The option “Scan backups for files associated with ransomware” can be enabled via Partner Dashboard in the Monitoring settings.

Once this option is enabled, each backup session OBRM is comparing files in a backup set against files associated with ransomware.

OBRM generates warning notification “The attributes of this file indicate that there may be ransomware on this computer” with a list of affected items. This warning is included with the backup report if it is enabled. Also, the corresponding warning event appears on the Dashboard.

List of attributes included in ransomware detection
- *.codyprince92@mail.com.ovgm
- *.fastrecovery@airmail.cc
- *.reycarnasi1983@protonmail.com.gw3w
- *.billingsupp
- *.ndpyhss
- *.SF
- *.digiworldhack@tutanota.com
- RESTORE-SIGRUN.*
- *id-*.BI_ID
- *.cryptgh0st
- *.emilysupp
- *.RedEye
- *.AdolfHitler
- *.crybrazil
- *.infovip@airmail.cc
- *.REBUS
- filesinfo.txt
- !!!!RESTORE_FILES!!!.txt
- *.insta
- *.CONTACTUS
- *.osk<br>
- *.[pain@cock.lu].pain
- *.embrace
- Decoding help.hta
- *.karne
- *.setimichas1971@protonmail.com.b4wq
- *.decodeme666tutanota_com
- *.josep
- *.decodeme666@tutanota_com
- *.cdrpt
- *.SEPSIS
- *.ransomed@india.com
- *.sigrun
- *.booknish
- *.bip<br>
- *.[Sepsis@protonmail.com].SEPSIS
- *.MTXLOCK<br>
- *.RansomAES
- *.PAUSA
- *.hac
- *.[BaYuCheng@yeah.net].china
- *.UselessFiles
- *.GrAnoSinSa
- *.rand
- HOW DECRIPT FILES.hta
- *.kcwenc
- *.mich
- *.OBLIVION
- *.cryptfile
- *.BlackRouter
- *.pay2me
- *.Satyr
- *.sorry
- *.tron
- *.sky
- *.NMCRYPT
- *@tutanota.com
- *@tuta.io
- *.Horros
- *.LolSec
- Perfect.sys
- *.d3g1d5
- *.excuses
- *.cock.email
- *.MOLE66
- *.*.sell
- UselessDisk.exe
- *.EGG
- *.JFCWF
- wormDll*.dll
- ScreenLocker_x86.dll
- SsExecutor_x86.exe
- Spreader_x86.dll
- tabDll*.dll
- Zenis-*.*
- *.xwz
- *.Stinger
- 0000-SORRY-FOR-FILES.html
- READ_ME_HELP.png
- READ_ME_HELP.txt
- *.[restorehelp@qq.com].java
- *.FRS
- Zenis-Instructions.html
- *.[batmanbitka1@cock.li].arena
- *.koreaGame
- *.improved
- *.[volcano666@tutanota.de].volcano
- *@adsoleware.com*
- *.kwaaklocked
- _XiaoBa_Info_.hta
- *.XiaoBa
- *.cypher
- *.bananaCrypt
- *BlockBax*
- ownertrust.txt
- qwerty-pub.key
- *.igza4c
- *.Nutella
- *.[everbe@airmail.cc].everbe
- *.Sil3nt5pring
- *.Crab
- *.jodis
- *.jes
- *.Bitconnect
- *.arrow
- *.contact-me-here-for-the-key-admin@adsoleware.com
- *.leenapidx
- *.creeper
- *.Encrypted[BaYuCheng@yeah.net].XiaBa
- *.styver
- *.leenapidx@snakebite.com.hrhr
- *.YOU-ARE-FUCKED-BY-BALILUWARE-(CODED-BY-HEROPOINT)
- *.frmvrlr2017
- *.SUSPENDED
- Restore Files.TxT
- *.ANNABELLE
- *.messenger-*
- *.[ID62133703]
- *.nazcrypt
- *.THANATOS
- *.ransomwared
- *.saturn
- *.happyness
- *[ignatevv330@gmail.com].java
- *fuga139gh@dr.com*
- *.Tornado
- *.david
- *.defender
- *.blank
- matrix-readme.rtf
- WhatHappenedWithFiles.rtf
- WhatHappenedWithMyFiles.rtf
- Readme-Matrix.rtf
- #_#WhatWrongWithMyFiles#_#.rtf
- *_[LINERSMIK@NAVER.COM][JINNYG@TUTANOTA
- *.honor
- *.twist
- *ReadMe_Decryptor.txt
- .[decryptor@cock.li].dcrtr
- *.blackruby
- *.justice
- *.adam
- *...Files-Frozen-NEED-TO-MAKE-PAYMENT
- *.[GuardBTC@cock.li].java
- *.bunny
- *.lockme
- *.DREAM
- *.same
- *.write
- *.b89b
- *.GDCB
- *.[decrypthelp@qq.com].java
- *.block
- *.DEUSCRYPT
- *.notfoundrans
- *.howcanihelpusir
- *.happenencedfiles
- *.AreYouLoveMyRansFile
- *.country82000
- *.insane
- *.qwerty
- *.LOCKED_BY_pablukl0cker
- *.[insane@airmail.cc].insane
- *.velso
- *.[stopstorage@qq.com].java
- *.[bacon@oddwallps.com].java
- *.PLANETARY
- *.CryptWalker
- *.Infinite
- *.[satan2018@protonmail.com].java
- *.LTML
- *.[decodingfiles@tuta.io].java
- *.kryptonite
- *.Server
- *.leon
- *.vrmrkz
- *.1btc
- *.[Bas_ket@aol.com].java
- *.id-02B52D6C.[Bas_ket@aol.com].java
- *.sysdown
- *.gigahertz
- *.rapid
- *.triple_m
- *.info
- *.weapologize
- *.tastylock
- *.blind2
- *.STOP
- *.wtf
- *.[supp01@arimail.cc].napoleon
- *.File
- *.[pain@onefinedstay.com].java
- *.godra
- *.maniac
- *.VENDETTA
- *.[Hardcorrr@protonmail.com].java
- *.[Hardcorr@protonmail.com].java
- *.satan
- *.fix
- *.GORILLA
- *.CHRISTMAS
- *.[slaker@india.com]*.wallet
- *.492
- *.Cyclone
- *.katipuneros
- *.styx
- *.RDWF
- *.wmfxdqz
- *.Work
- *.noblis
- *.DS335
- *.[skeleton@rape.lol].skeleton
- *.e4n
- *.encencenc
- *.executioner
- *.CerBerSysLocked0009881
- *.spider
- *.[blind@cock.li].blind
- *.0wn3dyou
- *.Frivolity
- *.lime
- *.[paradisecity@cock.li].arena
- _READ_ME_FOR_DECRYPT.txt
- *.[amagnus@india.com].wallet
- *.eTeRnItY
- *.bit
- *.dxjay
- *.dwbiwty
- *.xhspythxn
- *.fbuvkngy
- *.RansomMine
- *.MTC
- *.napoleon
- *.dlenggrl
- *.TEST
- *.GOTYA
- *.maxicrypt
- *.[maxicrypt@cock.li].maxicrypt
- *.encrptd
- *.vpgvlkb
- *.areyoulovemyrans
- *.shadow
- *.[suupport@protonmail.com].scarab
- *.cock.li
- *.aajf
- *.iGotYou
- *.Ipcrestore
- *.PHOBOS
- *.fairytail
- *.fucku
- *.basslock
- *.wdie
- *.wsmile
- *.wndie
- *.0000
- *.RASTAKHIZ
- *.PANDA
- *.BIG1
- *.TRUE
- *.am
- *.kill
- *.kimchenyn
- *.XZZX
- *.fat32
- *.##ENCRYPTED_BY_pablukl0cker##
- *aes_ni_gov
- *.aes_ni
- *.bloked
- *.cripted
- *.filesfucked
- *.cryptx*
- *.how_to_recover*.*
- *.help_restore*.*
- *.restore_fi*.*
- *.ukr.net*
- *.qq_com*
- Wo_sind_meine_Dateien.htm*
- *.fake
- *.cobra
- *].block
- !!!GetBackData!!!.txt
- *.HRM
- *.skvtb
- *.game
- *.Losers
- *.gr3g
- *.oni
- *.sinta
- *.libbywovas@dr.com.gr3g
- *.xiaoba33
- *.xiaoba32
- *.xiaoba31
- *.xiaoba30
- *.xiaoba29
- *.xiaoba28
- *.xiaoba27
- *.xiaoba26
- *.xiaoba25
- *.xiaoba24
- *.xiaoba23
- *.xiaoba22
- *.xiaoba21
- *.xiaoba20
- *.xiaoba19
- *.xiaoba18
- *.xiaoba17
- *.xiaoba16
- *.xiaoba15
- *.xiaoba14
- *.xiaoba13
- *.xiaoba12
- *.xiaoba11
- *.xiaoba10
- *.xiaoba9
- *.xiaoba8
- *.xiaoba7
- *.xiaoba6
- *.xiaoba5
- *.xiaoba4
- *.xiaoba3
- *.xiaoba2
- *.XiaoBa1
- *.XiaoBa34
- *.colecyrus@mail.com.b007
- allcry_upx.exe
- *-PLIIKI.txt
- dispci.exe
- cscc.dat
- infpub.dat
- LEIA_ME.txt
- *.lordofshadow
- *.SaherBlueEagleRansomware
- *.[MAXVISION@SECMAIL.PRO].CRIPTOGRAFADO
- !____________DESKRYPT@TUTAMAIL.COM________.rar
- How_Decrypt_Files.hta
- *.Ordinal
- *.aes!
- READ_ME_FOR_DECRYPT_*.txt
- *.ihsdj
- *.kgpvwnr
- *.LIN
- *.CHAK
- *.Chartogy
- *.viiper
- *.x1881
- *.stroman
- *.asasin
- *.BUGWARE
- *.SENRUS17
- !! RETURN FILES !!.txt
- *.loveransisgood
- *.PayDay
- *.allcry
- *.lockd
- *.PRIVAT66
- *.SHARK
- 005-DO-YOU-WANT-FILES.html
- *.#
- *.CyberSoldiersST
- *.wyvern
- *.technicy
- *.cyberdrill
- *.ZW
- *.myransext2017
- *.ykcol
- *.XmdXtazX.
- *.albertkerr94@mail.com.m5m5
- *.cryptojoker
- *.Doxes
- *.XmdXtazX
- *.blind
- *.Locked_file
- *.HeroesOftheStorm
- *.dian
- *.mind
- *.H_F_D_locked
- *.reaGAN
- *.INCANTO
- *.pablukCRYPT
- *.gocr
- *.revolution
- *.disposed2017
- *.armadilo1
- *.trevinomason1@mail.com.vsunit
- *.[Brazzers@aolonline.top].arena
- _RECoVERY_+*.*
- *.__dilmaV1
- *.hacked
- *.[assistance@firemail.cc].nuclear
- READ_THIS_FILE_1.TXT
- *.pnr
- *.{ljspqk7@aol.com}.BRT92
- *.ILLNEST
- *.OhNo!
- *.akira
- *..txt
- *.3nCRY
- *.clinTON
- RESTORE_INFO-*.txt
- *.BUSH
- *.[black.world@tuta.io].nuclear
- *.CryptedOpps
- *.crypt12
- *.OTR
- Important_Read_Me.txt
- *.JezRoz
- *.UNLIS
- *.granny
- *.shinigami
- *.PA-SIEM
- *.flat
- TUTORIEL.bmp
- *.xolzsec
- *.Flux
- *.Blocked2
- *.wooly
- *.nuclear
- *.area
- *.EMPTY
- *.arena
- lukitus.html
- *.zuzya
- *.{saruman7@india.com}.BRT92
- *.CYRON
- *.#Locky
- *.ERROR
- *.EV
- *.lokitus
- *.lukitus-tiedostoptett
- *.fmoon
- *.cesar
- *.lukitus
- *.KK
- *.prosperous666
- *.[actum_signum@aol.com].onion
- *.encrypted[Payfordecrypt@protonmail.com]
- *.enc
- *.anubi
- *.D2550A49BF52DFC23F2C013C5
- *.LEGO
- *.Cerber_RansomWare@qq.com
- *.0x009d8a
- *.3301
- *.ZABLOKOWANE
- *.pabluklocker
- *.cezar
- *.cnc
- *.trump
- *.Crypton
- *.rumblegoodboy
- *.BONUM
- *.[cho.dambler@yandex.com]
- diablo6-*.htm
- *.DIABLO6
- *.PEDO
- *.HELLO
- *.ACTUM
- *.OGONIA
- *.WAmarlocked
- !## DECRYPT FILES ##!.txt
- *.nopasaran
- *.gryphon
- ebay-msg.html
- ebay_was_here
- *.ebay
- *.491
- *.mtk118
- *.490
- *.shutdown57
- *.PIRATE
- *.wxdrJbgSDa
- *.sea
- *.PLIN
- *.726
- *.SEVENDAYS
- *.nemesis
- *.ocean
- *.rose
- *.[avalona.toga@aol.com].blocking
- *.Node0
- *.supported2017
- RECOVER-FILES.html
- READ_ME_ASAP.txt
- _iWasHere.txt
- !!!SAVE YOUR FILES!.bmp
- !!!!!SAVE YOUR FILES!!!!.txt
- @decrypt_your_files.txt
- HowToDecryptIMPORTANT!.txt
- *.WINDOWS
- *.bbqb
- *.725
- *.DG
- *.Srpx
- *.freefoam
- *.MyChemicalRomance4EVER
- *.extension.srpx
- *.fuck_you_av_we_are_not_globe_fake
- *.BRT92
- *.qwqd
- IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- *.TGIF
- *.snake
- *.MOLE03
- *.MOLE04
- *.Petya
- *.HAPP
- *.bam!
- *.Atom
- *.GOTHAM
- *.skunk
- *.symbiom_ransomware_locked
- *.CK
- *.HUSTONWEHAVEAPROBLEM@KEEMAIL.ME
- *.yl
- *.ZAYKA
- *.NOOB
- *.crptd
- Instruction for file recovery.txt
- *.[mich78@usa.com]
- *.Reyptson
- *.explorer
- *.au1crypt
- *.s1crypt
- *.alosia
- *.korea
- *.POHU
- *.Ransed
- *.EXTE
- _HELP_INSTRUCTION.TXT
- *.Malki
- *.707
- *.A604AF9070
- *.scorpio
- *id-*_[*@*.*].*
- *.Cry128
- *.Cry36
- *.Cry9
- *.xz
- *.readme_txt
- Ransom.rtf
- *.OXR
- *.acc
- *.MOLE01
- *.3ncrypt3d
- *.AZER
- _INTERESTING_INFORMACION_FOR_DECRYPT.TXT
- *.dcry
- *.MOLE00
- *.LoveYou
- *.z3r0
- *.4x82N
- *.63vc4
- *.BELGIAN_COCOA
- RESTORE-.-FILES.txt
- *.moments2900
- *.0x004867
- *.MMM
- *.rat
- *.aleta
- *.ranrans
- *.lalabitch,
- *.gankLocked
- *.ipygh
- *.via
- dllhost.dat
- FE04.tmp
- 027cc450ef5f8c5f653329641ec1fed9*.*
- petwrap.exe
- *.lamo
- File_Encryption_Notice.txt
- *.suppose666
- *.mention9823
- *.breeding123
- *.sux
- *.cfm
- *.Wana Decrypt0r Trojan-Syria Editi0n
- Paxynok.html
- *.pscrypt
- *.a990
- Tempimage.jpg
- *.Tesla
- WannaCry.TXT
- *.kuntzware
- *.nsmf
- *.Facebook
- *.pizdosik
- *.[resque@plague.desi].scarab
- *.sux.AES128
- *.cspider
- *.[teroda@bigmir.net].masterteroda@bigmir.net
- *.zbt
- *.MOLE02
- your_key.rsa
- OkuBeni.txt
- *@*.blocking
- *.ogre
- *.tax
- StrutterGear.exe
- ReadMe_Important.txt
- Sifre_Coz_Talimat.html
- *.whycry
- !READ.htm
- !_ _!.txt
- *.cr020801
- *.cerber6
- *.netn6
- *.rnsmwre
- *.ghost
- *.scarab
- IF_YOU_WANT_TO_GET_ALL_YOUR_FILES_BACK_PLEASE_READ_THIS.TXT
- *.R4bb0l0ck
- *.TraNs
- #HOW_TO_UNRIP#.txt
- *.BeethoveN
- *.tdelf
- *.spectre
- mood-ravishing-hd-wallpaper-142943312215.jpg
- Blooper.exe
- SintaLocker.exe
- SintaRun.py
- *.switch
- *.payforunlock
- HOW TO RECOVER ENCRYPTED FILES.TXT
- README_FOR_DECRYPT.txt
- *.dolphin
- *.dviide
- *.sVn
- *.R3K7M9
- *.BMCODE
- *.zilla
- *.RaaS
- *.resurrection
- *.lost
- *.ram
- *.master
- *.brickr
- READ_DECRYPT_FILES.txt
- *.ramen
- *.TRMT
- *.gommemode
- *.andonio
- *.phantom
- *.r3store
- Read me for help thanks.txt
- *.imsorry
- help_to_decrypt.txt
- *.YYTO
- *.read_to_txt_file.yyto
- *.beep
- *.666
- AArI.jpg
- *.crying
- *.antihacker2017
- *.theworldisyours
- *.spora
- *.sexy
- *.realfs0ciety@sigaint.org.fs0ciety
- *.pays
- *.payrms
- *.paymts
- *.paymrss
- *.paym
- *.lol
- *.madebyadam
- *.locklock
- *.lcked
- *.kyra
- *.kernel_time
- *.kernel_pid
- *.kernel_complete
- *.ifuckedyou
- *.grt
- *.crypte
- *.cbu1
- *-webmafia@asia.com_donald@trampo.info
- *.beef
- *.write_us_on_email
- *.LIGHTNING
- *.xfile
- DECRYPTION.TXT
- *.oled
- *.wtdi
- *.4rwcry4w
- *.Encrypted_By_VMola.com
- *.wlu
- Restore_maysomware_files.html
- *.maysomware
- *.damoclis
- *.decrypter@tutanota.com
- *.VisionCrypt
- *.pwned
- how_to_back_files.html
- *.hNcrypt
- *.~xdata~
- *.b0ff
- Galaperidol.exe
- HOW_CAN_I_DECRYPT_MY_FILES.txt
- *.xdata
- Hello There! Fellow @kee User!.txt
- *.kee
- *.grux
- Restore_your_files.txt
- READ_ME.html
- *.mordor
- *.die
- *.SaMsUnG
- !#_DECRYPT_#!.inf
- *.nuke55
- *.onyon
- *.blocked
- !Please Read Me!.txt
- !WannaDecryptor!.exe.lnk
- *.DARKCRY
- *.wincry
- *.wncrypt
- WannaCrypt 4.0.exe
- t.wry
- *.vCrypt1
- *.theva
- *.PAY
- tor.exe
- tasksche.exe
- wcry.zip
- taskhsvc.exe
- taskse.exe
- taskdl.exe
- *.pky
- *.eky
- wcry.exe
- Wannacry.exe
- @WanaDecryptor@.*
- *.slvpawned
- *.WCRYT
- *.WRNY
- *.LOCKED.txt
- *.wncryt
- *.wnry
- *.viki
- RESTORE-12345-FILES.TXT
- *.donation1@protonmail.ch.12345
- *.block_file12
- *.@decrypt2017
- *.vdul
- *.2cXpCihgsVxB3
- *.son
- loptr-*.htm
- *.paycyka
- *.medal
- *.bagi
- @Please_Read_Me@.txt
- *.wncry
- _!!!_README_!!!_*
- _!!!_README_!!!_*_.hta
- _!!!_README_!!!_*_.txt
- *.news
- *.corrupted
- HOW_TO_DECRYPT_FILES.html
- *.shifr
- DECRYPT_INFO.txt
- *.FailedAccess
- Cversions.2.db
- *.helppme@india.com.*
- ReadME_Decrypt_Help_*.html
- *.fartplz
- *.vCrypt1
- *.xncrypt
- *.Lockify
- *.htrs
- *.cryptowin
- *.owned
- *.x0lzs3c
- *.UIWIX
- *.CRYPTOBOSS
- *.loptr
- *.jaff
- *.bitkangoroo
- *.cloud
- zcrypt.exe
- *.uk-dealer@sigaint.org
- *_luck
- *.decrypt2017
- *.[admin@hoist.desi].*.WALLET
- *.[crysis@life.com].*.WALLET
- *.[SHIELD0@USA.COM].*.WALLET
- #_RESTORING_FILES_#.TXT
- *.haters
- *.anon
- *.amnesia
- *.keepcalm
- *.MIKOYAN
- RESTORE_FILES.HTML
- *.WWW
- *.CRYPTED000007
- *.HELPPME@INDIA.COM.ID83994902
- HOW_RETURN_FILES.TXT
- *.MAYA
- *.CONTACT_TARINEOZA@GMAIL.COM
- *.CRYPTOBYTE
- *.AES
- NOTE;!!!-ODZYSKAJ-PLIKI-!!!.TXT
- INSTRUCTION_FOR_HELPING_FILE_RECOVERY.txt
- *.ADR
- *.NM4
- DesktopOsiris.*
- OSIRIS-*.*
- redchip2.exe
- *.LOLI
- ATLAS_FILES.txt
- *.whatthefuck
- *.loveyouisreal
- *.okokokokok
- *.ranranranran
- READ_IT_FOR_GET_YOUR_FILE.txt
- *.psh
- *.GETREKT
- *.one
- !!! READ THIS - IMPORTANT !!!.txt
- *.aes_ni_0day
- *.JEEPERS
- PAYMENT-INSTRUCTIONS.TXT
- *.LOCKOUT
- *.ATLAS
- *.FLATCHER3@INDIA.COM.000G
- *.AES-NI
- *.DEXTER
- *.CONFICKER
- *.ONION
- *.[NO.TORP3DA@PROTONMAIL.CH].WALLET
- *.LCKD
- *.MOLE
- *.RANSOM
- *.lambda.l0cked
- 009-READ-FOR-DECCCC-FILESSS.html
- _READ_THI$_FILE_*
- *.I'WANT MONEY
- *.gembok
- !Decrypt-All-Files-*.txt
- *.[GOFMEN17@YA.RU].CRP
- *.SERP
- *.kilit
- 0_HELP_DECRYPT_FILES.HTM
- HUR_DEKRYPTERA_FILER.html
- HUR_DEKRYPTERA_FILER.txt
- *.LAMBDA.LOCKED
- *.ADMIN@BADADMIN.XYZ
- *.SKJDTHGHH
- *.LOCK75
- *.B10CKED
- *.A95436@YA.RU
- *.IWANT
- *.Fuck_You
- Recupere seus arquivos aqui.txt
- READ TO UNLOCK FILES.salsa.*.html
- *.SALSA222
- *.NUMBERDOT
- How Decrypt My Files.lnk
- How_Decrypt_My_Files
- *.CRADLE
- *.ID-7ES642406.CRY
- READ ME ABOUT DECRYPTION.txt
- *.Do_not_change_the_file_name.cryp
- *.pr0tect
- *.android
- *_READ_THIS_FILE_*_*
- *.btcware
- *drakosho_new@aol.com*
- *.AngleWare
- *.zorro
- *.CIFGKSAFFSFYGHD
- *.A9V9AHU4
- *.payfordecrypt
- OKU.TXT
- ZINO_NOTE.TXT
- *.ZINO
- *.kirked
- *.CRPTXXX
- HOW_TO_FIX_!.TXT
- *.[BRAINCRYPT@INDIA.COM].BRAINCRYPT
- *.pizdec
- *.REVENGE
- !!!READ_TO_UNLOCK!!!.TXT
- *.openforyou@india.com
- *.warn_wallet
- *.nemo-hacks.at.sigaint.org
- *.MATRIX
- Crytp0l0cker.Upack.dll
- Crytp0l0cker.dll
- Crytp0l0cker.exe
- decrypted_files.dat
- padcryptUninstaller.exe
- PadCrypt.exe
- Vape Launcher.exe
- READ_ME_!.txt
- *.enjey
- Aescrypt.exe
- *.GG
- *.[PINGY@INDIA.COM]
- *.WORMKILLER@INDIA.COM.XTBL
- *.CEBER3
- IF_WANT_FILES_BACK_PLS_READ.html
- *.iaufkakfhsaraf
- _HELP_HELP_HELP_*
- zXz.html
- *.zXz
- VictemKey_*_*
- HVORDAN_DU_GENDANNER_FILER.html
- HVORDAN_DU_GENDANNER_FILER.txt
- HELP_ME_PLEASE.txt
- !_RECOVERY_HELP_!.txt
- PLEASE-READIT-IF_YOU-WANT.html
- *.filegofprencrp
- COME_RIPRISTINARE_I_FILE.*
- fattura_*.js
- *_steaveiwalker@india.com_
- COMO_ABRIR_ARQUIVOS.txt
- *info@kraken.cc_worldcza@email.cz
- *.kr3
- COMO_RESTAURAR_ARCHIVOS.txt
- COMO_RESTAURAR_ARCHIVOS.html
- *.ENCR
- *.[File-Help@India.Com].mails
- damage@india.com*
- *.tmp.exe
- What happen to my files.txt
- *.jeepdayz@india.com
- *.BarRax
- *.damage
- *.locked-*
- *.jey
- *.CRYPTOSHIEL
- *.cfk
- ASSISTANCE_IN_RECOVERY.txt
- #_DECRYPT_ASSISTANCE_#.txt
- *.lfk
- _HELP_HELP_HELP_*.hta
- _HELP_HELP_HELP_*.jpg
- BTC_DECRYPT_FILES.txt
- *.TheTrumpLockerp
- *.TheTrumpLockerf
- *.d4nk
- *.x3mpro
- READ-READ-READ.html
- *.weencedufiles
- *.jse
- *.powned
- [KASISKI]*
- INSTRUCCIONES.txt
- @_USE_TO_FIX_*.txt
- *.happydayzz
- *.hasp
- 001-READ-FOR-DECRYPT-FILES.html
- DECRYPT_INFORMATION.html
- Rans0m_N0te_Read_ME.txt
- email-vpupkin3@aol.com*
- *.hnyear
- *.hnumkhotep@india.com.hnumkhotep
- *.wowwhereismyfiles
- *.decryptional
- *.wowreadfordecryp
- *.7zipper
- *.youransom
- *.gui
- *.Harzhuangzi
- *.encryptedyourfiles
- *HERMES
- [amanda_sofost@india.com].wallet
- *.wcry
- *.velikasrbija
- *.razarac
- *.serpent
- *.msj
- *.szesnl
- _DECRYPT_INFO_szesnl.html
- 000-IF-YOU-WANT-DEC-FILES.html
- *.evillock
- *.letmetrydecfiles
- *.yourransom
- *.lambda_l0cked
- *.gefickt
- *.HakunaMatata
- *.CRYPTOSHIELD
- *.weareyourfriends
- MERRY_I_LOVE_YOU_BRUCE.hta
- How decrypt files.hta
- unCrypte@outlook.com*
- decipher_ne@outlook.com*
- *.potato
- *.otherinformation
- *.vxLock
- *.rdmk
- *.paytounlock
- TRY-READ-ME-TO-DEC.html
- EMAIL_*_recipient.zip
- *.sage
- *garryweber@protonmail.ch
- LEER_INMEDIATAMENTE.txt
- *.killedXXX
- *.doomed
- *.sifreli
- *.MERRY
- 000-No-PROBLEM-WE-DEC-FILES.html
- *.noproblemwedecfiles
- WE-MUST-DEC-FILES.html
- *.powerfulldecrypt
- *.stn
- *bingo@opensourcemail.org
- *.id-3044989498_x3m
- *.x3m
- READ_ME_TO_DECRYPT_YOU_INFORMA.jjj
- *.wuciwug
- *.kencf
- *.file0locked
- file0locked.js
- CryptoRansomware.exe
- *.VBRANSOM
- _HELP_Recover_Files_.html
- *.oops
- *.deria
- *.RMCM1
- *.Locked-by-Mafia
- *-filesencrypted.html
- decrypt_Globe*.exe
- *.hnumkhotep
- DecryptFile.txt
- *.L0CKED
- NFS-e*1025-7152.exe
- firstransomware.exe
- HELP-ME-ENCED-FILES.html
- *.helpmeencedfiles
- *EdgeLocker*.exe
- *.edgel
- *.XBTL
- *.firecrypt
- YOUR_FILES_ARE_DEAD.hta
- *.MRCR1
- *.PEGS1
- *.RARE1
- *.airacropencrypted!
- *[cryptsvc@mail.ru].*
- WHERE-YOUR-FILES.html
- *.Whereisyourfiles
- *opentoyou@india.com
- C-email-*-*.odcodc
- *.maktub
- *.hush
- *.bript
- _*_README.hta
- _*_README.jpg
- HOW_OPEN_FILES.hta
- *.gangbang
- GJENOPPRETTING_AV_FILER.html
- GJENOPPRETTING_AV_FILER.txt
- !!! HOW TO DECRYPT FILES !!!.txt
- *.braincrypt
- INSTRUCTION RESTORE FILE.TXT
- *.lesli
- Survey Locker.exe
- !!!!!ATENO!!!!!.html
- Receipt.exe
- WindowsApplication1.exe
- HWID Lock.exe
- VIP72.exe
- DALE_FILES.TXT
- *.DALE
- *.8637
- *.kok
- HOW_TO_RESTORE_YOUR_DATA.html
- *.paymrts
- *.paymds
- RESTORE_CORUPTED_FILES.HTML
- READ@My.txt
- Cyber SpLiTTer Vbs.exe
- *.flyper
- 000-PLEASE-READ-WE-HELP.html
- *.helpdecrypt@india.com
- *.VforVendetta
- popcorn_time.exe
- *.filock
- *.wallet
- *_.rmd
- *.uDz2j8mv
- OSIRIS-*.htm
- DesktopOsiris.htm
- *[cryptservice@inbox.ru]*
- *.no_more_ransom
- bahij2@india.com
- *.lovewindows
- *.osiris
- *.R.i.P
- Important!.txt
- !_HOW_TO_RESTORE_*.txt
- HOW_TO_RESTORE_FILES.txt
- _README_*.hta
- *.Zzzz
- *[lavandos@dr.com].wallet
- *.coin
- *.crypted_file
- *.EncrypTile
- *.hcked
- _README_.hta
- Runsome.exe
- Payment_Advice.mht
- lblBitcoinInfoMain.txt
- lblFinallyText.txt
- lblMain.txt
- *.hannah
- *.vindows
- How to decrypt your files.jpg
- How to decrypt your files.txt
- How to get data back.txt
- *.zycrypt
- *.sgood
- *.zzzzz
- xort.txt
- DOSYALARINIZA ULAMAK N AINIZ.html
- HOWTO_RECOVER_FILES_*.TXT
- HELP_RESTORE_FILES_*.TXT
- Recovery+*.html
- Recovery+*.txt
- _H_e_l_p_RECOVER_INSTRUCTIONS+*.png
- _H_e_l_p_RECOVER_INSTRUCTIONS+*.html
- help_recover_instructions+*.html
- help_recover_instructions+*.BMP
- _how_recover+*.html
- _how_recover+*.txt
- ThxForYurTyme.txt
- _HOW_TO_Decrypt.bmp
- _RECOVER_INSTRUCTIONS.ini
- ###-READ-FOR-HELLPP.html
- rtext.txt
- DECRYPTION INSTRUCTIONS.txt
- decrypt explanations.html
- _WHAT_is.html
- _HOWDO_text.html
- readme_liesmich_encryptor_raas.txt
- _Adatok_visszaallitasahoz_utasitasok.txt
- How to restore files.hta
- locked.bmp
- README_TO_RECURE_YOUR_FILES.txt
- Your files encrypted by our friends !!!.txt
- ATTENTION.url
- @WARNING_FILES_ARE_ENCRYPTED.*.txt
- README!!!.txt
- # README.hta
- !Recovery_*.html
- YourID.txt
- recover.bmp
- recover.txt
- README HOW TO DECRYPT YOUR FILES.HTML
- READ_IT.txt
- *.lock93
- *.!emc
- *.adk
- svchosd.exe
- *.aesir
- *.CHIP
- *.happy
- *.angelamerkel
- *.razy1337
- *.zendr4
- *.dharma
- *.locked3
- *.duhust
- *.exploit
- *_crypt
- *_help_instruct*.*
- *!DMAlock*
- *.GSupport3
- *.rnsmwr
- *.dCrypt
- ransomed.html
- *.Alcatraz
- *_WHAT_is.html
- readme.hta
- *.96e2
- *.thor
- *.dxxd
- *.usr0
- *.shit
- *.coded
- *.raid10
- *.realfs0ciety*
- *.rip
- *.okean*
- *.globe
- *.nuclear55
- *.1txt
- *.kostya
- *.k0stya
- *.comrade
- *.exotic
- *.fuck
- *.Yakes
- *.Zimbra
- email-salazar_slytherin10@yahoo.com.ver-*.id-*-*.randomname-*
- *._AiraCropEncrypted!
- README_RECOVER_FILES_*.txt
- README_RECOVER_FILES_*.png
- README_RECOVER_FILES_*.html
- *.~HL*
- Sarah_G@ausi.com___*
- *.zc3791
- *.venusp
- *.shino
- *.bleepYourFiles
- *.crashed
- *.amba
- *.7h9r
- *.
- *.
- *.b5c6
- *.ap19
- *.a19
- _*_HOWDO_text.html
- *_HOWDO_text.bmp
- *_HOWDO_text.html
- *.odin
- *.zypto*
- zzzzzzzzzzzzzzzzzyyy
- zycrypt.*
- *decrypt your file*.*
- *_nullbyte*
- *.bart
- *.axx
- _H_e_l_p_RECOVER_INSTRUCTIONS+*.txt
- HOW-TO-DECRYPT-FILES.HTML
- HOW_TO_DECRYPT.HTML
- exit.hhr.obleep
- UnblockFiles.vbs
- README_DECRYPT_HYDRA_ID_*.txt
- DECRYPT_Readme.TXT.ReadMe
- Decrypt All Files *.bmp
- HowDecrypt.gif
- HELP_YOURFILES.HTML
- HOW TO DECRYPT FILES.HTML
- BUYUNLOCKCODE
- BitCryptorFileList.txt
- *.crjocker
- *.POSHKODER
- *.hydracrypt_ID_*
- *.CTBL2
- *.unbrecrypt_ID_*
- *.padcrypt
- *.rekt
- *.CCCRRRPPP
- *.SecureCrypte
- *.windows10
- *.pdcr
- *.keybtc@inbox
- *.breaking_bad
- *.cryptowall
- *.xorist
- *.crypt1
- How_to_decrypt_your_files.jpg
- How_to_restore_files.hta
- *.cerber3
- *.a5zfn
- *.purge
- *.fantom
- *.cerber2
- !readme.*
- Como descriptografar seus arquivos.txt
- *.C0rp0r@c@0Xr@
- *.domino
- *cerber2
- *.cawwcca
- how_to_unlock*.*
- !Recovery_*.txt
- Read_this_file.txt
- *.legion
- *.encoderpass
- *.cryptolocker
- *.7z.encrypted
- ATTENTION!!!.txt
- HELP_DECRYPT.lnk
- how to decrypt aes files.lnk
- restore_files.txt
- HowDecrypt.txt
- $RECYCLE.BIN.{*-*-*-*}
- *.heisenberg
- *.breaking bad
- *.razy
- *.Venusf
- .~
- *.payfornature@india.com.crypted
- winclwp.jpg
- wie_zum_Wiederherstellen_von_Dateien.txt
- tox.html
- strongcrypt.bmp
- qwer2.html
- qwer.html
- pronk.txt
- paycrypt.bmp
- maxcrypt.bmp
- how_decrypt.gif
- how to get data.txt
- help_recover_instructions*.txt
- help_recover_instructions*.html
- help_recover_instructions*.bmp
- help-file-decrypt.enc
- enigma_encr.txt
- enigma.hta
- default432643264.jpg
- default32643264.bmp
- decypt_your_files.html
- de_crypt_readme.txt
- de_crypt_readme.html
- de_crypt_readme.bmp
- cryptinfo.txt
- crjoker.html
- _how_recover*.txt
- _how_recover*.html
- _Locky_recover_instructions.bmp
- _H_e_l_p_RECOVER_INSTRUCTIONS*.txt
- _H_e_l_p_RECOVER_INSTRUCTIONS*.png
- _H_e_l_p_RECOVER_INSTRUCTIONS*.html
- _HELP_instructions.txt
- _HELP_instructions.bmp
- _DECRYPT_INFO_*.html
- Your files encrypted by our friends !!! txt
- Your files are locked !.txt
- Your files are locked !!.txt
- Your files are locked !!!.txt
- Your files are locked !!!!.txt
- YOUR_FILES_ARE_LOCKED.txt
- YOUR_FILES_ARE_ENCRYPTED.TXT
- YOUR_FILES_ARE_ENCRYPTED.HTML
- YOUGOTHACKED.TXT
- UNLOCK_FILES_INSTRUCTIONS.txt
- UNLOCK_FILES_INSTRUCTIONS.html
- SIFRE_COZME_TALIMATI.html
- SHTODELATVAM.txt
- Read Me (How Decrypt) !!!!.txt
- RESTORE_FILES_*.txt
- RESTORE_FILES_*.*
- READ_THIS_TO_DECRYPT.html
- README_HOW_TO_UNLOCK.TXT
- README_HOW_TO_UNLOCK.HTML
- README_DECRYPT_UMBRE_ID_*.txt
- README_DECRYPT_UMBRE_ID_*.jpg
- README_DECRYPT_HYRDA_ID_*.txt
- READ ME FOR DECRYPT.txt
- READ IF YOU WANT YOUR FILES BACK.html
- Payment_Instructions.jpg
- ONTSLEUTELINGS_INSTRUCTIES.html
- OKSOWATHAPPENDTOYOURFILES.TXT
- MENSAGEM.txt
- KryptoLocker_README.txt
- Instructionaga.txt
- ISTRUZIONI_DECRITTAZIONE.html
- INSTRUCTIONS_DE_DECRYPTAGE.html
- INSTRUCCIONES_DESCIFRADO.html
- INSTALL_TOR.URL
- IMPORTANT.README
- IMPORTANT READ ME.txt
- Howto_RESTORE_FILES.html
- How to decrypt your data.txt
- How to decrypt LeChiffre files.html
- Help Decrypt.html
- Hacked_Read_me_to_decrypt_files.html
- HOW_TO_UNLOCK_FILES_README_*.txt
- HOW_TO_RESTORE_FILES.html
- HOW_DECRYPT.URL
- HOW_DECRYPT.TXT
- HOW_DECRYPT.HTML
- HOWTO_RECOVER_FILES_*.*
- HOW TO DECRYPT FILES.txt
- HELP_YOUR_FILES.html
- HELP_YOUR_FILES.PNG
- HELP_TO_SAVE_FILES.bmp
- HELP_RESTORE_FILES_*.*
- HELP_DECRYPT.URL
- HELP_DECRYPT.PNG
- HELP_DECRYPT.HTML
- GetYouFiles.txt
- File Decrypt Help.html
- FILES_BACK.txt
- ENTSCHLUSSELN_HINWEISE.html
- DecryptAllFiles*.txt
- DESIFROVANI_POKYNY.html
- DECRYPT_YOUR_FILES.txt
- DECRYPT_YOUR_FILES.HTML
- DECRYPT_ReadMe1.TXT
- DECRYPT_INSTRUCTIONS.html
- DECRYPT_INSTRUCTION.URL
- DECRYPT_INSTRUCTION.HTML
- DECRYPTION_HOWTO.Notepad
- Comment dbloquer mes fichiers.txt
- BUYUNLOCKCODE.txt
- AllFilesAreLocked*.bmp
- 4-14-2016-INFECTION.TXT
- *_ryp
- *_HELP_instructions.html
- *.xcrypt
- *.unavailable
- *.szf
- *.porno.pornoransom
- *.plauge17
- *.neitrino
- *.kimcilware.locked
- *.iwanthelpuuu
- *.herbst
- *.helpdecrypt@ukr.net
- *.h3ll
- *.gws.porno
- *.fuckyourdata
- *.encrypted.locked
- *.cryptz
- *.crypttt
- *.cripttt
- *.criptokod
- *.criptiko
- *.btc.kkk.fun.gws
- *.aga
- *._ryp
- *.Where_my_files.txt
- *.Read_Me.Txt
- *.RSplited
- *.KEYZ.KEYH0LES
- *.How_To_Get_Back.txt
- *.How_To_Decrypt.txt
- *.Contact_Here_To_Recover_Your_Files.txt
- *.31392E30362E32303136_*
- # DECRYPT MY FILES #.vbs
- # DECRYPT MY FILES #.txt
- # DECRYPT MY FILES #.html
- !Where_are_my_files!.html
- !!!README!!!*.rtf
- !!!-WARNING-!!!.txt
- !!!-WARNING-!!!.html
- *.magic_software_syndicate
- *maestro@pizzacrypts.info
- *.crypt
- *.bitstak
- *.wflx
- *.CRRRT
- howtodecryptaesfiles.txt
- !satana!.txt
- *.akaibvn
- *.cRh8
- *.YTBL
- *.krypted
- *.tzu
- *.6FKR8d
- *.sshxkej
- *.eclr
- *.epic
- *.paybtcs
- *.AFD
- *.paymst
- *.payms
- *.isis
- *.zepto
- *.bart.zip
- *.kratos
- *.31342E30362E32303136*
- *.SecureCrypted
- *.crptrgr
- *.rtyrtyrty
- !DMALOCK3.0*
- *.evil
- *.crypt38
- *.asdasdasd
- *.ded
- *.bloccato
- *.canihelpyou
- *.crypz
- decrypt-instruct*.*
- *files_are_encrypted.*
- *decryptmyfiles*.*
- help_instructions.*
- *-recover-*.*
- de_crypt_readme.*
- *!recover!*.*
- *recover}-*.*
- *rec0ver*.*
- _help_instruct*.*
- *_recover_*.*
- *+recover+*.*
- *warning-!!*.*
- *decrypt my file*.*
- help_file_*.*
- recovery+*.*
- readme_for_decrypt*.*
- install_tor*.*
- readme_decrypt*.*
- howtodecrypt*.*
- howto_restore*.*
- how_to_recover*.*
- how_recover*.*
- how_to_decrypt*.*
- how to decrypt*.*
- help_restore*.*
- help_your_file*.*
- help_recover*.*
- help_decrypt*.*
- decrypt_instruct*.*
- cryptolocker.*
- *recover_instruction*.*
- *.hydracrypt_ID*
- *gmail*.crypt
- *.cryptotorlocker*
- *.xxx
- *.xyz
- *.xtbl
- *.xort
- *.xrtn
- *.vvv
- *.vscrypt
- *.trun
- *.ttt
- *.surprise
- *.troyancoder@qq_com
- *.sport
- *.scl
- *.ryp
- *.sanction
- *.RRK
- *.rokku
- *.remind
- *.relock@qq_com
- *.RDM
- *.RADAMANT
- *.R5A
- *.R4A
- *.PoAr2w
- *.pizda@qq_com
- *.p5tkjw
- *.oplata@qq_com
- *.oshit
- *.oor
- *.one-we_can-help_you
- *.OMG!
- *.nochance
- *.nalog@qq_com
- *.micro
- *.LOL!
- *.locky
- *.locked
- *.LeChiffre
- *.kraken
- *.korrektor
- *.kkk
- *.kimcilware
- *.KEYZ
- *.keybtc@inbox_com
- *.KEYHOLES
- *.justbtcwillhelpyou
- *.infected
- *.helpdecrypt@ukr_net
- *.hb15
- *.ha3
- *.gruzin@qq_com
- *.gws
- *.fun
- *.fucked
- *.enigma
- *.encryptedped
- *.encryptedRSA
- *.encryptedAES
- *.Encrypted
- *.encrypt
- *.encedRSA
- *.EnCiPhErEd
- *.dyatel@qq_com
- *.czvxce
- *.darkness
- *.ctbl
- *.CrySiS
- *.CryptoTorLocker2015!
- *.crypted
- *.cry
- *.crjoker
- *.crinf
- *.crime
- *.coverton
- *.code
- *.clf
- *.chifrator@qq_com
- *.cerber
- *.cbf
- *.btcbtcbtc
- *.btc-help-you
- *.btc
- *.bloc
- *.better_call_saul
- *.AES256
- *.{CRYPTENDBLACKDC}
- *.73i87A
- *.zzz
- *.abc
- *.aaa
- vault.txt
- vault.key
- recovery_key.txt
- vault.hta
- message.txt
- recovery_file.txt
- confirmation.key
- enc_files.txt
- last_chance.txt
- *.vault
- *want your files back.*
- *.frtrss
- *.exx
- *.ezz
- *.ecc
- *help_restore*.*
- *how_to_recover*.*
- *restore_fi*.*
- *ukr.net*
- *qq_com*
- *keemail.me*
- *decipher*
- *install_tor*.*
- *@india.com*
- *@gmail_com_*
- *.*obleep
- *.*exx
- *.*locked
- *.*nochance
- *.*kraken
- *.*kb15
- *.*darkness
- *.*crypto
- *.*cry
- _Locky_recover_instructions.txt
- help_recover_instructions+*.txt
- recoverfile*.txt
- Howto_Restore_FILES.TXT
- recoveryfile*.txt
- _how_recover.txt
- howrecover+*.txt
- restorefiles.txt
- howto_recover_file.txt
- HowtoRESTORE_FILES.txt
- RECOVERY_FILE*.txt
- RECOVERY_FILES.txt
- help_decrypt_your_files.html
- HELPDECYPRT_YOUR_FILES.HTML
- IHAVEYOURSECRET.KEY
- SECRET.KEY
- SECRETIDHERE.KEY
- READTHISNOW!!!.TXT
- IAMREADYTOPAY.TXT
- HELLOTHERE.TXT
- FILESAREGONE.TXT
- DECRYPT_ReadMe.TXT
- Read.txt
- About_Files.txt
- _secret_code.txt
- ReadDecryptFilesHere.txt
- Coin.Locker.txt
- HOW_TO_DECRYPT_FILES.TXT
- DECRYPT_INSTRUCTION.TXT
- encryptor_raas_readme_liesmich.txt
- Help_Decrypt.txt
- YOUR_FILES.url
- How_To_Recover_Files.txt
- YOUR_FILES.HTML
- INSTRUCCIONES_DESCIFRADO.TXT
- DECRYPT_INSTRUCTIONS.TXT
- HELP_TO_SAVE_FILES.txt
- DecryptAllFiles.txt
- HELP_RECOVER_FILES.txt
- HELP_RESTORE_FILES.txt
- HELP_TO_DECRYPT_YOUR_FILES.txt
- HELP_YOUR_FILES.TXT
- HELPDECRYPT.TXT
- *.CTB2
- *.SUPERCRYPT
- *.magic
- *.1999
- *.toxcrypt
- *.bleep
- *.0x0
- *.good
- *.R16M01D05
- *.pzdc
- *.XRNT
- *.crypto
- *.ccc
- *.da_