Hey There!
Ransomware has been blowing up in the news lately and the kind Veeamy McVeeamy Face has asked if I could do a quick blog post on how to help prevent Cryptolocker hitting your file shares with File Server Resource Manager.
If you have as little faith in your end users as I do in mine, then this should hopefully help minimize the damage done to your environment when someone thinks they have a fine from a government agency, or an email from the King of some South African country offering sweet sweet money. If they only just click this one link, it will all be theirs.
Now normally I would write a step-by-step guide on how to set this up. However to save you all some time there’s a handy script I’ve been using this to accomplish this quickly and painlessly for new clients when on-boarding them.
Available on GitHub here: https://github.com/nexxai/CryptoBlocker
To advocate why I choose to do this via script below are the 1012 file types currently known to be used by Cryptolocker and it’s variants:
*.~xdata~ *.b0ff Galaperidol.exe HOW_CAN_I_DECRYPT_MY_FILES.txt *.xdata Hello There! Fellow @kee User!.txt *.kee *.grux Restore_your_files.txt READ_ME.html *.mordor *.die *.SaMsUnG !#_DECRYPT_#!.inf *.nuke55 *.onyon *.blocked !Please Read Me!.txt !WannaDecryptor!.exe.lnk *.DARKCRY *.wincry *.wncrypt WannaCrypt 4.0.exe t.wry *.vCrypt1 *.theva *.PAY tor.exe tasksche.exe wcry.zip taskhsvc.exe taskse.exe taskdl.exe *.pky *.eky wcry.exe Wannacry.exe @WanaDecryptor@.* *.slvpawned *.WCRYT *.WRNY *.LOCKED.txt *.wncryt *.wnry *.viki RESTORE-12345-FILES.TXT *.donation1@protonmail.ch.12345 *.block_file12 *.@decrypt2017 *.vdul *.2cXpCihgsVxB3 *.son loptr-*.htm *.paycyka *.medal *.bagi @Please_Read_Me@.txt *.wncry _!!!_README_!!!_* _!!!_README_!!!_*_.hta _!!!_README_!!!_*_ .txt *.news *.corrupted HOW_TO_DECRYPT_FILES.html *.shifr DECRYPT_INFO.txt *.FailedAccess Cversions.2.db *.helppme@india.com.* ReadME_Decrypt_Help_*.html *.fartplz КАК_РАСШИФРОВАТЬ_ФАЙЛЫ.txt * .vCrypt1 *.xncrypt *.Lockify *.htrs *.cryptowin *.owned *.x0lzs3c *.UIWIX *.CRYPTOBOSS *.loptr *.jaff *.bitkangoroo *.cloud zcrypt.exe *.uk-dealer@sigaint.org *_luck *.decrypt2017 *.[admin@hoist.desi].*.WALLET *.[crysis@life.com].*.WALLET *.[SHIELD0@USA.COM].*.WALLET #_RESTORING_FILES_#.TXT *.haters *.anon *.amnesia *.keepcalm *.MIKOYAN RESTORE_FILES.HTML *.WWW *.CRYPTED000007 *.HELPPME@INDIA.COM.ID83994902 HOW_RETURN_FILES.TXT *.MAYA *.CONTACT_TARINEOZA@GMAIL.COM *.CRYPTOBYTE *.AES NOTE;!!!-ODZYSKAJ-PLIKI-!!!.TXT INSTRUCTION_FOR_HELPING_FILE_RECOVERY.txt *.ADR *.NM4 DesktopOsiris.* OSIRIS-*.* redchip2.exe *.LOLI ATLAS_FILES.txt *.whatthefuck *.loveyouisreal *.okokokokok *.ranranranran READ_IT_FOR_GET_YOUR_FILE.txt *.psh *.GETREKT *.one !!! READ THIS - IMPORTANT !!!.txt *.aes_ni_0day *.JEEPERS PAYMENT-INSTRUCTIONS.TXT *.LOCKOUT *.ATLAS *.FLATCHER3@INDIA.COM.000G *.AES-NI *.DEXTER *.CONFICKER *.ONION *.[NO.TORP3DA@PROTONMAIL.CH].WALLET *.LCKD *.MOLE *.RANSOM *.lambda.l0cked 009-READ-FOR-DECCCC-FILESSS.html _READ_THI$_FILE_* *.I'WANT MONEY *.gembok !Decrypt-All-Files-*.txt *.[GOFMEN17@YA.RU],CRP *.SERP *.kilit 0_HELP_DECRYPT_FILES.HTM HUR_DEKRYPTERA_FILER.html HUR_DEKRYPTERA_FILER.txt *.LAMBDA.LOCKED *.ADMIN@BADADMIN.XYZ *.SKJDTHGHH *.LOCK75 *.B10CKED *.A95436@YA.RU *.IWANT *.Fuck_You Recupere seus arquivos aqui.txt READ TO UNLOCK FILES.salsa.*.html *.SALSA222 *.NUMBERDOT How Decrypt My Files.lnk How_Decrypt_My_Files *.CRADLE *.ID-7ES642406.CRY READ ME ABOUT DECRYPTION.txt *.Do_not_change_the_file_name.cryp *.pr0tect *.android *_READ_THIS_FILE_*_* *.btcware *drakosho_new@aol.com* *.AngleWare *.zorro *.CIFGKSAFFSFYGHD *.A9V9AHU4 *.payfordecrypt OKU.TXT ZINO_NOTE.TXT *.ZINO *.kirked *.CRPTXXX HOW_TO_FIX_!.TXT *.[BRAINCRYPT@INDIA.COM].BRAINCRYPT *.pizdec *.REVENGE !!!READ_TO_UNLOCK!!!.TXT *.openforyou@india.com *.warn_wallet *.nemo-hacks.at.sigaint.org *.MATRIX Crytp0l0cker.Upack.dll Crytp0l0cker.dll Crytp0l0cker.exe decrypted_files.dat padcryptUninstaller.exe PadCrypt.exe Vape Launcher.exe READ_ME_!.txt *.enjey Aescrypt.exe *.GG *.[PINGY@INDIA.COM] *.WORMKILLER@INDIA.COM.XTBL *.CEBER3 IF_WANT_FILES_BACK_PLS_READ.html *.iaufkakfhsaraf _HELP_HELP_HELP_* zXz.html *.zXz VictemKey_*_* HVORDAN_DU_GENDANNER_FILER.html HVORDAN_DU_GENDANNER_FILER.txt HELP_ME_PLEASE.txt !_RECOVERY_HELP_!.txt PLEASE-READIT-IF_YOU-WANT.html *.filegofprencrp COME_RIPRISTINARE_I_FILE.* fattura_*.js *_steaveiwalker@india.com_ COMO_ABRIR_ARQUIVOS.txt *info@kraken.cc_worldcza@email.cz *.kr3 COMO_RESTAURAR_ARCHIVOS.txt COMO_RESTAURAR_ARCHIVOS.html *.ENCR *.[File-Help@India.Com].mails damage@india.com* *.tmp.exe What happen to my files.txt *.jeepdayz@india.com *.BarRax *.damage *.locked-* *.jey *.CRYPTOSHIEL *.cfk ASSISTANCE_IN_RECOVERY.txt #_DECRYPT_ASSISTANCE_#.txt *.lfk _HELP_HELP_HELP_*.hta _HELP_HELP_HELP_*.jpg BTC_DECRYPT_FILES.txt *.TheTrumpLockerp *.TheTrumpLockerf *.d4nk *.x3mpro READ-READ-READ.html *.weencedufiles *.jse *.powned [KASISKI]* INSTRUCCIONES.txt @_USE_TO_FIX_*.txt *.happydayzz *.hasp 001-READ-FOR-DECRYPT-FILES.html DECRYPT_INFORMATION.html Rans0m_N0te_Read_ME.txt email-vpupkin3@aol.com* *.hnyear *.hnumkhotep@india.com.hnumkhotep *.wowwhereismyfiles *.decryptional *.wowreadfordecryp *.7zipper *.youransom *.gui *.Harzhuangzi *.encryptedyourfiles *HERMES [amanda_sofost@india.com].wallet *.wcry *.velikasrbija *.razarac *.serpent *.msj *.szesnl _DECRYPT_INFO_szesnl.html 000-IF-YOU-WANT-DEC-FILES.html *.evillock *.letmetrydecfiles *.yourransom *.lambda_l0cked *.gefickt *.HakunaMatata *.CRYPTOSHIELD *.weareyourfriends MERRY_I_LOVE_YOU_BRUCE.hta How decrypt files.hta unCrypte@outlook.com* decipher_ne@outlook.com* *.potato *.otherinformation *.vxLock *.rdmk *.paytounlock TRY-READ-ME-TO-DEC.html EMAIL_*_recipient.zip *.sage *garryweber@protonmail.ch LEER_INMEDIATAMENTE.txt *.killedXXX *.doomed *.sifreli *.MERRY 000-No-PROBLEM-WE-DEC-FILES.html *.noproblemwedecfiles WE-MUST-DEC-FILES.html *.powerfulldecrypt *.stn *bingo@opensourcemail.org *.id-3044989498_x3m *.x3m READ_ME_TO_DECRYPT_YOU_INFORMA.jjj *.wuciwug *.kencf *.file0locked file0locked.js CryptoRansomware.exe *.VBRANSOM _HELP_Recover_Files_.html *.oops *.deria *.RMCM1 *.Locked-by-Mafia *.кибер разветвитель *-filesencrypted.html decrypt_Globe*.exe *.hnumkhotep DecryptFile.txt *.L0CKED NFS-e*1025-7152.exe firstransomware.exe HELP-ME-ENCED-FILES.html *.helpmeencedfiles *EdgeLocker*.exe *.edgel *.XBTL *.firecrypt YOUR_FILES_ARE_DEAD.hta *.MRCR1 *.PEGS1 *.RARE1 *.airacropencrypted! *[cryptsvc@mail.ru].* WHERE-YOUR-FILES.html *.Whereisyourfiles *opentoyou@india.com C-email-*-*.odcodc *.maktub *.hush *.bript _*_README.hta _*_README.jpg HOW_OPEN_FILES.hta *.gangbang GJENOPPRETTING_AV_FILER.html GJENOPPRETTING_AV_FILER.txt !!! HOW TO DECRYPT FILES !!!.txt *.braincrypt INSTRUCTION RESTORE FILE.TXT *.lesli Survey Locker.exe !!!!!ATENÇÃO!!!!!.html Receipt.exe WindowsApplication1.exe HWID Lock.exe VIP72.exe DALE_FILES.TXT *.DALE *.8637 *.kok HOW_TO_RESTORE_YOUR_DATA.html *.paymrts *.paymds RESTORE_CORUPTED_FILES.HTML READ@My.txt Cyber SpLiTTer Vbs.exe *.flyper 000-PLEASE-READ-WE-HELP.html *.helpdecrypt@india.com *.VforVendetta popcorn_time.exe *.filock *.wallet *_.rmd *.uDz2j8mv OSIRIS-*.htm DesktopOsiris.htm *[cryptservice@inbox.ru]* *.no_more_ransom bahij2@india.com *.lovewindows *.osiris *.R.i.P Important!.txt !_HOW_TO_RESTORE_*.txt HOW_TO_RESTORE_FILES.txt _README_*.hta *.Zzzz *[lavandos@dr.com].wallet *.coin *.crypted_file *.EncrypTile *.hcked _README_.hta Runsome.exe Payment_Advice.mht lblBitcoinInfoMain.txt lblFinallyText.txt lblMain.txt *.hannah *.vindows How to decrypt your files.jpg How to decrypt your files.txt How to get data back.txt *.zycrypt *.sgood *.zzzzz xort.txt DOSYALARINIZA ULAŞMAK İÇİN AÇINIZ.html HOWTO_RECOVER_FILES_*.TXT HELP_RESTORE_FILES_*.TXT Recovery+*.html Recovery+*.txt _H_e_l_p_RECOVER_INSTRUCTIONS+*.png _H_e_l_p_RECOVER_INSTRUCTIONS+*.html help_recover_instructions+*.html help_recover_instructions+*.BMP _how_recover+*.html _how_recover+*.txt ThxForYurTyme.txt _HOW_TO_Decrypt.bmp _RECOVER_INSTRUCTIONS.ini ###-READ-FOR-HELLPP.html rtext.txt DECRYPTION INSTRUCTIONS.txt decrypt explanations.html _WHAT_is.html _HOWDO_text.html readme_liesmich_encryptor_raas.txt _Adatok_visszaallitasahoz_utasitasok.txt How to restore files.hta locked.bmp README_TO_RECURE_YOUR_FILES.txt Your files encrypted by our friends !!!.txt ATTENTION.url @WARNING_FILES_ARE_ENCRYPTED.*.txt README!!!.txt # README.hta !Recovery_*.html YourID.txt recover.bmp recover.txt README HOW TO DECRYPT YOUR FILES.HTML READ_IT.txt *.lock93 *.!emc *.adk svchosd.exe *.aesir *.CHIP *.happy *.angelamerkel *.razy1337 *.zendr4 *.dharma *.locked3 *.duhust *.exploit *_crypt *_help_instruct*.* *!DMAlock* *.GSupport3 *.rnsmwr *.dCrypt ransomed.html *.Alcatraz *_WHAT_is.html readme.hta *.96e2 *.thor *.dxxd *.usr0 *.shit *.coded *.raid10 *.realfs0ciety* *.rip *.okean* *.globe *.nuclear55 *.1txt *.kostya *.k0stya *.comrade *.exotic *.fuck *.Yakes *.Zimbra email-salazar_slytherin10@yahoo.com.ver-*.id-*-*.randomname-* *._AiraCropEncrypted! README_RECOVER_FILES_*.txt README_RECOVER_FILES_*.png README_RECOVER_FILES_*.html *.~HL* Sarah_G@ausi.com___* *.zc3791 *.venusp *.shino *.bleepYourFiles *.crashed *.amba *.7h9r *.已加密 *.암호화됨 *.b5c6 *.ap19 *.a19 _*_HOWDO_text.html *_HOWDO_text.bmp *_HOWDO_text.html *.odin *.zypto* zzzzzzzzzzzzzzzzzyyy zycrypt.* *decrypt your file*.* *_nullbyte* *.bart *.axx _H_e_l_p_RECOVER_INSTRUCTIONS+*.txt HOW-TO-DECRYPT-FILES.HTML HOW_TO_DECRYPT.HTML exit.hhr.obleep UnblockFiles.vbs README_DECRYPT_HYDRA_ID_*.txt DECRYPT_Readme.TXT.ReadMe Decrypt All Files *.bmp HowDecrypt.gif HELP_YOURFILES.HTML HOW TO DECRYPT FILES.HTML BUYUNLOCKCODE BitCryptorFileList.txt *.crjocker *.POSHKODER *.hydracrypt_ID_* *.CTBL2 *.unbrecrypt_ID_* *.padcrypt *.rekt *.CCCRRRPPP *.SecureCrypte *.windows10 *.pdcr *.keybtc@inbox *.breaking_bad *.cryptowall *.xorist *.crypt1 How_to_decrypt_your_files.jpg How_to_restore_files.hta *.cerber3 *.a5zfn *.purge *.fantom *.cerber2 !readme.* Como descriptografar seus arquivos.txt *.C0rp0r@c@0Xr@ *.domino *cerber2 *.cawwcca how_to_unlock*.* !Recovery_*.txt Read_this_file.txt *.legion *.encoderpass *.cryptolocker *.7z.encrypted ATTENTION!!!.txt HELP_DECRYPT.lnk how to decrypt aes files.lnk restore_files.txt HowDecrypt.txt $RECYCLE.BIN.{*-*-*-*} *.heisenberg *.breaking bad *.razy *.Venusf .~ *.payfornature@india.com.crypted winclwp.jpg wie_zum_Wiederherstellen_von_Dateien.txt tox.html strongcrypt.bmp qwer2.html qwer.html pronk.txt paycrypt.bmp maxcrypt.bmp how_decrypt.gif how to get data.txt help_recover_instructions*.txt help_recover_instructions*.html help_recover_instructions*.bmp help-file-decrypt.enc enigma_encr.txt enigma.hta default432643264.jpg default32643264.bmp decypt_your_files.html de_crypt_readme.txt de_crypt_readme.html de_crypt_readme.bmp cryptinfo.txt crjoker.html _how_recover*.txt _how_recover*.html _Locky_recover_instructions.bmp _H_e_l_p_RECOVER_INSTRUCTIONS*.txt _H_e_l_p_RECOVER_INSTRUCTIONS*.png _H_e_l_p_RECOVER_INSTRUCTIONS*.html _HELP_instructions.txt _HELP_instructions.bmp _DECRYPT_INFO_*.html Your files encrypted by our friends !!! txt Your files are locked !.txt Your files are locked !!.txt Your files are locked !!!.txt Your files are locked !!!!.txt YOUR_FILES_ARE_LOCKED.txt YOUR_FILES_ARE_ENCRYPTED.TXT YOUR_FILES_ARE_ENCRYPTED.HTML YOUGOTHACKED.TXT UNLOCK_FILES_INSTRUCTIONS.txt UNLOCK_FILES_INSTRUCTIONS.html SIFRE_COZME_TALIMATI.html SHTODELATVAM.txt Read Me (How Decrypt) !!!!.txt RESTORE_FILES_*.txt RESTORE_FILES_*.* READ_THIS_TO_DECRYPT.html README_HOW_TO_UNLOCK.TXT README_HOW_TO_UNLOCK.HTML README_DECRYPT_UMBRE_ID_*.txt README_DECRYPT_UMBRE_ID_*.jpg README_DECRYPT_HYRDA_ID_*.txt READ ME FOR DECRYPT.txt READ IF YOU WANT YOUR FILES BACK.html Payment_Instructions.jpg ONTSLEUTELINGS_INSTRUCTIES.html OKSOWATHAPPENDTOYOURFILES.TXT MENSAGEM.txt KryptoLocker_README.txt Instructionaga.txt ISTRUZIONI_DECRITTAZIONE.html INSTRUCTIONS_DE_DECRYPTAGE.html INSTRUCCIONES_DESCIFRADO.html INSTALL_TOR.URL IMPORTANT.README IMPORTANT READ ME.txt Howto_RESTORE_FILES.html How to decrypt your data.txt How to decrypt LeChiffre files.html Help Decrypt.html Hacked_Read_me_to_decrypt_files.html HOW_TO_UNLOCK_FILES_README_*.txt HOW_TO_RESTORE_FILES.html HOW_DECRYPT.URL HOW_DECRYPT.TXT HOW_DECRYPT.HTML HOWTO_RECOVER_FILES_*.* HOW TO DECRYPT FILES.txt HELP_YOUR_FILES.html HELP_YOUR_FILES.PNG HELP_TO_SAVE_FILES.bmp HELP_RESTORE_FILES_*.* HELP_DECRYPT.URL HELP_DECRYPT.PNG HELP_DECRYPT.HTML GetYouFiles.txt File Decrypt Help.html FILES_BACK.txt ENTSCHLUSSELN_HINWEISE.html DecryptAllFiles*.txt DESIFROVANI_POKYNY.html DECRYPT_YOUR_FILES.txt DECRYPT_YOUR_FILES.HTML DECRYPT_ReadMe1.TXT DECRYPT_INSTRUCTIONS.html DECRYPT_INSTRUCTION.URL DECRYPT_INSTRUCTION.HTML DECRYPTION_HOWTO.Notepad Comment débloquer mes fichiers.txt BUYUNLOCKCODE.txt AllFilesAreLocked*.bmp 4-14-2016-INFECTION.TXT *_ryp *_HELP_instructions.html *.xcrypt *.unavailable *.szf *.porno.pornoransom *.plauge17 *.neitrino *.kimcilware.locked *.iwanthelpuuu *.herbst *.helpdecrypt@ukr.net *.h3ll *.gws.porno *.fuckyourdata *.encrypted.locked *.cryptz *.crypttt *.cripttt *.criptokod *.criptiko *.btc.kkk.fun.gws *.aga *._ryp *.Where_my_files.txt *.Read_Me.Txt *.RSplited *.KEYZ.KEYH0LES *.How_To_Get_Back.txt *.How_To_Decrypt.txt *.Contact_Here_To_Recover_Your_Files.txt *.31392E30362E32303136_* # DECRYPT MY FILES #.vbs # DECRYPT MY FILES #.txt # DECRYPT MY FILES #.html !Where_are_my_files!.html !!!README!!!*.rtf !!!-WARNING-!!!.txt !!!-WARNING-!!!.html *.magic_software_syndicate *maestro@pizzacrypts.info *.crypt *.bitstak *.wflx *.CRRRT howtodecryptaesfiles.txt !satana!.txt *.akaibvn *.cRh8 *.YTBL *.krypted *.tzu *.6FKR8d *.sshxkej *.eclr *.epic *.paybtcs *.AFD *.paymst *.payms *.isis *.zepto *.bart.zip *.kratos *.31342E30362E32303136* *.SecureCrypted *.crptrgr *.rtyrtyrty !DMALOCK3.0* *.evil *.crypt38 *.asdasdasd *.ded *.bloccato *.canihelpyou *.crypz decrypt-instruct*.* *files_are_encrypted.* *decryptmyfiles*.* help_instructions.* *-recover-*.* de_crypt_readme.* *!recover!*.* *recover}-*.* *rec0ver*.* _help_instruct*.* *_recover_*.* *+recover+*.* *warning-!!*.* *decrypt my file*.* help_file_*.* recovery+*.* readme_for_decrypt*.* install_tor*.* readme_decrypt*.* howtodecrypt*.* howto_restore*.* how_to_recover*.* how_recover*.* how_to_decrypt*.* how to decrypt*.* help_restore*.* help_your_file*.* help_recover*.* help_decrypt*.* decrypt_instruct*.* cryptolocker.* *recover_instruction*.* *.hydracrypt_ID* *gmail*.crypt *.cryptotorlocker* *.xxx *.xyz *.xtbl *.xort *.xrtn *.vvv *.vscrypt *.trun *.ttt *.surprise *.troyancoder@qq_com *.sport *.scl *.ryp *.sanction *.RRK *.rokku *.remind *.relock@qq_com *.RDM *.RADAMANT *.R5A *.R4A *.PoAr2w *.pizda@qq_com *.p5tkjw *.oplata@qq_com *.oshit *.oor *.one-we_can-help_you *.OMG! *.nochance *.nalog@qq_com *.micro *.LOL! *.locky *.locked *.LeChiffre *.kraken *.korrektor *.kkk *.kimcilware *.KEYZ *.keybtc@inbox_com *.KEYHOLES *.justbtcwillhelpyou *.infected *.helpdecrypt@ukr_net *.hb15 *.ha3 *.gruzin@qq_com *.gws *.fun *.fucked *.enigma *.encryptedped *.encryptedRSA *.encryptedAES *.Encrypted *.encrypt *.encedRSA *.EnCiPhErEd *.dyatel@qq_com *.czvxce *.darkness *.ctbl *.CrySiS *.CryptoTorLocker2015! *.crypted *.cry *.crjoker *.crinf *.crime *.coverton *.code *.clf *.chifrator@qq_com *.cerber *.cbf *.btcbtcbtc *.btc-help-you *.btc *.bloc *.better_call_saul *.AES256 *.{CRYPTENDBLACKDC} *.73i87A *.zzz *.abc *.aaa vault.txt vault.key recovery_key.txt vault.hta message.txt recovery_file.txt confirmation.key enc_files.txt last_chance.txt *.vault *want your files back.* *.frtrss *.exx *.ezz *.ecc *help_restore*.* *how_to_recover*.* *restore_fi*.* *ukr.net* *qq_com* *keemail.me* *decipher* *install_tor*.* *@india.com* *@gmail_com_* *.*obleep *.*exx *.*locked *.*nochance *.*kraken *.*kb15 *.*darkness *.*crypto *.*cry _Locky_recover_instructions.txt help_recover_instructions+*.txt recoverfile*.txt Howto_Restore_FILES.TXT recoveryfile*.txt _how_recover.txt howrecover+*.txt restorefiles.txt howto_recover_file.txt HowtoRESTORE_FILES.txt RECOVERY_FILE*.txt RECOVERY_FILES.txt help_decrypt_your_files.html HELPDECYPRT_YOUR_FILES.HTML IHAVEYOURSECRET.KEY SECRET.KEY SECRETIDHERE.KEY READTHISNOW!!!.TXT IAMREADYTOPAY.TXT HELLOTHERE.TXT FILESAREGONE.TXT DECRYPT_ReadMe.TXT Read.txt About_Files.txt _secret_code.txt ReadDecryptFilesHere.txt Coin.Locker.txt HOW_TO_DECRYPT_FILES.TXT DECRYPT_INSTRUCTION.TXT encryptor_raas_readme_liesmich.txt Help_Decrypt.txt YOUR_FILES.url How_To_Recover_Files.txt YOUR_FILES.HTML INSTRUCCIONES_DESCIFRADO.TXT DECRYPT_INSTRUCTIONS.TXT HELP_TO_SAVE_FILES.txt DecryptAllFiles.txt HELP_RECOVER_FILES.txt HELP_RESTORE_FILES.txt HELP_TO_DECRYPT_YOUR_FILES.txt HELP_YOUR_FILES.TXT HELPDECRYPT.TXT *.CTB2 *.SUPERCRYPT *.magic *.1999 *.toxcrypt *.bleep *.0x0 *.good *.R16M01D05 *.pzdc *.XRNT *.crypto *.ccc *.da_vinci_code *.payransom *.KEYH0LES oor.* *.zyklon *.zcrypt *.Z81928819 *.Silent *.RSNSlocked *.RAD *.porno *.pornoransom *.odcodc _ryp *.helpdecrypt@ukr*.net *.only-we_can-help_you *.cryp1 *.fileiscryptedhard *.blocatto *.8lock8 *.777