Local $directorio = "C:\Users\usuario\AppData\Roaming\godmode.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}"
Local $godmode = "C:\Users\usuario\AppData\Roaming\com4.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}"
DirCreate ($directorio)
Dirmove ($directorio , $godmode , 1)

*.*cry
*.*crypto
*.*darkness
*.*enc*
*.*exx
*.*kb15
*.*kraken
*.*locked
*.*nochance
*.0x0
*.1999
*.73i87A
*.7z.encrypted
*.aaa
*.abc
*.AES256
*.better_call_saul
*.bleep
*.btc
*.BTC
*.btcbtcbtc
*.canihelpyou
*.cbf
*.ccc
*.cerber
*.cerber3
*.chifrator@qq_com
*.clf
*.coverton
*.crime
*.crinf
*.crjoker
*.cry
*.crypt
*.crypted
*.crypto
*.crypto*
*.cryptolocker
*.cryptotorlocker*
*.CryptoTorLocker2015!
*.CrySiS
*.ctb2
*.CTB2
*.ctbl
*.ctbl
*.CTBL
*.czvxce
*.darkness
*.da_vinci_code
*.dyatel@qq_com
*.ecc
*.enc
*.encedRSA
*.enciphered
*.EnCiPhErEd
*.Encrypted
*.encrypted*
*.encryptedAES
*.encryptedRSA
*.enigma
*.exx
*.ezz
*.flyper
*.frtrss
*.fucked
*.fun
*.FUN
*.good
*.gruzin@qq_com
*.gsw
*.gws
*.GWS
*.ha3
*.HA3
*.hb15
*.helpdecrypt@ukr*.net
*.html
*.hydracrypt*
*.iloveworld
*.JUST
*.justbtcwillhelpyou
*.kb15
*.keybtc@inbox_com
*.kimcilware
*.KKK
*.kraken
*.lechiffre
*.LeChiffre
*.locked
*.locky
*.lol!
*.LOL!
*.magic
*.micro
*.mp3
*.nalog@qq_com
*.nochance
*.obleep
*.odin
*.omg!
*.OMG!
*.oplata@qq_com
*.oshit
*.p5tkjw
*.pizda@qq_com
*.PoAr2w
*.pzdc
*.r16m*
*.R16M01D05
*.R5A
*.r5a
*.RADAMANT
*.rdm
*.RDM
*.relock@qq_com
*.remind
*.rokku
*.rrk
*.RRK
*.sanction
*.sport
*.supercrypt
*.SUPERCRYPT
*.surprise
*.toxcrypt
*.troyancoder@qq_com
*.ttt
*.vault
*.vvv
*.xort
*.xrnt
*.XRNT
*.xrtn
*.xtbl
*.XTBL
*.xxx
*.xyz
*.zzz
*@gmail_com_*
*@india.com*
*_H_e_l_p_RECOVER_INSTRUCTIONS*
*_LAST
*cpyt*
*crypt*
*decipher*
*help_restore*.*
*help_your_files*.*
*how_to_recover*.*
*install_tor*.*
*keemail.me*
*qq_com*
*restore_fi*.*
*ukr.net*
*want your files back.*
_crypt
_DECRYPT_INFO_*
_ryp
AllFilesAreLocked*.bmp
ATTENTION!!!.txt
confirmation.key
Decrypt.exe
DECRYPT_INSTRUCTION.HTML
DECRYPT_INSTRUCTION.TXT
DECRYPT_INSTRUCTIONS.HTML
DECRYPT_INSTRUCTIONS.TXT
DecryptAllFiles*.txt
DecryptAllFiles.txt
enc_files.txt
HELP_DECRYPT.HTML
HELP_DECRYPT.lnk
HELP_DECRYPT.PNG
HELP_DECRYPT.TXT
HELP_RESTORE_FILES.txt
HELP_TO_DECRYPT_YOUR_FILES.txt
HELP_TO_SAVE_FILES.txt
how to decrypt aes files.lnk
How_Decrypt.html
How_Decrypt.txt
HowDecrypt.txt
last_chance.txt
message.txt
MESSAGE.txt
oor*.
recovery_file.txt
recovery_key.txt
RECOVERY_KEY.TXT
restore_files*.txt
restore_files.txt
vault.hta
vault.key
vault.txt
*.zepto
*.venusf

#cs ----------------------------------------------------------------------------
 AutoIt Version: 3.3.8.1
 Author:         Blau
 Thanks to: SadFud
#ce ----------------------------------------------------------------------------
 
#include <Misc.au3>
 
Local $aParams[3] ;Array que contiene los parámetros del callback
$aParams[0] = "CallArgArray" ;Obligatorio para la función Call
$aParams[1] = "Caca" ;$sTitle
$aParams[2] = "Pedo" ;$sMessage
 
AntiEmulationByMouse("Funciona", $aParams)
AntiEmulationByFreeSpace("Funciona", $aParams)
AntiEmulationByPixel("Funciona", $aParams)
AntiEmulationByWindow("Funciona", $aParams)
AntiEmulationByKey(41, "Funciona", $aParams)
 
Func AntiEmulationByMouse($sFunction, $aParams)
    Local $aPos = MouseGetPos() ;Obtiene la posición del ratón
    Local $bPos = MouseGetPos() ;Obtiene la posición del ratón otra vez
    While $aPos[0] = $bPos[0] And $aPos[1] = $bPos[1] ;Si las posiciones son iguales
        Sleep(100)  ;Esperamos 100 milisegundos
        $bPos = MouseGetPos() ;Obtenemos de nuevo la posición del ratón
    WEnd
    Call($sFunction, $aParams) ;Llamamos a la función callback
EndFunc
 
Func AntiEmulationByWindow($sFunction, $aParams)
    Local $aWindow = WinGetTitle("[ACTIVE]")
    Local $bWindow = WinGetTitle("[ACTIVE]")
    While $aWindow = $bWindow
        Sleep(100)
        $bWindow = WinGetTitle("[ACTIVE]")
    WEnd
    Call($sFunction, $aParams)
EndFunc
 
Func AntiEmulationByKey($sKey, $sFunction, $aParams) ;https://www.autoitscript.com/autoit3/docs/libfunctions/_IsPressed.htm
    While Not _IsPressed($sKey)
        Sleep(100)
    WEnd
    Call($sFunction, $aParams)
EndFunc
 
Func AntiEmulationByFreeSpace($sFunction, $aParams)
    Local $aSpace = DriveSpaceFree(@HomeDrive & "\")
    Local $bSpace = DriveSpaceFree(@HomeDrive & "\")
    While $aSpace = $bSpace
        Sleep(100)
        $bSpace = DriveSpaceFree(@HomeDrive & "\")
    WEnd
    Call($sFunction, $aParams)
EndFunc
 
Func AntiEmulationByPixel($sFunction, $aParams)
    Local $nRandomX = Random(0, @DeskTopHeight, 1)
    Local $nRandomY = Random(0, @DeskTopWidth, 1)
    Local $aPixel = PixelGetColor ($nRandomX, $nRandomY)
    Local $bPixel = PixelGetColor ($nRandomX, $nRandomY)
    While $aPixel = $bPixel
        Sleep(100)
       $bPixel = PixelGetColor ($nRandomX, $nRandomY)
    WEnd
    Call($sFunction, $aParams)
EndFunc
 
Func Funciona($sTitle, $sMessage)
    MsgBox(0, $sTitle, $sMessage)
EndFunc

Set IE = CreateObject("InternetExplorer.Application")
IE.Visible = False
IE.Navigate "URL"