New-FSRMFileGroup -name "Ransomware File Group" -IncludePattern @("*.0x0","*.1999","*.*obleep","*.LOL!","*.aaa","*.abc","*.bleep","*.ccc","*.ctbl","*.ctb2","*.crinf","*.crjoker","*.cry","*.crypto*","*.cryptotorlocker*","*.darkness","*.ecc","*.enc","*.EnCiPhErEd","*.encrypted*","*.exx","*.ezz","*.frtrss","*.good","*.ha3","*.hydracrypt*","*.kb15","*.kraken","*.lechiffre","*.locky","*.magic","*.micro","*.nochance","*.omg!","*.r16M*","*.r5a","*.rdm","*.rrk","*.supercrypt","*.toxcrypt","*.ttt","*.vault","*.vvv","*.xxx","*.xrnt","*.xtbl","*.xyz","*.zzz","*@gmail_com_*","*@india.com*","*gmail*.crypt","*install_tor*.*","*keemail.me*","*qq_com*","*restore_fi*.*","*ukr.net*","*want%syour%sfiles%sback.*","DECRYPT_HELP.*","HELP_YOUR_FILES.*","confirmation.key","cryptolocker.*","decrypt_instruct*.*","djqfu*.*","enc_files.txt","help_decrypt*.*","helpdecrypt*.*","help_recover*.*","help_restore*.*","help_your_file*.*","how%sto%sdecrypt*.*","how_decrypt*.*","how_recover*.*","how_to_decrypt*.*","how_to_recover*.*","howto_restore*.*","howto_restore_file*.*","howtodecrypt*.*","install_tor*.*","instructions_xxxx.png","last_chance.*","message.txt","readme_decrypt*.*","readme_for_decrypt*.*","recovery_file.txt","recovery_key.txt","*recover_instructions.txt","restore_fi.*","vault.hta","vault.key","vault.txt","HELP_TO_DECRYPT_YOUR_FILES.txt","HELP_TO_SAVE_FILES.txt","DecryptAllFiles.txt","DECRYPT_INSTRUCTIONS.TXT","INSTRUCCIONES_DESCIFRADO.TXT","How_To_Recover_Files.txt","YOUR_FILES.HTML","YOUR_FILES.url","encryptor_raas_readme_liesmich.txt","Help_Decrypt.txt","DECRYPT_INSTRUCTION.TXT","HOW_TO_DECRYPT_FILES.TXT","ReadDecryptFilesHere.txt","Coin.Locker.txt","_secret_code.txt","DECRYPT_ReadMe.TXT","FILESAREGONE.TXT","IAMREADYTOPAY.TXT","HELLOTHERE.TXT","READTHISNOW!!!.TXT","SECRETIDHERE.KEY","IHAVEYOURSECRET.KEY","SECRET.KEY","RECOVERY_FILES.txt","RECOVERY_FILE*.txt","HowtoRESTORE*.txt","howto_recover_file.txt","restorefiles.txt","howrecover+*.txt","_how_recover.txt","recoveryfile*.txt","recoverfile*.txt","Howto_Restore_FILES.TXT","help_recover_instructions+*.txt","_Locky_recover_instructions.txt")