t5AFn2fQ

1# Extensions
2$ext = @( `
3"!!! HOW TO DECRYPT FILES !!!.txt", `
4"!!! READ THIS - IMPORTANT !!!.txt", `
5"!!!!!ATENÇÃO!!!!!.html", `
6"!!!READ_TO_UNLOCK!!!.TXT", `
7"!!!README!!!*.rtf", `
8"!!!-WARNING-!!!.html", `
9"!!!-WARNING-!!!.txt", `
10"!_HOW_TO_RESTORE_*.txt", `
11"!_RECOVERY_HELP_!.txt", `
12"!Decrypt-All-Files-*.txt", `
13"!DMALOCK3.0*", `
14"!readme.*", `
15"!Recovery_*.html", `
16"!Recovery_*.txt", `
17"!satana!.txt", `
18"!Where_are_my_files!.html", `
19"# DECRYPT MY FILES #.html", `
20"# DECRYPT MY FILES #.txt", `
21"# DECRYPT MY FILES #.vbs", `
22"# README.hta", `
23"###-READ-FOR-HELLPP.html", `
24"#_DECRYPT_ASSISTANCE_#.txt", `
25"#_RESTORING_FILES_#.TXT", `
26"$RECYCLE.BIN.{*-*-*-*}", `
27"* .vCrypt1", `
28"*!DMAlock*", `
29"*!recover!*.*", `
30"*.!emc", `
31"*.*cry", `
32"*.*crypto", `
33"*.*darkness", `
34"*.*exx", `
35"*.*kb15", `
36"*.*kraken", `
37"*.*locked", `
38"*.*nochance", `
39"*.*obleep", `
40"*.???", `
41"*.????", `
42"*.????? ????????????", `
43"*.@decrypt2017", `
44"*.[admin@hoist.desi].*.WALLET", `
45"*.[BRAINCRYPT@INDIA.COM].BRAINCRYPT", `
46"*.[crysis@life.com].*.WALLET", `
47"*.[File-Help@India.Com].mails", `
48"*.[GOFMEN17@YA.RU],CRP", `
49"*.[NO.TORP3DA@PROTONMAIL.CH].WALLET", `
50"*.[PINGY@INDIA.COM]", `
51"*.[SHIELD0@USA.COM].*.WALLET", `
52"*._AiraCropEncrypted!", `
53"*._ryp", `
54"*.{CRYPTENDBLACKDC}", `
55"*.~HL*", `
56"*.0x0", `
57"*.1999", `
58"*.1txt", `
59"*.2cXpCihgsVxB3", `
60"*.31342E30362E32303136*", `
61"*.31392E30362E32303136_*", `
62"*.6FKR8d", `
63"*.73i87A", `
64"*.777", `
65"*.7h9r", `
66"*.7z.encrypted", `
67"*.7zipper", `
68"*.8637", `
69"*.8lock8", `
70"*.96e2", `
71"*.a19", `
72"*.a5zfn", `
73"*.A95436@YA.RU", `
74"*.A9V9AHU4", `
75"*.aaa", `
76"*.abc", `
77"*.adk", `
78"*.ADMIN@BADADMIN.XYZ", `
79"*.ADR", `
80"*.AES", `
81"*.aes_ni_0day", `
82"*.AES256", `
83"*.aesir", `
84"*.AES-NI", `
85"*.AFD", `
86"*.aga", `
87"*.airacropencrypted!", `
88"*.akaibvn", `
89"*.Alcatraz", `
90"*.amba", `
91"*.amnesia", `
92"*.android", `
93"*.angelamerkel", `
94"*.AngleWare", `
95"*.anon", `
96"*.ap19", `
97"*.asdasdasd", `
98"*.ATLAS", `
99"*.axx", `
100"*.B10CKED", `
101"*.b5c6", `
102"*.bagi", `
103"*.BarRax", `
104"*.bart", `
105"*.bart.zip", `
106"*.better_call_saul", `
107"*.bitkangoroo", `
108"*.bitstak", `
109"*.bleep", `
110"*.bleepYourFiles", `
111"*.bloc", `
112"*.blocatto", `
113"*.bloccato", `
114"*.block_file12", `
115"*.braincrypt", `
116"*.breaking bad", `
117"*.breaking_bad", `
118"*.bript", `
119"*.btc", `
120"*.btc.kkk.fun.gws", `
121"*.btcbtcbtc", `
122"*.btc-help-you", `
123"*.btcware", `
124"*.C0rp0r@c@0Xr@", `
125"*.canihelpyou", `
126"*.cawwcca", `
127"*.cbf", `
128"*.ccc", `
129"*.CCCRRRPPP", `
130"*.CEBER3", `
131"*.cerber", `
132"*.cerber2", `
133"*.cerber3", `
134"*.cfk", `
135"*.chifrator@qq_com", `
136"*.CHIP", `
137"*.CIFGKSAFFSFYGHD", `
138"*.clf", `
139"*.cloud", `
140"*.code", `
141"*.coded", `
142"*.coin", `
143"*.comrade", `
144"*.CONFICKER", `
145"*.Contact_Here_To_Recover_Your_Files.txt", `
146"*.CONTACT_TARINEOZA@GMAIL.COM", `
147"*.corrupted", `
148"*.coverton", `
149"*.CRADLE", `
150"*.crashed", `
151"*.cRh8", `
152"*.crime", `
153"*.crinf", `
154"*.criptiko", `
155"*.criptokod", `
156"*.cripttt", `
157"*.crjocker", `
158"*.crjoker", `
159"*.crptrgr", `
160"*.CRPTXXX", `
161"*.CRRRT", `
162"*.cry", `
163"*.cryp1", `
164"*.crypt", `
165"*.crypt1", `
166"*.crypt38", `
167"*.crypted", `
168"*.crypted_file", `
169"*.CRYPTED000007", `
170"*.crypto", `
171"*.CRYPTOBOSS", `
172"*.CRYPTOBYTE", `
173"*.cryptolocker", `
174"*.CRYPTOSHIEL", `
175"*.CRYPTOSHIELD", `
176"*.cryptotorlocker*", `
177"*.CryptoTorLocker2015!", `
178"*.cryptowall", `
179"*.cryptowin", `
180"*.crypttt", `
181"*.cryptz", `
182"*.crypz", `
183"*.CrySiS", `
184"*.CTB2", `
185"*.ctbl", `
186"*.CTBL2", `
187"*.czvxce", `
188"*.d4nk", `
189"*.da_vinci_code", `
190"*.DALE", `
191"*.damage", `
192"*.darkness", `
193"*.dCrypt", `
194"*.decrypt2017", `
195"*.decryptional", `
196"*.ded", `
197"*.deria", `
198"*.DEXTER", `
199"*.dharma", `
200"*.Do_not_change_the_file_name.cryp", `
201"*.domino", `
202"*.donation1@protonmail.ch.12345", `
203"*.doomed", `
204"*.duhust", `
205"*.dxxd", `
206"*.dyatel@qq_com", `
207"*.ecc", `
208"*.eclr", `
209"*.edgel", `
210"*.eky", `
211"*.encedRSA", `
212"*.EnCiPhErEd", `
213"*.encoderpass", `
214"*.ENCR", `
215"*.encrypt", `
216"*.Encrypted", `
217"*.encrypted.locked", `
218"*.encryptedAES", `
219"*.encryptedped", `
220"*.encryptedRSA", `
221"*.encryptedyourfiles", `
222"*.EncrypTile", `
223"*.enigma", `
224"*.enjey", `
225"*.epic", `
226"*.evil", `
227"*.evillock", `
228"*.exotic", `
229"*.exploit", `
230"*.exx", `
231"*.ezz", `
232"*.FailedAccess", `
233"*.fantom", `
234"*.fartplz", `
235"*.file0locked", `
236"*.filegofprencrp", `
237"*.fileiscryptedhard", `
238"*.filock", `
239"*.firecrypt", `
240"*.FLATCHER3@INDIA.COM.000G", `
241"*.flyper", `
242"*.frtrss", `
243"*.fuck", `
244"*.Fuck_You", `
245"*.fucked", `
246"*.fuckyourdata", `
247"*.fun", `
248"*.gangbang", `
249"*.gefickt", `
250"*.gembok", `
251"*.GETREKT", `
252"*.GG", `
253"*.globe", `
254"*.good", `
255"*.gruzin@qq_com", `
256"*.GSupport3", `
257"*.gui", `
258"*.gws", `
259"*.gws.porno", `
260"*.h3ll", `
261"*.ha3", `
262"*.HakunaMatata", `
263"*.hannah", `
264"*.happy", `
265"*.happydayzz", `
266"*.Harzhuangzi", `
267"*.hasp", `
268"*.haters", `
269"*.hb15", `
270"*.hcked", `
271"*.heisenberg", `
272"*.helpdecrypt@india.com", `
273"*.helpdecrypt@ukr*.net", `
274"*.helpdecrypt@ukr.net", `
275"*.helpdecrypt@ukr_net", `
276"*.helpmeencedfiles", `
277"*.helppme@india.com.*", `
278"*.HELPPME@INDIA.COM.ID83994902", `
279"*.herbst", `
280"*.hnumkhotep", `
281"*.hnumkhotep@india.com.hnumkhotep", `
282"*.hnyear", `
283"*.How_To_Decrypt.txt", `
284"*.How_To_Get_Back.txt", `
285"*.htrs", `
286"*.hush", `
287"*.hydracrypt_ID*", `
288"*.hydracrypt_ID_*", `
289"*.iaufkakfhsaraf", `
290"*.id-3044989498_x3m", `
291"*.ID-7ES642406.CRY", `
292"*.infected", `
293"*.isis", `
294"*.IWANT", `
295"*.I'WANT MONEY", `
296"*.iwanthelpuuu", `
297"*.jaff", `
298"*.jeepdayz@india.com", `
299"*.JEEPERS", `
300"*.jey", `
301"*.jse", `
302"*.justbtcwillhelpyou", `
303"*.k0stya", `
304"*.keepcalm", `
305"*.kencf", `
306"*.keybtc@inbox", `
307"*.keybtc@inbox_com", `
308"*.KEYH0LES", `
309"*.KEYHOLES", `
310"*.KEYZ", `
311"*.KEYZ.KEYH0LES", `
312"*.kilit", `
313"*.killedXXX", `
314"*.kimcilware", `
315"*.kimcilware.locked", `
316"*.kirked", `
317"*.kkk", `
318"*.kok", `
319"*.korrektor", `
320"*.kostya", `
321"*.kr3", `
322"*.kraken", `
323"*.kratos", `
324"*.krypted", `
325"*.L0CKED", `
326"*.lambda.l0cked", `
327"*.LAMBDA.LOCKED", `
328"*.lambda_l0cked", `
329"*.LCKD", `
330"*.LeChiffre", `
331"*.legion", `
332"*.lesli", `
333"*.letmetrydecfiles", `
334"*.lfk", `
335"*.LOCK75", `
336"*.lock93", `
337"*.locked", `
338"*.locked-*", `
339"*.LOCKED.txt", `
340"*.locked3", `
341"*.Locked-by-Mafia", `
342"*.Lockify", `
343"*.LOCKOUT", `
344"*.locky", `
345"*.LOL!", `
346"*.LOLI", `
347"*.loptr", `
348"*.lovewindows", `
349"*.loveyouisreal", `
350"*.magic", `
351"*.magic_software_syndicate", `
352"*.maktub", `
353"*.MATRIX", `
354"*.MAYA", `
355"*.medal", `
356"*.MERRY", `
357"*.micro", `
358"*.MIKOYAN", `
359"*.MOLE", `
360"*.MRCR1", `
361"*.msj", `
362"*.nalog@qq_com", `
363"*.neitrino", `
364"*.nemo-hacks.at.sigaint.org", `
365"*.news", `
366"*.NM4", `
367"*.no_more_ransom", `
368"*.nochance", `
369"*.noproblemwedecfiles", `
370"*.nuclear55", `
371"*.NUMBERDOT", `
372"*.odcodc", `
373"*.odin", `
374"*.okean*", `
375"*.okokokokok", `
376"*.OMG!", `
377"*.one", `
378"*.one-we_can-help_you", `
379"*.ONION", `
380"*.only-we_can-help_you", `
381"*.oops", `
382"*.oor", `
383"*.openforyou@india.com", `
384"*.oplata@qq_com", `
385"*.oshit", `
386"*.osiris", `
387"*.otherinformation", `
388"*.owned", `
389"*.p5tkjw", `
390"*.padcrypt", `
391"*.PAY", `
392"*.paybtcs", `
393"*.paycyka", `
394"*.payfordecrypt", `
395"*.payfornature@india.com.crypted", `
396"*.paymds", `
397"*.paymrts", `
398"*.payms", `
399"*.paymst", `
400"*.payransom", `
401"*.paytounlock", `
402"*.pdcr", `
403"*.PEGS1", `
404"*.pizda@qq_com", `
405"*.pizdec", `
406"*.pky", `
407"*.plauge17", `
408"*.PoAr2w", `
409"*.porno", `
410"*.porno.pornoransom", `
411"*.pornoransom", `
412"*.POSHKODER", `
413"*.potato", `
414"*.powerfulldecrypt", `
415"*.powned", `
416"*.pr0tect", `
417"*.psh", `
418"*.purge", `
419"*.pzdc", `
420"*.R.i.P", `
421"*.R16M01D05", `
422"*.R4A", `
423"*.R5A", `
424"*.RAD", `
425"*.RADAMANT", `
426"*.raid10", `
427"*.ranranranran", `
428"*.RANSOM", `
429"*.RARE1", `
430"*.razarac", `
431"*.razy", `
432"*.razy1337", `
433"*.RDM", `
434"*.rdmk", `
435"*.Read_Me.Txt", `
436"*.realfs0ciety*", `
437"*.rekt", `
438"*.relock@qq_com", `
439"*.remind", `
440"*.REVENGE ", `
441"*.rip", `
442"*.RMCM1", `
443"*.rnsmwr", `
444"*.rokku", `
445"*.RRK", `
446"*.RSNSlocked", `
447"*.RSplited", `
448"*.rtyrtyrty", `
449"*.ryp", `
450"*.sage", `
451"*.SALSA222", `
452"*.sanction", `
453"*.scl", `
454"*.SecureCrypte", `
455"*.SecureCrypted", `
456"*.SERP", `
457"*.serpent", `
458"*.sgood", `
459"*.shifr", `
460"*.shino", `
461"*.shit", `
462"*.sifreli", `
463"*.Silent", `
464"*.SKJDTHGHH", `
465"*.slvpawned", `
466"*.son", `
467"*.sport", `
468"*.sshxkej", `
469"*.stn", `
470"*.SUPERCRYPT", `
471"*.surprise", `
472"*.szesnl", `
473"*.szf", `
474"*.TheTrumpLockerf", `
475"*.TheTrumpLockerp", `
476"*.theva", `
477"*.thor", `
478"*.tmp.exe", `
479"*.toxcrypt", `
480"*.troyancoder@qq_com", `
481"*.trun", `
482"*.ttt", `
483"*.tzu", `
484"*.uDz2j8mv", `
485"*.UIWIX", `
486"*.uk-dealer@sigaint.org", `
487"*.unavailable", `
488"*.unbrecrypt_ID_*", `
489"*.usr0", `
490"*.vault", `
491"*.VBRANSOM", `
492"*.vCrypt1", `
493"*.vdul", `
494"*.velikasrbija", `
495"*.Venusf", `
496"*.venusp", `
497"*.VforVendetta", `
498"*.viki", `
499"*.vindows", `
500"*.vscrypt", `
501"*.vvv", `
502"*.vxLock", `
503"*.wallet", `
504"*.warn_wallet", `
505"*.wcry", `
506"*.WCRYT", `
507"*.weareyourfriends", `
508"*.weencedufiles", `
509"*.wflx", `
510"*.whatthefuck", `
511"*.Where_my_files.txt", `
512"*.Whereisyourfiles", `
513"*.windows10", `
514"*.wncry", `
515"*.wncryt", `
516"*.wnry", `
517"*.WORMKILLER@INDIA.COM.XTBL", `
518"*.wowreadfordecryp", `
519"*.wowwhereismyfiles", `
520"*.WRNY", `
521"*.wuciwug", `
522"*.WWW", `
523"*.x0lzs3c", `
524"*.x3m", `
525"*.x3mpro", `
526"*.XBTL", `
527"*.xcrypt", `
528"*.xncrypt", `
529"*.xorist", `
530"*.xort", `
531"*.XRNT", `
532"*.xrtn", `
533"*.xtbl", `
534"*.xxx", `
535"*.xyz", `
536"*.Yakes", `
537"*.youransom", `
538"*.yourransom", `
539"*.YTBL", `
540"*.Z81928819", `
541"*.zc3791", `
542"*.zcrypt", `
543"*.zendr4", `
544"*.zepto", `
545"*.Zimbra", `
546"*.ZINO", `
547"*.zorro", `
548"*.zXz", `
549"*.zycrypt", `
550"*.zyklon", `
551"*.zypto*", `
552"*.zzz", `
553"*.Zzzz", `
554"*.zzzzz", `
555"*@gmail_com_*", `
556"*@india.com*", `
557"*[cryptservice@inbox.ru]*", `
558"*[cryptsvc@mail.ru].*", `
559"*[lavandos@dr.com].wallet", `
560"*_.rmd", `
561"*_crypt", `
562"*_help_instruct*.*", `
563"*_HELP_instructions.html", `
564"*_HOWDO_text.bmp", `
565"*_HOWDO_text.html", `
566"*_luck", `
567"*_nullbyte*", `
568"*_READ_THIS_FILE_*_*", `
569"*_recover_*.*", `
570"*_ryp", `
571"*_steaveiwalker@india.com_", `
572"*_WHAT_is.html", `
573"*+recover+*.*", `
574"*bingo@opensourcemail.org", `
575"*cerber2", `
576"*decipher*", `
577"*decrypt my file*.*", `
578"*decrypt your file*.*", `
579"*decryptmyfiles*.*", `
580"*drakosho_new@aol.com*", `
581"*EdgeLocker*.exe ", `
582"*files_are_encrypted.*", `
583"*-filesencrypted.html", `
584"*garryweber@protonmail.ch", `
585"*gmail*.crypt", `
586"*help_restore*.*", `
587"*HERMES", `
588"*how_to_recover*.*", `
589"*info@kraken.cc_worldcza@email.cz", `
590"*install_tor*.*", `
591"*keemail.me*", `
592"*maestro@pizzacrypts.info", `
593"*opentoyou@india.com", `
594"*qq_com*", `
595"*rec0ver*.*", `
596"*-recover-*.*", `
597"*recover_instruction*.*", `
598"*recover}-*.*", `
599"*restore_fi*.*", `
600"*ukr.net*", `
601"*want your files back.*", `
602"*warning-!!*.*", `
603".~", `
604"???_????????????_?????.txt", `
605"@_USE_TO_FIX_*.txt", `
606"@Please_Read_Me@.txt", `
607"@WanaDecryptor@.*", `
608"@WARNING_FILES_ARE_ENCRYPTED.*.txt", `
609"[amanda_sofost@india.com].wallet", `
610"[KASISKI]*", `
611"_!!!_README_!!!_*", `
612"_!!!_README_!!!_*_ .txt", `
613"_!!!_README_!!!_*_.hta", `
614"_*_HOWDO_text.html", `
615"_*_README.hta", `
616"_*_README.jpg", `
617"_Adatok_visszaallitasahoz_utasitasok.txt", `
618"_DECRYPT_INFO_*.html", `
619"_DECRYPT_INFO_szesnl.html", `
620"_H_e_l_p_RECOVER_INSTRUCTIONS*.html", `
621"_H_e_l_p_RECOVER_INSTRUCTIONS*.png", `
622"_H_e_l_p_RECOVER_INSTRUCTIONS*.txt", `
623"_H_e_l_p_RECOVER_INSTRUCTIONS+*.html", `
624"_H_e_l_p_RECOVER_INSTRUCTIONS+*.png", `
625"_H_e_l_p_RECOVER_INSTRUCTIONS+*.txt", `
626"_HELP_HELP_HELP_*", `
627"_HELP_HELP_HELP_*.hta", `
628"_HELP_HELP_HELP_*.jpg", `
629"_help_instruct*.*", `
630"_HELP_instructions.bmp", `
631"_HELP_instructions.txt", `
632"_HELP_Recover_Files_.html", `
633"_how_recover*.html", `
634"_how_recover*.txt", `
635"_how_recover.txt", `
636"_how_recover+*.html", `
637"_how_recover+*.txt", `
638"_HOW_TO_Decrypt.bmp", `
639"_HOWDO_text.html", `
640"_Locky_recover_instructions.bmp", `
641"_Locky_recover_instructions.txt", `
642"_READ_THI$_FILE_*", `
643"_README_*.hta", `
644"_README_.hta", `
645"_RECOVER_INSTRUCTIONS.ini", `
646"_ryp", `
647"_secret_code.txt", `
648"_WHAT_is.html", `
649"0_HELP_DECRYPT_FILES.HTM", `
650"000-IF-YOU-WANT-DEC-FILES.html", `
651"000-No-PROBLEM-WE-DEC-FILES.html", `
652"000-PLEASE-READ-WE-HELP.html", `
653"001-READ-FOR-DECRYPT-FILES.html", `
654"009-READ-FOR-DECCCC-FILESSS.html", `
655"4-14-2016-INFECTION.TXT", `
656"About_Files.txt", `
657"Aescrypt.exe", `
658"AllFilesAreLocked*.bmp", `
659"ASSISTANCE_IN_RECOVERY.txt", `
660"ATLAS_FILES.txt", `
661"ATTENTION!!!.txt", `
662"ATTENTION.url", `
663"bahij2@india.com", `
664"BitCryptorFileList.txt", `
665"BTC_DECRYPT_FILES.txt", `
666"BUYUNLOCKCODE", `
667"BUYUNLOCKCODE.txt", `
668"C-email-*-*.odcodc", `
669"Coin.Locker.txt", `
670"COME_RIPRISTINARE_I_FILE.*", `
671"Comment débloquer mes fichiers.txt", `
672"Como descriptografar seus arquivos.txt", `
673"COMO_ABRIR_ARQUIVOS.txt", `
674"COMO_RESTAURAR_ARCHIVOS.html", `
675"COMO_RESTAURAR_ARCHIVOS.txt", `
676"confirmation.key", `
677"crjoker.html", `
678"cryptinfo.txt", `
679"cryptolocker.*", `
680"CryptoRansomware.exe", `
681"Crytp0l0cker.dll", `
682"Crytp0l0cker.exe", `
683"Crytp0l0cker.Upack.dll", `
684"Cversions.2.db", `
685"Cyber SpLiTTer Vbs.exe", `
686"DALE_FILES.TXT", `
687"damage@india.com*", `
688"de_crypt_readme.*", `
689"de_crypt_readme.bmp", `
690"de_crypt_readme.html", `
691"de_crypt_readme.txt", `
692"decipher_ne@outlook.com*", `
693"Decrypt All Files *.bmp", `
694"decrypt explanations.html", `
695"decrypt_Globe*.exe", `
696"DECRYPT_INFO.txt", `
697"DECRYPT_INFORMATION.html", `
698"decrypt_instruct*.*", `
699"DECRYPT_INSTRUCTION.HTML", `
700"DECRYPT_INSTRUCTION.TXT", `
701"DECRYPT_INSTRUCTION.URL", `
702"DECRYPT_INSTRUCTIONS.html", `
703"DECRYPT_INSTRUCTIONS.TXT", `
704"DECRYPT_ReadMe.TXT", `
705"DECRYPT_Readme.TXT.ReadMe", `
706"DECRYPT_ReadMe1.TXT", `
707"DECRYPT_YOUR_FILES.HTML", `
708"DECRYPT_YOUR_FILES.txt", `
709"DecryptAllFiles*.txt", `
710"DecryptAllFiles.txt", `
711"decrypted_files.dat", `
712"DecryptFile.txt", `
713"decrypt-instruct*.*", `
714"DECRYPTION INSTRUCTIONS.txt", `
715"DECRYPTION_HOWTO.Notepad", `
716"decypt_your_files.html", `
717"default32643264.bmp", `
718"default432643264.jpg", `
719"DESIFROVANI_POKYNY.html", `
720"DesktopOsiris.*", `
721"DesktopOsiris.htm", `
722"DOSYALARINIZA ULASMAK IÇIN AÇINIZ.html", `
723"EMAIL_*_recipient.zip", `
724"email-salazar_slytherin10@yahoo.com.ver-*.id-*-*.randomname-*", `
725"email-vpupkin3@aol.com*", `
726"enc_files.txt", `
727"encryptor_raas_readme_liesmich.txt", `
728"enigma.hta", `
729"enigma_encr.txt", `
730"ENTSCHLUSSELN_HINWEISE.html", `
731"exit.hhr.obleep", `
732"fattura_*.js", `
733"File Decrypt Help.html", `
734"file0locked.js", `
735"FILES_BACK.txt", `
736"FILESAREGONE.TXT", `
737"firstransomware.exe", `
738"GetYouFiles.txt", `
739"GJENOPPRETTING_AV_FILER.html", `
740"GJENOPPRETTING_AV_FILER.txt", `
741"Hacked_Read_me_to_decrypt_files.html", `
742"HELLOTHERE.TXT", `
743"Help Decrypt.html", `
744"help_decrypt*.*", `
745"HELP_DECRYPT.HTML", `
746"HELP_DECRYPT.lnk", `
747"HELP_DECRYPT.PNG", `
748"Help_Decrypt.txt", `
749"HELP_DECRYPT.URL", `
750"help_decrypt_your_files.html", `
751"help_file_*.*", `
752"help_instructions.*", `
753"HELP_ME_PLEASE.txt", `
754"help_recover*.*", `
755"HELP_RECOVER_FILES.txt", `
756"help_recover_instructions*.bmp", `
757"help_recover_instructions*.html", `
758"help_recover_instructions*.txt", `
759"help_recover_instructions+*.BMP", `
760"help_recover_instructions+*.html", `
761"help_recover_instructions+*.txt", `
762"help_restore*.*", `
763"HELP_RESTORE_FILES.txt", `
764"HELP_RESTORE_FILES_*.*", `
765"HELP_RESTORE_FILES_*.TXT", `
766"HELP_TO_DECRYPT_YOUR_FILES.txt", `
767"HELP_TO_SAVE_FILES.bmp", `
768"HELP_TO_SAVE_FILES.txt", `
769"help_your_file*.*", `
770"HELP_YOUR_FILES.html", `
771"HELP_YOUR_FILES.PNG", `
772"HELP_YOUR_FILES.TXT", `
773"HELP_YOURFILES.HTML", `
774"HELPDECRYPT.TXT", `
775"HELPDECYPRT_YOUR_FILES.HTML", `
776"help-file-decrypt.enc", `
777"HELP-ME-ENCED-FILES.html", `
778"How decrypt files.hta", `
779"How Decrypt My Files.lnk", `
780"how to decrypt aes files.lnk", `
781"HOW TO DECRYPT FILES.HTML", `
782"HOW TO DECRYPT FILES.txt", `
783"How to decrypt LeChiffre files.html", `
784"How to decrypt your data.txt", `
785"How to decrypt your files.jpg", `
786"How to decrypt your files.txt", `
787"how to decrypt*.*", `
788"How to get data back.txt", `
789"how to get data.txt", `
790"How to restore files.hta", `
791"how_decrypt.gif", `
792"HOW_DECRYPT.HTML", `
793"HOW_DECRYPT.TXT", `
794"HOW_DECRYPT.URL", `
795"How_Decrypt_My_Files", `
796"HOW_OPEN_FILES.hta", `
797"how_recover*.*", `
798"HOW_RETURN_FILES.TXT", `
799"how_to_decrypt*.*", `
800"HOW_TO_DECRYPT.HTML", `
801"HOW_TO_DECRYPT_FILES.html", `
802"HOW_TO_DECRYPT_FILES.TXT", `
803"How_to_decrypt_your_files.jpg", `
804"HOW_TO_FIX_!.TXT", `
805"how_to_recover*.*", `
806"How_To_Recover_Files.txt", `
807"How_to_restore_files.hta", `
808"HOW_TO_RESTORE_FILES.html", `
809"HOW_TO_RESTORE_FILES.txt", `
810"HOW_TO_RESTORE_YOUR_DATA.html", `
811"how_to_unlock*.*", `
812"HOW_TO_UNLOCK_FILES_README_*.txt", `
813"HowDecrypt.gif", `
814"HowDecrypt.txt", `
815"howrecover+*.txt", `
816"howto_recover_file.txt", `
817"HOWTO_RECOVER_FILES_*.*", `
818"HOWTO_RECOVER_FILES_*.TXT", `
819"howto_restore*.*", `
820"Howto_RESTORE_FILES.html", `
821"Howto_Restore_FILES.TXT", `
822"howtodecrypt*.*", `
823"howtodecryptaesfiles.txt", `
824"HOW-TO-DECRYPT-FILES.HTML", `
825"HowtoRESTORE_FILES.txt", `
826"HUR_DEKRYPTERA_FILER.html", `
827"HUR_DEKRYPTERA_FILER.txt", `
828"HVORDAN_DU_GENDANNER_FILER.html", `
829"HVORDAN_DU_GENDANNER_FILER.txt", `
830"HWID Lock.exe", `
831"IAMREADYTOPAY.TXT", `
832"IF_WANT_FILES_BACK_PLS_READ.html", `
833"IHAVEYOURSECRET.KEY", `
834"IMPORTANT READ ME.txt", `
835"Important!.txt", `
836"IMPORTANT.README", `
837"install_tor*.*", `
838"INSTALL_TOR.URL", `
839"INSTRUCCIONES.txt", `
840"INSTRUCCIONES_DESCIFRADO.html", `
841"INSTRUCCIONES_DESCIFRADO.TXT", `
842"INSTRUCTION RESTORE FILE.TXT", `
843"INSTRUCTION_FOR_HELPING_FILE_RECOVERY.txt", `
844"Instructionaga.txt", `
845"INSTRUCTIONS_DE_DECRYPTAGE.html", `
846"ISTRUZIONI_DECRITTAZIONE.html", `
847"KryptoLocker_README.txt", `
848"last_chance.txt", `
849"lblBitcoinInfoMain.txt", `
850"lblFinallyText.txt", `
851"lblMain.txt", `
852"LEER_INMEDIATAMENTE.txt", `
853"locked.bmp", `
854"loptr-*.htm", `
855"maxcrypt.bmp", `
856"MENSAGEM.txt", `
857"MERRY_I_LOVE_YOU_BRUCE.hta", `
858"message.txt", `
859"NFS-e*1025-7152.exe", `
860"NOTE;!!!-ODZYSKAJ-PLIKI-!!!.TXT", `
861"OKSOWATHAPPENDTOYOURFILES.TXT", `
862"OKU.TXT", `
863"ONTSLEUTELINGS_INSTRUCTIES.html", `
864"oor.*", `
865"OSIRIS-*.*", `
866"OSIRIS-*.htm", `
867"PadCrypt.exe", `
868"padcryptUninstaller.exe", `
869"paycrypt.bmp", `
870"Payment_Advice.mht", `
871"Payment_Instructions.jpg", `
872"PAYMENT-INSTRUCTIONS.TXT", `
873"PLEASE-READIT-IF_YOU-WANT.html", `
874"popcorn_time.exe", `
875"pronk.txt", `
876"qwer.html", `
877"qwer2.html", `
878"Rans0m_N0te_Read_ME.txt", `
879"ransomed.html", `
880"READ IF YOU WANT YOUR FILES BACK.html", `
881"Read Me (How Decrypt) !!!!.txt", `
882"READ ME ABOUT DECRYPTION.txt", `
883"READ ME FOR DECRYPT.txt", `
884"READ TO UNLOCK FILES.salsa.*.html", `
885"Read.txt", `
886"READ@My.txt", `
887"READ_IT.txt", `
888"READ_IT_FOR_GET_YOUR_FILE.txt", `
889"READ_ME_!.txt", `
890"READ_ME_TO_DECRYPT_YOU_INFORMA.jjj", `
891"Read_this_file.txt", `
892"READ_THIS_TO_DECRYPT.html", `
893"ReadDecryptFilesHere.txt", `
894"README HOW TO DECRYPT YOUR FILES.HTML", `
895"README!!!.txt", `
896"readme.hta", `
897"readme_decrypt*.*", `
898"ReadME_Decrypt_Help_*.html", `
899"README_DECRYPT_HYDRA_ID_*.txt", `
900"README_DECRYPT_HYRDA_ID_*.txt", `
901"README_DECRYPT_UMBRE_ID_*.jpg", `
902"README_DECRYPT_UMBRE_ID_*.txt", `
903"readme_for_decrypt*.*", `
904"README_HOW_TO_UNLOCK.HTML", `
905"README_HOW_TO_UNLOCK.TXT", `
906"readme_liesmich_encryptor_raas.txt", `
907"README_RECOVER_FILES_*.html", `
908"README_RECOVER_FILES_*.png", `
909"README_RECOVER_FILES_*.txt", `
910"README_TO_RECURE_YOUR_FILES.txt", `
911"READ-READ-READ.html", `
912"READTHISNOW!!!.TXT", `
913"Receipt.exe", `
914"recover.bmp", `
915"recover.txt", `
916"recoverfile*.txt", `
917"RECOVERY_FILE*.txt", `
918"recovery_file.txt", `
919"RECOVERY_FILES.txt", `
920"recovery_key.txt", `
921"recovery+*.*", `
922"Recovery+*.html", `
923"Recovery+*.txt", `
924"recoveryfile*.txt", `
925"Recupere seus arquivos aqui.txt", `
926"redchip2.exe", `
927"RESTORE_CORUPTED_FILES.HTML", `
928"RESTORE_FILES.HTML", `
929"restore_files.txt", `
930"RESTORE_FILES_*.*", `
931"RESTORE_FILES_*.txt", `
932"RESTORE-12345-FILES.TXT", `
933"restorefiles.txt", `
934"rtext.txt", `
935"Runsome.exe", `
936"Sarah_G@ausi.com___*", `
937"SECRET.KEY", `
938"SECRETIDHERE.KEY", `
939"SHTODELATVAM.txt", `
940"SIFRE_COZME_TALIMATI.html", `
941"strongcrypt.bmp", `
942"Survey Locker.exe", `
943"svchosd.exe", `
944"taskdl.exe", `
945"taskhsvc.exe", `
946"tasksche.exe", `
947"taskse.exe", `
948"ThxForYurTyme.txt", `
949"tor.exe", `
950"tox.html", `
951"TRY-READ-ME-TO-DEC.html", `
952"UnblockFiles.vbs", `
953"unCrypte@outlook.com*", `
954"UNLOCK_FILES_INSTRUCTIONS.html", `
955"UNLOCK_FILES_INSTRUCTIONS.txt", `
956"Vape Launcher.exe", `
957"vault.hta", `
958"vault.key", `
959"vault.txt", `
960"VictemKey_*_*", `
961"VIP72.exe", `
962"Wannacry.exe", `
963"wcry.exe", `
964"wcry.zip", `
965"WE-MUST-DEC-FILES.html", `
966"What happen to my files.txt", `
967"WHERE-YOUR-FILES.html", `
968"wie_zum_Wiederherstellen_von_Dateien.txt", `
969"winclwp.jpg", `
970"WindowsApplication1.exe", `
971"xort.txt", `
972"YOUGOTHACKED.TXT", `
973"Your files are locked !!!!.txt", `
974"Your files are locked !!!.txt", `
975"Your files are locked !!.txt", `
976"Your files are locked !.txt", `
977"Your files encrypted by our friends !!! txt", `
978"Your files encrypted by our friends !!!.txt", `
979"YOUR_FILES.HTML", `
980"YOUR_FILES.url", `
981"YOUR_FILES_ARE_DEAD.hta", `
982"YOUR_FILES_ARE_ENCRYPTED.HTML", `
983"YOUR_FILES_ARE_ENCRYPTED.TXT", `
984"YOUR_FILES_ARE_LOCKED.txt", `
985"YourID.txt", `
986"zcrypt.exe", `
987"ZINO_NOTE.TXT", `
988"zXz.html", `
989"zycrypt.*", `
990"zzzzzzzzzzzzzzzzzyyy", `
991
992# Neue Fsrm Dateigruppe
993New-FsrmFileGroup -Name "Ransomware" -IncludePattern $ext