diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index e7e3ee8e..ac17a715 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -5026,7 +5026,11 @@
           "HELP_YOUR_FILES.html (CryptXXX)",
           "HELP_YOUR_FILES.txt (CryptoWall 3.0, 4.0)",
           "INSTRUCTION RESTORE FILE.TXT",
-          "# HELP_DECRYPT_YOUR_FILES #.TXT"
+          "# HELP_DECRYPT_YOUR_FILES #.TXT",
+          "_HELP_INSTRUCTION.TXT",
+          "C:\\ProgramData\\[random].exe",
+          "Hello!\n\nAttention! All Your data was encrypted!\n\nFor specific informartion, please send us an email with Your ID number:\n\nempty01@techmail.info\n\nempty02@yahooweb.co\n\nempty003@protonmail.com\n\nWe will help You as soon as possible!\n\nDECRYPT-ID-[id] number",
+          "Hello!\n\nAttention! All Your data was encrypted!\n\nFor specific informartion, please send us an email with Your ID number:\n\ny0000@tuta.io\n\ny0000@protonmail.com\n\ny0000z@yandex.com\n\ny0000s@yandex.com\n\nPlease send email to all email addresses! We will help You as soon as possible!\n\nDECRYPT-ID-[id]"
         ],
         "refs": [
           "http://www.nyxbone.com/malware/CryptoMix.html",