по расшифровке.TXT 1678 | 1676 *.kes$ 1679 | 1677 *.condat 1680 | 1678 *.dotmap 1681 | 1679 *.4k 1682 | 1680 *.ge0l0gic_readme.txt 1683 | 1681 *.mamba 1684 | 1682 *.ge0l0gic 1685 | 1683 *.ddos 1686 | 1684 Locked.* 1687 | 1685 .PLUT 1688 | 1686 .jack 1689 | 1687 HowToBackFiles.txt 1690 | 1688 DECRYPT-FILES.html 1691 | 1689 *.non 1692 | 1690 !!!INSTRUCTION_RNSMW!!!.txt 1693 | 1691 *.drweb 1694 | 1692 *.qbtex 1695 | 1693 *.yG 1696 | 1694 *.radman 1697 | 1695 *.\[epta.mcold@gmail.com\], 1698 | 1696 !INSTRUCTI0NS!.TXT 1699 | 1697 *.666decrypt666 1700 | 1698 *Decryptoroperator@qq.com 1701 | 1699 *.ztsysjz 1702 | 1700 *.lockhelp@qq.gate 1703 | 1701 Decryptyourdata@qq.com 1704 | 1702 *.\[w_unblock24@qq.com\].ws 1705 | 1703 \[Lockhelp@qq.com\].Gate 1706 | 1704 *.GGGHJMNGFD 1707 | 1705 *.OOOKJYHCTVDF 1708 | 1706 .eth 1709 | 1707 *.PLUT 1710 | 1708 *.bufas 1711 | 1709 *.codnat1 1712 | 1710 *.codnat 1713 | 1711 *.fordan 1714 | 1712 *.\[blellockr@godzym.me\].bkc 1715 | 1713 .nampohyu 1716 | 1714 *.berost 1717 | 1715 *.forasom 1718 | 1716 *.{Killback@protonmail.com}KBK 1719 | 1717 *.fedasot 1720 | 1718 *.\[staRcRypt@tutanota.com\].omerta 1721 | 1719 *.sarut 1722 | 1720 *.Navi 1723 | 1721 *.dutan 1724 | 1722 *.aes128ctr 1725 | 1723 *.roldat 1726 | 1724 *.hofos 1727 | 1725 *.cheetah 1728 | 1726 *.todarius 1729 | 1727 *.FREDD 1730 | 1728 *.Kiratos 1731 | 1729 *.enc_robbinhood 1732 | 1730 *.jzphmsfs 1733 | 1731 *.\[zoro4747@gmx.de\].zoro 1734 | 1732 *.verasto 1735 | 1733 READ_ME.cube 1736 | 1734 *.sambo, 1737 | 1735 HELP_BY_CROC.TXT 1738 | 1736 *.LDPR 1739 | 1737 warning.txt 1740 | 1738 *.guesswho 1741 | 1739 *.moresa 1742 | 1740 *.burn 1743 | 1741 *.robinhood 1744 | 1742 *.COLORIT 1745 | 1743 *.SAVEYOURDATA 1746 | 1744 *.aescrypt 1747 | 1745 _HELP_INSTRUCTIONS_.TXT 1748 | 1746 *lockhelp@qq.com 1749 | 1747 *.Ryuk 1750 | 1748 *.croc 1751 | 1749 *.norvas 1752 | 1750 *.\[absonkaine@aol.com\].phoenix 1753 | 1751 *.CRABSLKT 1754 | 1752 *.gotcha 1755 | 1753 *.cube 1756 | 1754 *.SDEN 1757 | 1755 *.obagarmrk 1758 | 1756 *.tater 1759 | 1757 *.pumas 1760 | 1758 *.browec 1761 | 1759 *.hdeaf 1762 | 1760 *.guvara 1763 | 1761 *.tabufa 1764 | 1762 *.tokog 1765 | 1763 *.fuchsia 1766 | 1764 *.etols 1767 | 1765 *.\[velasquez.joeli@aol.com\] 1768 | 1766 *.gate 1769 | 1767 *.langolier 1770 | 1768 *.spyhunter 1771 | 1769 *.cryptoid 1772 | 1770 *.\[adobe-123@tutanota.com\].ETH 1773 | 1771 *.Jumper 1774 | 1772 *.major 1775 | 1773 *.raldug 1776 | 1774 *.phoenix 1777 | 1775 *.gropas 1778 | 1776 *.wannacash 1779 | 1777 *.NGSC 1780 | 1778 *.bmps@tutanota.com.major 1781 | 1779 *._Crypted 1782 | 1780 *.roland 1783 | 1781 *.NOLOST 1784 | 1782 *.Marozka 1785 | 1783 *.encryptedALL 1786 | 1784 *.stun 1787 | 1785 *.grovas 1788 | 1786 *.trosak 1789 | 1787 *.tronas 1790 | 1788 *.JLCW2 1791 | 1789 *.\[thedecrypt111@qq.com\].ETH 1792 | 1790 *.drume 1793 | 1791 *.securityP 1794 | 1792 *.YYYYBJQOQDU 1795 | 1793 ENCRYPTED.TXT 1796 | 1794 *.MDEN 1797 | 1795 README_LOCKED.txt 1798 | 1796 README-NOW.txt 1799 | 1797 *.locker 1800 | 1798 *.proden 1801 | 1799 *.CQQUH 1802 | 1800 *\[p4d@tuta.io\].com 1803 | 1801 *.luceq 1804 | 1802 *.chech 1805 | 1803 *.\[mrpeterson@cock.li\].GFS 1806 | 1804 *.suffer 1807 | 1805 *.инструкция по оплате.txt 1808 | 1806 *.metan 1809 | 1807 *.kezoz 1810 | 1808 *.luces 1811 | 1809 *.doples 1812 | 1810 *.pdf_Axffyq_{babyfromparadise666@gmail.com}.p3rf0rm4 1813 | 1811 *.pdf.p3rf0rmr 1814 | 1812 *.{CALLMEGOAT@PROTONMAIL.COM}CMG 1815 | 1813 *.\[amber777king@cock.li\].amber 1816 | 1814 *.L1LL 1817 | 1815 *.charcl 1818 | 1816 *.UIK1J 1819 | 1817 *.kropun 1820 | 1818 *.jimm 1821 | 1819 *.klope 1822 | 1820 *.\[payransom@qq.com\].adobe 1823 | 1821 *.jamper 1824 | 1822 ---README---.TXT 1825 | 1823 *.\[w_decrypt24@qq.com\].zq 1826 | 1824 *.Scorpion 1827 | 1825 *.pulsar1 1828 | 1826 *.charck 1829 | 1827 *.kroput1 1830 | 1828 *.\[btccrypthelp@cock.li\].ETH 1831 | 1829 *.\[1701222381@qq.com\].ETH 1832 | 1830 *.\[decryptprof@qq.com\].ETH 1833 | 1831 *.\[decryptmyfiles@qq.com\].ETH 1834 | 1832 *.\[helpfilerestore@india.com\].ETH 1835 | 1833 *.\[MailPayment@decoder.com\].ETH 1836 | 1834 *.Blower@india.com 1837 | 1835 *.bRcrypT 1838 | 1836 *.GILLETTE 1839 | 1837 *.yatron 1840 | 1838 *.kroput 1841 | 1839 *.\[plombiren@hotmail.com\].plomb 1842 | 1840 Restore_ICPICP_Files.txt 1843 | 1841 HOW-TO-RESTORE-FILES.txt 1844 | 1842 !#_How_to_decrypt_files_$!.txt 1845 | 1843 _如何解密我的文件_.txt 1846 | 1844 How to decrypt.txt 1847 | 1845 *.\[help24decrypt@cock.li 1848 | 1846 *.Neptune 1849 | 1847 *.{mattpear@protonmail.com} 1850 | 1848 *.promorad2 1851 | 1849 *.andymarvin 1852 | 1850 *.mamasitaq 1853 | 1851 *.cockista 1854 | 1852 *.crabs 1855 | 1853 *.dy8wud 1856 | 1854 *.\[china-decryptor@pm.me\] 1857 | 1855 *.kitty 1858 | 1856 *.CIOP 1859 | 1857 *.pfanz 1860 | 1858 *.jcry 1861 | 1859 *.evopro 1862 | 1860 *.{mattpear@protonmail.com}MTP 1863 | 1861 *.Annabelle2 1864 | 1862 *.\[help24decrypt@cock.li\] 1865 | 1863 *.promock 1866 | 1864 *.promorad 1867 | 1865 HOW TO DECRYPT\[1T0tO\].txt 1868 | 1866 !_!email__ prusa@goat.si __!..PAYMAN 1869 | 1867 !SBLOCK_INFO!.rtf 1870 | 1868 *.Frendi 1871 | 1869 инструкция по оплате.txt 1872 | 1870 how_to_recver_files.txt 1873 | 1871 *.aqva 1874 | 1872 !#_How_to_decrypt_files_#! 1875 | 1873 SECURITY-ISSUE-INFO.txt 1876 | 1874 ! ПРОЧТИ МЕНЯ !.html 1877 | 1875 *.cammora 1878 | 1876 *.SBLOCK 1879 | 1877 *.promoz 1880 | 1878 *.crazy 1881 | 1879 *.ARTEMY 1882 | 1880 *.rontok 1883 | 1881 *.crypt2019 1884 | 1882 *.\[crypted_files@qq.com\].aqva 1885 | 1883 *.BlackPink 1886 | 1884 *.id.*.crazy 1887 | 1885 !GBLOCK_INFO.rtf 1888 | 1886 *.GBLOCK 1889 | 1887 *.cekisan 1890 | 1888 *.promos 1891 | 1889 *.seed 1892 | 1890 *.jupstb 1893 | 1891 *.KARLS 1894 | 1892 !PEDANt_INFO!.rtf 1895 | 1893 *.mecury 1896 | 1894 *.PLANT 1897 | 1895 #HELP-DECRYPT-FCRYPT1.1#.txt 1898 | 1896 *.infileshop@gmail_com_ID44 1899 | 1897 *.shadi 1900 | 1898 *.dedo 1901 | 1899 *.help24decrypt@qq.com 1902 | 1900 *.\[raphaeldupon@aol.com\].ETH 1903 | 1901 *.PEDANT 1904 | 1902 *.Encrypted5 1905 | 1903 *.Gefest3 1906 | 1904 ClopReadMe.txt 1907 | 1905 *.frend 1908 | 1906 *.amber 1909 | 1907 !!!READ_IT!!!.txt 1910 | 1908 Readme_Restore_Files.txt 1911 | 1909 Your files are now encrypted.txt 1912 | 1910 HOW_TO_DECRYPT_MY_FILES.txt 1913 | 1911 *.snake4444 1914 | 1912 *.\[drwho888@mail.fr\].888 1915 | 1913 *.FCrypt 1916 | 1914 *.Clop 1917 | 1915 *.fastrecovery.xmpp.jp 1918 | 1916 *.poyvonm 1919 | 1917 *.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx 1920 | 1918 *.FileSlack 1921 | 1919 *.pluto 1922 | 1920 *.paycoin 1923 | 1921 *.blower 1924 | 1922 *.nosafe 1925 | 1923 *.tuki17@qq.com 1926 | 1924 *.secure 1927 | 1925 *.crypted_pony_test_build* 1928 | 1926 *.YOLO 1929 | 1927 *.qwex 1930 | 1928 *.DESYNC 1931 | 1929 *.crash 1932 | 1930 *.pennywise 1933 | 1931 *.888 1934 | 1932 *.*GEFEST 1935 | 1933 *adobe.gefest 1936 | 1934 *.OOFNIK 1937 | 1935 *.\[welesmatron@aol.com\].btc 1938 | 1936 *.Mcafee 1939 | 1937 *.mbrcodes 1940 | 1938 *.UNIT09 1941 | 1939 *.Xcri 1942 | 1940 *.telebak 1943 | 1941 *.\[buy-decryptor@pm.me\] 1944 | 1942 *.adobee 1945 | 1943 *.mafee 1946 | 1944 *.\[writehere@qq.com\].btc 1947 | 1945 *.GEFEST 1948 | 1946 CRYPTOID_* 1949 | 1947 *.PC-FunHACKED* 1950 | 1948 TrumpHead.exe 1951 | 1949 !README_GRHAN!.rtf 1952 | 1950 *.ppam 1953 | 1951 *.vaca 1954 | 1952 *.heets 1955 | 1953 *.alien 1956 | 1954 *.SPCT 1957 | 1955 anatova.txt 1958 | 1956 anatova.exe 1959 | 1957 170fb7438316.exe 1960 | 1958 CallOfCthulhu.exe 1961 | 1959 *.cripton 1962 | 1960 *.GMBN 1963 | 1961 *.ddpcbi 1964 | 1962 *.\[Traher@Dr.Com\] 1965 | 1963 *.2lwnPp2B 1966 | 1964 *\[gomer_simpson2@aol.com\].phobos 1967 | 1965 *._raphaeldupon@aol.com_.btc 1968 | 1966 *.RENSENWARE 1969 | 1967 *.rumba 1970 | 1968 *.AUF 1971 | 1969 *.Tfudeq 1972 | 1970 *.tfudet 1973 | 1971 *.JAMES 1974 | 1972 *.sdwwbrb 1975 | 1973 *.ucftz* 1976 | 1974 *.xcry7684 1977 | 1975 *.eddldzor 1978 | 1976 *.hncdumn 1979 | 1977 *.g^od 1980 | 1978 *.ezzyl 1981 | 1979 *.jundmd@cock.li* 1982 | 1980 *.obfuscated 1983 | 1981 *.rsucozxze 1984 | 1982 *.mdk4y 1985 | 1983 *.GRHAN 1986 | 1984 *.zzzzzzzz 1987 | 1985 *.bvjznsjlo 1988 | 1986 *.sjjpu 1989 | 1987 *.djuvq 1990 | 1988 *.djvup 1991 | 1989 *.djvut 1992 | 1990 *.djvur 1993 | 1991 *.djvus 1994 | 1992 *.uudjvu 1995 | 1993 *.udjvu 1996 | 1994 *djvuu 1997 | 1995 *.tfude 1998 | 1996 *.tro 1999 | 1997 *{alexbanan@tuta.io}.CORP 2000 | 1998 .\[ti_kozel@lashbania.tv\].* 2001 | 1999 #RECOVERY_FILES#.txt 2002 | 2000 *id-.LyaS 2003 | 2001 $%%! NOTE ABOUT FILES -=!-.html 2004 | 2002 *__{}.VACv2 2005 | 2003 *.pdff 2006 | 2004 *.djvuq 2007 | 2005 *.INDRIK 2008 | 2006 *.recovery_email__retmydata@protonmail.com__*_.aes256.testE 2009 | 2007 *.artilkilin@tuta.io.wq2k 2010 | 2008 *.recovery_email_\[retmydata@protonmail.com\]*.aes256 2011 | 2009 *.vulston 2012 | 2010 *.SATANA 2013 | 2011 *\[decryptdata@qq.com\].rar 2014 | 2012 *.to.dernesatiko@mail.com.crypted 2015 | 2013 *.ryx 2016 | 2014 *.\[ti_kozel@lashbania.tv\].костя 2017 | 2015 *.nostro 2018 | 2016 *.\[Unlock24@cock.li\].combo 2019 | 2017 *.mouse 2020 | 2018 *.snatch 2021 | 2019 *.bizer 2022 | 2020 *.tunca 2023 | 2021 *.\[decrypthelper@protonmail.com\].phobos 2024 | 2022 *.locked_by_mR_Anonymous(TZ_HACKERS) 2025 | 2023 *.ducueyuav 2026 | 2024 *.oslawcmme 2027 | 2025 *.Защищено 2028 | 2026 *.Djvuu 2029 | 2027 *.PRCP 2030 | 2028 *.\[backtonormal@foxmail.com\].adobe 2031 | 2029 *.WORMCRYPT0R 2032 | 2030 *.evolution 2033 | 2031 *.cmsnwned 2034 | 2032 *.ironhead 2035 | 2033 *.ktuhzxpi 2036 | 2034 *.elpvd 2037 | 2035 *.kali 2038 | 2036 *.Mercury 2039 | 2037 *.\[avflantuheems1984@aol.com\].adobe 2040 | 2038 *.FJ7QvaR9VUmi 2041 | 2039 *.gerber5 2042 | 2040 *.CRYPTR 2043 | 2041 *.XY6LR 2044 | 2042 cmdRansomware.* 2045 | 2043 #RECOVERY_FILES#.* 2046 | 2044 *.decryptgarranty 2047 | 2045 _How to restore files.* 2048 | 2046 _How_To_Decrypt_My_File_.* 2049 | 2047 *.lucky 2050 | 2048 *.PERSONAL_ID* 2051 | 2049 *.garcewa 2052 | 2050 *.danger 2053 | 2051 *.israbye 2054 | 2052 *.\[fileslocker@pm.me\] 2055 | 2053 *.greystars@protonmail.com 2056 | 2054 *.iaufhhhhfiles_BACK_PLS_READ.html 2057 | 2055 *.iaufhhhfiles_BACK_PLS_READ.html 2058 | 2056 *.hilegofprencrp 2059 | 2057 *.wowreadfordecry 2060 | 2058 *.btc -help-you 2061 | 2059 *.checkdiskenced 2062 | 2060 *.iloveworld 2063 | 2061 *.goforhelp 2064 | 2062 *.encmywork 2065 | 2063 *.\[parambingobam@cock.li\].adobe 2066 | 2064 *.\[mercarinotitia@qq.com\].adobe 2067 | 2065 *.crypted_bizarrio@pay4me_in 2068 | 2066 *.DeLpHiMoRiX* 2069 | 2067 *.malwarehunterteam 2070 | 2068 *.demonslay335_you_cannot_decrypt_me! 2071 | 2069 *.peosajwqfk 2072 | 2070 *.online24files@airmail.cc 2073 | 2071 *.risk 2074 | 2072 *.\[cyberwars@qq.com\].war 2075 | 2073 *.stevenseagal@airmail.cc 2076 | 2074 *.myjob 2077 | 2075 *.lolita 2078 | 2076 *snowpicnic* 2079 | 2077 *SIMMYWARE* 2080 | 2078 how to get back you files.txt 2081 | 2079 *.cccmn 2082 | 2080 aboutYourFiles.* 2083 | 2081 *wall.i 2084 | 2082 #RECOVERY-PC#.* 2085 | 2083 !-GET_MY_FILES-!.* 2086 | 2084 @_RESTORE-FILES_@.* 2087 | 2085 *.Puma 2088 | 2086 *.\[yoursalvations@protonmail.ch\].neverdies@tutanota.com 2089 | 2087 *.kraussmfz 2090 | 2088 *.PUMAX 2091 | 2089 *.anami 2092 | 2090 *.449o43 2093 | 2091 *.DeLpHiMoRiX!@@@@_@@_@_2018_@@@_@_@_@@@ 2094 | 2092 *.\[stopencrypt@qq.com\].adobe 2095 | 2093 *.Enter 2096 | 2094 *.betta 2097 | 2095 *.INFOWAIT 2098 | 2096 *.FIXT 2099 | 2097 *.fire 2100 | 2098 *.Horsuke 2101 | 2099 *.Vapor 2102 | 2100 *.ispfv 2103 | 2101 *.Bear 2104 | 2102 *.EnyBenied 2105 | 2103 *.BlackHat 2106 | 2104 *.Epoblockl 2107 | 2105 *.DATAWAIT 2108 | 2106 *.010001 2109 | 2107 *.AUDIT 2110 | 2108 *.\[papillon9275\] 2111 | 2109 *.UKCZA 2112 | 2110 *.YIAQDG 2113 | 2111 *.CQXGPMKNR 2114 | 2112 *.HHFEHIOL 2115 | 2113 *.GrujaRS 2116 | 2114 *.xuy 2117 | 2115 *.crypted034 2118 | 2116 *.FilGZmsp 2119 | 2117 *.krzffw 2120 | 2118 *.impect 2121 | 2119 *.fast 2122 | 2120 *.Ox4444 2123 | 2121 *.6db8 2124 | 2122 *.PTGEPVEKM 2125 | 2123 *.adobe 2126 | 2124 *.JKOUOGVG 2127 | 2125 *.mariacbc 2128 | 2126 *.supportfiless24@protonmail.ch 2129 | 2127 *.SYMMYWARE 2130 | 2128 *.vendetta2 2131 | 2129 *.xxxxx 2132 | 2130 *.CommonRansom 2133 | 2131 *.crypt888 2134 | 2132 *.gdb 2135 | 2133 *.wewillhelp@airmail.cc 2136 | 2134 *.WAND 2137 | 2135 *.\[everest@airmail.cc\].EVEREST 2138 | 2136 *.FUNNY 2139 | 2137 *.vanss 2140 | 2138 *.SANTANA 2141 | 2139 *.NOT 2142 | 2140 *.beer 2143 | 2141 *.SOLO 2144 | 2142 *.GMPF 2145 | 2143 *.W0YR8 2146 | 2144 *.charm 2147 | 2145 *.birbb 2148 | 2146 TOTALLYLEGIT.EXE 2149 | 2147 *.altdelete@cock.li.district 2150 | 2148 *.ctrlalt@cock.li.district 2151 | 2149 *.THDA 2152 | 2150 *.katyusha 2153 | 2151 *.LGAWPULM 2154 | 2152 *.\[mixon.constantine@aol.com\].gamma 2155 | 2153 *.101 2156 | 2154 *.zlpzdel 2157 | 2155 *.junked 2158 | 2156 *.DQXOO 2159 | 2157 *.NOBAD 2160 | 2158 *.garrantydecrypt 2161 | 2159 *.BAWSUOOXE 2162 | 2160 *.Kg9EX 2163 | 2161 *.EMAN50 2164 | 2162 *.\[crab7765@gmx.de\].crab 2165 | 2163 !!!ReadMeToDecrypt.txt 2166 | 2164 *.qweuirtksd 2167 | 2165 #README_GMAN#.rtf 2168 | 2166 !README_GMAN!.rtf 2169 | 2167 *.GMAN 2170 | 2168 *.boost 2171 | 2169 *.ziqzqzdi 2172 | 2170 52036F92.tmp 2173 | 2171 *.FFF 2174 | 2172 *.911 2175 | 2173 *.2xx9 2176 | 2174 *.@decrypt_2017 2177 | 2175 (encrypted)* 2178 | 2176 *zn2016 2179 | 2177 #HOW_DECRYPT_FILES#.html 2180 | 2178 !back_files!.html 2181 | 2179 *.Bill_Clinton@derpymailorg 2182 | 2180 *.nWcrypt 2183 | 2181 *.needkeys 2184 | 2182 *.YAYA 2185 | 2183 *.write_on_email 2186 | 2184 *.needdecrypt 2187 | 2185 *.0402 2188 | 2186 *.NIGGA 2189 | 2187 HOW_DECRYPT_FILES#.html 2190 | 2188 *.eQTz 2191 | 2189 *.aRpt 2192 | 2190 *.3P7m 2193 | 2191 *.3RNu 2194 | 2192 *.rpd 2195 | 2193 *.\[oron@india.com\].dharma 2196 | 2194 HOW TO RECOVER ENCRYPTED FILES-infovip@airmail.cc.TXT 2197 | 2195 READ_TO_DECRYPT.html 2198 | 2196 *.\[embrace@airmail.cc\].embrace 2199 | 2197 *\[Beamsell@qq.com\].bip 2200 | 2198 *\[files.restore@aol.com\].write 2201 | 2199 #NEWRAR_README#.rtf 2202 | 2200 Files encrypted.html 2203 | 2201 *.backup 2204 | 2202 *\[java2018@tuta io\].arrow 2205 | 2203 !OoopsYourFilesLocked!.rtf 2206 | 2204 *\[RELOCK001@TUTA.IO\] 2207 | 2205 *.\[btc@fros.cc\].btc 2208 | 2206 How To Restore Files.txt 2209 | 2207 *.bgtx 2210 | 2208 Info.hta 2211 | 2209 FILES ENCRYPTED.txt 2212 | 2210 *.DHDR4 2213 | 2211 *.crypted_marztoneb@tutanota_de 2214 | 2212 YOU_MUST_READ_ME.rtf 2215 | 2213 *How to Decrypt Files-*.html 2216 | 2214 *.BaLoZiN 2217 | 2215 *.RJZUNA 2218 | 2216 *@LOCKED 2219 | 2217 *.EMAN 2220 | 2218 *.firmabilgileri 2221 | 2219 *-DECRYPT.txt 2222 | 2220 *.iudgkwv 2223 | 2221 *.\[notopen@countermail.com\].NOT_OPEN 2224 | 2222 ReadMe_Decryptor.txt 2225 | 2223 !_HOW_RECOVERY_FILES_!.txt 2226 | 2224 READ__IT.txt 2227 | 2225 *.f*cked 2228 | 2226 *-DECRYPT.html 2229 | 2227 *.\[paydecryption@qq.com\].brrr 2230 | 2228 *.spaß 2231 | 2229 *.olduw 2232 | 2230 *.yoewy 2233 | 2231 *.BDKR 2234 | 2232 *.onlinesupport 2235 | 2233 *.anonymous 2236 | 2234 *.bkp 2237 | 2235 *.ryk 2238 | 2236 *.skype 2239 | 2237 *.CHE808 2240 | 2238 *.parrot 2241 | 2239 *.monro 2242 | 2240 *.NOT_OPEN 2243 | 2241 *.no_more_ransomware 2244 | 2242 *.gamma 2245 | 2243 *.brrr 2246 | 2244 *.Nano 2247 | 2245 *.ITLOCK 2248 | 2246 *.SAVEfiles 2249 | 2247 *.mvp 2250 | 2248 *.hitler 2251 | 2249 *.mammon 2252 | 2250 *.SLAV 2253 | 2251 *.davilarita@mail.com.yyy0 2254 | 2252 *\[shivamana@seznam.cz\].pip 2255 | 2253 *.KOK08 2256 | 2254 *.eoeo 2257 | 2255 *.FASTBOB 2258 | 2256 *.lockymap 2259 | 2257 *.NEWRAR 2260 | 2258 *.cryptoNar 2261 | 2259 *.partially.cryptoNar 2262 | 2260 *.PICO 2263 | 2261 *.CYBERGOD 2264 | 2262 *.rcrypted 2265 | 2263 *.kvllyatprotonmaildotch 2266 | 2264 *.KOK8 2267 | 2265 *.fsdfsdfsdfsdfsdfsfdsfs 2268 | 2266 How To Decode Files.hta 2269 | 2267 *.BadNews 2270 | 2268 *.cassetto 2271 | 2269 *.sophos 2272 | 2270 *.{incredible0ansha@tuta.io}.ARA 2273 | 2271 *.\[backdata@cock.li\].CreamPie 2274 | 2272 *.FuckedByGhost 2275 | 2273 *.#__EnCrYpTED_BY_dzikusssT3AM_ransomware!__# 2276 | 2274 *.lockedfile 2277 | 2275 *.WHY 2278 | 2276 *.AlfaBlock 2279 | 2277 # How to Decrypt Files.txt 2280 | 2278 *-Lock.onion 2281 | 2279 *.PrOtOnIs.VaNdElIs 2282 | 2280 *.PrOtOnIs 2283 | 2281 *.Armage 2284 | 2282 *.rent 2285 | 2283 *.fox 2286 | 2284 *.pleaseCallQQ 2287 | 2285 *.lockedgood 2288 | 2286 *.hacked.by.Snaiparul 2289 | 2287 *.ShutUpAndDance 2290 | 2288 *.K8VfiZ 2291 | 2289 *.G8xB 2292 | 2290 *.cmb 2293 | 2291 *.b29 2294 | 2292 *.poolezoor 2295 | 2293 *.id-*.cmb 2296 | 2294 *.KEYPASS 2297 | 2295 *.doubleoffset 2298 | 2296 *.tedcrypt 2299 | 2297 !=How_to_decrypt_files=!.txt 2300 | 2298 *.divine 2301 | 2299 *.wannacryv2 2302 | 2300 *.anonimus.mr@yahoo.com 2303 | 2301 *.dragnea 2304 | 2302 *.RECOVERYOURFILES 2305 | 2303 *.invaded 2306 | 2304 *.incpas 2307 | 2305 *.BARRACUDA 2308 | 2306 *.sdk 2309 | 2307 *.cryptes 2310 | 2308 *.like 2311 | 2309 *.ukrain 2312 | 2310 *.dfjhsalfhsakljfhsljkahfdjklashfdjklh 2313 | 2311 *.black007 2314 | 2312 *.combo 2315 | 2313 *.adapaterson@mail.com.mkmk 2316 | 2314 *0nl1ne* 2317 | 2315 *.locked.zip 2318 | 2316 *.boris 2319 | 2317 *.powerfuldecrypt 2320 | 2318 *.predator 2321 | 2319 *.XERO 2322 | 2320 *.HYENA 2323 | 2321 *.BD.Recovery 2324 | 2322 *.zzz12 2325 | 2323 *king_ouroboros* 2326 | 2324 *.dyaaghemy 2327 | 2325 *.\[firmabilgileri@bk.ru\] 2328 | 2326 *.DATASTOP 2329 | 2327 *.thunder 2330 | 2328 *.LanRan* 2331 | 2329 *.deep 2332 | 2330 *.TaRoNiS 2333 | 2331 *.desu 2334 | 2332 *.SHRUG2 2335 | 2333 *.\[thunderhelp@airmail.cc\].thunder 2336 | 2334 *.LanRan2.0.5 2337 | 2335 *.\[dsupport@protonmail.com\] 2338 | 2336 *.jewsomware 2339 | 2337 *.\[Filesreturn247@gmx.de\].lock 2340 | 2338 *.##___POLICJA!!!___TEN_PLIK_ZOSTA 2341 | 2339 *.animus 2342 | 2340 *.\[evil@cock.lu\].EVIL 2343 | 2341 *.\[mrbin775@gmx.de\].bin 2344 | 2342 *.DATA_IS_SAFE_YOU_NEED_TO_MAKE_THE_PAYMENT_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_LOST_FOREVER_PLEASE_BE_REZONABLE_IS_NOT_A_JOKE_TIME_IS_LIMITED 2345 | 2343 *.XVNAW 2346 | 2344 *.24H 2347 | 2345 *.\[eV3rbe@rape.lol\].eV3rbe 2348 | 2346 *.SHRUG 2349 | 2347 *.KUAJW 2350 | 2348 *.\[btc2018@tutanota.de\].meduza 2351 | 2349 *.coder007@protonmail.com 2352 | 2350 *\[qmqtt@protonmail.ch\].HRM 2353 | 2351 *\[qrrqtt@protonmail.ch\].HRM 2354 | 2352 *.choda 2355 | 2353 *.ransomcrypt 2356 | 2354 FILES.TXT 2357 | 2355 *.nozelesn 2358 | 2356 *.KRAB 2359 | 2357 *.Aurora 2360 | 2358 *.bomber 2361 | 2359 *.BtcKING 2362 | 2360 *.CyberSCCP 2363 | 2361 *.ssimpotashka@gmail.com 2364 | 2362 *.PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_to_make_the_payment 2365 | 2363 *@cock.email 2366 | 2364 *.recme 2367 | 2365 *.king_ouroboros* 2368 | 2366 *.omerta 2369 | 2367 *.\[XAVAX@PM.ME\].omerta 2370 | 2368 *.donut 2371 | 2369 *.volcano 2372 | 2370 *.jungle@anonymousspechcom 2373 | 2371 *.Alkohol 2374 | 2372 *.oneway 2375 | 2373 *.ONYX 2376 | 2374 *.fastsupport@xmpp.jp 2377 | 2375 *.BIG4+ 2378 | 2376 *.leen 2379 | 2377 *.horsuke@nuke.africa 2380 | 2378 *.DiskDoctor 2381 | 2379 *.qnbqw 2382 | 2380 *.ssananunak1987@protonmail.com.b2fr 2383 | 2381 *.codyprince92@mail.com.ovgm 2384 | 2382 *.fastrecovery@airmail.cc 2385 | 2383 *.reycarnasi1983@protonmail.com.gw3w 2386 | 2384 *.billingsupp 2387 | 2385 *.ndpyhss 2388 | 2386 *.SF 2389 | 2387 *.digiworldhack@tutanota.com 2390 | 2388 RESTORE-SIGRUN.* 2391 | 2389 *id-*.BI_ID 2392 | 2390 *.cryptgh0st 2393 | 2391 *.emilysupp 2394 | 2392 *.RedEye 2395 | 2393 *.AdolfHitler 2396 | 2394 *.crybrazil 2397 | 2395 *.infovip@airmail.cc 2398 | 2396 *.REBUS 2399 | 2397 filesinfo.txt 2400 | 2398 !!!!RESTORE_FILES!!!.txt 2401 | 2399 *.insta 2402 | 2400 *.CONTACTUS 2403 | 2401 *.osk 2404 | 2402 *.\[pain@cock.lu\].pain 2405 | 2403 *.embrace 2406 | 2404 Decoding help.hta 2407 | 2405 *.karne 2408 | 2406 *.setimichas1971@protonmail.com.b4wq 2409 | 2407 *.decodeme666tutanota_com 2410 | 2408 *.josep 2411 | 2409 *.decodeme666@tutanota_com 2412 | 2410 *.cdrpt 2413 | 2411 *.SEPSIS 2414 | 2412 *.ransomed@india.com 2415 | 2413 *.sigrun 2416 | 2414 *.booknish 2417 | 2415 *.bip 2418 | 2416 *.\[Sepsis@protonmail.com\].SEPSIS 2419 | 2417 *.MTXLOCK 2420 | 2418 *.RansomAES 2421 | 2419 *.PAUSA 2422 | 2420 *.hac 2423 | 2421 *.\[BaYuCheng@yeah.net\].china 2424 | 2422 *.UselessFiles 2425 | 2423 *.GrAnoSinSa 2426 | 2424 *.rand 2427 | 2425 HOW DECRIPT FILES.hta 2428 | 2426 *.kcwenc 2429 | 2427 *.mich 2430 | 2428 *.OBLIVION 2431 | 2429 *.cryptfile 2432 | 2430 *.BlackRouter 2433 | 2431 *.pay2me 2434 | 2432 *.Satyr 2435 | 2433 *.sorry 2436 | 2434 *.tron 2437 | 2435 *.sky 2438 | 2436 *.NMCRYPT 2439 | 2437 *@tutanota.com\] 2440 | 2438 *@tuta.io\] 2441 | 2439 *.Horros 2442 | 2440 *.LolSec 2443 | 2441 Perfect.sys 2444 | 2442 *.d3g1d5 2445 | 2443 *.excuses 2446 | 2444 *.cock.email 2447 | 2445 *.MOLE66 2448 | 2446 *.*.sell 2449 | 2447 UselessDisk.exe 2450 | 2448 *.EGG 2451 | 2449 *.JFCWF 2452 | 2450 wormDll*.dll 2453 | 2451 ScreenLocker_x86.dll 2454 | 2452 SsExecutor_x86.exe 2455 | 2453 Spreader_x86.dll 2456 | 2454 tabDll*.dll 2457 | 2455 Zenis-*.* 2458 | 2456 *.xwz 2459 | 2457 *.Stinger 2460 | 2458 0000-SORRY-FOR-FILES.html 2461 | 2459 READ_ME_HELP.png 2462 | 2460 READ_ME_HELP.txt 2463 | 2461 *.\[restorehelp@qq.com\].java 2464 | 2462 *.FRS 2465 | 2463 Zenis-Instructions.html 2466 | 2464 *.\[batmanbitka1@cock.li\].arena 2467 | 2465 *.koreaGame 2468 | 2466 *.improved 2469 | 2467 *.\[volcano666@tutanota.de\].volcano 2470 | 2468 *@adsoleware.com* 2471 | 2469 *.kwaaklocked 2472 | 2470 _XiaoBa_Info_.hta 2473 | 2471 *.XiaoBa 2474 | 2472 *.cypher 2475 | 2473 *.bananaCrypt 2476 | 2474 *BlockBax* 2477 | 2475 ownertrust.txt 2478 | 2476 qwerty-pub.key 2479 | 2477 *.igza4c 2480 | 2478 *.Nutella 2481 | 2479 *.\[everbe@airmail.cc\].everbe 2482 | 2480 *.Sil3nt5pring 2483 | 2481 *.Crab 2484 | 2482 *.jodis 2485 | 2483 *.jes 2486 | 2484 *.Bitconnect 2487 | 2485 *.arrow 2488 | 2486 *.contact-me-here-for-the-key-admin@adsoleware.com 2489 | 2487 *.leenapidx 2490 | 2488 *.creeper 2491 | 2489 *.Encrypted\[BaYuCheng@yeah.net\].XiaBa 2492 | 2490 *.styver 2493 | 2491 *.leenapidx@snakebite.com.hrhr 2494 | 2492 *.YOU-ARE-FUCKED-BY-BALILUWARE-(CODED-BY-HEROPOINT) 2495 | 2493 *.frmvrlr2017 2496 | 2494 *.SUSPENDED 2497 | 2495 Restore Files.TxT 2498 | 2496 *.ANNABELLE 2499 | 2497 *.messenger-* 2500 | 2498 *.\[ID62133703\] 2501 | 2499 *.nazcrypt 2502 | 2500 *.THANATOS 2503 | 2501 *.ransomwared 2504 | 2502 *.saturn 2505 | 2503 *.干物妹！ 2506 | 2504 *.happyness 2507 | 2505 *\[ignatevv330@gmail.com\].java 2508 | 2506 *fuga139gh@dr.com* 2509 | 2507 *.Tornado 2510 | 2508 *.david 2511 | 2509 *.defender 2512 | 2510 *.blank 2513 | 2511 matrix-readme.rtf 2514 | 2512 WhatHappenedWithFiles.rtf 2515 | 2513 WhatHappenedWithMyFiles.rtf 2516 | 2514 Readme-Matrix.rtf 2517 | 2515 #_#WhatWrongWithMyFiles#_#.rtf 2518 | 2516 *_\[LINERSMIK@NAVER.COM\]\[JINNYG@TUTANOTA 2519 | 2517 *.honor 2520 | 2518 *.twist 2521 | 2519 *ReadMe_Decryptor.txt 2522 | 2520 .\[decryptor@cock.li\].dcrtr 2523 | 2521 *.blackruby 2524 | 2522 *.justice 2525 | 2523 *.adam 2526 | 2524 *...Files-Frozen-NEED-TO-MAKE-PAYMENT… 2527 | 2525 *.\[GuardBTC@cock.li\].java 2528 | 2526 *.bunny 2529 | 2527 *.lockme 2530 | 2528 *.DREAM 2531 | 2529 *.same 2532 | 2530 *.write 2533 | 2531 *.b89b 2534 | 2532 *.GDCB 2535 | 2533 *.\[decrypthelp@qq.com\].java 2536 | 2534 *.block 2537 | 2535 *.DEUSCRYPT 2538 | 2536 *.notfoundrans 2539 | 2537 *.howcanihelpusir 2540 | 2538 *.happenencedfiles 2541 | 2539 *.AreYouLoveMyRansFile 2542 | 2540 *.country82000 2543 | 2541 *.insane 2544 | 2542 *.qwerty 2545 | 2543 *.LOCKED_BY_pablukl0cker 2546 | 2544 *.\[insane@airmail.cc\].insane 2547 | 2545 *.velso 2548 | 2546 *.\[stopstorage@qq.com\].java 2549 | 2547 *.\[bacon@oddwallps.com\].java 2550 | 2548 *.PLANETARY 2551 | 2549 *.CryptWalker 2552 | 2550 *.Infinite 2553 | 2551 *.\[satan2018@protonmail.com\].java 2554 | 2552 *.LTML 2555 | 2553 *.\[decodingfiles@tuta.io\].java 2556 | 2554 *.kryptonite 2557 | 2555 *.Server 2558 | 2556 *.leon 2559 | 2557 *.vrmrkz 2560 | 2558 *.1btc 2561 | 2559 *.\[Bas_ket@aol.com\].java 2562 | 2560 *.id-02B52D6C.\[Bas_ket@aol.com\].java 2563 | 2561 *.sysdown 2564 | 2562 *.gigahertz 2565 | 2563 *.rapid 2566 | 2564 *.triple_m 2567 | 2565 *.info 2568 | 2566 *.weapologize 2569 | 2567 *.tastylock 2570 | 2568 *.blind2 2571 | 2569 *.STOP 2572 | 2570 *.wtf 2573 | 2571 *.\[supp01@arimail.cc\].napoleon 2574 | 2572 *.File 2575 | 2573 *.\[pain@onefinedstay.com\].java 2576 | 2574 *.godra 2577 | 2575 *.maniac 2578 | 2576 *.VENDETTA 2579 | 2577 *.\[Hardcorrr@protonmail.com\].java 2580 | 2578 *.\[Hardcorr@protonmail.com\].java 2581 | 2579 *.satan 2582 | 2580 *.fix 2583 | 2581 *.GORILLA 2584 | 2582 *.CHRISTMAS 2585 | 2583 *.\[slaker@india.com\]*.wallet 2586 | 2584 *.492 2587 | 2585 *.Cyclone 2588 | 2586 *.katipuneros 2589 | 2587 *.styx 2590 | 2588 *.RDWF 2591 | 2589 *.wmfxdqz 2592 | 2590 *.Work 2593 | 2591 *.noblis 2594 | 2592 *.DS335 2595 | 2593 *.\[skeleton@rape.lol\].skeleton 2596 | 2594 *.e4m 2597 | 2595 *.encencenc 2598 | 2596 *.executioner 2599 | 2597 *.CerBerSysLocked0009881 2600 | 2598 *.spider 2601 | 2599 *.\[blind@cock.li\].blind 2602 | 2600 *.0wn3dyou 2603 | 2601 *.Frivolity 2604 | 2602 *.lime 2605 | 2603 *.\[paradisecity@cock.li\].arena 2606 | 2604 _READ_ME_FOR_DECRYPT.txt 2607 | 2605 *.\[amagnus@india.com\].wallet 2608 | 2606 *.eTeRnItY 2609 | 2607 *.bit 2610 | 2608 *.dxjay 2611 | 2609 *.dwbiwty 2612 | 2610 *.xhspythxn 2613 | 2611 *.fbuvkngy 2614 | 2612 *.RansomMine 2615 | 2613 *.MTC 2616 | 2614 *.napoleon 2617 | 2615 *.dlenggrl 2618 | 2616 *.TEST 2619 | 2617 *.GOTYA 2620 | 2618 *.maxicrypt 2621 | 2619 *.\[maxicrypt@cock.li\].maxicrypt 2622 | 2620 *.encrptd 2623 | 2621 *.vpgvlkb 2624 | 2622 *.areyoulovemyrans 2625 | 2623 *.shadow 2626 | 2624 *.\[suupport@protonmail.com\].scarab 2627 | 2625 *.cock.li 2628 | 2626 *.aajf 2629 | 2627 *.iGotYou 2630 | 2628 *.Ipcrestore 2631 | 2629 *.PHOBOS 2632 | 2630 *.fairytail 2633 | 2631 *.fucku 2634 | 2632 *.basslock 2635 | 2633 *.wdie 2636 | 2634 *.wsmile 2637 | 2635 *.wndie 2638 | 2636 *.0000 2639 | 2637 *.RASTAKHIZ 2640 | 2638 *.PANDA 2641 | 2639 *.BIG1 2642 | 2640 *.TRUE 2643 | 2641 *.am 2644 | 2642 *.kill 2645 | 2643 *.kimchenyn 2646 | 2644 *.XZZX 2647 | 2645 *.fat32 2648 | 2646 *.##ENCRYPTED_BY_pablukl0cker## 2649 | 2647 *aes_ni_gov 2650 | 2648 *.aes_ni 2651 | 2649 *.bloked 2652 | 2650 *.cripted 2653 | 2651 *.filesfucked 2654 | 2652 *.cryptx* 2655 | 2653 *.how_to_recover*.* 2656 | 2654 *.help_restore*.* 2657 | 2655 *.restore_fi*.* 2658 | 2656 *.ukr.net* 2659 | 2657 *.qq_com* 2660 | 2658 Wo_sind_meine_Dateien.htm* 2661 | 2659 *.fake 2662 | 2660 *.cobra 2663 | 2661 *\].block 2664 | 2662 !!!GetBackData!!!.txt 2665 | 2663 *.HRM 2666 | 2664 *.skvtb 2667 | 2665 *.game 2668 | 2666 *.Losers 2669 | 2667 *.gr3g 2670 | 2668 *.oni 2671 | 2669 *.sinta 2672 | 2670 *.libbywovas@dr.com.gr3g 2673 | 2671 *.xiaoba33 2674 | 2672 *.xiaoba32 2675 | 2673 *.xiaoba31 2676 | 2674 *.xiaoba30 2677 | 2675 *.xiaoba29 2678 | 2676 *.xiaoba28 2679 | 2677 *.xiaoba27 2680 | 2678 *.xiaoba26 2681 | 2679 *.xiaoba25 2682 | 2680 *.xiaoba24 2683 | 2681 *.xiaoba23 2684 | 2682 *.xiaoba22 2685 | 2683 *.xiaoba21 2686 | 2684 *.xiaoba20 2687 | 2685 *.xiaoba19 2688 | 2686 *.xiaoba18 2689 | 2687 *.xiaoba17 2690 | 2688 *.xiaoba16 2691 | 2689 *.xiaoba15 2692 | 2690 *.xiaoba14 2693 | 2691 *.xiaoba13 2694 | 2692 *.xiaoba12 2695 | 2693 *.xiaoba11 2696 | 2694 *.xiaoba10 2697 | 2695 *.xiaoba9 2698 | 2696 *.xiaoba8 2699 | 2697 *.xiaoba7 2700 | 2698 *.xiaoba6 2701 | 2699 *.xiaoba5 2702 | 2700 *.xiaoba4 2703 | 2701 *.xiaoba3 2704 | 2702 *.xiaoba2 2705 | 2703 *.XiaoBa1 2706 | 2704 *.XiaoBa34 2707 | 2705 *.colecyrus@mail.com.b007 2708 | 2706 allcry_upx.exe 2709 | 2707 *-PLIIKI.txt 2710 | 2708 dispci.exe 2711 | 2709 cscc.dat 2712 | 2710 infpub.dat 2713 | 2711 LEIA_ME.txt 2714 | 2712 *.lordofshadow 2715 | 2713 *.SaherBlueEagleRansomware 2716 | 2714 *.\[MAXVISION@SECMAIL.PRO\].CRIPTOGRAFADO 2717 | 2715 !____________DESKRYPT@TUTAMAIL.COM________.rar 2718 | 2716 How_Decrypt_Files.hta 2719 | 2717 *.Ordinal 2720 | 2718 *.aes! 2721 | 2719 READ_ME_FOR_DECRYPT_*.txt 2722 | 2720 *.ihsdj 2723 | 2721 *.kgpvwnr 2724 | 2722 *.LIN 2725 | 2723 *.CHAK 2726 | 2724 *.Chartogy 2727 | 2725 *.viiper 2728 | 2726 *.x1881 2729 | 2727 *.stroman 2730 | 2728 *.asasin 2731 | 2729 *.BUGWARE 2732 | 2730 *.SENRUS17 2733 | 2731 !! RETURN FILES !!.txt 2734 | 2732 *.loveransisgood 2735 | 2733 *.PayDay 2736 | 2734 *.allcry 2737 | 2735 *.lockd 2738 | 2736 *.PRIVAT66 2739 | 2737 *.SHARK 2740 | 2738 005-DO-YOU-WANT-FILES.html 2741 | 2739 *.# 2742 | 2740 *.CyberSoldiersST 2743 | 2741 *.wyvern 2744 | 2742 *.technicy 2745 | 2743 *.cyberdrill 2746 | 2744 *.ZW 2747 | 2745 *.myransext2017 2748 | 2746 *.ykcol 2749 | 2747 *.XmdXtazX. 2750 | 2748 *.albertkerr94@mail.com.m5m5 2751 | 2749 *.cryptojoker 2752 | 2750 *.Doxes 2753 | 2751 *.XmdXtazX 2754 | 2752 *.blind 2755 | 2753 *.Locked_file 2756 | 2754 *.HeroesOftheStorm 2757 | 2755 *.dian 2758 | 2756 *.mind 2759 | 2757 *.H_F_D_locked 2760 | 2758 *.reaGAN 2761 | 2759 *.INCANTO 2762 | 2760 *.pablukCRYPT 2763 | 2761 *.gocr 2764 | 2762 *.revolution 2765 | 2763 *.disposed2017 2766 | 2764 *.armadilo1 2767 | 2765 *.trevinomason1@mail.com.vsunit 2768 | 2766 *.\[Brazzers@aolonline.top\].arena 2769 | 2767 _RECoVERY_+*.* 2770 | 2768 *.__dilmaV1 2771 | 2769 *.hacked 2772 | 2770 *.\[assistance@firemail.cc\].nuclear 2773 | 2771 READ_THIS_FILE_1.TXT 2774 | 2772 *.pnr 2775 | 2773 *.{ljspqk7@aol.com}.BRT92 2776 | 2774 *.ILLNEST 2777 | 2775 *.OhNo! 2778 | 2776 *.akira 2779 | 2777 *..txt 2780 | 2778 *.3nCRY 2781 | 2779 *.clinTON 2782 | 2780 RESTORE_INFO-*.txt 2783 | 2781 *.BUSH 2784 | 2782 *.\[black.world@tuta.io\].nuclear 2785 | 2783 *.CryptedOpps 2786 | 2784 *.crypt12 2787 | 2785 *.OTR 2788 | 2786 Important_Read_Me.txt 2789 | 2787 *.JezRoz 2790 | 2788 *.UNLIS 2791 | 2789 *.granny 2792 | 2790 *.shinigami 2793 | 2791 *.PA-SIEM 2794 | 2792 *.flat 2795 | 2793 TUTORIEL.bmp 2796 | 2794 *.xolzsec 2797 | 2795 *.Flux 2798 | 2796 *.Blocked2 2799 | 2797 *.wooly 2800 | 2798 *.nuclear 2801 | 2799 *.area 2802 | 2800 *.EMPTY 2803 | 2801 *.arena 2804 | 2802 lukitus.html 2805 | 2803 *.zuzya 2806 | 2804 *.{saruman7@india.com}.BRT92 2807 | 2805 *.CYRON 2808 | 2806 *.#Locky 2809 | 2807 *.ERROR 2810 | 2808 *.EV 2811 | 2809 *.lokitus 2812 | 2810 *.lukitus-tiedostopäätettä 2813 | 2811 *.fmoon 2814 | 2812 *.cesar 2815 | 2813 *.lukitus 2816 | 2814 *.KK 2817 | 2815 *.prosperous666 2818 | 2816 *.\[actum_signum@aol.com\].onion 2819 | 2817 *.encrypted\[Payfordecrypt@protonmail.com\] 2820 | 2818 *.enc 2821 | 2819 *.anubi 2822 | 2820 *.D2550A49BF52DFC23F2C013C5 2823 | 2821 *.LEGO 2824 | 2822 *.Cerber_RansomWare@qq.com 2825 | 2823 *.0x009d8a 2826 | 2824 *.3301 2827 | 2825 *.ZABLOKOWANE 2828 | 2826 *.pabluklocker 2829 | 2827 *.cezar 2830 | 2828 *.cnc 2831 | 2829 *.trump 2832 | 2830 *.Crypton 2833 | 2831 *.rumblegoodboy 2834 | 2832 *.BONUM 2835 | 2833 *.\[cho.dambler@yandex.com\] 2836 | 2834 diablo6-*.htm 2837 | 2835 *.DIABLO6 2838 | 2836 *.PEDO 2839 | 2837 *.HELLO 2840 | 2838 *.ACTUM 2841 | 2839 *.OGONIA 2842 | 2840 *.WAmarlocked 2843 | 2841 !## DECRYPT FILES ##!.txt 2844 | 2842 *.nopasaran 2845 | 2843 *.gryphon 2846 | 2844 ebay-msg.html 2847 | 2845 ebay_was_here 2848 | 2846 *.ebay 2849 | 2847 *.491 2850 | 2848 *.mtk118 2851 | 2849 *.490 2852 | 2850 *.shutdown57 2853 | 2851 *.PIRATE 2854 | 2852 *.wxdrJbgSDa 2855 | 2853 *.sea 2856 | 2854 *.PLIN 2857 | 2855 *.726 2858 | 2856 *.SEVENDAYS 2859 | 2857 *.nemesis 2860 | 2858 *.ocean 2861 | 2859 *.rose 2862 | 2860 *.\[avalona.toga@aol.com\].blocking 2863 | 2861 *.Node0 2864 | 2862 *.supported2017 2865 | 2863 RECOVER-FILES.html 2866 | 2864 READ_ME_ASAP.txt 2867 | 2865 _iWasHere.txt 2868 | 2866 !!!SAVE YOUR FILES!.bmp 2869 | 2867 !!!!!SAVE YOUR FILES!!!!.txt 2870 | 2868 @decrypt_your_files.txt 2871 | 2869 HowToDecryptIMPORTANT!.txt 2872 | 2870 *.WINDOWS 2873 | 2871 *.bbqb 2874 | 2872 *.725 2875 | 2873 *.DG 2876 | 2874 *.Srpx 2877 | 2875 *.freefoam 2878 | 2876 *.MyChemicalRomance4EVER 2879 | 2877 *.extension.srpx 2880 | 2878 *.fuck_you_av_we_are_not_globe_fake 2881 | 2879 *.BRT92 2882 | 2880 *.qwqd 2883 | 2881 IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT 2884 | 2882 *.TGIF 2885 | 2883 *.snake 2886 | 2884 *.MOLE03 2887 | 2885 *.MOLE04 2888 | 2886 *.Petya 2889 | 2887 *.HAPP 2890 | 2888 *.bam! 2891 | 2889 *.Atom 2892 | 2890 *.GOTHAM 2893 | 2891 *.skunk 2894 | 2892 *.symbiom_ransomware_locked 2895 | 2893 *.CK 2896 | 2894 *.HUSTONWEHAVEAPROBLEM@KEEMAIL.ME 2897 | 2895 *.yl 2898 | 2896 *.ZAYKA 2899 | 2897 *.NOOB 2900 | 2898 *.crptd 2901 | 2899 Instruction for file recovery.txt 2902 | 2900 *.\[mich78@usa.com\] 2903 | 2901 *.Reyptson 2904 | 2902 *.explorer 2905 | 2903 *.au1crypt 2906 | 2904 *.s1crypt 2907 | 2905 *.alosia 2908 | 2906 *.korea 2909 | 2907 *.POHU 2910 | 2908 *.Ransed 2911 | 2909 *.EXTE 2912 | 2910 _HELP_INSTRUCTION.TXT 2913 | 2911 *.Malki 2914 | 2912 *.707 2915 | 2913 *.A604AF9070 2916 | 2914 *.scorpio 2917 | 2915 *id-*_\[*@*.*\].* 2918 | 2916 *.Cry128 2919 | 2917 *.Cry36 2920 | 2918 *.Cry9 2921 | 2919 *.xz 2922 | 2920 *.readme_txt 2923 | 2921 Ransom.rtf 2924 | 2922 *.OXR 2925 | 2923 *.acc 2926 | 2924 *.MOLE01 2927 | 2925 *.3ncrypt3d 2928 | 2926 *.AZER 2929 | 2927 _INTERESTING_INFORMACION_FOR_DECRYPT.TXT 2930 | 2928 *.dcry 2931 | 2929 *.MOLE00 2932 | 2930 *.LoveYou 2933 | 2931 *.z3r0 2934 | 2932 *.4x82N 2935 | 2933 *.63vc4 2936 | 2934 *.BELGIAN_COCOA 2937 | 2935 RESTORE-.-FILES.txt 2938 | 2936 *.moments2900 2939 | 2937 *.0x004867 2940 | 2938 *.MMM 2941 | 2939 *.rat 2942 | 2940 *.aleta 2943 | 2941 *.ranrans 2944 | 2942 *.lalabitch, 2945 | 2943 *.gankLocked 2946 | 2944 *.ipygh 2947 | 2945 *.via 2948 | 2946 dllhost.dat 2949 | 2947 FE04.tmp 2950 | 2948 027cc450ef5f8c5f653329641ec1fed9*.* 2951 | 2949 petwrap.exe 2952 | 2950 *.lamo 2953 | 2951 File_Encryption_Notice.txt 2954 | 2952 *.suppose666 2955 | 2953 *.mention9823 2956 | 2954 *.breeding123 2957 | 2955 *.sux 2958 | 2956 *.cfm 2959 | 2957 *.Wana Decrypt0r Trojan-Syria Editi0n 2960 | 2958 Paxynok.html 2961 | 2959 *.pscrypt 2962 | 2960 *.a990 2963 | 2961 Tempimage.jpg 2964 | 2962 *.Tesla 2965 | 2963 WannaCry.TXT 2966 | 2964 *.kuntzware 2967 | 2965 *.nsmf 2968 | 2966 *.Facebook 2969 | 2967 *.pizdosik 2970 | 2968 *.\[resque@plague.desi\].scarab 2971 | 2969 *.sux.AES128 2972 | 2970 *.cspider 2973 | 2971 *.\[teroda@bigmir.net\].masterteroda@bigmir.net 2974 | 2972 *.zbt 2975 | 2973 *.MOLE02 2976 | 2974 your_key.rsa 2977 | 2975 OkuBeni.txt 2978 | 2976 *@*.blocking 2979 | 2977 *.ogre 2980 | 2978 *.tax 2981 | 2979 StrutterGear.exe 2982 | 2980 ReadMe_Important.txt 2983 | 2981 Sifre_Coz_Talimat.html 2984 | 2982 *.whycry 2985 | 2983 !READ.htm 2986 | 2984 !_ИНСТРУКЦИЯ_!.txt 2987 | 2985 *.cr020801 2988 | 2986 *.cerber6 2989 | 2987 *.netn6 2990 | 2988 *.rnsmwre 2991 | 2989 *.ghost 2992 | 2990 *.scarab 2993 | 2991 IF_YOU_WANT_TO_GET_ALL_YOUR_FILES_BACK_PLEASE_READ_THIS.TXT 2994 | 2992 *.R4bb0l0ck 2995 | 2993 *.TraNs 2996 | 2994 #HOW_TO_UNRIP#.txt 2997 | 2995 *.BeethoveN 2998 | 2996 * .tdelf 2999 | 2997 *.spectre 3000 | 2998 mood-ravishing-hd-wallpaper-142943312215.jpg 3001 | 2999 Blooper.exe 3002 | 3000 SintaLocker.exe 3003 | 3001 SintaRun.py 3004 | 3002 *.switch 3005 | 3003 *.payforunlock 3006 | 3004 HOW TO RECOVER ENCRYPTED FILES.TXT 3007 | 3005 README_FOR_DECRYPT.txt 3008 | 3006 *.dolphin 3009 | 3007 *.dviide 3010 | 3008 *.sVn 3011 | 3009 *.R3K7M9 3012 | 3010 *.BMCODE 3013 | 3011 *.zilla 3014 | 3012 *.RaaS 3015 | 3013 *.resurrection 3016 | 3014 *.lost 3017 | 3015 *.ram 3018 | 3016 *.master 3019 | 3017 *.brickr 3020 | 3018 READ_DECRYPT_FILES.txt 3021 | 3019 *.ramen 3022 | 3020 *.TRMT 3023 | 3021 *.gommemode 3024 | 3022 *.andonio 3025 | 3023 *.phantom 3026 | 3024 *.r3store 3027 | 3025 Read me for help thanks.txt 3028 | 3026 *.imsorry 3029 | 3027 help_to_decrypt.txt 3030 | 3028 *.YYTO 3031 | 3029 *.read_to_txt_file.yyto 3032 | 3030 *.beep 3033 | 3031 *.666 3034 | 3032 AArI.jpg 3035 | 3033 *.crying 3036 | 3034 *.antihacker2017 3037 | 3035 *.theworldisyours 3038 | 3036 *.spora 3039 | 3037 *.sexy 3040 | 3038 *.realfs0ciety@sigaint.org.fs0ciety 3041 | 3039 *.pays 3042 | 3040 *.payrms 3043 | 3041 *.paymts 3044 | 3042 *.paymrss 3045 | 3043 *.paym 3046 | 3044 *.lol 3047 | 3045 *.madebyadam 3048 | 3046 *.locklock 3049 | 3047 *.lcked 3050 | 3048 *.kyra 3051 | 3049 *.kernel_time 3052 | 3050 *.kernel_pid 3053 | 3051 *.kernel_complete 3054 | 3052 *.ifuckedyou 3055 | 3053 *.grt 3056 | 3054 *.crypte 3057 | 3055 *.cbu1 3058 | 3056 *-webmafia@asia.com_donald@trampo.info 3059 | 3057 *.beef 3060 | 3058 *.write_us_on_email 3061 | 3059 *.LIGHTNING 3062 | 3060 *.xfile 3063 | 3061 DECRYPTION.TXT 3064 | 3062 *.oled 3065 | 3063 *.wtdi 3066 | 3064 *.4rwcry4w 3067 | 3065 *.Encrypted_By_VMola.com 3068 | 3066 *.wlu 3069 | 3067 Restore_maysomware_files.html 3070 | 3068 *.maysomware 3071 | 3069 *.damoclis 3072 | 3070 *.decrypter@tutanota.com 3073 | 3071 *.VisionCrypt 3074 | 3072 *.pwned 3075 | 3073 how_to_back_files.html 3076 | 3074 *.hNcrypt 3077 | 3075 *.~xdata~ 3078 | 3076 *.b0ff 3079 | 3077 Galaperidol.exe 3080 | 3078 HOW_CAN_I_DECRYPT_MY_FILES.txt 3081 | 3079 *.xdata 3082 | 3080 Hello There! Fellow @kee User!.txt 3083 | 3081 *.kee 3084 | 3082 *.grux 3085 | 3083 Restore_your_files.txt 3086 | 3084 READ_ME.html 3087 | 3085 *.mordor 3088 | 3086 *.die 3089 | 3087 *.SaMsUnG 3090 | 3088 !#_DECRYPT_#!.inf 3091 | 3089 *.nuke55 3092 | 3090 *.onyon 3093 | 3091 *.blocked 3094 | 3092 !Please Read Me!.txt 3095 | 3093 !WannaDecryptor!.exe.lnk 3096 | 3094 *.DARKCRY 3097 | 3095 *.wincry 3098 | 3096 *.wncrypt 3099 | 3097 WannaCrypt 4.0.exe 3100 | 3098 t.wry 3101 | 3099 *.vCrypt1 3102 | 3100 *.theva 3103 | 3101 tor.exe 3104 | 3102 tasksche.exe 3105 | 3103 wcry.zip 3106 | 3104 taskhsvc.exe 3107 | 3105 taskse.exe 3108 | 3106 taskdl.exe 3109 | 3107 *.pky 3110 | 3108 *.eky 3111 | 3109 wcry.exe 3112 | 3110 Wannacry.exe 3113 | 3111 @WanaDecryptor@.* 3114 | 3112 *.slvpawned 3115 | 3113 *.WCRYT 3116 | 3114 *.WRNY 3117 | 3115 *.LOCKED.txt 3118 | 3116 *.wncryt 3119 | 3117 *.wnry 3120 | 3118 *.viki 3121 | 3119 RESTORE-12345-FILES.TXT 3122 | 3120 *.donation1@protonmail.ch.12345 3123 | 3121 *.block_file12 3124 | 3122 *.@decrypt2017 3125 | 3123 *.vdul 3126 | 3124 *.2cXpCihgsVxB3 3127 | 3125 *.son 3128 | 3126 loptr-*.htm 3129 | 3127 *.paycyka 3130 | 3128 *.medal 3131 | 3129 *.bagi 3132 | 3130 @Please_Read_Me@.txt 3133 | 3131 *.wncry 3134 | 3132 _!!!_README_!!!_* 3135 | 3133 _!!!_README_!!!_*_.hta 3136 | 3134 _!!!_README_!!!_*_ .txt 3137 | 3135 *.news 3138 | 3136 *.corrupted 3139 | 3137 HOW_TO_DECRYPT_FILES.html 3140 | 3138 *.shifr 3141 | 3139 DECRYPT_INFO.txt 3142 | 3140 *.FailedAccess 3143 | 3141 Cversions.2.db 3144 | 3142 *.helppme@india.com.* 3145 | 3143 ReadME_Decrypt_Help_*.html 3146 | 3144 *.fartplz 3147 | 3145 * .vCrypt1 3148 | 3146 *.xncrypt 3149 | 3147 *.Lockify 3150 | 3148 *.htrs 3151 | 3149 *.cryptowin 3152 | 3150 *.owned 3153 | 3151 *.x0lzs3c 3154 | 3152 *.UIWIX 3155 | 3153 *.CRYPTOBOSS 3156 | 3154 *.loptr 3157 | 3155 *.jaff 3158 | 3156 *.bitkangoroo 3159 | 3157 *.cloud 3160 | 3158 zcrypt.exe 3161 | 3159 *.uk-dealer@sigaint.org 3162 | 3160 *_luck 3163 | 3161 *.decrypt2017 3164 | 3162 *.\[admin@hoist.desi\].*.WALLET 3165 | 3163 *.\[crysis@life.com\].*.WALLET 3166 | 3164 *.\[SHIELD0@USA.COM\].*.WALLET 3167 | 3165 #_RESTORING_FILES_#.TXT 3168 | 3166 *.haters 3169 | 3167 *.anon 3170 | 3168 *.amnesia 3171 | 3169 *.keepcalm 3172 | 3170 *.MIKOYAN 3173 | 3171 RESTORE_FILES.HTML 3174 | 3172 *.WWW 3175 | 3173 *.CRYPTED000007 3176 | 3174 *.HELPPME@INDIA.COM.ID83994902 3177 | 3175 HOW_RETURN_FILES.TXT 3178 | 3176 *.MAYA 3179 | 3177 *.CONTACT_TARINEOZA@GMAIL.COM 3180 | 3178 *.CRYPTOBYTE 3181 | 3179 *.AES 3182 | 3180 NOTE;!!!-ODZYSKAJ-PLIKI-!!!.TXT 3183 | 3181 INSTRUCTION_FOR_HELPING_FILE_RECOVERY.txt 3184 | 3182 *.ADR 3185 | 3183 *.NM4 3186 | 3184 DesktopOsiris.* 3187 | 3185 OSIRIS-*.* 3188 | 3186 redchip2.exe 3189 | 3187 *.LOLI 3190 | 3188 ATLAS_FILES.txt 3191 | 3189 *.whatthefuck 3192 | 3190 *.loveyouisreal 3193 | 3191 *.okokokokok 3194 | 3192 *.ranranranran 3195 | 3193 READ_IT_FOR_GET_YOUR_FILE.txt 3196 | 3194 *.psh 3197 | 3195 *.GETREKT 3198 | 3196 !!! READ THIS - IMPORTANT !!!.txt 3199 | 3197 *.aes_ni_0day 3200 | 3198 *.JEEPERS 3201 | 3199 PAYMENT-INSTRUCTIONS.TXT 3202 | 3200 *.LOCKOUT 3203 | 3201 *.ATLAS 3204 | 3202 *.FLATCHER3@INDIA.COM.000G 3205 | 3203 *.AES-NI 3206 | 3204 *.DEXTER 3207 | 3205 *.CONFICKER 3208 | 3206 *.ONION 3209 | 3207 *.\[NO.TORP3DA@PROTONMAIL.CH\].WALLET 3210 | 3208 *.LCKD 3211 | 3209 *.MOLE 3212 | 3210 *.RANSOM 3213 | 3211 *.lambda.l0cked 3214 | 3212 009-READ-FOR-DECCCC-FILESSS.html 3215 | 3213 _READ_THI$_FILE_* 3216 | 3214 *.I'WANT MONEY 3217 | 3215 *.gembok 3218 | 3216 !Decrypt-All-Files-*.txt 3219 | 3217 *.\[GOFMEN17@YA.RU\],CRP 3220 | 3218 *.SERP 3221 | 3219 *.kilit 3222 | 3220 0_HELP_DECRYPT_FILES.HTM 3223 | 3221 HUR_DEKRYPTERA_FILER.html 3224 | 3222 HUR_DEKRYPTERA_FILER.txt 3225 | 3223 *.LAMBDA.LOCKED 3226 | 3224 *.ADMIN@BADADMIN.XYZ 3227 | 3225 *.SKJDTHGHH 3228 | 3226 *.LOCK75 3229 | 3227 *.B10CKED 3230 | 3228 *.A95436@YA.RU 3231 | 3229 *.IWANT 3232 | 3230 *.Fuck_You 3233 | 3231 Recupere seus arquivos aqui.txt 3234 | 3232 READ TO UNLOCK FILES.salsa.*.html 3235 | 3233 *.SALSA222 3236 | 3234 *.NUMBERDOT 3237 | 3235 How Decrypt My Files.lnk 3238 | 3236 How_Decrypt_My_Files 3239 | 3237 *.CRADLE 3240 | 3238 *.ID-7ES642406.CRY 3241 | 3239 READ ME ABOUT DECRYPTION.txt 3242 | 3240 *.Do_not_change_the_file_name.cryp 3243 | 3241 *.pr0tect 3244 | 3242 *.android 3245 | 3243 *_READ_THIS_FILE_*_* 3246 | 3244 *.btcware 3247 | 3245 *drakosho_new@aol.com* 3248 | 3246 *.AngleWare 3249 | 3247 *.zorro 3250 | 3248 *.CIFGKSAFFSFYGHD 3251 | 3249 *.A9V9AHU4 3252 | 3250 *.payfordecrypt 3253 | 3251 OKU.TXT 3254 | 3252 ZINO_NOTE.TXT 3255 | 3253 *.ZINO 3256 | 3254 *.kirked 3257 | 3255 *.CRPTXXX 3258 | 3256 HOW_TO_FIX_!.TXT 3259 | 3257 *.\[BRAINCRYPT@INDIA.COM\].BRAINCRYPT 3260 | 3258 *.pizdec 3261 | 3259 *.REVENGE 3262 | 3260 !!!READ_TO_UNLOCK!!!.TXT 3263 | 3261 *.openforyou@india.com 3264 | 3262 *.warn_wallet 3265 | 3263 *.nemo-hacks.at.sigaint.org 3266 | 3264 *.MATRIX 3267 | 3265 Crytp0l0cker.Upack.dll 3268 | 3266 Crytp0l0cker.dll 3269 | 3267 Crytp0l0cker.exe 3270 | 3268 decrypted_files.dat 3271 | 3269 padcryptUninstaller.exe 3272 | 3270 PadCrypt.exe 3273 | 3271 Vape Launcher.exe 3274 | 3272 READ_ME_!.txt 3275 | 3273 *.enjey 3276 | 3274 Aescrypt.exe 3277 | 3275 *.GG 3278 | 3276 *.\[PINGY@INDIA.COM\] 3279 | 3277 *.WORMKILLER@INDIA.COM.XTBL 3280 | 3278 *.CEBER3 3281 | 3279 IF_WANT_FILES_BACK_PLS_READ.html 3282 | 3280 *.iaufkakfhsaraf 3283 | 3281 _HELP_HELP_HELP_* 3284 | 3282 zXz.html 3285 | 3283 *.zXz 3286 | 3284 VictemKey_*_* 3287 | 3285 HVORDAN_DU_GENDANNER_FILER.html 3288 | 3286 HVORDAN_DU_GENDANNER_FILER.txt 3289 | 3287 HELP_ME_PLEASE.txt 3290 | 3288 !_RECOVERY_HELP_!.txt 3291 | 3289 PLEASE-READIT-IF_YOU-WANT.html 3292 | 3290 *.filegofprencrp 3293 | 3291 COME_RIPRISTINARE_I_FILE.* 3294 | 3292 fattura_*.js 3295 | 3293 *_steaveiwalker@india.com_ 3296 | 3294 COMO_ABRIR_ARQUIVOS.txt 3297 | 3295 *info@kraken.cc_worldcza@email.cz 3298 | 3296 *.kr3 3299 | 3297 COMO_RESTAURAR_ARCHIVOS.txt 3300 | 3298 COMO_RESTAURAR_ARCHIVOS.html 3301 | 3299 *.ENCR 3302 | 3300 *.\[File-Help@India.Com\].mails 3303 | 3301 damage@india.com* 3304 | 3302 *.tmp.exe 3305 | 3303 What happen to my files.txt 3306 | 3304 *.jeepdayz@india.com 3307 | 3305 *.BarRax 3308 | 3306 *.damage 3309 | 3307 *.locked-* 3310 | 3308 *.jey 3311 | 3309 *.CRYPTOSHIEL 3312 | 3310 *.cfk 3313 | 3311 ASSISTANCE_IN_RECOVERY.txt 3314 | 3312 #_DECRYPT_ASSISTANCE_#.txt 3315 | 3313 *.lfk 3316 | 3314 _HELP_HELP_HELP_*.hta 3317 | 3315 _HELP_HELP_HELP_*.jpg 3318 | 3316 BTC_DECRYPT_FILES.txt 3319 | 3317 *.TheTrumpLockerp 3320 | 3318 *.TheTrumpLockerf 3321 | 3319 *.d4nk 3322 | 3320 *.x3mpro 3323 | 3321 READ-READ-READ.html 3324 | 3322 *.weencedufiles 3325 | 3323 *.jse 3326 | 3324 *.powned 3327 | 3325 \[KASISKI\]* 3328 | 3326 INSTRUCCIONES.txt 3329 | 3327 @_USE_TO_FIX_*.txt 3330 | 3328 *.happydayzz 3331 | 3329 *.hasp 3332 | 3330 001-READ-FOR-DECRYPT-FILES.html 3333 | 3331 DECRYPT_INFORMATION.html 3334 | 3332 Rans0m_N0te_Read_ME.txt 3335 | 3333 email-vpupkin3@aol.com* 3336 | 3334 *.hnyear 3337 | 3335 *.hnumkhotep@india.com.hnumkhotep 3338 | 3336 *.wowwhereismyfiles 3339 | 3337 *.decryptional 3340 | 3338 *.wowreadfordecryp 3341 | 3339 *.7zipper 3342 | 3340 *.youransom 3343 | 3341 *.gui 3344 | 3342 *.Harzhuangzi 3345 | 3343 *.encryptedyourfiles 3346 | 3344 *HERMES 3347 | 3345 \[amanda_sofost@india.com\].wallet 3348 | 3346 *.wcry 3349 | 3347 *.velikasrbija 3350 | 3348 *.razarac 3351 | 3349 *.serpent 3352 | 3350 *.msj 3353 | 3351 *.szesnl 3354 | 3352 _DECRYPT_INFO_szesnl.html 3355 | 3353 000-IF-YOU-WANT-DEC-FILES.html 3356 | 3354 *.evillock 3357 | 3355 *.letmetrydecfiles 3358 | 3356 *.yourransom 3359 | 3357 *.lambda_l0cked 3360 | 3358 *.gefickt 3361 | 3359 *.HakunaMatata 3362 | 3360 *.CRYPTOSHIELD 3363 | 3361 *.weareyourfriends 3364 | 3362 MERRY_I_LOVE_YOU_BRUCE.hta 3365 | 3363 How decrypt files.hta 3366 | 3364 unCrypte@outlook.com* 3367 | 3365 decipher_ne@outlook.com* 3368 | 3366 *.potato 3369 | 3367 *.otherinformation 3370 | 3368 *.vxLock 3371 | 3369 *.rdmk 3372 | 3370 *.paytounlock 3373 | 3371 TRY-READ-ME-TO-DEC.html 3374 | 3372 EMAIL_*_recipient.zip 3375 | 3373 *.sage 3376 | 3374 *garryweber@protonmail.ch 3377 | 3375 LEER_INMEDIATAMENTE.txt 3378 | 3376 *.killedXXX 3379 | 3377 *.doomed 3380 | 3378 *.sifreli 3381 | 3379 *.MERRY 3382 | 3380 000-No-PROBLEM-WE-DEC-FILES.html 3383 | 3381 *.noproblemwedecfiles 3384 | 3382 WE-MUST-DEC-FILES.html 3385 | 3383 *.powerfulldecrypt 3386 | 3384 *.stn 3387 | 3385 *bingo@opensourcemail.org 3388 | 3386 *.id-3044989498_x3m 3389 | 3387 *.x3m 3390 | 3388 READ_ME_TO_DECRYPT_YOU_INFORMA.jjj 3391 | 3389 *.wuciwug 3392 | 3390 *.kencf 3393 | 3391 *.file0locked 3394 | 3392 file0locked.js 3395 | 3393 CryptoRansomware.exe 3396 | 3394 *.VBRANSOM 3397 | 3395 _HELP_Recover_Files_.html 3398 | 3396 *.oops 3399 | 3397 *.deria 3400 | 3398 *.RMCM1 3401 | 3399 *.Locked-by-Mafia 3402 | 3400 *.кибер разветвитель 3403 | 3401 *-filesencrypted.html 3404 | 3402 decrypt_Globe*.exe 3405 | 3403 *.hnumkhotep 3406 | 3404 DecryptFile.txt 3407 | 3405 *.L0CKED 3408 | 3406 NFS-e*1025-7152.exe 3409 | 3407 firstransomware.exe 3410 | 3408 HELP-ME-ENCED-FILES.html 3411 | 3409 *.helpmeencedfiles 3412 | 3410 *EdgeLocker*.exe 3413 | 3411 *.edgel 3414 | 3412 *.XBTL 3415 | 3413 *.firecrypt 3416 | 3414 YOUR_FILES_ARE_DEAD.hta 3417 | 3415 *.MRCR1 3418 | 3416 *.PEGS1 3419 | 3417 *.RARE1 3420 | 3418 *.airacropencrypted! 3421 | 3419 *\[cryptsvc@mail.ru\].* 3422 | 3420 WHERE-YOUR-FILES.html 3423 | 3421 *.Whereisyourfiles 3424 | 3422 *opentoyou@india.com 3425 | 3423 C-email-*-*.odcodc 3426 | 3424 *.maktub 3427 | 3425 *.hush 3428 | 3426 *.bript 3429 | 3427 _*_README.hta 3430 | 3428 _*_README.jpg 3431 | 3429 HOW_OPEN_FILES.hta 3432 | 3430 *.gangbang 3433 | 3431 GJENOPPRETTING_AV_FILER.html 3434 | 3432 GJENOPPRETTING_AV_FILER.txt 3435 | 3433 !!! HOW TO DECRYPT FILES !!!.txt 3436 | 3434 *.braincrypt 3437 | 3435 INSTRUCTION RESTORE FILE.TXT 3438 | 3436 *.lesli 3439 | 3437 Survey Locker.exe 3440 | 3438 !!!!!ATENÇÃO!!!!!.html 3441 | 3439 Receipt.exe 3442 | 3440 WindowsApplication1.exe 3443 | 3441 HWID Lock.exe 3444 | 3442 VIP72.exe 3445 | 3443 DALE_FILES.TXT 3446 | 3444 *.DALE 3447 | 3445 *.8637 3448 | 3446 *.kok 3449 | 3447 HOW_TO_RESTORE_YOUR_DATA.html 3450 | 3448 *.paymrts 3451 | 3449 *.paymds 3452 | 3450 RESTORE_CORUPTED_FILES.HTML 3453 | 3451 READ@My.txt 3454 | 3452 Cyber SpLiTTer Vbs.exe 3455 | 3453 *.flyper 3456 | 3454 000-PLEASE-READ-WE-HELP.html 3457 | 3455 *.helpdecrypt@india.com 3458 | 3456 *.VforVendetta 3459 | 3457 popcorn_time.exe 3460 | 3458 *.filock 3461 | 3459 *.wallet 3462 | 3460 *_.rmd 3463 | 3461 *.uDz2j8mv 3464 | 3462 OSIRIS-*.htm 3465 | 3463 DesktopOsiris.htm 3466 | 3464 *\[cryptservice@inbox.ru\]* 3467 | 3465 *.no_more_ransom 3468 | 3466 bahij2@india.com 3469 | 3467 *.lovewindows 3470 | 3468 *.osiris 3471 | 3469 *.R.i.P 3472 | 3470 Important!.txt 3473 | 3471 !_HOW_TO_RESTORE_*.txt 3474 | 3472 HOW_TO_RESTORE_FILES.txt 3475 | 3473 _README_*.hta 3476 | 3474 *.Zzzz 3477 | 3475 *\[lavandos@dr.com\].wallet 3478 | 3476 *.coin 3479 | 3477 *.crypted_file 3480 | 3478 *.EncrypTile 3481 | 3479 *.hcked 3482 | 3480 _README_.hta 3483 | 3481 Runsome.exe 3484 | 3482 Payment_Advice.mht 3485 | 3483 lblBitcoinInfoMain.txt 3486 | 3484 lblFinallyText.txt 3487 | 3485 lblMain.txt 3488 | 3486 *.hannah 3489 | 3487 *.vindows 3490 | 3488 How to decrypt your files.jpg 3491 | 3489 How to decrypt your files.txt 3492 | 3490 How to get data back.txt 3493 | 3491 *.zycrypt 3494 | 3492 *.sgood 3495 | 3493 *.zzzzz 3496 | 3494 xort.txt 3497 | 3495 DOSYALARINIZA ULAŞMAK İÇİN AÇINIZ.html 3498 | 3496 HOWTO_RECOVER_FILES_*.TXT 3499 | 3497 HELP_RESTORE_FILES_*.TXT 3500 | 3498 Recovery+*.html 3501 | 3499 Recovery+*.txt 3502 | 3500 _H_e_l_p_RECOVER_INSTRUCTIONS+*.png 3503 | 3501 _H_e_l_p_RECOVER_INSTRUCTIONS+*.html 3504 | 3502 help_recover_instructions+*.html 3505 | 3503 help_recover_instructions+*.BMP 3506 | 3504 _how_recover+*.html 3507 | 3505 _how_recover+*.txt 3508 | 3506 ThxForYurTyme.txt 3509 | 3507 _HOW_TO_Decrypt.bmp 3510 | 3508 _RECOVER_INSTRUCTIONS.ini 3511 | 3509 ###-READ-FOR-HELLPP.html 3512 | 3510 rtext.txt 3513 | 3511 DECRYPTION INSTRUCTIONS.txt 3514 | 3512 decrypt explanations.html 3515 | 3513 _WHAT_is.html 3516 | 3514 _HOWDO_text.html 3517 | 3515 readme_liesmich_encryptor_raas.txt 3518 | 3516 _Adatok_visszaallitasahoz_utasitasok.txt 3519 | 3517 How to restore files.hta 3520 | 3518 locked.bmp 3521 | 3519 README_TO_RECURE_YOUR_FILES.txt 3522 | 3520 Your files encrypted by our friends !!!.txt 3523 | 3521 ATTENTION.url 3524 | 3522 @WARNING_FILES_ARE_ENCRYPTED.*.txt 3525 | 3523 README!!!.txt 3526 | 3524 # README.hta 3527 | 3525 !Recovery_*.html 3528 | 3526 YourID.txt 3529 | 3527 recover.bmp 3530 | 3528 recover.txt 3531 | 3529 README HOW TO DECRYPT YOUR FILES.HTML 3532 | 3530 READ_IT.txt 3533 | 3531 *.lock93 3534 | 3532 *.!emc 3535 | 3533 *.adk 3536 | 3534 svchosd.exe 3537 | 3535 *.aesir 3538 | 3536 *.CHIP 3539 | 3537 *.happy 3540 | 3538 *.angelamerkel 3541 | 3539 *.razy1337 3542 | 3540 *.zendr4 3543 | 3541 *.dharma 3544 | 3542 *.locked3 3545 | 3543 *.duhust 3546 | 3544 *.exploit 3547 | 3545 *_crypt 3548 | 3546 *_help_instruct*.* 3549 | 3547 *!DMAlock* 3550 | 3548 *.GSupport3 3551 | 3549 *.rnsmwr 3552 | 3550 *.dCrypt 3553 | 3551 ransomed.html 3554 | 3552 *.Alcatraz 3555 | 3553 *_WHAT_is.html 3556 | 3554 readme.hta 3557 | 3555 *.96e2 3558 | 3556 *.thor 3559 | 3557 *.dxxd 3560 | 3558 *.usr0 3561 | 3559 *.shit 3562 | 3560 *.coded 3563 | 3561 *.raid10 3564 | 3562 *.realfs0ciety* 3565 | 3563 *.rip 3566 | 3564 *.okean* 3567 | 3565 *.globe 3568 | 3566 *.nuclear55 3569 | 3567 *.1txt 3570 | 3568 *.kostya 3571 | 3569 *.k0stya 3572 | 3570 *.comrade 3573 | 3571 *.exotic 3574 | 3572 *.fuck 3575 | 3573 *.Yakes 3576 | 3574 *.Zimbra 3577 | 3575 email-salazar_slytherin10@yahoo.com.ver-*.id-*-*.randomname-* 3578 | 3576 *._AiraCropEncrypted! 3579 | 3577 README_RECOVER_FILES_*.txt 3580 | 3578 README_RECOVER_FILES_*.png 3581 | 3579 README_RECOVER_FILES_*.html 3582 | 3580 *.~HL* 3583 | 3581 Sarah_G@ausi.com___* 3584 | 3582 *.zc3791 3585 | 3583 *.venusp 3586 | 3584 *.shino 3587 | 3585 *.bleepYourFiles 3588 | 3586 *.crashed 3589 | 3587 *.amba 3590 | 3588 *.7h9r 3591 | 3589 *.已加密 3592 | 3590 *.암호화됨 3593 | 3591 *.b5c6 3594 | 3592 *.ap19 3595 | 3593 *.a19 3596 | 3594 _*_HOWDO_text.html 3597 | 3595 *_HOWDO_text.bmp 3598 | 3596 *_HOWDO_text.html 3599 | 3597 *.odin 3600 | 3598 *.zypto* 3601 | 3599 zzzzzzzzzzzzzzzzzyyy 3602 | 3600 zycrypt.* 3603 | 3601 *decrypt your file*.* 3604 | 3602 *_nullbyte* 3605 | 3603 *.bart 3606 | 3604 *.axx 3607 | 3605 _H_e_l_p_RECOVER_INSTRUCTIONS+*.txt 3608 | 3606 HOW-TO-DECRYPT-FILES.HTML 3609 | 3607 HOW_TO_DECRYPT.HTML 3610 | 3608 exit.hhr.obleep 3611 | 3609 UnblockFiles.vbs 3612 | 3610 README_DECRYPT_HYDRA_ID_*.txt 3613 | 3611 DECRYPT_Readme.TXT.ReadMe 3614 | 3612 Decrypt All Files *.bmp 3615 | 3613 HowDecrypt.gif 3616 | 3614 HELP_YOURFILES.HTML 3617 | 3615 HOW TO DECRYPT FILES.HTML 3618 | 3616 BUYUNLOCKCODE 3619 | 3617 BitCryptorFileList.txt 3620 | 3618 *.crjocker 3621 | 3619 *.POSHKODER 3622 | 3620 *.hydracrypt_ID_* 3623 | 3621 *.CTBL2 3624 | 3622 *.unbrecrypt_ID_* 3625 | 3623 *.padcrypt 3626 | 3624 *.rekt 3627 | 3625 *.CCCRRRPPP 3628 | 3626 *.SecureCrypte 3629 | 3627 *.windows10 3630 | 3628 *.pdcr 3631 | 3629 *.keybtc@inbox 3632 | 3630 *.breaking_bad 3633 | 3631 *.cryptowall 3634 | 3632 *.xorist 3635 | 3633 *.crypt1 3636 | 3634 How_to_decrypt_your_files.jpg 3637 | 3635 How_to_restore_files.hta 3638 | 3636 *.cerber3 3639 | 3637 *.a5zfn 3640 | 3638 *.purge 3641 | 3639 *.fantom 3642 | 3640 *.cerber2 3643 | 3641 !readme.* 3644 | 3642 Como descriptografar seus arquivos.txt 3645 | 3643 *.C0rp0r@c@0Xr@ 3646 | 3644 *.domino 3647 | 3645 *cerber2 3648 | 3646 *.cawwcca 3649 | 3647 how_to_unlock*.* 3650 | 3648 !Recovery_*.txt 3651 | 3649 Read_this_file.txt 3652 | 3650 *.legion 3653 | 3651 *.encoderpass 3654 | 3652 *.cryptolocker 3655 | 3653 *.7z.encrypted 3656 | 3654 ATTENTION!!!.txt 3657 | 3655 HELP_DECRYPT.lnk 3658 | 3656 how to decrypt aes files.lnk 3659 | 3657 restore_files.txt 3660 | 3658 HowDecrypt.txt 3661 | 3659 $RECYCLE.BIN.{*-*-*-*} 3662 | 3660 *.heisenberg 3663 | 3661 *.breaking bad 3664 | 3662 *.razy 3665 | 3663 *.Venusf 3666 | 3664 .~ 3667 | 3665 *.payfornature@india.com.crypted 3668 | 3666 winclwp.jpg 3669 | 3667 wie_zum_Wiederherstellen_von_Dateien.txt 3670 | 3668 tox.html 3671 | 3669 strongcrypt.bmp 3672 | 3670 qwer2.html 3673 | 3671 qwer.html 3674 | 3672 pronk.txt 3675 | 3673 paycrypt.bmp 3676 | 3674 maxcrypt.bmp 3677 | 3675 how_decrypt.gif 3678 | 3676 how to get data.txt 3679 | 3677 help_recover_instructions*.txt 3680 | 3678 help_recover_instructions*.html 3681 | 3679 help_recover_instructions*.bmp 3682 | 3680 help-file-decrypt.enc 3683 | 3681 enigma_encr.txt 3684 | 3682 enigma.hta 3685 | 3683 default432643264.jpg 3686 | 3684 default32643264.bmp 3687 | 3685 decypt_your_files.html 3688 | 3686 de_crypt_readme.txt 3689 | 3687 de_crypt_readme.html 3690 | 3688 de_crypt_readme.bmp 3691 | 3689 cryptinfo.txt 3692 | 3690 crjoker.html 3693 | 3691 _how_recover*.txt 3694 | 3692 _how_recover*.html 3695 | 3693 _Locky_recover_instructions.bmp 3696 | 3694 _H_e_l_p_RECOVER_INSTRUCTIONS*.txt 3697 | 3695 _H_e_l_p_RECOVER_INSTRUCTIONS*.png 3698 | 3696 _H_e_l_p_RECOVER_INSTRUCTIONS*.html 3699 | 3697 _HELP_instructions.txt 3700 | 3698 _HELP_instructions.bmp 3701 | 3699 _DECRYPT_INFO_*.html 3702 | 3700 Your files encrypted by our friends !!! txt 3703 | 3701 Your files are locked !.txt 3704 | 3702 Your files are locked !!.txt 3705 | 3703 Your files are locked !!!.txt 3706 | 3704 Your files are locked !!!!.txt 3707 | 3705 YOUR_FILES_ARE_LOCKED.txt 3708 | 3706 YOUR_FILES_ARE_ENCRYPTED.TXT 3709 | 3707 YOUR_FILES_ARE_ENCRYPTED.HTML 3710 | 3708 YOUGOTHACKED.TXT 3711 | 3709 UNLOCK_FILES_INSTRUCTIONS.txt 3712 | 3710 UNLOCK_FILES_INSTRUCTIONS.html 3713 | 3711 SIFRE_COZME_TALIMATI.html 3714 | 3712 SHTODELATVAM.txt 3715 | 3713 Read Me (How Decrypt) !!!!.txt 3716 | 3714 RESTORE_FILES_*.txt 3717 | 3715 RESTORE_FILES_*.* 3718 | 3716 READ_THIS_TO_DECRYPT.html 3719 | 3717 README_HOW_TO_UNLOCK.TXT 3720 | 3718 README_HOW_TO_UNLOCK.HTML 3721 | 3719 README_DECRYPT_UMBRE_ID_*.txt 3722 | 3720 README_DECRYPT_UMBRE_ID_*.jpg 3723 | 3721 README_DECRYPT_HYRDA_ID_*.txt 3724 | 3722 READ ME FOR DECRYPT.txt 3725 | 3723 READ IF YOU WANT YOUR FILES BACK.html 3726 | 3724 Payment_Instructions.jpg 3727 | 3725 ONTSLEUTELINGS_INSTRUCTIES.html 3728 | 3726 OKSOWATHAPPENDTOYOURFILES.TXT 3729 | 3727 MENSAGEM.txt 3730 | 3728 KryptoLocker_README.txt 3731 | 3729 Instructionaga.txt 3732 | 3730 ISTRUZIONI_DECRITTAZIONE.html 3733 | 3731 INSTRUCTIONS_DE_DECRYPTAGE.html 3734 | 3732 INSTRUCCIONES_DESCIFRADO.html 3735 | 3733 INSTALL_TOR.URL 3736 | 3734 IMPORTANT.README 3737 | 3735 IMPORTANT READ ME.txt 3738 | 3736 Howto_RESTORE_FILES.html 3739 | 3737 How to decrypt your data.txt 3740 | 3738 How to decrypt LeChiffre files.html 3741 | 3739 Help Decrypt.html 3742 | 3740 Hacked_Read_me_to_decrypt_files.html 3743 | 3741 HOW_TO_UNLOCK_FILES_README_*.txt 3744 | 3742 HOW_TO_RESTORE_FILES.html 3745 | 3743 HOW_DECRYPT.URL 3746 | 3744 HOW_DECRYPT.TXT 3747 | 3745 HOW_DECRYPT.HTML 3748 | 3746 HOWTO_RECOVER_FILES_*.* 3749 | 3747 HOW TO DECRYPT FILES.txt 3750 | 3748 HELP_YOUR_FILES.html 3751 | 3749 HELP_YOUR_FILES.PNG 3752 | 3750 HELP_TO_SAVE_FILES.bmp 3753 | 3751 HELP_RESTORE_FILES_*.* 3754 | 3752 HELP_DECRYPT.URL 3755 | 3753 HELP_DECRYPT.PNG 3756 | 3754 HELP_DECRYPT.HTML 3757 | 3755 GetYouFiles.txt 3758 | 3756 File Decrypt Help.html 3759 | 3757 FILES_BACK.txt 3760 | 3758 ENTSCHLUSSELN_HINWEISE.html 3761 | 3759 DecryptAllFiles*.txt 3762 | 3760 DESIFROVANI_POKYNY.html 3763 | 3761 DECRYPT_YOUR_FILES.txt 3764 | 3762 DECRYPT_YOUR_FILES.HTML 3765 | 3763 DECRYPT_ReadMe1.TXT 3766 | 3764 DECRYPT_INSTRUCTIONS.html 3767 | 3765 DECRYPT_INSTRUCTION.URL 3768 | 3766 DECRYPT_INSTRUCTION.HTML 3769 | 3767 DECRYPTION_HOWTO.Notepad 3770 | 3768 Comment débloquer mes fichiers.txt 3771 | 3769 BUYUNLOCKCODE.txt 3772 | 3770 AllFilesAreLocked*.bmp 3773 | 3771 4-14-2016-INFECTION.TXT 3774 | 3772 *_ryp 3775 | 3773 *_HELP_instructions.html 3776 | 3774 *.xcrypt 3777 | 3775 *.unavailable 3778 | 3776 *.szf 3779 | 3777 *.porno.pornoransom 3780 | 3778 *.plauge17 3781 | 3779 *.neitrino 3782 | 3780 *.kimcilware.locked 3783 | 3781 *.iwanthelpuuu 3784 | 3782 *.herbst 3785 | 3783 *.helpdecrypt@ukr.net 3786 | 3784 *.h3ll 3787 | 3785 *.gws.porno 3788 | 3786 *.fuckyourdata 3789 | 3787 *.encrypted.locked 3790 | 3788 *.cryptz 3791 | 3789 *.crypttt 3792 | 3790 *.cripttt 3793 | 3791 *.criptokod 3794 | 3792 *.criptiko 3795 | 3793 *.btc.kkk.fun.gws 3796 | 3794 *.aga 3797 | 3795 *._ryp 3798 | 3796 *.Where_my_files.txt 3799 | 3797 *.Read_Me.Txt 3800 | 3798 *.RSplited 3801 | 3799 *.KEYZ.KEYH0LES 3802 | 3800 *.How_To_Get_Back.txt 3803 | 3801 *.How_To_Decrypt.txt 3804 | 3802 *.Contact_Here_To_Recover_Your_Files.txt 3805 | 3803 *.31392E30362E32303136_* 3806 | 3804 # DECRYPT MY FILES #.vbs 3807 | 3805 # DECRYPT MY FILES #.txt 3808 | 3806 # DECRYPT MY FILES #.html 3809 | 3807 !Where_are_my_files!.html 3810 | 3808 !!!README!!!*.rtf 3811 | 3809 !!!-WARNING-!!!.txt 3812 | 3810 !!!-WARNING-!!!.html 3813 | 3811 *.magic_software_syndicate 3814 | 3812 *maestro@pizzacrypts.info 3815 | 3813 *.crypt 3816 | 3814 *.bitstak 3817 | 3815 *.wflx 3818 | 3816 *.CRRRT 3819 | 3817 howtodecryptaesfiles.txt 3820 | 3818 !satana!.txt 3821 | 3819 *.akaibvn 3822 | 3820 *.cRh8 3823 | 3821 *.YTBL 3824 | 3822 *.krypted 3825 | 3823 *.tzu 3826 | 3824 *.6FKR8d 3827 | 3825 *.sshxkej 3828 | 3826 *.eclr 3829 | 3827 *.epic 3830 | 3828 *.paybtcs 3831 | 3829 *.AFD 3832 | 3830 *.paymst 3833 | 3831 *.payms 3834 | 3832 *.isis 3835 | 3833 *.zepto 3836 | 3834 *.bart.zip 3837 | 3835 *.kratos 3838 | 3836 *.31342E30362E32303136* 3839 | 3837 *.SecureCrypted 3840 | 3838 *.crptrgr 3841 | 3839 *.rtyrtyrty 3842 | 3840 !DMALOCK3.0* 3843 | 3841 *.evil 3844 | 3842 *.crypt38 3845 | 3843 *.asdasdasd 3846 | 3844 *.ded 3847 | 3845 *.bloccato 3848 | 3846 *.canihelpyou 3849 | 3847 *.crypz 3850 | 3848 decrypt-instruct*.* 3851 | 3849 *files_are_encrypted.* 3852 | 3850 *decryptmyfiles*.* 3853 | 3851 help_instructions.* 3854 | 3852 *-recover-*.* 3855 | 3853 de_crypt_readme.* 3856 | 3854 *!recover!*.* 3857 | 3855 *recover}-*.* 3858 | 3856 *rec0ver*.* 3859 | 3857 _help_instruct*.* 3860 | 3858 *_recover_*.* 3861 | 3859 *+recover+*.* 3862 | 3860 *warning-!!*.* 3863 | 3861 *decrypt my file*.* 3864 | 3862 help_file_*.* 3865 | 3863 recovery+*.* 3866 | 3864 readme_for_decrypt*.* 3867 | 3865 install_tor*.* 3868 | 3866 readme_decrypt*.* 3869 | 3867 howtodecrypt*.* 3870 | 3868 howto_restore*.* 3871 | 3869 how_to_recover*.* 3872 | 3870 how_recover*.* 3873 | 3871 how_to_decrypt*.* 3874 | 3872 how to decrypt*.* 3875 | 3873 help_restore*.* 3876 | 3874 help_your_file*.* 3877 | 3875 help_recover*.* 3878 | 3876 help_decrypt*.* 3879 | 3877 decrypt_instruct*.* 3880 | 3878 cryptolocker.* 3881 | 3879 *recover_instruction*.* 3882 | 3880 *.hydracrypt_ID* 3883 | 3881 *gmail*.crypt 3884 | 3882 *.cryptotorlocker* 3885 | 3883 *.xxx 3886 | 3884 *.xyz 3887 | 3885 *.xtbl 3888 | 3886 *.xort 3889 | 3887 *.xrtn 3890 | 3888 *.vvv 3891 | 3889 *.vscrypt 3892 | 3890 *.trun 3893 | 3891 *.ttt 3894 | 3892 *.surprise 3895 | 3893 *.troyancoder@qq_com 3896 | 3894 *.sport 3897 | 3895 *.scl 3898 | 3896 *.ryp 3899 | 3897 *.sanction 3900 | 3898 *.RRK 3901 | 3899 *.rokku 3902 | 3900 *.remind 3903 | 3901 *.relock@qq_com 3904 | 3902 *.RDM 3905 | 3903 *.RADAMANT 3906 | 3904 *.R5A 3907 | 3905 *.R4A 3908 | 3906 *.PoAr2w 3909 | 3907 *.pizda@qq_com 3910 | 3908 *.p5tkjw 3911 | 3909 *.oplata@qq_com 3912 | 3910 *.oshit 3913 | 3911 *.oor 3914 | 3912 *.one-we_can-help_you 3915 | 3913 *.OMG! 3916 | 3914 *.nochance 3917 | 3915 *.nalog@qq_com 3918 | 3916 *.micro 3919 | 3917 *.LOL! 3920 | 3918 *.locky 3921 | 3919 *.locked 3922 | 3920 *.LeChiffre 3923 | 3921 *.kraken 3924 | 3922 *.korrektor 3925 | 3923 *.kkk 3926 | 3924 *.kimcilware 3927 | 3925 *.KEYZ 3928 | 3926 *.keybtc@inbox_com 3929 | 3927 *.KEYHOLES 3930 | 3928 *.justbtcwillhelpyou 3931 | 3929 *.infected 3932 | 3930 *.helpdecrypt@ukr_net 3933 | 3931 *.hb15 3934 | 3932 *.ha3 3935 | 3933 *.gruzin@qq_com 3936 | 3934 *.gws 3937 | 3935 *.fun 3938 | 3936 *.fucked 3939 | 3937 *.enigma 3940 | 3938 *.encryptedped 3941 | 3939 *.encryptedRSA 3942 | 3940 *.encryptedAES 3943 | 3941 *.Encrypted 3944 | 3942 *.encrypt 3945 | 3943 *.encedRSA 3946 | 3944 *.EnCiPhErEd 3947 | 3945 *.dyatel@qq_com 3948 | 3946 *.czvxce 3949 | 3947 *.darkness 3950 | 3948 *.ctbl 3951 | 3949 *.CrySiS 3952 | 3950 *.CryptoTorLocker2015! 3953 | 3951 *.crypted 3954 | 3952 *.cry 3955 | 3953 *.crjoker 3956 | 3954 *.crinf 3957 | 3955 *.crime 3958 | 3956 *.coverton 3959 | 3957 *.code 3960 | 3958 *.clf 3961 | 3959 *.chifrator@qq_com 3962 | 3960 *.cerber 3963 | 3961 *.cbf 3964 | 3962 *.btcbtcbtc 3965 | 3963 *.btc-help-you 3966 | 3964 *.btc 3967 | 3965 *.bloc 3968 | 3966 *.better_call_saul 3969 | 3967 *.AES256 3970 | 3968 *.{CRYPTENDBLACKDC} 3971 | 3969 *.73i87A 3972 | 3970 *.zzz 3973 | 3971 *.abc 3974 | 3972 *.aaa 3975 | 3973 vault.txt 3976 | 3974 vault.key 3977 | 3975 recovery_key.txt 3978 | 3976 vault.hta 3979 | 3977 message.txt 3980 | 3978 recovery_file.txt 3981 | 3979 confirmation.key 3982 | 3980 enc_files.txt 3983 | 3981 last_chance.txt 3984 | 3982 *.vault 3985 | 3983 *want your files back.* 3986 | 3984 *.frtrss 3987 | 3985 *.exx 3988 | 3986 *.ezz 3989 | 3987 *.ecc 3990 | 3988 *help_restore*.* 3991 | 3989 *how_to_recover*.* 3992 | 3990 *restore_fi*.* 3993 | 3991 *ukr.net* 3994 | 3992 *qq_com* 3995 | 3993 *keemail.me* 3996 | 3994 *decipher* 3997 | 3995 *install_tor*.* 3998 | 3996 *@india.com* 3999 | 3997 *@gmail_com_* 4000 | 3998 *.*obleep 4001 | 3999 *.*exx 4002 | 4000 *.*locked 4003 | 4001 *.*nochance 4004 | 4002 *.*kraken 4005 | 4003 *.*kb15 4006 | 4004 *.*darkness 4007 | 4005 *.*crypto 4008 | 4006 *.*cry 4009 | 4007 _Locky_recover_instructions.txt 4010 | 4008 help_recover_instructions+*.txt 4011 | 4009 recoverfile*.txt 4012 | 4010 Howto_Restore_FILES.TXT 4013 | 4011 recoveryfile*.txt 4014 | 4012 _how_recover.txt 4015 | 4013 howrecover+*.txt 4016 | 4014 restorefiles.txt 4017 | 4015 howto_recover_file.txt 4018 | 4016 HowtoRESTORE_FILES.txt 4019 | 4017 RECOVERY_FILE*.txt 4020 | 4018 RECOVERY_FILES.txt 4021 | 4019 help_decrypt_your_files.html 4022 | 4020 HELPDECYPRT_YOUR_FILES.HTML 4023 | 4021 IHAVEYOURSECRET.KEY 4024 | 4022 SECRET.KEY 4025 | 4023 SECRETIDHERE.KEY 4026 | 4024 READTHISNOW!!!.TXT 4027 | 4025 IAMREADYTOPAY.TXT 4028 | 4026 HELLOTHERE.TXT 4029 | 4027 FILESAREGONE.TXT 4030 | 4028 DECRYPT_ReadMe.TXT 4031 | 4029 Read.txt 4032 | 4030 About_Files.txt 4033 | 4031 _secret_code.txt 4034 | 4032 ReadDecryptFilesHere.txt 4035 | 4033 Coin.Locker.txt 4036 | 4034 HOW_TO_DECRYPT_FILES.TXT 4037 | 4035 DECRYPT_INSTRUCTION.TXT 4038 | 4036 encryptor_raas_readme_liesmich.txt 4039 | 4037 Help_Decrypt.txt 4040 | 4038 YOUR_FILES.url 4041 | 4039 How_To_Recover_Files.txt 4042 | 4040 YOUR_FILES.HTML 4043 | 4041 INSTRUCCIONES_DESCIFRADO.TXT 4044 | 4042 DECRYPT_INSTRUCTIONS.TXT 4045 | 4043 HELP_TO_SAVE_FILES.txt 4046 | 4044 DecryptAllFiles.txt 4047 | 4045 HELP_RECOVER_FILES.txt 4048 | 4046 HELP_RESTORE_FILES.txt 4049 | 4047 HELP_TO_DECRYPT_YOUR_FILES.txt 4050 | 4048 HELP_YOUR_FILES.TXT 4051 | 4049 HELPDECRYPT.TXT 4052 | 4050 *.CTB2 4053 | 4051 *.SUPERCRYPT 4054 | 4052 *.magic 4055 | 4053 *.1999 4056 | 4054 *.toxcrypt 4057 | 4055 *.bleep 4058 | 4056 *.0x0 4059 | 4057 *.good 4060 | 4058 *.R16M01D05 4061 | 4059 *.pzdc 4062 | 4060 *.XRNT 4063 | 4061 *.crypto 4064 | 4062 *.ccc 4065 | 4063 *.da_vinci_code 4066 | 4064 *.payransom 4067 | 4065 *.KEYH0LES 4068 | 4066 oor.* 4069 | 4067 *.zyklon 4070 | 4068 *.zcrypt 4071 | 4069 *.Z81928819 4072 | 4070 *.Silent 4073 | 4071 *.RSNSlocked 4074 | 4072 *.RAD 4075 | 4073 *.porno 4076 | 4074 *.pornoransom 4077 | 4075 *.odcodc 4078 | 4076 _ryp 4079 | 4077 *.helpdecrypt@ukr*.net 4080 | 4078 *.only-we_can-help_you 4081 | 4079 *.cryp1 4082 | 4080 *.fileiscryptedhard 4083 | 4081 *.blocatto 4084 | 4082 *.8lock8 4085 | 4083 *.777 4086 | --------------------------------------------------------------------------------