The option “Scan backups for files associated with ransomware” can be enabled via Partner Dashboard in the Monitoring settings.

Once this option is enabled, each backup session OBRM is comparing files in a backup set against files associated with ransomware.

OBRM generates warning notification “The attributes of this file indicate that there may be ransomware on this computer” with a list of affected items. This warning is included with the backup report if it is enabled. Also, the corresponding warning event appears on the Dashboard.

The list of attributes included in ransomware detection
  • *.codyprince92@mail.com.ovgm
  • *.fastrecovery@airmail.cc
  • *.reycarnasi1983@protonmail.com.gw3w
  • *.billingsupp
  • *.ndpyhss
  • *.SF
  • *.digiworldhack@tutanota.com
  • RESTORE-SIGRUN.*
  • *id-*.BI_ID
  • *.cryptgh0st
  • *.emilysupp
  • *.RedEye
  • *.AdolfHitler
  • *.crybrazil
  • *.infovip@airmail.cc
  • *.REBUS
  • filesinfo.txt
  • !!!!RESTORE_FILES!!!.txt
  • *.insta
  • *.CONTACTUS
  • *.osk<br>
  • *.[pain@cock.lu].pain
  • *.embrace
  • Decoding help.hta
  • *.karne
  • *.setimichas1971@protonmail.com.b4wq
  • *.decodeme666tutanota_com
  • *.josep
  • *.decodeme666@tutanota_com
  • *.cdrpt
  • *.SEPSIS
  • *.ransomed@india.com
  • *.sigrun
  • *.booknish
  • *.bip<br>
  • *.[Sepsis@protonmail.com].SEPSIS
  • *.MTXLOCK<br>
  • *.RansomAES
  • *.PAUSA
  • *.hac
  • *.[BaYuCheng@yeah.net].china
  • *.UselessFiles
  • *.GrAnoSinSa
  • *.rand
  • HOW DECRIPT FILES.hta
  • *.kcwenc
  • *.mich
  • *.OBLIVION
  • *.cryptfile
  • *.BlackRouter
  • *.pay2me
  • *.Satyr
  • *.sorry
  • *.tron
  • *.sky
  • *.NMCRYPT
  • *@tutanota.com
  • *@tuta.io
  • *.Horros
  • *.LolSec
  • Perfect.sys
  • *.d3g1d5
  • *.excuses
  • *.cock.email
  • *.MOLE66
  • *.*.sell
  • UselessDisk.exe
  • *.EGG
  • *.JFCWF
  • wormDll*.dll
  • ScreenLocker_x86.dll
  • SsExecutor_x86.exe
  • Spreader_x86.dll
  • tabDll*.dll
  • Zenis-*.*
  • *.xwz
  • *.Stinger
  • 0000-SORRY-FOR-FILES.html
  • READ_ME_HELP.png
  • READ_ME_HELP.txt
  • *.[restorehelp@qq.com].java
  • *.FRS
  • Zenis-Instructions.html
  • *.[batmanbitka1@cock.li].arena
  • *.koreaGame
  • *.improved
  • *.[volcano666@tutanota.de].volcano
  • *@adsoleware.com*
  • *.kwaaklocked
  • _XiaoBa_Info_.hta
  • *.XiaoBa
  • *.cypher
  • *.bananaCrypt
  • *BlockBax*
  • ownertrust.txt
  • qwerty-pub.key
  • *.igza4c
  • *.Nutella
  • *.[everbe@airmail.cc].everbe
  • *.Sil3nt5pring
  • *.Crab
  • *.jodis
  • *.jes
  • *.Bitconnect
  • *.arrow
  • *.contact-me-here-for-the-key-admin@adsoleware.com
  • *.leenapidx
  • *.creeper
  • *.Encrypted[BaYuCheng@yeah.net].XiaBa
  • *.styver
  • *.leenapidx@snakebite.com.hrhr
  • *.YOU-ARE-FUCKED-BY-BALILUWARE-(CODED-BY-HEROPOINT)
  • *.frmvrlr2017
  • *.SUSPENDED
  • Restore Files.TxT
  • *.ANNABELLE
  • *.messenger-*
  • *.[ID62133703]
  • *.nazcrypt
  • *.THANATOS
  • *.ransomwared
  • *.saturn
  • *.happyness
  • *[ignatevv330@gmail.com].java
  • *fuga139gh@dr.com*
  • *.Tornado
  • *.david
  • *.defender
  • *.blank
  • matrix-readme.rtf
  • WhatHappenedWithFiles.rtf
  • WhatHappenedWithMyFiles.rtf
  • Readme-Matrix.rtf
  • #_#WhatWrongWithMyFiles#_#.rtf
  • *_[LINERSMIK@NAVER.COM][JINNYG@TUTANOTA
  • *.honor
  • *.twist
  • *ReadMe_Decryptor.txt
  • .[decryptor@cock.li].dcrtr
  • *.blackruby
  • *.justice
  • *.adam
  • *...Files-Frozen-NEED-TO-MAKE-PAYMENT
  • *.[GuardBTC@cock.li].java
  • *.bunny
  • *.lockme
  • *.DREAM
  • *.same
  • *.write
  • *.b89b
  • *.GDCB
  • *.[decrypthelp@qq.com].java
  • *.block
  • *.DEUSCRYPT
  • *.notfoundrans
  • *.howcanihelpusir
  • *.happenencedfiles
  • *.AreYouLoveMyRansFile
  • *.country82000
  • *.insane
  • *.qwerty
  • *.LOCKED_BY_pablukl0cker
  • *.[insane@airmail.cc].insane
  • *.velso
  • *.[stopstorage@qq.com].java
  • *.[bacon@oddwallps.com].java
  • *.PLANETARY
  • *.CryptWalker
  • *.Infinite
  • *.[satan2018@protonmail.com].java
  • *.LTML
  • *.[decodingfiles@tuta.io].java
  • *.kryptonite
  • *.Server
  • *.leon
  • *.vrmrkz
  • *.1btc
  • *.[Bas_ket@aol.com].java
  • *.id-02B52D6C.[Bas_ket@aol.com].java
  • *.sysdown
  • *.gigahertz
  • *.rapid
  • *.triple_m
  • *.info
  • *.weapologize
  • *.tastylock
  • *.blind2
  • *.STOP
  • *.wtf
  • *.[supp01@arimail.cc].napoleon
  • *.File
  • *.[pain@onefinedstay.com].java
  • *.godra
  • *.maniac
  • *.VENDETTA
  • *.[Hardcorrr@protonmail.com].java
  • *.[Hardcorr@protonmail.com].java
  • *.satan
  • *.fix
  • *.GORILLA
  • *.CHRISTMAS
  • *.[slaker@india.com]*.wallet
  • *.492
  • *.Cyclone
  • *.katipuneros
  • *.styx
  • *.RDWF
  • *.wmfxdqz
  • *.Work
  • *.noblis
  • *.DS335
  • *.[skeleton@rape.lol].skeleton
  • *.e4n
  • *.encencenc
  • *.executioner
  • *.CerBerSysLocked0009881
  • *.spider
  • *.[blind@cock.li].blind
  • *.0wn3dyou
  • *.Frivolity
  • *.lime
  • *.[paradisecity@cock.li].arena
  • _READ_ME_FOR_DECRYPT.txt
  • *.[amagnus@india.com].wallet
  • *.eTeRnItY
  • *.bit
  • *.dxjay
  • *.dwbiwty
  • *.xhspythxn
  • *.fbuvkngy
  • *.RansomMine
  • *.MTC
  • *.napoleon
  • *.dlenggrl
  • *.TEST
  • *.GOTYA
  • *.maxicrypt
  • *.[maxicrypt@cock.li].maxicrypt
  • *.encrptd
  • *.vpgvlkb
  • *.areyoulovemyrans
  • *.shadow
  • *.[suupport@protonmail.com].scarab
  • *.cock.li
  • *.aajf
  • *.iGotYou
  • *.Ipcrestore
  • *.PHOBOS
  • *.fairytail
  • *.fucku
  • *.basslock
  • *.wdie
  • *.wsmile
  • *.wndie
  • *.0000
  • *.RASTAKHIZ
  • *.PANDA
  • *.BIG1
  • *.TRUE
  • *.am
  • *.kill
  • *.kimchenyn
  • *.XZZX
  • *.fat32
  • *.##ENCRYPTED_BY_pablukl0cker##
  • *aes_ni_gov
  • *.aes_ni
  • *.bloked
  • *.cripted
  • *.filesfucked
  • *.cryptx*
  • *.how_to_recover*.*
  • *.help_restore*.*
  • *.restore_fi*.*
  • *.ukr.net*
  • *.qq_com*
  • Wo_sind_meine_Dateien.htm*
  • *.fake
  • *.cobra
  • *].block
  • !!!GetBackData!!!.txt
  • *.HRM
  • *.skvtb
  • *.game
  • *.Losers
  • *.gr3g
  • *.oni
  • *.sinta
  • *.libbywovas@dr.com.gr3g
  • *.xiaoba33
  • *.xiaoba32
  • *.xiaoba31
  • *.xiaoba30
  • *.xiaoba29
  • *.xiaoba28
  • *.xiaoba27
  • *.xiaoba26
  • *.xiaoba25
  • *.xiaoba24
  • *.xiaoba23
  • *.xiaoba22
  • *.xiaoba21
  • *.xiaoba20
  • *.xiaoba19
  • *.xiaoba18
  • *.xiaoba17
  • *.xiaoba16
  • *.xiaoba15
  • *.xiaoba14
  • *.xiaoba13
  • *.xiaoba12
  • *.xiaoba11
  • *.xiaoba10
  • *.xiaoba9
  • *.xiaoba8
  • *.xiaoba7
  • *.xiaoba6
  • *.xiaoba5
  • *.xiaoba4
  • *.xiaoba3
  • *.xiaoba2
  • *.XiaoBa1
  • *.XiaoBa34
  • *.colecyrus@mail.com.b007
  • allcry_upx.exe
  • *-PLIIKI.txt
  • dispci.exe
  • cscc.dat
  • infpub.dat
  • LEIA_ME.txt
  • *.lordofshadow
  • *.SaherBlueEagleRansomware
  • *.[MAXVISION@SECMAIL.PRO].CRIPTOGRAFADO
  • !____________DESKRYPT@TUTAMAIL.COM________.rar
  • How_Decrypt_Files.hta
  • *.Ordinal
  • *.aes!
  • READ_ME_FOR_DECRYPT_*.txt
  • *.ihsdj
  • *.kgpvwnr
  • *.LIN
  • *.CHAK
  • *.Chartogy
  • *.viiper
  • *.x1881
  • *.stroman
  • *.asasin
  • *.BUGWARE
  • *.SENRUS17
  • !! RETURN FILES !!.txt
  • *.loveransisgood
  • *.PayDay
  • *.allcry
  • *.lockd
  • *.PRIVAT66
  • *.SHARK
  • 005-DO-YOU-WANT-FILES.html
  • *.#
  • *.CyberSoldiersST
  • *.wyvern
  • *.technicy
  • *.cyberdrill
  • *.ZW
  • *.myransext2017
  • *.ykcol
  • *.XmdXtazX.
  • *.albertkerr94@mail.com.m5m5
  • *.cryptojoker
  • *.Doxes
  • *.XmdXtazX
  • *.blind
  • *.Locked_file
  • *.HeroesOftheStorm
  • *.dian
  • *.mind
  • *.H_F_D_locked
  • *.reaGAN
  • *.INCANTO
  • *.pablukCRYPT
  • *.gocr
  • *.revolution
  • *.disposed2017
  • *.armadilo1
  • *.trevinomason1@mail.com.vsunit
  • *.[Brazzers@aolonline.top].arena
  • _RECoVERY_+*.*
  • *.__dilmaV1
  • *.hacked
  • *.[assistance@firemail.cc].nuclear
  • READ_THIS_FILE_1.TXT
  • *.pnr
  • *.{ljspqk7@aol.com}.BRT92
  • *.ILLNEST
  • *.OhNo!
  • *.akira
  • *..txt
  • *.3nCRY
  • *.clinTON
  • RESTORE_INFO-*.txt
  • *.BUSH
  • *.[black.world@tuta.io].nuclear
  • *.CryptedOpps
  • *.crypt12
  • *.OTR
  • Important_Read_Me.txt
  • *.JezRoz
  • *.UNLIS
  • *.granny
  • *.shinigami
  • *.PA-SIEM
  • *.flat
  • TUTORIEL.bmp
  • *.xolzsec
  • *.Flux
  • *.Blocked2
  • *.wooly
  • *.nuclear
  • *.area
  • *.EMPTY
  • *.arena
  • lukitus.html
  • *.zuzya
  • *.{saruman7@india.com}.BRT92
  • *.CYRON
  • *.#Locky
  • *.ERROR
  • *.EV
  • *.lokitus
  • *.lukitus-tiedostoptett
  • *.fmoon
  • *.cesar
  • *.lukitus
  • *.KK
  • *.prosperous666
  • *.[actum_signum@aol.com].onion
  • *.encrypted[Payfordecrypt@protonmail.com]
  • *.enc
  • *.anubi
  • *.D2550A49BF52DFC23F2C013C5
  • *.LEGO
  • *.Cerber_RansomWare@qq.com
  • *.0x009d8a
  • *.3301
  • *.ZABLOKOWANE
  • *.pabluklocker
  • *.cezar
  • *.cnc
  • *.trump
  • *.Crypton
  • *.rumblegoodboy
  • *.BONUM
  • *.[cho.dambler@yandex.com]
  • diablo6-*.htm
  • *.DIABLO6
  • *.PEDO
  • *.HELLO
  • *.ACTUM
  • *.OGONIA
  • *.WAmarlocked
  • !## DECRYPT FILES ##!.txt
  • *.nopasaran
  • *.gryphon
  • ebay-msg.html
  • ebay_was_here
  • *.ebay
  • *.491
  • *.mtk118
  • *.490
  • *.shutdown57
  • *.PIRATE
  • *.wxdrJbgSDa
  • *.sea
  • *.PLIN
  • *.726
  • *.SEVENDAYS
  • *.nemesis
  • *.ocean
  • *.rose
  • *.[avalona.toga@aol.com].blocking
  • *.Node0
  • *.supported2017
  • RECOVER-FILES.html
  • READ_ME_ASAP.txt
  • _iWasHere.txt
  • !!!SAVE YOUR FILES!.bmp
  • !!!!!SAVE YOUR FILES!!!!.txt
  • @decrypt_your_files.txt
  • HowToDecryptIMPORTANT!.txt
  • *.WINDOWS
  • *.bbqb
  • *.725
  • *.DG
  • *.Srpx
  • *.freefoam
  • *.MyChemicalRomance4EVER
  • *.extension.srpx
  • *.fuck_you_av_we_are_not_globe_fake
  • *.BRT92
  • *.qwqd
  • IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
  • *.TGIF
  • *.snake
  • *.MOLE03
  • *.MOLE04
  • *.Petya
  • *.HAPP
  • *.bam!
  • *.Atom
  • *.GOTHAM
  • *.skunk
  • *.symbiom_ransomware_locked
  • *.CK
  • *.HUSTONWEHAVEAPROBLEM@KEEMAIL.ME
  • *.yl
  • *.ZAYKA
  • *.NOOB
  • *.crptd
  • Instruction for file recovery.txt
  • *.[mich78@usa.com]
  • *.Reyptson
  • *.explorer
  • *.au1crypt
  • *.s1crypt
  • *.alosia
  • *.korea
  • *.POHU
  • *.Ransed
  • *.EXTE
  • _HELP_INSTRUCTION.TXT
  • *.Malki
  • *.707
  • *.A604AF9070
  • *.scorpio
  • *id-*_[*@*.*].*
  • *.Cry128
  • *.Cry36
  • *.Cry9
  • *.xz
  • *.readme_txt
  • Ransom.rtf
  • *.OXR
  • *.acc
  • *.MOLE01
  • *.3ncrypt3d
  • *.AZER
  • _INTERESTING_INFORMACION_FOR_DECRYPT.TXT
  • *.dcry
  • *.MOLE00
  • *.LoveYou
  • *.z3r0
  • *.4x82N
  • *.63vc4
  • *.BELGIAN_COCOA
  • RESTORE-.-FILES.txt
  • *.moments2900
  • *.0x004867
  • *.MMM
  • *.rat
  • *.aleta
  • *.ranrans
  • *.lalabitch,
  • *.gankLocked
  • *.ipygh
  • *.via
  • dllhost.dat
  • FE04.tmp
  • 027cc450ef5f8c5f653329641ec1fed9*.*
  • petwrap.exe
  • *.lamo
  • File_Encryption_Notice.txt
  • *.suppose666
  • *.mention9823
  • *.breeding123
  • *.sux
  • *.cfm
  • *.Wana Decrypt0r Trojan-Syria Editi0n
  • Paxynok.html
  • *.pscrypt
  • *.a990
  • Tempimage.jpg
  • *.Tesla
  • WannaCry.TXT
  • *.kuntzware
  • *.nsmf
  • *.Facebook
  • *.pizdosik
  • *.[resque@plague.desi].scarab
  • *.sux.AES128
  • *.cspider
  • *.[teroda@bigmir.net].masterteroda@bigmir.net
  • *.zbt
  • *.MOLE02
  • your_key.rsa
  • OkuBeni.txt
  • *@*.blocking
  • *.ogre
  • *.tax
  • StrutterGear.exe
  • ReadMe_Important.txt
  • Sifre_Coz_Talimat.html
  • *.whycry
  • !READ.htm
  • !_ _!.txt
  • *.cr020801
  • *.cerber6
  • *.netn6
  • *.rnsmwre
  • *.ghost
  • *.scarab
  • IF_YOU_WANT_TO_GET_ALL_YOUR_FILES_BACK_PLEASE_READ_THIS.TXT
  • *.R4bb0l0ck
  • *.TraNs
  • #HOW_TO_UNRIP#.txt
  • *.BeethoveN
  • *.tdelf
  • *.spectre
  • mood-ravishing-hd-wallpaper-142943312215.jpg
  • Blooper.exe
  • SintaLocker.exe
  • SintaRun.py
  • *.switch
  • *.payforunlock
  • HOW TO RECOVER ENCRYPTED FILES.TXT
  • README_FOR_DECRYPT.txt
  • *.dolphin
  • *.dviide
  • *.sVn
  • *.R3K7M9
  • *.BMCODE
  • *.zilla
  • *.RaaS
  • *.resurrection
  • *.lost
  • *.ram
  • *.master
  • *.brickr
  • READ_DECRYPT_FILES.txt
  • *.ramen
  • *.TRMT
  • *.gommemode
  • *.andonio
  • *.phantom
  • *.r3store
  • Read me for help thanks.txt
  • *.imsorry
  • help_to_decrypt.txt
  • *.YYTO
  • *.read_to_txt_file.yyto
  • *.beep
  • *.666
  • AArI.jpg
  • *.crying
  • *.antihacker2017
  • *.theworldisyours
  • *.spora
  • *.sexy
  • *.realfs0ciety@sigaint.org.fs0ciety
  • *.pays
  • *.payrms
  • *.paymts
  • *.paymrss
  • *.paym
  • *.lol
  • *.madebyadam
  • *.locklock
  • *.lcked
  • *.kyra
  • *.kernel_time
  • *.kernel_pid
  • *.kernel_complete
  • *.ifuckedyou
  • *.grt
  • *.crypte
  • *.cbu1
  • *-webmafia@asia.com_donald@trampo.info
  • *.beef
  • *.write_us_on_email
  • *.LIGHTNING
  • *.xfile
  • DECRYPTION.TXT
  • *.oled
  • *.wtdi
  • *.4rwcry4w
  • *.Encrypted_By_VMola.com
  • *.wlu
  • Restore_maysomware_files.html
  • *.maysomware
  • *.damoclis
  • *.decrypter@tutanota.com
  • *.VisionCrypt
  • *.pwned
  • how_to_back_files.html
  • *.hNcrypt
  • *.~xdata~
  • *.b0ff
  • Galaperidol.exe
  • HOW_CAN_I_DECRYPT_MY_FILES.txt
  • *.xdata
  • Hello There! Fellow @kee User!.txt
  • *.kee
  • *.grux
  • Restore_your_files.txt
  • READ_ME.html
  • *.mordor
  • *.die
  • *.SaMsUnG
  • !#_DECRYPT_#!.inf
  • *.nuke55
  • *.onyon
  • *.blocked
  • !Please Read Me!.txt
  • !WannaDecryptor!.exe.lnk
  • *.DARKCRY
  • *.wincry
  • *.wncrypt
  • WannaCrypt 4.0.exe
  • t.wry
  • *.vCrypt1
  • *.theva
  • *.PAY
  • tor.exe
  • tasksche.exe
  • wcry.zip
  • taskhsvc.exe
  • taskse.exe
  • taskdl.exe
  • *.pky
  • *.eky
  • wcry.exe
  • Wannacry.exe
  • @WanaDecryptor@.*
  • *.slvpawned
  • *.WCRYT
  • *.WRNY
  • *.LOCKED.txt
  • *.wncryt
  • *.wnry
  • *.viki
  • RESTORE-12345-FILES.TXT
  • *.donation1@protonmail.ch.12345
  • *.block_file12
  • *.@decrypt2017
  • *.vdul
  • *.2cXpCihgsVxB3
  • *.son
  • loptr-*.htm
  • *.paycyka
  • *.medal
  • *.bagi
  • @Please_Read_Me@.txt
  • *.wncry
  • _!!!_README_!!!_*
  • _!!!_README_!!!_*_.hta
  • _!!!_README_!!!_*_.txt
  • *.news
  • *.corrupted
  • HOW_TO_DECRYPT_FILES.html
  • *.shifr
  • DECRYPT_INFO.txt
  • *.FailedAccess
  • Cversions.2.db
  • *.helppme@india.com.*
  • ReadME_Decrypt_Help_*.html
  • *.fartplz
  • *.vCrypt1
  • *.xncrypt
  • *.Lockify
  • *.htrs
  • *.cryptowin
  • *.owned
  • *.x0lzs3c
  • *.UIWIX
  • *.CRYPTOBOSS
  • *.loptr
  • *.jaff
  • *.bitkangoroo
  • *.cloud
  • zcrypt.exe
  • *.uk-dealer@sigaint.org
  • *_luck
  • *.decrypt2017
  • *.[admin@hoist.desi].*.WALLET
  • *.[crysis@life.com].*.WALLET
  • *.[SHIELD0@USA.COM].*.WALLET
  • #_RESTORING_FILES_#.TXT
  • *.haters
  • *.anon
  • *.amnesia
  • *.keepcalm
  • *.MIKOYAN
  • RESTORE_FILES.HTML
  • *.WWW
  • *.CRYPTED000007
  • *.HELPPME@INDIA.COM.ID83994902
  • HOW_RETURN_FILES.TXT
  • *.MAYA
  • *.CONTACT_TARINEOZA@GMAIL.COM
  • *.CRYPTOBYTE
  • *.AES
  • NOTE;!!!-ODZYSKAJ-PLIKI-!!!.TXT
  • INSTRUCTION_FOR_HELPING_FILE_RECOVERY.txt
  • *.ADR
  • *.NM4
  • DesktopOsiris.*
  • OSIRIS-*.*
  • redchip2.exe
  • *.LOLI
  • ATLAS_FILES.txt
  • *.whatthefuck
  • *.loveyouisreal
  • *.okokokokok
  • *.ranranranran
  • READ_IT_FOR_GET_YOUR_FILE.txt
  • *.psh
  • *.GETREKT
  • *.one
  • !!! READ THIS - IMPORTANT !!!.txt`
  • *.aes_ni_0day
  • *.JEEPERS
  • PAYMENT-INSTRUCTIONS.TXT
  • *.LOCKOUT
  • *.ATLAS
  • *.FLATCHER3@INDIA.COM.000G
  • *.AES-NI
  • *.DEXTER
  • *.CONFICKER
  • *.ONION
  • *.[NO.TORP3DA@PROTONMAIL.CH].WALLET
  • *.LCKD
  • *.MOLE
  • *.RANSOM
  • *.lambda.l0cked
  • 009-READ-FOR-DECCCC-FILESSS.html
  • _READ_THI$_FILE_*
  • *.I'WANT MONEY
  • *.gembok
  • !Decrypt-All-Files-*.txt
  • *.[GOFMEN17@YA.RU].CRP
  • *.SERP
  • *.kilit
  • 0_HELP_DECRYPT_FILES.HTM
  • HUR_DEKRYPTERA_FILER.html
  • HUR_DEKRYPTERA_FILER.txt
  • *.LAMBDA.LOCKED
  • *.ADMIN@BADADMIN.XYZ
  • *.SKJDTHGHH
  • *.LOCK75
  • *.B10CKED
  • *.A95436@YA.RU
  • *.IWANT
  • *.Fuck_You
  • Recupere seus arquivos aqui.txt
  • READ TO UNLOCK FILES.salsa.*.html
  • *.SALSA222
  • *.NUMBERDOT
  • How Decrypt My Files.lnk
  • How_Decrypt_My_Files
  • *.CRADLE
  • *.ID-7ES642406.CRY
  • READ ME ABOUT DECRYPTION.txt
  • *.Do_not_change_the_file_name.cryp
  • *.pr0tect
  • *.android
  • *_READ_THIS_FILE_*_*
  • *.btcware
  • *drakosho_new@aol.com*
  • *.AngleWare
  • *.zorro
  • *.CIFGKSAFFSFYGHD
  • *.A9V9AHU4
  • *.payfordecrypt
  • OKU.TXT
  • ZINO_NOTE.TXT
  • *.ZINO
  • *.kirked
  • *.CRPTXXX
  • HOW_TO_FIX_!.TXT
  • *.[BRAINCRYPT@INDIA.COM].BRAINCRYPT
  • *.pizdec
  • *.REVENGE
  • !!!READ_TO_UNLOCK!!!.TXT
  • *.openforyou@india.com
  • *.warn_wallet
  • *.nemo-hacks.at.sigaint.org
  • *.MATRIX
  • Crytp0l0cker.Upack.dll
  • Crytp0l0cker.dll
  • Crytp0l0cker.exe
  • decrypted_files.dat
  • padcryptUninstaller.exe
  • PadCrypt.exe
  • Vape Launcher.exe
  • READ_ME_!.txt
  • *.enjey
  • Aescrypt.exe
  • *.GG
  • *.[PINGY@INDIA.COM]
  • *.WORMKILLER@INDIA.COM.XTBL
  • *.CEBER3
  • IF_WANT_FILES_BACK_PLS_READ.html
  • *.iaufkakfhsaraf
  • _HELP_HELP_HELP_*
  • zXz.html
  • *.zXz
  • VictemKey_*_*
  • HVORDAN_DU_GENDANNER_FILER.html
  • HVORDAN_DU_GENDANNER_FILER.txt
  • HELP_ME_PLEASE.txt
  • !_RECOVERY_HELP_!.txt
  • PLEASE-READIT-IF_YOU-WANT.html
  • *.filegofprencrp
  • COME_RIPRISTINARE_I_FILE.*
  • fattura_*.js
  • *_steaveiwalker@india.com_
  • COMO_ABRIR_ARQUIVOS.txt
  • *info@kraken.cc_worldcza@email.cz
  • *.kr3
  • COMO_RESTAURAR_ARCHIVOS.txt
  • COMO_RESTAURAR_ARCHIVOS.html
  • *.ENCR
  • *.[File-Help@India.Com].mails
  • damage@india.com*
  • *.tmp.exe
  • What happen to my files.txt
  • *.jeepdayz@india.com
  • *.BarRax
  • *.damage
  • *.locked-*
  • *.jey
  • *.CRYPTOSHIEL
  • *.cfk
  • ASSISTANCE_IN_RECOVERY.txt
  • #_DECRYPT_ASSISTANCE_#.txt
  • *.lfk
  • _HELP_HELP_HELP_*.hta
  • _HELP_HELP_HELP_*.jpg
  • BTC_DECRYPT_FILES.txt
  • *.TheTrumpLockerp
  • *.TheTrumpLockerf
  • *.d4nk
  • *.x3mpro
  • READ-READ-READ.html
  • *.weencedufiles
  • *.jse
  • *.powned
  • [KASISKI]*
  • INSTRUCCIONES.txt
  • @_USE_TO_FIX_*.txt
  • *.happydayzz
  • *.hasp
  • 001-READ-FOR-DECRYPT-FILES.html
  • DECRYPT_INFORMATION.html
  • Rans0m_N0te_Read_ME.txt
  • email-vpupkin3@aol.com*
  • *.hnyear
  • *.hnumkhotep@india.com.hnumkhotep
  • *.wowwhereismyfiles
  • *.decryptional
  • *.wowreadfordecryp
  • *.7zipper
  • *.youransom
  • *.gui
  • *.Harzhuangzi
  • *.encryptedyourfiles
  • *HERMES
  • [amanda_sofost@india.com].wallet
  • *.wcry
  • *.velikasrbija
  • *.razarac
  • *.serpent
  • *.msj
  • *.szesnl
  • _DECRYPT_INFO_szesnl.html
  • 000-IF-YOU-WANT-DEC-FILES.html
  • *.evillock
  • *.letmetrydecfiles
  • *.yourransom
  • *.lambda_l0cked
  • *.gefickt
  • *.HakunaMatata
  • *.CRYPTOSHIELD
  • *.weareyourfriends
  • MERRY_I_LOVE_YOU_BRUCE.hta
  • How decrypt files.hta
  • unCrypte@outlook.com*
  • decipher_ne@outlook.com*
  • *.potato
  • *.otherinformation
  • *.vxLock
  • *.rdmk
  • *.paytounlock
  • TRY-READ-ME-TO-DEC.html
  • EMAIL_*_recipient.zip
  • *.sage
  • *garryweber@protonmail.ch
  • LEER_INMEDIATAMENTE.txt
  • *.killedXXX
  • *.doomed
  • *.sifreli
  • *.MERRY
  • 000-No-PROBLEM-WE-DEC-FILES.html
  • *.noproblemwedecfiles
  • WE-MUST-DEC-FILES.html
  • *.powerfulldecrypt
  • *.stn
  • *bingo@opensourcemail.org
  • *.id-3044989498_x3m
  • *.x3m
  • READ_ME_TO_DECRYPT_YOU_INFORMA.jjj
  • *.wuciwug
  • *.kencf
  • *.file0locked
  • file0locked.js
  • CryptoRansomware.exe
  • *.VBRANSOM
  • _HELP_Recover_Files_.html
  • *.oops
  • *.deria
  • *.RMCM1
  • *.Locked-by-Mafia
  • *-filesencrypted.html
  • decrypt_Globe*.exe
  • *.hnumkhotep
  • DecryptFile.txt
  • *.L0CKED
  • NFS-e*1025-7152.exe
  • firstransomware.exe
  • HELP-ME-ENCED-FILES.html
  • *.helpmeencedfiles
  • *EdgeLocker*.exe
  • *.edgel
  • *.XBTL
  • *.firecrypt
  • YOUR_FILES_ARE_DEAD.hta
  • *.MRCR1
  • *.PEGS1
  • *.RARE1
  • *.airacropencrypted!
  • *[cryptsvc@mail.ru].*
  • WHERE-YOUR-FILES.html
  • *.Whereisyourfiles
  • *opentoyou@india.com
  • C-email-*-*.odcodc
  • *.maktub
  • *.hush
  • *.bript
  • _*_README.hta
  • _*_README.jpg
  • HOW_OPEN_FILES.hta
  • *.gangbang
  • GJENOPPRETTING_AV_FILER.html
  • GJENOPPRETTING_AV_FILER.txt
  • !!! HOW TO DECRYPT FILES !!!.txt
  • *.braincrypt
  • INSTRUCTION RESTORE FILE.TXT
  • *.lesli
  • Survey Locker.exe
  • !!!!!ATENO!!!!!.html
  • Receipt.exe
  • WindowsApplication1.exe
  • HWID Lock.exe
  • VIP72.exe
  • DALE_FILES.TXT
  • *.DALE
  • *.8637
  • *.kok
  • HOW_TO_RESTORE_YOUR_DATA.html
  • *.paymrts
  • *.paymds
  • RESTORE_CORUPTED_FILES.HTML
  • READ@My.txt
  • Cyber SpLiTTer Vbs.exe
  • *.flyper
  • 000-PLEASE-READ-WE-HELP.html
  • *.helpdecrypt@india.com
  • *.VforVendetta
  • popcorn_time.exe
  • *.filock
  • *.wallet
  • *_.rmd
  • *.uDz2j8mv
  • OSIRIS-*.htm
  • DesktopOsiris.htm
  • *[cryptservice@inbox.ru]*
  • *.no_more_ransom
  • bahij2@india.com
  • *.lovewindows
  • *.osiris
  • *.R.i.P
  • Important!.txt
  • !_HOW_TO_RESTORE_*.txt
  • HOW_TO_RESTORE_FILES.txt
  • _README_*.hta
  • *.Zzzz
  • *[lavandos@dr.com].wallet
  • *.coin
  • *.crypted_file
  • *.EncrypTile
  • *.hcked
  • _README_.hta
  • Runsome.exe
  • Payment_Advice.mht
  • lblBitcoinInfoMain.txt
  • lblFinallyText.txt
  • lblMain.txt
  • *.hannah
  • *.vindows
  • How to decrypt your files.jpg
  • How to decrypt your files.txt
  • How to get data back.txt
  • *.zycrypt
  • *.sgood
  • *.zzzzz
  • xort.txt
  • DOSYALARINIZA ULAMAK N AINIZ.html
  • HOWTO_RECOVER_FILES_*.TXT
  • HELP_RESTORE_FILES_*.TXT
  • Recovery+*.html
  • Recovery+*.txt _H_e_l_p_RECOVER_INSTRUCTIONS+*.png`
  • _H_e_l_p_RECOVER_INSTRUCTIONS+*.html
  • help_recover_instructions+*.html
  • help_recover_instructions+*.BMP
  • _how_recover+*.html
  • _how_recover+*.txt
  • ThxForYurTyme.txt
  • _HOW_TO_Decrypt.bmp
  • _RECOVER_INSTRUCTIONS.ini
  • ###-READ-FOR-HELLPP.html
  • rtext.txt
  • DECRYPTION INSTRUCTIONS.txt
  • decrypt explanations.html
  • _WHAT_is.html
  • _HOWDO_text.html
  • readme_liesmich_encryptor_raas.txt
  • _Adatok_visszaallitasahoz_utasitasok.txt
  • How to restore files.hta
  • locked.bmp
  • README_TO_RECURE_YOUR_FILES.txt
  • Your files encrypted by our friends !!!.txt
  • ATTENTION.url
  • @WARNING_FILES_ARE_ENCRYPTED.*.txt
  • README!!!.txt
  • # README.hta
  • !Recovery_*.html
  • YourID.txt
  • recover.bmp
  • recover.txt
  • README HOW TO DECRYPT YOUR FILES.HTML
  • READ_IT.txt
  • *.lock93
  • *.!emc
  • *.adk
  • svchosd.exe
  • *.aesir
  • *.CHIP
  • *.happy
  • *.angelamerkel
  • *.razy1337
  • *.zendr4
  • *.dharma
  • *.locked3
  • *.duhust
  • *.exploit
  • *_crypt
  • *_help_instruct*.*
  • *!DMAlock*
  • *.GSupport3
  • *.rnsmwr
  • *.dCrypt
  • ransomed.html
  • *.Alcatraz
  • *_WHAT_is.html
  • readme.hta
  • *.96e2
  • *.thor
  • *.dxxd
  • *.usr0
  • *.shit
  • *.coded
  • *.raid10
  • *.realfs0ciety*
  • *.rip
  • *.okean*
  • *.globe
  • *.nuclear55
  • *.1txt
  • *.kostya
  • *.k0stya
  • *.comrade
  • *.exotic
  • *.fuck
  • *.Yakes
  • *.Zimbra
  • email-salazar_slytherin10@yahoo.com.ver-*.id-*-*.randomname-*
  • *._AiraCropEncrypted!
  • README_RECOVER_FILES_*.txt
  • README_RECOVER_FILES_*.png
  • README_RECOVER_FILES_*.html
  • *.~HL*
  • Sarah_G@ausi.com___*
  • *.zc3791
  • *.venusp
  • *.shino
  • *.bleepYourFiles
  • *.crashed
  • *.amba
  • *.7h9r
  • *.
  • *.
  • *.b5c6
  • *.ap19
  • *.a19
  • _*_HOWDO_text.html
  • *_HOWDO_text.bmp
  • *_HOWDO_text.html
  • *.odin
  • *.zypto*
  • zzzzzzzzzzzzzzzzzyyy
  • zycrypt.*
  • *decrypt your file*.*
  • *_nullbyte*
  • *.bart
  • *.axx
  • _H_e_l_p_RECOVER_INSTRUCTIONS+*.txt
  • HOW-TO-DECRYPT-FILES.HTML
  • HOW_TO_DECRYPT.HTML
  • exit.hhr.obleep
  • UnblockFiles.vbs
  • README_DECRYPT_HYDRA_ID_*.txt
  • DECRYPT_Readme.TXT.ReadMe
  • Decrypt All Files *.bmp
  • HowDecrypt.gif
  • HELP_YOURFILES.HTML
  • HOW TO DECRYPT FILES.HTML
  • BUYUNLOCKCODE
  • BitCryptorFileList.txt
  • *.crjocker
  • *.POSHKODER
  • *.hydracrypt_ID_*
  • *.CTBL2
  • *.unbrecrypt_ID_*
  • *.padcrypt
  • *.rekt
  • *.CCCRRRPPP
  • *.SecureCrypte
  • *.windows10
  • *.pdcr
  • *.keybtc@inbox
  • *.breaking_bad
  • *.cryptowall
  • *.xorist
  • *.crypt1
  • How_to_decrypt_your_files.jpg
  • How_to_restore_files.hta
  • *.cerber3
  • *.a5zfn
  • *.purge
  • *.fantom
  • *.cerber2
  • !readme.*
  • Como descriptografar seus arquivos.txt
  • *.C0rp0r@c@0Xr@
  • *.domino
  • *cerber2
  • *.cawwcca
  • how_to_unlock*.*
  • !Recovery_*.txt
  • Read_this_file.txt
  • *.legion
  • *.encoderpass
  • *.cryptolocker
  • *.7z.encrypted
  • ATTENTION!!!.txt
  • HELP_DECRYPT.lnk
  • how to decrypt aes files.lnk
  • restore_files.txt
  • HowDecrypt.txt
  • $RECYCLE.BIN.{*-*-*-*}
  • *.heisenberg
  • *.breaking bad
  • *.razy
  • *.Venusf
  • .~
  • *.payfornature@india.com.crypted
  • winclwp.jpg
  • wie_zum_Wiederherstellen_von_Dateien.txt
  • tox.html
  • strongcrypt.bmp
  • qwer2.html
  • qwer.html
  • pronk.txt
  • paycrypt.bmp
  • maxcrypt.bmp
  • how_decrypt.gif
  • how to get data.txt
  • help_recover_instructions*.txt
  • help_recover_instructions*.html
  • help_recover_instructions*.bmp
  • help-file-decrypt.enc
  • enigma_encr.txt
  • enigma.hta
  • default432643264.jpg
  • default32643264.bmp
  • decypt_your_files.html
  • de_crypt_readme.txt
  • de_crypt_readme.html
  • de_crypt_readme.bmp
  • cryptinfo.txt
  • crjoker.html
  • _how_recover*.txt
  • _how_recover*.html
  • _Locky_recover_instructions.bmp
  • _H_e_l_p_RECOVER_INSTRUCTIONS*.txt
  • _H_e_l_p_RECOVER_INSTRUCTIONS*.png
  • _H_e_l_p_RECOVER_INSTRUCTIONS*.html
  • _HELP_instructions.txt
  • _HELP_instructions.bmp
  • _DECRYPT_INFO_*.html
  • Your files encrypted by our friends !!! txt
  • Your files are locked !.txt
  • Your files are locked !!.txt
  • Your files are locked !!!.txt
  • Your files are locked !!!!.txt
  • YOUR_FILES_ARE_LOCKED.txt
  • YOUR_FILES_ARE_ENCRYPTED.TXT
  • YOUR_FILES_ARE_ENCRYPTED.HTML
  • YOUGOTHACKED.TXT
  • UNLOCK_FILES_INSTRUCTIONS.txt
  • UNLOCK_FILES_INSTRUCTIONS.html
  • SIFRE_COZME_TALIMATI.html
  • SHTODELATVAM.txt
  • Read Me (How Decrypt) !!!!.txt
  • RESTORE_FILES_*.txt
  • RESTORE_FILES_*.*
  • READ_THIS_TO_DECRYPT.html
  • README_HOW_TO_UNLOCK.TXT
  • README_HOW_TO_UNLOCK.HTML
  • README_DECRYPT_UMBRE_ID_*.txt
  • README_DECRYPT_UMBRE_ID_*.jpg
  • README_DECRYPT_HYRDA_ID_*.txt
  • READ ME FOR DECRYPT.txt
  • READ IF YOU WANT YOUR FILES BACK.html
  • Payment_Instructions.jpg
  • ONTSLEUTELINGS_INSTRUCTIES.html
  • OKSOWATHAPPENDTOYOURFILES.TXT
  • MENSAGEM.txt
  • KryptoLocker_README.txt
  • Instructionaga.txt
  • ISTRUZIONI_DECRITTAZIONE.html
  • INSTRUCTIONS_DE_DECRYPTAGE.html
  • INSTRUCCIONES_DESCIFRADO.html
  • INSTALL_TOR.URL
  • IMPORTANT.README
  • IMPORTANT READ ME.txt
  • Howto_RESTORE_FILES.html
  • How to decrypt your data.txt
  • How to decrypt LeChiffre files.html
  • Help Decrypt.html
  • Hacked_Read_me_to_decrypt_files.html
  • HOW_TO_UNLOCK_FILES_README_*.txt
  • HOW_TO_RESTORE_FILES.html
  • HOW_DECRYPT.URL
  • HOW_DECRYPT.TXT
  • HOW_DECRYPT.HTML
  • HOWTO_RECOVER_FILES_*.*
  • HOW TO DECRYPT FILES.txt
  • HELP_YOUR_FILES.html
  • HELP_YOUR_FILES.PNG
  • HELP_TO_SAVE_FILES.bmp
  • HELP_RESTORE_FILES_*.*
  • HELP_DECRYPT.URL
  • HELP_DECRYPT.PNG
  • HELP_DECRYPT.HTML
  • GetYouFiles.txt
  • File Decrypt Help.html
  • FILES_BACK.txt
  • ENTSCHLUSSELN_HINWEISE.html
  • DecryptAllFiles*.txt
  • DESIFROVANI_POKYNY.html
  • DECRYPT_YOUR_FILES.txt
  • DECRYPT_YOUR_FILES.HTML
  • DECRYPT_ReadMe1.TXT
  • DECRYPT_INSTRUCTIONS.html
  • DECRYPT_INSTRUCTION.URL
  • DECRYPT_INSTRUCTION.HTML
  • DECRYPTION_HOWTO.Notepad
  • Comment dbloquer mes fichiers.txt
  • BUYUNLOCKCODE.txt
  • AllFilesAreLocked*.bmp
  • 4-14-2016-INFECTION.TXT
  • *_ryp
  • *_HELP_instructions.html
  • *.xcrypt
  • *.unavailable
  • *.szf
  • *.porno.pornoransom
  • *.plauge17
  • *.neitrino
  • *.kimcilware.locked
  • *.iwanthelpuuu
  • *.herbst
  • *.helpdecrypt@ukr.net
  • *.h3ll
  • *.gws.porno
  • *.fuckyourdata
  • *.encrypted.locked
  • *.cryptz
  • *.crypttt
  • *.cripttt
  • *.criptokod
  • *.criptiko
  • *.btc.kkk.fun.gws
  • *.aga
  • *._ryp
  • *.Where_my_files.txt
  • *.Read_Me.Txt
  • *.RSplited
  • *.KEYZ.KEYH0LES
  • *.How_To_Get_Back.txt
  • *.How_To_Decrypt.txt
  • *.Contact_Here_To_Recover_Your_Files.txt
  • *.31392E30362E32303136_*
  • # DECRYPT MY FILES #.vbs
  • # DECRYPT MY FILES #.txt
  • # DECRYPT MY FILES #.html
  • !Where_are_my_files!.html
  • !!!README!!!*.rtf
  • !!!-WARNING-!!!.txt
  • !!!-WARNING-!!!.html
  • *.magic_software_syndicate
  • *maestro@pizzacrypts.info
  • *.crypt
  • *.bitstak
  • *.wflx
  • *.CRRRT
  • howtodecryptaesfiles.txt
  • !satana!.txt
  • *.akaibvn
  • *.cRh8
  • *.YTBL
  • *.krypted
  • *.tzu
  • *.6FKR8d
  • *.sshxkej
  • *.eclr
  • *.epic
  • *.paybtcs
  • *.AFD
  • *.paymst
  • *.payms
  • *.isis
  • *.zepto
  • *.bart.zip
  • *.kratos
  • *.31342E30362E32303136*
  • *.SecureCrypted
  • *.crptrgr
  • *.rtyrtyrty
  • !DMALOCK3.0*
  • *.evil
  • *.crypt38
  • *.asdasdasd
  • *.ded
  • *.bloccato
  • *.canihelpyou
  • *.crypz
  • decrypt-instruct*.*
  • *files_are_encrypted.*
  • *decryptmyfiles*.*
  • help_instructions.*
  • *-recover-*.*
  • de_crypt_readme.*
  • *!recover!*.*
  • *recover}-*.*
  • *rec0ver*.*
  • _help_instruct*.*
  • *_recover_*.*
  • *+recover+*.*
  • *warning-!!*.*
  • *decrypt my file*.*
  • help_file_*.*
  • recovery+*.*
  • readme_for_decrypt*.*
  • install_tor*.*
  • readme_decrypt*.*
  • howtodecrypt*.*
  • howto_restore*.*
  • how_to_recover*.*
  • how_recover*.*
  • how_to_decrypt*.*
  • how to decrypt*.*
  • help_restore*.*
  • help_your_file*.*
  • help_recover*.*
  • help_decrypt*.*
  • decrypt_instruct*.*
  • cryptolocker.*
  • *recover_instruction*.*
  • *.hydracrypt_ID*
  • *gmail*.crypt
  • *.cryptotorlocker*
  • *.xxx
  • *.xyz
  • *.xtbl
  • *.xort
  • *.xrtn
  • *.vvv
  • *.vscrypt
  • *.trun
  • *.ttt
  • *.surprise
  • *.troyancoder@qq_com
  • *.sport
  • *.scl
  • *.ryp
  • *.sanction
  • *.RRK
  • *.rokku
  • *.remind
  • *.relock@qq_com
  • *.RDM
  • *.RADAMANT
  • *.R5A
  • *.R4A
  • *.PoAr2w
  • *.pizda@qq_com
  • *.p5tkjw
  • *.oplata@qq_com
  • *.oshit
  • *.oor
  • *.one-we_can-help_you
  • *.OMG!
  • *.nochance
  • *.nalog@qq_com
  • *.micro
  • *.LOL!
  • *.locky
  • *.locked
  • *.LeChiffre
  • *.kraken
  • *.korrektor
  • *.kkk
  • *.kimcilware
  • *.KEYZ
  • *.keybtc@inbox_com
  • *.KEYHOLES
  • *.justbtcwillhelpyou
  • *.infected
  • *.helpdecrypt@ukr_net
  • *.hb15
  • *.ha3
  • *.gruzin@qq_com
  • *.gws
  • *.fun
  • *.fucked
  • *.enigma
  • *.encryptedped
  • *.encryptedRSA
  • *.encryptedAES
  • *.Encrypted
  • *.encrypt
  • *.encedRSA
  • *.EnCiPhErEd
  • *.dyatel@qq_com
  • *.czvxce
  • *.darkness
  • *.ctbl
  • *.CrySiS
  • *.CryptoTorLocker2015!
  • *.crypted
  • *.cry
  • *.crjoker
  • *.crinf
  • *.crime
  • *.coverton
  • *.code
  • *.clf
  • *.chifrator@qq_com
  • *.cerber
  • *.cbf
  • *.btcbtcbtc
  • *.btc-help-you
  • *.btc
  • *.bloc
  • *.better_call_saul
  • *.AES256
  • *.{CRYPTENDBLACKDC}
  • *.73i87A
  • *.zzz
  • *.abc
  • *.aaa
  • vault.txt
  • vault.key
  • recovery_key.txt
  • vault.hta
  • message.txt
  • recovery_file.txt
  • confirmation.key
  • enc_files.txt
  • last_chance.txt
  • *.vault
  • *want your files back.*
  • *.frtrss
  • *.exx
  • *.ezz
  • *.ecc
  • *help_restore*.*
  • *how_to_recover*.*
  • *restore_fi*.*
  • *ukr.net*
  • *qq_com*
  • *keemail.me*
  • *decipher*
  • *install_tor*.*
  • *@india.com*
  • *@gmail_com_*
  • *.*obleep
  • *.*exx
  • *.*locked
  • *.*nochance
  • *.*kraken
  • *.*kb15
  • *.*darkness
  • *.*crypto
  • *.*cry
  • _Locky_recover_instructions.txt
  • help_recover_instructions+*.txt
  • recoverfile*.txt
  • Howto_Restore_FILES.TXT
  • recoveryfile*.txt
  • _how_recover.txt
  • howrecover+*.txt
  • restorefiles.txt
  • howto_recover_file.txt
  • HowtoRESTORE_FILES.txt
  • RECOVERY_FILE*.txt
  • RECOVERY_FILES.txt
  • help_decrypt_your_files.html
  • HELPDECYPRT_YOUR_FILES.HTML
  • IHAVEYOURSECRET.KEY
  • SECRET.KEY
  • SECRETIDHERE.KEY
  • READTHISNOW!!!.TXT
  • IAMREADYTOPAY.TXT
  • HELLOTHERE.TXT
  • FILESAREGONE.TXT
  • DECRYPT_ReadMe.TXT
  • Read.txt
  • About_Files.txt
  • _secret_code.txt
  • ReadDecryptFilesHere.txt
  • Coin.Locker.txt
  • HOW_TO_DECRYPT_FILES.TXT
  • DECRYPT_INSTRUCTION.TXT
  • encryptor_raas_readme_liesmich.txt
  • Help_Decrypt.txt
  • YOUR_FILES.url
  • How_To_Recover_Files.txt
  • YOUR_FILES.HTML
  • INSTRUCCIONES_DESCIFRADO.TXT
  • DECRYPT_INSTRUCTIONS.TXT
  • HELP_TO_SAVE_FILES.txt
  • DecryptAllFiles.txt
  • HELP_RECOVER_FILES.txt
  • HELP_RESTORE_FILES.txt
  • HELP_TO_DECRYPT_YOUR_FILES.txt
  • HELP_YOUR_FILES.TXT
  • HELPDECRYPT.TXT
  • *.CTB2
  • *.SUPERCRYPT
  • *.magic
  • *.1999
  • *.toxcrypt
  • *.bleep
  • *.0x0
  • *.good
  • *.R16M01D05
  • *.pzdc
  • *.XRNT
  • *.crypto
  • *.ccc
  • *.da_