{
 "version": "2026.10.20",
 "extensions": [
  ".(.*)\\.encoded\\.([a-z0-9]{9})$",
  ".(.*)_crypt\\.(.*)-_(.*)@(.*)$",
  ".(.*)_crypt\\.(.*)-_locked$",
  ".(.*)_crypt\\.(.*)-_locked_by_krec$",
  ".(.*)_crypt\\.(.*)-_locked_by_perfect$",
  ".(.*)_crypt\\.(.*)-_r9oj$",
  ".(.*)_crypt\\.(.*)-_x3m$",
  ".([a-f0-9]{8})_luck$",
  ".([a-za-z0-9+_-]{1,})\\.([a-z0-9]{3,4})\\.locky$",
  ".0x0",
  ".1999",
  ".1cbu1",
  ".1txt",
  ".73i87a",
  ".777",
  ".7h9r",
  ".8lock8",
  ".\\.(.*)\\.blt$",
  ".\\.(.*)\\.encrypted$",
  ".\\.(.*)\\.globe$",
  ".\\.(.*)\\.raid10$",
  ".\\.([0-9a-z]{20})_([0-9]{2})_([a-z0-9]{4,5})$",
  ".\\.[a-f0-9]{8}_luck$",
  ".\\.encrypted$",
  ".\\.encrypted\\.(.*)$",
  ".\\.exotic$",
  ".\\.id-(.*)-maestro@pizzacrypts\\.info$",
  ".\\.id-(\\d+)_(.*)$",
  ".\\.kraken$",
  ".\\.locked-(.*){3}$",
  ".\\.~$",
  ".^!enc",
  ".^(.*).encrypted.(.*)$",
  ".^decipher_ne@outlook\\.com_",
  ".^lock\\.",
  ".^locked-(.*)\\.([a-za-z]{4})$",
  ".^oor\\.",
  ".^umbrecrypt_",
  ".^uncrypte@outlook\\.com_",
  ".___xratteamlucked",
  ".__airacropencrypted!",
  "._airacropencrypted",
  "._nullbyte",
  "._ryp",
  ".a19",
  ".a5zfn",
  ".aaa",
  ".aac",
  ".abc",
  ".abcde",
  ".adk",
  ".adobe",
  ".adr",
  ".aes",
  ".aes256",
  ".aesir",
  ".afd",
  ".aga",
  ".alcatraz",
  ".amba",
  ".angelamerkel",
  ".angleware",
  ".antihacker2017",
  ".ap19",
  ".atlas",
  ".axx",
  ".barrax",
  ".bart",
  ".bart.zip",
  ".better_call_saul",
  ".bin",
  ".bip",
  ".bitstak",
  ".bleepyourfiles",
  ".bloc",
  ".blocatto",
  ".braincrypt",
  ".breaking_bad",
  ".bript",
  ".btc",
  ".btc-help-you",
  ".btcbtcbtc",
  ".btcware",
  ".cbf",
  ".ccc",
  ".cccrrrppp",
  ".cerber",
  ".cerber2",
  ".cerber3",
  ".chifrator@qq_com",
  ".chip",
  ".cifgksaffsfyghd",
  ".clf",
  ".code",
  ".coded",
  ".comrade",
  ".conficker",
  ".coverton",
  ".crashed",
  ".crime",
  ".crinf",
  ".criptiko",
  ".criptoko",
  ".criptokod",
  ".cripttt",
  ".crjoker",
  ".crptrgr",
  ".crptxxx",
  ".crrrt",
  ".cry",
  ".cry_*",
  ".cryeye",
  ".cryp1",
  ".crypt",
  ".crypt38",
  ".crypte",
  ".crypted",
  ".crypted_file",
  ".crypto",
  ".cryptolocker",
  ".cryptoshiel",
  ".cryptoshield",
  ".cryptotorlocker2015!",
  ".cryptowall",
  ".cryptz",
  ".crypz",
  ".crysis",
  ".ctbl",
  ".czvxce",
  ".d4nk",
  ".da_vinci_code",
  ".dale",
  ".damage",
  ".darkness",
  ".dcrypt",
  ".decrypt2017",
  ".ded",
  ".deria",
  ".devil",
  ".dexter",
  ".dglnl",
  ".dharma",
  ".diablo6",
  ".disappeared",
  ".dll",
  ".do_not_change_the_filename",
  ".domino",
  ".doomed",
  ".dxxd",
  ".dyatel@qq_com",
  ".ecc",
  ".edgel",
  ".enc",
  ".encedrsa",
  ".enciphered",
  ".encmywork",
  ".encoderpass",
  ".encr",
  ".encrypt",
  ".encrypted",
  ".encrypted_by_lltp",
  ".encrypted_by_lltpp",
  ".encryptedaes",
  ".encryptedrsa",
  ".encryptedyourfiles",
  ".enigma",
  ".epic",
  ".evillock",
  ".exotic",
  ".exx",
  ".ezz",
  ".fantom",
  ".fear",
  ".fenixiloveyou!!",
  ".file0locked",
  ".fileiscryptedhard",
  ".filock",
  ".firecrypt",
  ".frtrss",
  ".fs0ciety",
  ".fuck",
  ".fucked",
  ".fuckyourdata",
  ".fun",
  ".gefickt",
  ".globe",
  ".good",
  ".googl",
  ".grt",
  ".gruzin@qq_com",
  ".gws",
  ".h3ll",
  ".ha3",
  ".hannah",
  ".hb15",
  ".hceem",
  ".helpdecrypt@ukr.net",
  ".helpmeencedfiles",
  ".herbst",
  ".hnumkhotep",
  ".hush",
  ".hydracrypt_id_([\\w]{8})$",
  ".iaufkakfhsaraf",
  ".id-7es642406.cry",
  ".ifuckedyou",
  ".infected",
  ".info",
  ".install_flash_player.exe",
  ".isis",
  ".iwanthelpuuu",
  ".jimm",
  ".justbtcwillhelpyou",
  ".karma",
  ".kasiski",
  ".kencf",
  ".kernel_complete",
  ".kernel_pid",
  ".kernel_time",
  ".keybtc@inbox_com",
  ".keyh0les",
  ".keyz",
  ".killedxxx",
  ".kimcilware",
  ".kirked",
  ".kk",
  ".kkk",
  ".korrektor",
  ".kostya",
  ".kr3",
  ".kraken",
  ".kratos",
  ".kyra",
  ".l0cked",
  ".lambda_l0cked",
  ".lcked",
  ".lechiffre",
  ".legion",
  ".lesli",
  ".letmetrydecfiles",
  ".licked",
  ".lock",
  ".lock93",
  ".locked",
  ".locked-by-mafia",
  ".locklock",
  ".locky",
  ".lol!",
  ".loli",
  ".lovewindows",
  ".lukitus",
  ".madebyadam",
  ".magic",
  ".maktub",
  ".maya",
  ".merry",
  ".mia.kokers@aol.com",
  ".micro",
  ".mole",
  ".mole02",
  ".mrcr1",
  ".nalog@qq_com",
  ".nemo-hacks.at.sigaint.org",
  ".nextcry",
  ".no_more_ransom",
  ".nochance",
  ".noproblemwedecfiles",
  ".noproblemwedecfiles​",
  ".notfoundrans",
  ".nuclear55",
  ".odcodc",
  ".odin",
  ".ohwqg",
  ".omg!",
  ".onion",
  ".only-we_can-help_you",
  ".oops",
  ".openforyou@india.com",
  ".oplata@qq_com",
  ".oshit",
  ".osiris",
  ".otherinformation",
  ".p5tkjw",
  ".padcrypt",
  ".paybtcs",
  ".paym",
  ".paymrss",
  ".payms",
  ".paymst",
  ".paymts",
  ".payransom",
  ".payrms",
  ".payrmts",
  ".pays",
  ".paytounlock",
  ".pdcr",
  ".pec",
  ".pegs1",
  ".perl",
  ".phobos",
  ".pizda@qq_com",
  ".poar2w",
  ".porno",
  ".potato",
  ".powerfulldecrypt",
  ".pubg",
  ".purge",
  ".pzdc",
  ".r.i.p",
  ".r16m01d05",
  ".r4a",
  ".r5a",
  ".rad",
  ".radamant",
  ".raid10",
  ".rare1",
  ".razy",
  ".rdm",
  ".rdmk",
  ".realfs0ciety@sigaint.org.fs0ciety",
  ".rekt",
  ".relock@qq_com",
  ".remind",
  ".rescuers@india.com.3392cyan548qzeuf.lock",
  ".revenge",
  ".rip",
  ".rmcm1",
  ".rmd",
  ".rnsmwr",
  ".rokku",
  ".rrk",
  ".rsnslocked",
  ".rsplited",
  ".ruby",
  ".sage",
  ".sanction",
  ".scarab",
  ".scl",
  ".securecrypted",
  ".serp",
  ".serpent",
  ".sexy",
  ".shino",
  ".shit",
  ".sifreli",
  ".silent",
  ".snatch",
  ".spora",
  ".sport",
  ".stn",
  ".surprise",
  ".szf",
  ".thetrumplockerf",
  ".thetrumplockerfp",
  ".theworldisyours",
  ".thor",
  ".toxcrypt",
  ".troyancoder@qq_com",
  ".trun",
  ".ttt",
  ".tzu",
  ".uk-dealer@sigaint.org",
  ".unavailable",
  ".unlockvt@india.com",
  ".vault",
  ".vbransom",
  ".velikasrbija",
  ".venusf",
  ".venusp",
  ".versiegelt",
  ".vforvendetta",
  ".vindows",
  ".vscrypt",
  ".vvv",
  ".vxlock",
  ".wallet",
  ".wcry",
  ".weareyourfriends",
  ".weencedufiles",
  ".wflx",
  ".where_my_files.txt",
  ".whereisyourfiles",
  ".windows10",
  ".wkgdiba",
  ".wncry",
  ".wnx",
  ".wvtr0",
  ".xcri",
  ".xort",
  ".xrtn",
  ".xtbl",
  ".xxx",
  ".xyz",
  ".ykcol",
  ".yourransom",
  ".ytbl",
  ".z81928819",
  ".zc3791",
  ".zcrypt",
  ".zepto",
  ".zino",
  ".zorro",
  ".zxz",
  ".zyklon",
  ".zzz",
  ".zzzzz",
  ".{cryptendblackdc}",
  ".~xdata~",
  ".кибер разветвитель",
  ".已加密",
  ".암호화됨"
 ],
 "filenamePatterns": [
  "!!readme!!*",
  "*_readme.txt",
  "*decrypt_files*",
  "*decrypt_instruction*",
  "*recover_instructions*",
  "*restore_files*",
  "help_decrypt*",
  "how_to_back_files*",
  "how_to_decrypt*",
  "ransom*",
  "readme_decrypt*",
  "readme_for_decrypt*"
 ]
}