tlds = [
    'aaa',
    'aarp',
    'abarth',
    'abb',
    'abbott',
    'abbvie',
    'abc',
    'able',
    'abogado',
    'abudhabi',
    'ac',
    'academy',
    'accenture',
    'accountant',
    'accountants',
    'aco',
    'active',
    'actor',
    'ad',
    'adac',
    'ads',
    'adult',
    'ae',
    'aeg',
    'aero',
    'aetna',
    'af',
    'afamilycompany',
    'afl',
    'africa',
    'ag',
    'agakhan',
    'agency',
    'ai',
    'aig',
    'aigo',
    'airbus',
    'airforce',
    'airtel',
    'akdn',
    'al',
    'alfaromeo',
    'alibaba',
    'alipay',
    'allfinanz',
    'allstate',
    'ally',
    'alsace',
    'alstom',
    'am',
    'americanexpress',
    'americanfamily',
    'amex',
    'amfam',
    'amica',
    'amsterdam',
    'analytics',
    'android',
    'anquan',
    'anz',
    'ao',
    'aol',
    'apartments',
    'app',
    'apple',
    'aq',
    'aquarelle',
    'ar',
    'arab',
    'aramco',
    'archi',
    'army',
    'arpa',
    'art',
    'arte',
    'as',
    'asda',
    'asia',
    'associates',
    'at',
    'athleta',
    'attorney',
    'au',
    'auction',
    'audi',
    'audible',
    'audio',
    'auspost',
    'author',
    'auto',
    'autos',
    'avianca',
    'aw',
    'aws',
    'ax',
    'axa',
    'az',
    'azure',
    'ba',
    'baby',
    'baidu',
    'banamex',
    'bananarepublic',
    'band',
    'bank',
    'bar',
    'barcelona',
    'barclaycard',
    'barclays',
    'barefoot',
    'bargains',
    'baseball',
    'basketball',
    'bauhaus',
    'bayern',
    'bb',
    'bbc',
    'bbt',
    'bbva',
    'bcg',
    'bcn',
    'bd',
    'be',
    'beats',
    'beauty',
    'beer',
    'bentley',
    'berlin',
    'best',
    'bestbuy',
    'bet',
    'bf',
    'bg',
    'bh',
    'bharti',
    'bi',
    'bible',
    'bid',
    'bike',
    'bing',
    'bingo',
    'bio',
    'biz',
    'bj',
    'black',
    'blackfriday',
    'blanco',
    'blockbuster',
    'blog',
    'bloomberg',
    'blue',
    'bm',
    'bms',
    'bmw',
    'bn',
    'bnl',
    'bnpparibas',
    'bo',
    'boats',
    'boehringer',
    'bofa',
    'bom',
    'bond',
    'boo',
    'book',
    'booking',
    'bosch',
    'bostik',
    'boston',
    'bot',
    'boutique',
    'box',
    'br',
    'bradesco',
    'bridgestone',
    'broadway',
    'broker',
    'brother',
    'brussels',
    'bs',
    'bt',
    'budapest',
    'bugatti',
    'build',
    'builders',
    'business',
    'buy',
    'buzz',
    'bv',
    'bw',
    'by',
    'bz',
    'bzh',
    'ca',
    'cab',
    'cafe',
    'cal',
    'call',
    'calvinklein',
    'cam',
    'camera',
    'camp',
    'cancerresearch',
    'canon',
    'capetown',
    'capital',
    'capitalone',
    'car',
    'caravan',
    'cards',
    'care',
    'career',
    'careers',
    'cars',
    'cartier',
    'casa',
    'case',
    'caseih',
    'cash',
    'casino',
    'cat',
    'catering',
    'catholic',
    'cba',
    'cbn',
    'cbre',
    'cbs',
    'cc',
    'cd',
    'ceb',
    'center',
    'ceo',
    'cern',
    'cf',
    'cfa',
    'cfd',
    'cg',
    'ch',
    'chanel',
    'channel',
    'charity',
    'chase',
    'chat',
    'cheap',
    'chintai',
    'christmas',
    'chrome',
    'chrysler',
    'church',
    'ci',
    'cipriani',
    'circle',
    'cisco',
    'citadel',
    'citi',
    'citic',
    'city',
    'cityeats',
    'ck',
    'cl',
    'claims',
    'cleaning',
    'click',
    'clinic',
    'clinique',
    'clothing',
    'cloud',
    'club',
    'clubmed',
    'cm',
    'cn',
    'co',
    'coach',
    'codes',
    'coffee',
    'college',
    'cologne',
    'com',
    'comcast',
    'commbank',
    'community',
    'company',
    'compare',
    'computer',
    'comsec',
    'condos',
    'construction',
    'consulting',
    'contact',
    'contractors',
    'cooking',
    'cookingchannel',
    'cool',
    'coop',
    'corsica',
    'country',
    'coupon',
    'coupons',
    'courses',
    'cr',
    'credit',
    'creditcard',
    'creditunion',
    'cricket',
    'crown',
    'crs',
    'cruise',
    'cruises',
    'csc',
    'cu',
    'cuisinella',
    'cv',
    'cw',
    'cx',
    'cy',
    'cymru',
    'cyou',
    'cz',
    'dabur',
    'dad',
    'dance',
    'data',
    'date',
    'dating',
    'datsun',
    'day',
    'dclk',
    'dds',
    'de',
    'deal',
    'dealer',
    'deals',
    'degree',
    'delivery',
    'dell',
    'deloitte',
    'delta',
    'democrat',
    'dental',
    'dentist',
    'desi',
    'design',
    'dev',
    'dhl',
    'diamonds',
    'diet',
    'digital',
    'direct',
    'directory',
    'discount',
    'discover',
    'dish',
    'diy',
    'dj',
    'dk',
    'dm',
    'dnp',
    'do',
    'docs',
    'doctor',
    'dodge',
    'dog',
    'doha',
    'domains',
    'dot',
    'download',
    'drive',
    'dtv',
    'dubai',
    'duck',
    'dunlop',
    'duns',
    'dupont',
    'durban',
    'dvag',
    'dvr',
    'dz',
    'earth',
    'eat',
    'ec',
    'eco',
    'edeka',
    'edu',
    'education',
    'ee',
    'eg',
    'email',
    'emerck',
    'energy',
    'engineer',
    'engineering',
    'enterprises',
    'epost',
    'epson',
    'equipment',
    'er',
    'ericsson',
    'erni',
    'es',
    'esq',
    'estate',
    'esurance',
    'et',
    'etisalat',
    'eu',
    'eurovision',
    'eus',
    'events',
    'everbank',
    'exchange',
    'expert',
    'exposed',
    'express',
    'extraspace',
    'fage',
    'fail',
    'fairwinds',
    'faith',
    'family',
    'fan',
    'fans',
    'farm',
    'farmers',
    'fashion',
    'fast',
    'fedex',
    'feedback',
    'ferrari',
    'ferrero',
    'fi',
    'fiat',
    'fidelity',
    'fido',
    'film',
    'final',
    'finance',
    'financial',
    'fire',
    'firestone',
    'firmdale',
    'fish',
    'fishing',
    'fit',
    'fitness',
    'fj',
    'fk',
    'flickr',
    'flights',
    'flir',
    'florist',
    'flowers',
    'fly',
    'fm',
    'fo',
    'foo',
    'food',
    'foodnetwork',
    'football',
    'ford',
    'forex',
    'forsale',
    'forum',
    'foundation',
    'fox',
    'fr',
    'free',
    'fresenius',
    'frl',
    'frogans',
    'frontdoor',
    'frontier',
    'ftr',
    'fujitsu',
    'fujixerox',
    'fun',
    'fund',
    'furniture',
    'futbol',
    'fyi',
    'ga',
    'gal',
    'gallery',
    'gallo',
    'gallup',
    'game',
    'games',
    'gap',
    'garden',
    'gb',
    'gbiz',
    'gd',
    'gdn',
    'ge',
    'gea',
    'gent',
    'genting',
    'george',
    'gf',
    'gg',
    'ggee',
    'gh',
    'gi',
    'gift',
    'gifts',
    'gives',
    'giving',
    'gl',
    'glade',
    'glass',
    'gle',
    'global',
    'globo',
    'gm',
    'gmail',
    'gmbh',
    'gmo',
    'gmx',
    'gn',
    'godaddy',
    'gold',
    'goldpoint',
    'golf',
    'goo',
    'goodyear',
    'goog',
    'google',
    'gop',
    'got',
    'gov',
    'gp',
    'gq',
    'gr',
    'grainger',
    'graphics',
    'gratis',
    'green',
    'gripe',
    'grocery',
    'group',
    'gs',
    'gt',
    'gu',
    'guardian',
    'gucci',
    'guge',
    'guide',
    'guitars',
    'guru',
    'gw',
    'gy',
    'hair',
    'hamburg',
    'hangout',
    'haus',
    'hbo',
    'hdfc',
    'hdfcbank',
    'health',
    'healthcare',
    'help',
    'helsinki',
    'here',
    'hermes',
    'hgtv',
    'hiphop',
    'hisamitsu',
    'hitachi',
    'hiv',
    'hk',
    'hkt',
    'hm',
    'hn',
    'hockey',
    'holdings',
    'holiday',
    'homedepot',
    'homegoods',
    'homes',
    'homesense',
    'honda',
    'honeywell',
    'horse',
    'hospital',
    'host',
    'hosting',
    'hot',
    'hoteles',
    'hotels',
    'hotmail',
    'house',
    'how',
    'hr',
    'hsbc',
    'ht',
    'hu',
    'hughes',
    'hyatt',
    'hyundai',
    'ibm',
    'icbc',
    'ice',
    'icu',
    'id',
    'ie',
    'ieee',
    'ifm',
    'ikano',
    'il',
    'im',
    'imamat',
    'imdb',
    'immo',
    'immobilien',
    'in',
    'inc',
    'industries',
    'infiniti',
    'info',
    'ing',
    'ink',
    'institute',
    'insurance',
    'insure',
    'int',
    'intel',
    'international',
    'intuit',
    'investments',
    'io',
    'ipiranga',
    'iq',
    'ir',
    'irish',
    'is',
    'iselect',
    'ismaili',
    'ist',
    'istanbul',
    'it',
    'itau',
    'itv',
    'iveco',
    'jaguar',
    'java',
    'jcb',
    'jcp',
    'je',
    'jeep',
    'jetzt',
    'jewelry',
    'jio',
    'jll',
    'jm',
    'jmp',
    'jnj',
    'jo',
    'jobs',
    'joburg',
    'jot',
    'joy',
    'jp',
    'jpmorgan',
    'jprs',
    'juegos',
    'juniper',
    'kaufen',
    'kddi',
    'ke',
    'kerryhotels',
    'kerrylogistics',
    'kerryproperties',
    'kfh',
    'kg',
    'kh',
    'ki',
    'kia',
    'kim',
    'kinder',
    'kindle',
    'kitchen',
    'kiwi',
    'km',
    'kn',
    'koeln',
    'komatsu',
    'kosher',
    'kp',
    'kpmg',
    'kpn',
    'kr',
    'krd',
    'kred',
    'kuokgroup',
    'kw',
    'ky',
    'kyoto',
    'kz',
    'la',
    'lacaixa',
    'ladbrokes',
    'lamborghini',
    'lamer',
    'lancaster',
    'lancia',
    'lancome',
    'land',
    'landrover',
    'lanxess',
    'lasalle',
    'lat',
    'latino',
    'latrobe',
    'law',
    'lawyer',
    'lb',
    'lc',
    'lds',
    'lease',
    'leclerc',
    'lefrak',
    'legal',
    'lego',
    'lexus',
    'lgbt',
    'li',
    'liaison',
    'lidl',
    'life',
    'lifeinsurance',
    'lifestyle',
    'lighting',
    'like',
    'lilly',
    'limited',
    'limo',
    'lincoln',
    'linde',
    'link',
    'lipsy',
    'live',
    'living',
    'lixil',
    'lk',
    'llc',
    'loan',
    'loans',
    'locker',
    'locus',
    'loft',
    'lol',
    'london',
    'lotte',
    'lotto',
    'love',
    'lpl',
    'lplfinancial',
    'lr',
    'ls',
    'lt',
    'ltd',
    'ltda',
    'lu',
    'lundbeck',
    'lupin',
    'luxe',
    'luxury',
    'lv',
    'ly',
    'ma',
    'macys',
    'madrid',
    'maif',
    'maison',
    'makeup',
    'man',
    'management',
    'mango',
    'map',
    'market',
    'marketing',
    'markets',
    'marriott',
    'marshalls',
    'maserati',
    'mattel',
    'mba',
    'mc',
    'mckinsey',
    'md',
    'me',
    'med',
    'media',
    'meet',
    'melbourne',
    'meme',
    'memorial',
    'men',
    'menu',
    'merckmsd',
    'metlife',
    'mg',
    'mh',
    'miami',
    'microsoft',
    'mil',
    'mini',
    'mint',
    'mit',
    'mitsubishi',
    'mk',
    'ml',
    'mlb',
    'mls',
    'mm',
    'mma',
    'mn',
    'mo',
    'mobi',
    'mobile',
    'mobily',
    'moda',
    'moe',
    'moi',
    'mom',
    'monash',
    'money',
    'monster',
    'mopar',
    'mormon',
    'mortgage',
    'moscow',
    'moto',
    'motorcycles',
    'mov',
    'movie',
    'movistar',
    'mp',
    'mq',
    'mr',
    'ms',
    'msd',
    'mt',
    'mtn',
    'mtr',
    'mu',
    'museum',
    'mutual',
    'mv',
    'mw',
    'mx',
    'my',
    'mz',
    'na',
    'nab',
    'nadex',
    'nagoya',
    'name',
    'nationwide',
    'natura',
    'navy',
    'nba',
    'nc',
    'ne',
    'nec',
    'net',
    'netbank',
    'netflix',
    'network',
    'neustar',
    'new',
    'newholland',
    'news',
    'next',
    'nextdirect',
    'nexus',
    'nf',
    'nfl',
    'ng',
    'ngo',
    'nhk',
    'ni',
    'nico',
    'nike',
    'nikon',
    'ninja',
    'nissan',
    'nissay',
    'nl',
    'no',
    'nokia',
    'northwesternmutual',
    'norton',
    'now',
    'nowruz',
    'nowtv',
    'np',
    'nr',
    'nra',
    'nrw',
    'ntt',
    'nu',
    'nyc',
    'nz',
    'obi',
    'observer',
    'off',
    'office',
    'okinawa',
    'olayan',
    'olayangroup',
    'oldnavy',
    'ollo',
    'om',
    'omega',
    'one',
    'ong',
    'onl',
    'online',
    'onyourside',
    'ooo',
    'open',
    'oracle',
    'orange',
    'org',
    'organic',
    'origins',
    'osaka',
    'otsuka',
    'ott',
    'ovh',
    'pa',
    'page',
    'panasonic',
    'paris',
    'pars',
    'partners',
    'parts',
    'party',
    'passagens',
    'pay',
    'pccw',
    'pe',
    'pet',
    'pf',
    'pfizer',
    'pg',
    'ph',
    'pharmacy',
    'phd',
    'philips',
    'phone',
    'photo',
    'photography',
    'photos',
    'physio',
    'piaget',
    'pics',
    'pictet',
    'pictures',
    'pid',
    'pin',
    'ping',
    'pink',
    'pioneer',
    'pizza',
    'pk',
    'pl',
    'place',
    'play',
    'playstation',
    'plumbing',
    'plus',
    'pm',
    'pn',
    'pnc',
    'pohl',
    'poker',
    'politie',
    'porn',
    'post',
    'pr',
    'pramerica',
    'praxi',
    'press',
    'prime',
    'pro',
    'prod',
    'productions',
    'prof',
    'progressive',
    'promo',
    'properties',
    'property',
    'protection',
    'pru',
    'prudential',
    'ps',
    'pt',
    'pub',
    'pw',
    'pwc',
    'py',
    'qa',
    'qpon',
    'quebec',
    'quest',
    'qvc',
    'racing',
    'radio',
    'raid',
    're',
    'read',
    'realestate',
    'realtor',
    'realty',
    'recipes',
    'red',
    'redstone',
    'redumbrella',
    'rehab',
    'reise',
    'reisen',
    'reit',
    'reliance',
    'ren',
    'rent',
    'rentals',
    'repair',
    'report',
    'republican',
    'rest',
    'restaurant',
    'review',
    'reviews',
    'rexroth',
    'rich',
    'richardli',
    'ricoh',
    'rightathome',
    'ril',
    'rio',
    'rip',
    'rmit',
    'ro',
    'rocher',
    'rocks',
    'rodeo',
    'rogers',
    'room',
    'rs',
    'rsvp',
    'ru',
    'rugby',
    'ruhr',
    'run',
    'rw',
    'rwe',
    'ryukyu',
    'sa',
    'saarland',
    'safe',
    'safety',
    'sakura',
    'sale',
    'salon',
    'samsclub',
    'samsung',
    'sandvik',
    'sandvikcoromant',
    'sanofi',
    'sap',
    'sarl',
    'sas',
    'save',
    'saxo',
    'sb',
    'sbi',
    'sbs',
    'sc',
    'sca',
    'scb',
    'schaeffler',
    'schmidt',
    'scholarships',
    'school',
    'schule',
    'schwarz',
    'science',
    'scjohnson',
    'scor',
    'scot',
    'sd',
    'se',
    'search',
    'seat',
    'secure',
    'security',
    'seek',
    'select',
    'sener',
    'services',
    'ses',
    'seven',
    'sew',
    'sex',
    'sexy',
    'sfr',
    'sg',
    'sh',
    'shangrila',
    'sharp',
    'shaw',
    'shell',
    'shia',
    'shiksha',
    'shoes',
    'shop',
    'shopping',
    'shouji',
    'show',
    'showtime',
    'shriram',
    'si',
    'silk',
    'sina',
    'singles',
    'site',
    'sj',
    'sk',
    'ski',
    'skin',
    'sky',
    'skype',
    'sl',
    'sling',
    'sm',
    'smart',
    'smile',
    'sn',
    'sncf',
    'so',
    'soccer',
    'social',
    'softbank',
    'software',
    'sohu',
    'solar',
    'solutions',
    'song',
    'sony',
    'soy',
    'space',
    'spiegel',
    'sport',
    'spot',
    'spreadbetting',
    'sr',
    'srl',
    'srt',
    'st',
    'stada',
    'staples',
    'star',
    'starhub',
    'statebank',
    'statefarm',
    'stc',
    'stcgroup',
    'stockholm',
    'storage',
    'store',
    'stream',
    'studio',
    'study',
    'style',
    'su',
    'sucks',
    'supplies',
    'supply',
    'support',
    'surf',
    'surgery',
    'suzuki',
    'sv',
    'swatch',
    'swiftcover',
    'swiss',
    'sx',
    'sy',
    'sydney',
    'symantec',
    'systems',
    'sz',
    'tab',
    'taipei',
    'talk',
    'taobao',
    'target',
    'tatamotors',
    'tatar',
    'tattoo',
    'tax',
    'taxi',
    'tc',
    'tci',
    'td',
    'tdk',
    'team',
    'tech',
    'technology',
    'tel',
    'telefonica',
    'temasek',
    'tennis',
    'teva',
    'tf',
    'tg',
    'th',
    'thd',
    'theater',
    'theatre',
    'tiaa',
    'tickets',
    'tienda',
    'tiffany',
    'tips',
    'tires',
    'tirol',
    'tj',
    'tjmaxx',
    'tjx',
    'tk',
    'tkmaxx',
    'tl',
    'tm',
    'tmall',
    'tn',
    'to',
    'today',
    'tokyo',
    'tools',
    'top',
    'toray',
    'toshiba',
    'total',
    'tours',
    'town',
    'toyota',
    'toys',
    'tr',
    'trade',
    'trading',
    'training',
    'travel',
    'travelchannel',
    'travelers',
    'travelersinsurance',
    'trust',
    'trv',
    'tt',
    'tube',
    'tui',
    'tunes',
    'tushu',
    'tv',
    'tvs',
    'tw',
    'tz',
    'ua',
    'ubank',
    'ubs',
    'uconnect',
    'ug',
    'uk',
    'unicom',
    'university',
    'uno',
    'uol',
    'ups',
    'us',
    'uy',
    'uz',
    'va',
    'vacations',
    'vana',
    'vanguard',
    'vc',
    've',
    'vegas',
    'ventures',
    'verisign',
    'versicherung',
    'vet',
    'vg',
    'vi',
    'viajes',
    'video',
    'vig',
    'viking',
    'villas',
    'vin',
    'vip',
    'virgin',
    'visa',
    'vision',
    'vistaprint',
    'viva',
    'vivo',
    'vlaanderen',
    'vn',
    'vodka',
    'volkswagen',
    'volvo',
    'vote',
    'voting',
    'voto',
    'voyage',
    'vu',
    'vuelos',
    'wales',
    'walmart',
    'walter',
    'wang',
    'wanggou',
    'warman',
    'watch',
    'watches',
    'weather',
    'weatherchannel',
    'webcam',
    'weber',
    'website',
    'wed',
    'wedding',
    'weibo',
    'weir',
    'wf',
    'whoswho',
    'wien',
    'wiki',
    'williamhill',
    'win',
    'windows',
    'wine',
    'winners',
    'wme',
    'wolterskluwer',
    'woodside',
    'work',
    'works',
    'world',
    'wow',
    'ws',
    'wtc',
    'wtf',
    'xbox',
    'xerox',
    'xfinity',
    'xihuan',
    'xin',
    'xn--11b4c3d',
    'xn--1ck2e1b',
    'xn--1qqw23a',
    'xn--2scrj9c',
    'xn--30rr7y',
    'xn--3bst00m',
    'xn--3ds443g',
    'xn--3e0b707e',
    'xn--3hcrj9c',
    'xn--3oq18vl8pn36a',
    'xn--3pxu8k',
    'xn--42c2d9a',
    'xn--45br5cyl',
    'xn--45brj9c',
    'xn--45q11c',
    'xn--4gbrim',
    'xn--54b7fta0cc',
    'xn--55qw42g',
    'xn--55qx5d',
    'xn--5su34j936bgsg',
    'xn--5tzm5g',
    'xn--6frz82g',
    'xn--6qq986b3xl',
    'xn--80adxhks',
    'xn--80ao21a',
    'xn--80aqecdr1a',
    'xn--80asehdb',
    'xn--80aswg',
    'xn--8y0a063a',
    'xn--90a3ac',
    'xn--90ae',
    'xn--90ais',
    'xn--9dbq2a',
    'xn--9et52u',
    'xn--9krt00a',
    'xn--b4w605ferd',
    'xn--bck1b9a5dre4c',
    'xn--c1avg',
    'xn--c2br7g',
    'xn--cck2b3b',
    'xn--cg4bki',
    'xn--clchc0ea0b2g2a9gcd',
    'xn--czr694b',
    'xn--czrs0t',
    'xn--czru2d',
    'xn--d1acj3b',
    'xn--d1alf',
    'xn--e1a4c',
    'xn--eckvdtc9d',
    'xn--efvy88h',
    'xn--estv75g',
    'xn--fct429k',
    'xn--fhbei',
    'xn--fiq228c5hs',
    'xn--fiq64b',
    'xn--fiqs8s',
    'xn--fiqz9s',
    'xn--fjq720a',
    'xn--flw351e',
    'xn--fpcrj9c3d',
    'xn--fzc2c9e2c',
    'xn--fzys8d69uvgm',
    'xn--g2xx48c',
    'xn--gckr3f0f',
    'xn--gecrj9c',
    'xn--gk3at1e',
    'xn--h2breg3eve',
    'xn--h2brj9c',
    'xn--h2brj9c8c',
    'xn--hxt814e',
    'xn--i1b6b1a6a2e',
    'xn--imr513n',
    'xn--io0a7i',
    'xn--j1aef',
    'xn--j1amh',
    'xn--j6w193g',
    'xn--jlq61u9w7b',
    'xn--jvr189m',
    'xn--kcrx77d1x4a',
    'xn--kprw13d',
    'xn--kpry57d',
    'xn--kpu716f',
    'xn--kput3i',
    'xn--l1acc',
    'xn--lgbbat1ad8j',
    'xn--mgb9awbf',
    'xn--mgba3a3ejt',
    'xn--mgba3a4f16a',
    'xn--mgba7c0bbn0a',
    'xn--mgbaakc7dvf',
    'xn--mgbaam7a8h',
    'xn--mgbab2bd',
    'xn--mgbai9azgqp6j',
    'xn--mgbayh7gpa',
    'xn--mgbb9fbpob',
    'xn--mgbbh1a',
    'xn--mgbbh1a71e',
    'xn--mgbc0a9azcg',
    'xn--mgbca7dzdo',
    'xn--mgberp4a5d4ar',
    'xn--mgbgu82a',
    'xn--mgbi4ecexp',
    'xn--mgbpl2fh',
    'xn--mgbt3dhd',
    'xn--mgbtx2b',
    'xn--mgbx4cd0ab',
    'xn--mix891f',
    'xn--mk1bu44c',
    'xn--mxtq1m',
    'xn--ngbc5azd',
    'xn--ngbe9e0a',
    'xn--ngbrx',
    'xn--node',
    'xn--nqv7f',
    'xn--nqv7fs00ema',
    'xn--nyqy26a',
    'xn--o3cw4h',
    'xn--ogbpf8fl',
    'xn--otu796d',
    'xn--p1acf',
    'xn--p1ai',
    'xn--pbt977c',
    'xn--pgbs0dh',
    'xn--pssy2u',
    'xn--q9jyb4c',
    'xn--qcka1pmc',
    'xn--qxam',
    'xn--rhqv96g',
    'xn--rovu88b',
    'xn--rvc1e0am3e',
    'xn--s9brj9c',
    'xn--ses554g',
    'xn--t60b56a',
    'xn--tckwe',
    'xn--tiq49xqyj',
    'xn--unup4y',
    'xn--vermgensberater-ctb',
    'xn--vermgensberatung-pwb',
    'xn--vhquv',
    'xn--vuq861b',
    'xn--w4r85el8fhu5dnra',
    'xn--w4rs40l',
    'xn--wgbh1c',
    'xn--wgbl6a',
    'xn--xhq521b',
    'xn--xkc2al3hye2a',
    'xn--xkc2dl3a5ee0h',
    'xn--y9a3aq',
    'xn--yfro4i67o',
    'xn--ygbi2ammx',
    'xn--zfr164b',
    'xxx',
    'xyz',
    'yachts',
    'yahoo',
    'yamaxun',
    'yandex',
    'ye',
    'yodobashi',
    'yoga',
    'yokohama',
    'you',
    'youtube',
    'yt',
    'yun',
    'za',
    'zappos',
    'zara',
    'zero',
    'zip',
    'zippo',
    'zm',
    'zone',
    'zuerich',
    'zw',
    'onion',
]

schemes = [
    'aaa',
    'aaas',
    'about',
    'acap',
    'acct',
    'acr',
    'adiumxtra',
    'afp',
    'afs',
    'aim',
    'appdata',
    'apt',
    'attachment',
    'aw',
    'barion',
    'beshare',
    'bitcoin',
    'bitcoincash',
    'blob',
    'bolo',
    'browserext',
    'calculator',
    'callto',
    'cap',
    'chrome',
    'chrome-extension',
    'cid',
    'coap',
    'coap+tcp',
    'coap+ws',
    'coaps',
    'coaps+tcp',
    'coaps+ws',
    'com-eventbrite-attendee',
    'content',
    'conti',
    'crid',
    'cvs',
    'data',
    'dav',
    'diaspora',
    'dict',
    'did',
    'dis',
    'dlna-playcontainer',
    'dlna-playsingle',
    'dns',
    'dntp',
    'dtn',
    'dvb',
    'ed2k',
    'elsi',
    'example',
    'facetime',
    'fax',
    'feed',
    'feedready',
    'file',
    'filesystem',
    'finger',
    'fish',
    'ftp',
    'geo',
    'gg',
    'git',
    'gizmoproject',
    'go',
    'gopher',
    'graph',
    'gtalk',
    'h323',
    'ham',
    'hcap',
    'hcp',
    'http',
    'https',
    'hxxp',
    'hxxps',
    'hydrazone',
    'iax',
    'icap',
    'icon',
    'im',
    'imap',
    'info',
    'iotdisco',
    'ipn',
    'ipp',
    'ipps',
    'irc',
    'irc6',
    'ircs',
    'iris',
    'iris.beep',
    'iris.lwz',
    'iris.xpc',
    'iris.xpcs',
    'isostore',
    'itms',
    'jabber',
    'jar',
    'jms',
    'keyparc',
    'lastfm',
    'ldap',
    'ldaps',
    'lvlt',
    'magnet',
    'mailserver',
    'mailto',
    'maps',
    'market',
    'message',
    'microsoft.windows.camera',
    'microsoft.windows.camera.multipicker',
    'microsoft.windows.camera.picker',
    'mid',
    'mms',
    'modem',
    'mongodb',
    'moz',
    'ms-access',
    'ms-browser-extension',
    'ms-calculator',
    'ms-drive-to',
    'ms-enrollment',
    'ms-excel',
    'ms-eyecontrolspeech',
    'ms-gamebarservices',
    'ms-gamingoverlay',
    'ms-getoffice',
    'ms-help',
    'ms-infopath',
    'ms-inputapp',
    'ms-lockscreencomponent-config',
    'ms-media-stream-id',
    'ms-mixedrealitycapture',
    'ms-officeapp',
    'ms-people',
    'ms-project',
    'ms-powerpoint',
    'ms-publisher',
    'ms-restoretabcompanion',
    'ms-screenclip',
    'ms-screensketch',
    'ms-search',
    'ms-search-repair',
    'ms-secondary-screen-controller',
    'ms-secondary-screen-setup',
    'ms-settings',
    'ms-settings-airplanemode',
    'ms-settings-bluetooth',
    'ms-settings-camera',
    'ms-settings-cellular',
    'ms-settings-cloudstorage',
    'ms-settings-connectabledevices',
    'ms-settings-displays-topology',
    'ms-settings-emailandaccounts',
    'ms-settings-language',
    'ms-settings-location',
    'ms-settings-lock',
    'ms-settings-nfctransactions',
    'ms-settings-notifications',
    'ms-settings-power',
    'ms-settings-privacy',
    'ms-settings-proximity',
    'ms-settings-screenrotation',
    'ms-settings-wifi',
    'ms-settings-workplace',
    'ms-spd',
    'ms-sttoverlay',
    'ms-transit-to',
    'ms-useractivityset',
    'ms-virtualtouchpad',
    'ms-visio',
    'ms-walk-to',
    'ms-whiteboard',
    'ms-whiteboard-cmd',
    'ms-word',
    'msnim',
    'msrp',
    'msrps',
    'mtqp',
    'mumble',
    'mupdate',
    'mvn',
    'news',
    'nfs',
    'ni',
    'nih',
    'nntp',
    'notes',
    'ocf',
    'oid',
    'onenote',
    'onenote-cmd',
    'opaquelocktoken',
    'openpgp4fpr',
    'pack',
    'palm',
    'paparazzi',
    'pkcs11',
    'platform',
    'pop',
    'pres',
    'prospero',
    'proxy',
    'pwid',
    'psyc',
    'qb',
    'query',
    'redis',
    'rediss',
    'reload',
    'res',
    'resource',
    'rmi',
    'rsync',
    'rtmfp',
    'rtmp',
    'rtsp',
    'rtsps',
    'rtspu',
    'secondlife',
    'service',
    'session',
    'sftp',
    'sgn',
    'shttp',
    'sieve',
    'simpleledger',
    'sip',
    'sips',
    'skype',
    'smb',
    'sms',
    'smtp',
    'snews',
    'snmp',
    'soap.beep',
    'soap.beeps',
    'soldat',
    'spiffe',
    'spotify',
    'ssh',
    'steam',
    'stun',
    'stuns',
    'submit',
    'svn',
    'tag',
    'teamspeak',
    'tel',
    'teliaeid',
    'telnet',
    'tftp',
    'things',
    'thismessage',
    'tip',
    'tn3270',
    'tool',
    'turn',
    'turns',
    'tv',
    'udp',
    'unreal',
    'urn',
    'ut2004',
    'v-event',
    'vemmi',
    'ventrilo',
    'videotex',
    'vnc',
    'view-source',
    'wais',
    'webcal',
    'wpid',
    'ws',
    'wss',
    'wtai',
    'wyciwyg',
    'xcon',
    'xcon-userid',
    'xfire',
    'xmlrpc.beep',
    'xmlrpc.beeps',
    'xmpp',
    'xri',
    'ymsgr',
    'z39.50',
    'z39.50r',
    'z39.50s',
]

malware_name_regexes = [
    'b106-(bladabindi|cb|jenxcus)',
    'bladabindi/jenxcus',
    'delf(inject|in-?fam)?',
    'b106-delf(snif|inject)?',
    '(b106-)?otran',
    'b54-(base|code|config|old|dga1)',
    'b58-(chtoz|code1|crsh|dga1|dga2|(dns[1-5])|xplt|notc)',
    '((avalanche-|avalanchebotnet-)?andromeda|andromeda-b66)',
    'b66(-(exe|https?(-unknown)?|ir|tv(ir)?))?',
    '(b6[67]{1}-ss-|andromeda |b106-)?gamarue',
    '(b67-ss-generic|avalanche-(generic|unknown)|avalanchebotnet(-generic)?)',
    '(b67-ss-|avalanche-|avalanchebotnet-)?goznym',
    '(b67-ss-|avalanche-|avalanchebotnet-)?kins',
    '(b67-ss-|avalanche-|avalanchebotnet-)?marcher',
    '(b67-ss-|avalanche-|avalanchebotnet-)?matsnu',
    '(b67-ss-|avalanche-|avalanchebotnet-)?nymai[mn]',
    '(b67-ss-|avalanche-|avalanchebotnet-)?panda-?banker',
    '(b67-ss-|avalanche-|avalanchebotnet-)?ranbyus',
    '(b67-ss-|avalanche-|avalanchebotnet-)rovnix',
    'reactorbot',
    '(b67-ss-|avalanche-|avalanchebotnet-)?teslacrypt',
    'cryptesla',
    '(b67-ss-|avalanche-|avalanchebotnet-)?tinba',
    '(b67-ss-|avalanche-|avalanchebotnet-)?urlzone2?',
    '(b67-ss-|avalanche-|avalanchebotnet-)?(vawtrak|neverquest)',
    '(b67-ss-|avalanche-|avalanchebotnet-)?xswkit',
    '(b67-ss-|avalanche-|avalanchebotnet-)?bolek',
    'b67-ss-citadel',
    '(b46-http-[cm]|b93-(base|config|hd|plugins))',
    'b157-([no]3|r[01L])',
    '(caphaw|shylock)',
    'b68-(zeroaccess-)?(1|2)-(32|64)(bit)?(-supernode)?',
    'b68-(dns|tcp)',
    'zeroaccess',
    'b75-s(1|12|2)',
    'b85-r[1-2][sv]{1}',
    '(waled|waledpak|waledac)',
    '(b106-)?zbot',
    '(all4family_|manual)?pushdo',
    '(bitdefender-)?pykspa(_improved|_precursor)?',
    'bitdefender-sumxa',
    '(avalanche-|avalanchebotnet-)?citadel( certpl| ms|ch|-54|-b54)?',
    'conficker(_?[ab]{1,2})?',
    'downadup',
    'downloaderbot-(mxb|2)',
    'downloader-bot',
    '(cridex|bugat|feodo)',
    '(emote[dt]|geodo|heodo)',
    'dridex(-data)?',
    'gameover[-_](zeus-)(dga|peer|p2p|proxy)',
    '((avalanche-|avalanchebotnet-)?gozi2?|(gozi )?(isfb|crm)|papras|snifula|(trojanspy\\.)?ursnif|dreambot|goziiisfb)',
    '(avalanche-)?((p2p|vm)?zeus(_p2p|_gameover(_us)?|vm)?|botnet_certtw)',
    'ramnit(-0x[0-9a-f]*)?',
    'sality([_-]?p2p)?(v)?[0-9]?',
    'sality_(virus|old)',
    'b106-sality',
    '(tinba(-dga)?|zusy|(avalanche-)?tiny-?banker|illi)',
    'xcodeghost',
    'dorkbot([-_ ](ssl|ngrbot))?',
    'worm_dorkbot',
    '(iot)?mirai( mirai bot|-wget-download|-newpass|-botnet(14)?)?',
    'nivdort',
    '(b106-)?virut',
    '(n[eu]curs(web)?|pwszbot|zbal)',
    'kbot',
    'xpaj',
    '(mayachok|cidox|vundo)',
    '(rovnix|bkloader)',
    '(beebone|(b106-)?vobfus|vbofus|changeup|aaeh)',
    '(unknown([0-9]{4})?|sinkhole|ransomware|infected|bitdefender-foreign|(s_)?other|generic(_malware)?|malware-generic)',
    '(wannacry|wannacrypt)',
    '(b106-)?zegost',
    '(torpig|anserin|sinowal|mebroot|quarian|theola)',
    '(sphinx|anubisspy)',
    '(zeus_)?panda',
    '(avalanche-|avalanchebotnet-)?corebot',
    'b67-ss-corebot',
    '4shared',
    'admogo',
    '(adpeak|scorpionsaver)',
    'adware(-generic)?',
    '(adware)?gvance',
    '(andro|android.)?fakeinst',
    '(android)?bauts',
    'androidlocker',
    '(androidlucky|luckylocker)',
    '(asprox|aseljo|badsrc)',
    '(backdoor\\.)?kbotrep',
    'bamital',
    '(banjori|bankpatch|backpatcher|multibanker 2)',
    'bedep',
    '(betabot|(b106-)?neurevt)',
    '(b106-)?bifrose',
    'bitcoinminer',
    'blakamba',
    '(bondat|jsproslikefan)',
    'bookworm',
    'calfbot',
    'carberp',
    'carufax',
    'chinad',
    'crossrider',
    'cryptowall',
    'cutwail',
    'cycbot',
    'dark-?mailer[23]?',
    'dipverdle\\.?a?',
    'dircrypt',
    '(dyndns-mirage-apt|mirage)',
    'dyre(za)?',
    '(enfal(-apt)?|lurid)',
    'esfury',
    'expiro',
    'festy',
    '(osx\\.)?flashback|(osx\\.)?fakeflash',
    'fleercivet',
    'foxbantrix( unknown)?',
    'fsysna',
    'gamut',
    'ganlet',
    'genieo',
    'ghost-?push',
    'ginmaster',
    'gluper',
    'gootkit',
    'hawk',
    'ibanking',
    'induc',
    '(infy(-apt)?|foudre)',
    'installmonster',
    'installrex',
    'newgoz',
    'joinkjot',
    '(kelihos(c|\\.e)?|hlux)',
    '(trojan.)?kronos',
    'kuguo',
    '(b106-)?ldpinch',
    'lethic',
    '(downloader\\.)?(locky|ponik)',
    'machbot',
    'madangel',
    'madmax',
    'mediadashboard',
    '(metel|corkow)',
    'mewsspy',
    'mip',
    'mix[12]?',
    'mkero',
    'mobidash',
    'monero[ _-]?miner',
    'morto',
    'multiplug',
    'murofet',
    'netsky',
    '(neutrino|(worm.)?kasidet)',
    'njworm',
    'oimobi',
    'padcrypt',
    'palevo',
    'pirrit',
    '(pony|(b106-)?fareit)',
    '(poseidon|findpos)',
    'poweliks',
    'pwsbanker',
    'qadars',
    '(qakbot|qbot|pinkslipbot)',
    'quant[ _-]?loader',
    'ramdo',
    'renocide',
    'rerdom',
    '(retefe|tsukuba|werdlod)',
    'revmob',
    'rinoreader',
    '(android\\.)?rootnik',
    'sendsafe',
    'shifu',
    'shiz',
    'simda',
    'skeeyah',
    'skunkx',
    '(smokeloader|(avalanche(botnet)?-|b67-ss-)?dofoil)',
    'snappea(bot)?',
    'sniperspy',
    'sprotect',
    'spyeye',
    'stantinko',
    '(sykipot(-apt)?|getkys)',
    '(alureon|tdss|tdl-4|dnschanger|xpack|wowlik)',
    'techsnab',
    'tempedreve',
    'terdot',
    'torrentlocker',
    'unknownrat[23]?',
    'uupay',
    '(keylogger( |-))?vbklip',
    'verst',
    'viknok',
    'vinself',
    '((win32)?hlubea|shieldren)',
    '(wisdom_?eyes|shelldown)',
    '(worm_)?boinberg',
    '(iot)?wopbot',
    'ztorg',
    'ebury',
    'tofsee',
    'srizbi',
    'ponmocup',
    'pitou',
    '(b106-)?sisron',
    'shiotob',
    'mumblehard',
    'spyapp(-generic)?',
    'wauchos',
    'b106-(agent|autorun|inject(or)?|ircbot|ircbrute|keygen|keylogger|multi|obfuscator|possiblemalware|small)',
    '(solarbot|b106-napolar)',
    '(b106-)?poison_?ivy',
    '(b106-)?agentbypass',
    '(b106-)?ainslot',
    '(b106-)?amighelo',
    '(b106-)?ardamax',
    '(b106-)?assasin',
    '(b106-)?autoac',
    '(b106-)?autinject',
    '(b106-)?balidor',
    '(b106-)?bancos',
    '(b106-)?bandok',
    '(b106-)?banker',
    '(b106-)?banload',
    '(b106-)?bariori',
    '(b106-)?beastdoor',
    '(b106-)?beaugrit',
    '(b106-)?bexelets',
    '(b106-)?bezigate',
    '(b106-)?binder',
    '(b106-)?bisar',
    '(b106-)?blohi',
    '(b106-)?browserpassview',
    '(b106-)?cakl',
    '(b106-)?cashback',
    '(b106-)?ceatrg',
    '(b106-)?cechip',
    '(b106-)?ceeinject',
    '(b106-)?chuchelo',
    '(b106-)?chir',
    '(b106-)?comame',
    '(b106-)?comisproc',
    '(b106-)?comitsproc',
    '(b106-)?comrerop',
    '(b106-)?comroki',
    '(b106-)?comsirig',
    '(b106-)?coolvidoor',
    '(b106-)?coremhead',
    '(b106-)?crime',
    '(b106-)?danglo',
    '(b106-)?darkddoser',
    '(b106-)?darkmoon',
    '(b106-)?decay',
    '(b106-)?defsel',
    '(b106-)?dimegup',
    '(b106-)?dnr',
    '(b106-)?dokstormac',
    '(b106-)?dooxud',
    'b106-dorkbot',
    '(b106-)?dusvext',
    '(b106-)?dynamer',
    '(b106-)?effbee',
    '(b106-)?eyestye',
    '(b106-)?farfli',
    '(b106-)?folyris',
    '((b106-)?frosparf|feis)',
    '(b106-)?(fynloski|klovbot)',
    '(b106-)?gaobot',
    '(b106-)?geratid',
    '(b106-)?gernidru',
    '(b106-)?geycript',
    '(b106-)?gratem',
    '(b106-)?gspot',
    '(b106-)?habbo',
    '(b106-)?hamweq',
    '(b106-)?hanictik',
    '(b106-)?hiderun',
    '(b106-)?histboader',
    '(b106-)?horsamaz',
    '(b106-)?hoygunver',
    '(b106-)?hupigon',
    '(b106-)?itsproc',
    '(b106-)?kilim',
    '(b106-)?kkmaka',
    '(b106-)?knowlog',
    '(b106-)?lenc',
    '(b106-)?leodon',
    '(b106-)?levitiang',
    '(b106-)?lybsus',
    '(b106-)?lypsacop',
    '(b106-)?mafod',
    '(b106-)?malagent',
    '(b106-)?malex',
    '(b106-)?meredrop',
    '(b106-)?mielit',
    '(b106-)?misbot',
    '(b106-)?mobibez',
    '(b106-)?mosripe',
    '(b106-)?mosucker',
    '(b106-)?msposer',
    '(b106-)?naprat',
    '(b106-)?nayrabot',
    '(b106-)?necast',
    '(b106-)?neeris',
    '(b106-)?nemim',
    '(b106-)?neop',
    '(b106-)?neshta',
    '(b106-)?netbot',
    '(b106-)?netwiredrc',
    '(b106-)?nitol',
    '(b106-)?noancooe',
    '(b106-)?nosrawec',
    '(b106-)?nuqel',
    '(b106-)?nusump',
    '(b106-)?parama',
    '(b106-)?parite',
    '(b106-)?pcclient',
    '(b106-)?pdfjsc',
    '(b106-)?poison',
    '(b106-)?pontoeb',
    '(b106-)?popiidor',
    '(b106-)?prorat',
    '(b106-)?prosti',
    '(b106-)?protos',
    '(b106-)?pushbot',
    'b106-ramnit',
    '(b106-)?ranos',
    '(b106-)?rbot',
    '(b106-)?rebhip',
    'cybergate',
    '(b106-)?remhead',
    '(b106-)?rimod',
    '(b106-)?ritros',
    '(b106-)?runner',
    '(b106-)?scar',
    '(b106-)?sdbot',
    '(b106-)?sharke',
    '(b106-)?silby',
    '(b106-)?sillysharecopy',
    '(b106-)?sisproc',
    '(b106-)?skypams',
    '(b106-)?smpdoss',
    '(b106-)?sormoeck',
    '(b106-)?splori',
    '(b106-)?spybot',
    '(b106-)?squida',
    '(b106-)?ssonce',
    '(b106-)?sulunch',
    '((b106-)?(swisyn|arhost)|roopirs|ashwho)',
    '(b106-)?swrort',
    '(b106-)?synflood',
    '(b106-)?tapazom',
    '(b106-)?tawsebot',
    '(b106-)?tearspear',
    '(b106-)?tendrit',
    '(b106-)?tenpeq',
    '(b106-)?tobfy',
    '(b106-)?tocofob',
    '(b106-)?toobtox',
    '(b106-)?tumpadex',
    '(b106-)?turkojan',
    '(b106-)?twores',
    '(b106-)?vahodon',
    '(b106-)?vake',
    '(b106-)?vb',
    'adclicker',
    '(b106-)?vbcrypt',
    '(b106-)?vbinder',
    '(b106-)?vbinject',
    '(b106-)?vburses',
    '(b106-)?vharke',
    '(b106-)?vinject',
    '(b106-)?vonriamt',
    '(b106-)?vtub',
    '(b106-)?weenkay',
    '(b106-)?wervik',
    '(b106-)?xtrat',
    '(b106-)?xyligan',
    '(b106-)?yemrok',
    '(b106-)?zacusca',
    '(spyvoltar|buterat)',
    '(misfox|modpack)',
    'darkshell',
    '(ircbot|clicker|(ssl-)?unknown-bot-test|downloader|iframe exploit)',
    '(jadtre|killav)',
    'renos',
    'exobot',
    '(midhos|medfos)',
    'kraken',
    'fosniw',
    'patriot',
    '(koobface|jnanabot)',
    'emudbot',
    'vidro',
    'eitest',
    'vpnfilter(-ua)?',
    '(nukebot|nuclear bot|microbankingtrojan|xbot|tinynuke)',
    '(android\\.)?fobus',
    'disorderstatus',
    'nionspy',
    'stealrat',
    '(worm\\.)?phorpiex|trik',
    '(adware\\.)?domaiq',
    'harnig',
    'bulta',
    '(trojan\\.|android\\.)?fakeav',
    '(downloader\\.)talalpek',
    'crypdef',
    'harnig',
    '(trojan\\.)?autoit',
    'pws.pony',
    'bebloh',
    'bulta',
    '((ransom\\.)genasom|stampado)',
    '(b67-ss-trusteer|fake-trusteer-app|(avalanche-|avalanchebotnet-)trusteer)',
    'tsifiri',
    'android\\.marcher',
    '(android\\.)?smsspy',
    'banwarum',
    'fakealert',
    'yash( |-)rat',
    'proxyback',
    'ssl-vmzeus',
    'fakerea(n|m)',
    '(iot)?satori',
    '(android\\.)?fakebank',
    '(avalanche-|avalanchebotnet-|b6[67]-ss-)?smartapp',
    'blackbeard',
    '(lebreat|reatle|nujama)',
    'siggen6',
    'redyms',
    '(buzus|pushbot|yimfoca)',
    'dresscode',
    'kryptovor',
    'volatile_cedar',
    'x-?agent|chopstick|splm',
    '(ransom\\.)?cerber',
    '((android\\.)?smsbot|crosate)',
    'coinminer',
    'keybase',
    'android[\\.-]pwstealer',
    'lurk(banker)?',
    'trafog',
    'dirtjumper',
    'hesperbot',
    'banatrix',
    'kovter',
    'b67-ss-gozi2',
    'adware.eorezo',
    'android.banker',
    'android.cliaid',
    'bagle',
    'boaxxe',
    '(rakhni|crypaura)',
    'fobber',
    'gspy',
    'hancitor',
    'htbot',
    'shelltea',
    'silon',
    'tesch',
    'umbraloader',
    '(shadowpad|xshellghost)',
    'suppobox',
    'powersniff',
    'holycaptcha',
    'plasma-tomas',
    'spambot1',
    'multiple-malware unknown-requests',
    'adware[\\.-]medialabs',
    '((c_)?trickbot|trickster|thetrick|trickloader)',
    '(koceg|(worm_)?mandaph|socks)',
    '(android\\.)?occamy',
    '(pua\\.)?sprotector',
    '(android\\.)uupay',
    '(loader|cryptojacker)',
    'minr',
    '(android\\.)?fakedoc',
    '(dybalom|fignotok)',
    '(menupass( team)?|apt[- ]?10|stone[ -]?panda|cvnx|hogfish|happyyongzi|potassium|duststorm|red[ -]?apollo|cloud[ -]?hopper)',
    '(pua\\.android\\.)?ammob',
    '(android\\.)?coolwall',
    '((android\\.)?qysly|ztorg)',
    'cobalt[ _-]?(group|gang|spider)?',
    '(equation[ _-]?group|tilded[ _-]?team|lamberts|eqgrp|longhorn)',
    'helminth',
    '(apt-generic|unknown-apt)',
    '(win\\.|linux\\.)?ngioweb',
    '(android\\.)?rotexy',
    '(android\\.)?nitmo',
    'fallout(\\.exploitkit)?',
    '(travle|pylot)',
    '(android\\.)?hqwar',
    '(android\\.micropsia|vamp)',
    '(android\\.)?erop',
    '(android\\.)?infosteal(er)?',
    '(android\\.)?(premiumtext|rufraud)',
    'wrokni',
    '(android\\.)?faketelegram',
    '(android\\.)?teleplus',
    'nametrick',
    '(powerstats|valyria)',
    'cryptoloot',
    '(android\\.)?hiddad',
    'webprefix',
    '(infostealer\\.)?banbrox',
    '(android\\.)?milipnot',
    'android\\.locker',
    'fake_cs_updater',
    '(android\\.bankspy|android\\.bankbot|anubis)',
    '(android\\.)?gopl',
    '(android\\.)?asacub',
    'mysafeproxymonitor',
    'madominer',
    '(phishing\\.cobalt|cobalt-phishing)',
    '((pua\\.)?ghokswa|(ghokswa|gotoe)[ _-]browser)',
    'presenoker',
    'teleru',
    '(ransomware\\.)?shade',
]

malpedia_malware_name_regexes = [
    '7ev3n',
    '(9002|homeunix|hydraq|mcrat)',
    'abbath[ _-]?banker',
    'acronym',
    'adam[ _-]?locker',
    'adylkuzz',
    '(sun rootkit|comrat|agent[ _-]?btz)',
    'agent[ _-]?tesla',
    '(alice[ _-]?atm|pralice)',
    '(alina[ _-]?eagle|alina[ _-]?pos|katrina|alina[ _-]?spark)',
    '(allaple|starman)',
    'alma[ _-]?communicator',
    'alma[ _-]?locker',
    'alphabet[ _-]?ransomware',
    'alphalocker',
    'alphanc',
    'alreay',
    '(amtsol|adupihan)',
    'apocalypse[ _-]?ransom',
    'arefty',
    '(arik[ _-]?keylogger|aaron keylogger)',
    'aspc',
    'athenago',
    'atmii',
    'atmitch',
    'august[ _-]?stealer',
    '(auriga|riodrv)',
    'avast[ _-]?disabler',
    'aveo',
    'avzhan',
    'ayegent',
    '(azorult|puffstealer|rultazo)',
    '(snowball|babar)',
    'badencript',
    'badflick',
    'badnews',
    'bahamut',
    'bankshot',
    'bart',
    'batel',
    'bbsrat',
    'bernhardpos',
    'bfbot',
    'billgates',
    '(biscuit|zxdosml)',
    'bitsran',
    'blackenergy',
    '(poswds|kaptoxa|blackpos|reedum)',
    'blackrevolution',
    'blackshades',
    'bouncer',
    'bravonc',
    'bredolab',
    'bs2005',
    'btcware',
    'bugat[ _-]?alreadydump',
    '(buhtrap|ratopak)',
    '(bundestrojaner|0zapftis|r2d2)',
    'bunitu',
    'byeby',
    'c0d0so0',
    'cabart',
    '(cadelle|cadelspy)',
    'cannibal[ _-]?rat',
    '(carbanak|anunak)',
    'cardinal[ _-]?rat',
    'casper',
    'ccleaner[ _-]?backdoor',
    '(ham backdoor|chches)',
    '(cherrypickerpos|cherry[ _-]?picker)',
    '(androkins|chthonic)',
    'client[ _-]?maximus',
    'cloud[ _-]?duke',
    'cmsbrute',
    '(cmstar|meciv)',
    'cobalt[ _-]?strike',
    'cobian[ _-]?rat',
    '(carbon|cobra)',
    'cockblocker',
    'codekey',
    'combojack',
    'combos',
    'comodosec',
    'comrade[ _-]?circle',
    '(kido|traffic converter)',
    'confucius',
    'contopee',
    'cookiebag',
    '(sourface|coreshell)',
    'cradlecore',
    '(crash|crashoverride|industroyer)',
    'credraptor',
    'cryakl',
    'crylocker',
    'crypmic',
    'crypt0l0cker',
    'crypto[ _-]?fortress',
    'crypto[ _-]?ransomeware',
    'cryptolocker',
    'cryptoluck',
    '(cryptfile2|cryptomix)',
    'cryptorium',
    'cryptoshield',
    'cryptoshuffler',
    'cryptowire',
    'cryptxxxx',
    'csext',
    '(windshield|cuegoe)',
    'cutlet',
    'cyber[ _-]?splitter',
    'dairy',
    'darkcomet',
    'darkpulsar',
    'darksky',
    'darktrack[ _-]?rat',
    '(muirim|nioupale|daserf)',
    'datper',
    'deltas',
    'dented',
    'deputydog',
    'deria[ _-]?lock',
    '(photo|derusbi)',
    'devils[ _-]?rat',
    '(lusypos|dexter)',
    '(arena|crysis|dharma)',
    '(gorynch|crystal|gorynych|diamondfox)',
    'dimnie',
    'disttrack',
    'dma[ _-]?locker',
    '(shelma|doghousepower)',
    'dorshel',
    'downeks',
    'doublepulsar',
    '(delphacy|downdelph)',
    'downpaper',
    'dropshot',
    'dtbackdoor',
    'dualtoy',
    'dubnium[ _-]?darkhotel',
    'duqu',
    'duuzer',
    'eda2[ _-]?ransom',
    'ehdevel',
    'elise',
    'emdivi',
    'equationdrug',
    'erebus',
    '(eternal[ _-]?petya|expetr|petna|pnyetya|badrabbit|nyetya|npetya|diskcoder\\.c|nonpetya|notpetya)',
    '(etumbot|hightide)',
    'evilbunny',
    '(evilgrab|vidgrab)',
    '(evilpony|crestealer)',
    'evrial',
    'exchange[ _-]?tool',
    '(extrat|extreme[ _-]?rat)',
    'eye[ _-]?pyramid',
    '(willexec|fakedga)',
    'braviax',
    'faketc',
    'fanny',
    'fantomcrypt',
    'fast[ _-]?pos',
    'felismus',
    'fileice[ _-]?ransom',
    '(finfisher|finspy)',
    'fireball',
    'firecrypt',
    'first[ _-]?ransom',
    'flawedammyy',
    'flexispy',
    'floki[ _-]?bot',
    'floxif',
    'flusihoc',
    'formbook',
    'freenki',
    '(bitpaymer|friedex)',
    'furtim',
    'gameover[ _-]?dga',
    '(gameover[ _-]?p2p|goz|zeus p2p)',
    '(grandcrab|gandcrab)',
    'gaudox',
    '(gazer|whitebear)',
    'gearinformer',
    'getmail',
    '(getmypos|getmypass)',
    '(ghole|coreimpact \\(modified\\)|gholee)',
    '(ghost ibot|ghost[ _-]?admin)',
    '(ghost[ _-]?rat|gh0st rat|pcrat)',
    '(glasses|wordpress bruteforcer)',
    'globe[ _-]?ransom',
    'globeimposter',
    'glooxmail',
    'godzilla[ _-]?loader',
    'goggles',
    'gold[ _-]?dragon',
    '(goldeneye|petya/mischa)',
    'golroted',
    'goopic',
    'talalpek',
    'gpcode',
    'grabbot',
    'graftor',
    '(frameworkpos|grateful[ _-]?pos|trinity)',
    'grok',
    'h1n1',
    'hacksfase',
    'hackspy',
    'chanitor',
    'happy[ _-]?locker',
    'piptea',
    'havex[ _-]?rat',
    '(predator pain|hawkeye[ _-]?keylogger|hawkeye reborn)',
    'helauto',
    'heloag',
    'herbst',
    'heriplor',
    'hermes',
    'herpes',
    'hi[ _-]?zor[ _-]?rat',
    'hiddentear',
    'hidedrv',
    'hikit',
    'homefry',
    'htprat',
    'httpbrowser',
    '(hworm|houdini)',
    'ice[ _-]?ix',
    '(icedid|bokbot)',
    'icedid[ _-]?downloader',
    'icefog',
    'idkey',
    'imminent[ _-]?monitor[ _-]?rat',
    '(iap|pandemyia)',
    'ismagent',
    'ismdoor',
    'ispy[ _-]?keylogger',
    'isr[ _-]?stealer',
    'isspace',
    'jaff',
    'jager[ _-]?decryptor',
    '(reconcyc|kcna infostealer|c3pro-racoon|jaku)',
    'jasus',
    'jigsaw',
    'joao',
    'jqjsnicker',
    'jripbot',
    'kagent',
    'karagany',
    'kasperagent',
    'kazuar',
    'kegotip',
    'keylogger[ _-]?apt3',
    'khrat',
    'killdisk',
    '(kasper internet non-security|maple)',
    'klrd',
    'kokokrypt',
    'konni',
    '(bisonal|korlia)',
    '(blackmoon|krbanker)',
    'krdownloader',
    'osiris',
    '(kuaibpy|barys|kuaibu8|gofot)',
    'kuluoz',
    'kurton',
    'lambert',
    'latentbot',
    'lazarus',
    'laziok',
    'leash',
    'limitail',
    'listrix',
    'lock[ _-]?pos',
    'locky[ _-]?decryptor',
    'locky[ _-]?loader',
    '(loda|nymeria)',
    'logpos',
    'luminosity[ _-]?rat',
    'luzo',
    '(bomba locker|adneukine|lyposit|lucky locker)',
    '(machete|el machete)',
    'magala',
    'magniber',
    'majik[ _-]?pos',
    'maktub',
    '(diskcryptor|hddcryptor|mamba)',
    '(cryptohost|manamecrypt)',
    '(mangzamel|vedratve|junidor|mengkite)',
    'manifestus[ _-]?ransomware',
    'manitsme',
    'mapiget',
    'matrix[ _-]?banker',
    'matrix[ _-]?ransom',
    'matryoshka[ _-]?rat',
    '(dexlocker|mbrlock)',
    'medusa',
    'mewsei',
    'miancha',
    'microcin',
    'micropsia',
    'mikoponi',
    'mimikatz',
    'miniasp',
    'misdat',
    'mixfox',
    'miuref',
    'mm[ _-]?core',
    'mobi[ _-]?rat',
    'mocton',
    'moker',
    'mokes',
    'mole',
    'molerat[ _-]?loader',
    'moonwind',
    'morphine',
    'mosquito',
    'moure',
    'mozart',
    'multigrain[ _-]?pos',
    'murkytop',
    'mutabaha',
    'mykings[ _-]?spreader',
    'nabucur',
    'nagini',
    'naikon',
    'nano[ _-]?locker',
    'nanocore',
    'nautilus',
    'netc',
    'netrepser[ _-]?keylogger',
    'netsupportmanager[ _-]?rat',
    '(travnet|nettraveler)',
    '(netwire|recam)',
    'neuron',
    '(jimmy|neutrino[ _-]?pos)',
    'newcore[ _-]?rat',
    'newsreels',
    'nexster[ _-]?bot',
    'nexus[ _-]?logger',
    '(bladabindi|njrat)',
    'nransom',
    'oddjob',
    'odinaff',
    'olympic[ _-]?destroyer',
    '(sbot|onliner)',
    'op[ _-]?blockbuster',
    'opachki',
    'opghoul',
    'orcus[ _-]?rat',
    'ordinypt',
    'ovidiystealer',
    'zeuspanda',
    'petrwrap',
    'petya',
    '(rerol|pgift)',
    'philadelphia[ _-]?ransom',
    'pittytiger[ _-]?rat',
    '(pkybot|bublik|pykbot|tbag)',
    '(tscookie|plead)',
    'plexor',
    'ploutus[ _-]?atm',
    '(korplug|sogu|plugx)',
    'pivy',
    'polyglot[ _-]?ransom',
    'siplog',
    'poohmilk',
    'popcorn[ _-]?time',
    'poweliks[ _-]?dropper',
    'power[ _-]?ratankba',
    'powerduke',
    'prikormka',
    'prilex',
    'princess[ _-]?locker',
    'pss',
    'pteranodon',
    'punkey[ _-]?pos',
    'pvzout',
    '(qhost|tolouge)',
    '(qtproject|qtbot)',
    '(yggdrasil|quasar[ _-]?rat|cinarat)',
    'r980',
    'radamant',
    '(rambo|brebsd)',
    'nimnul',
    'ranscam',
    'ransoc',
    '(winlock|ransomlock)',
    'rapid[ _-]?stealer',
    'ratabankapos',
    'rawpos',
    '(crisis|rcs|remote control system)',
    'reaver',
    'red[ _-]?alert',
    'redleaves',
    'remcos',
    'remexi',
    'remsec[ _-]?strider',
    'remy',
    'retadup',
    '(revenge[ _-]?rat|revetrat)',
    'rgdoor',
    'rincux',
    'ripper[ _-]?atm',
    'rockloader',
    'rofin',
    'rokku',
    '(rokrat|dogcall)',
    '(rombertik|carbongrabber)',
    'romeos',
    'roseam',
    'rover',
    'royal[ _-]?dns',
    'royalcli',
    'rtm',
    'ruckguv',
    'runningrat',
    '(rcsu|rurktar)',
    '(sage[ _-]?ransom|saga)',
    '(sakurel|sakula[ _-]?rat)',
    'salgorea',
    'samsam',
    'satana',
    'sathurbot',
    'scanpos',
    'scote',
    'screenlocker',
    'seadaddy',
    'seasalt',
    '(eviltoss|azzy|sedreco)',
    '(gamefish|downrage|carberplike|jkeyskw|seduploader|jhuhugit)',
    'serpico',
    'shakti',
    'shapeshift',
    'shelllocker',
    'shimrat',
    'shujin',
    'shurl0ckr',
    '(destover|sierras)',
    '(truebot|silence)',
    'ibank',
    'skarab[ _-]?ransom',
    'skyplex',
    'slave',
    'slingshot',
    '(speccom|smac)',
    '(smominru|ismo)',
    'snatch[ _-]?loader',
    '(sneepy|byebyeshell)',
    'snojan',
    'snslocker',
    'socks5[ _-]?systemz',
    '(nadrac|socksbot|birddog)',
    'napolar',
    'soraya',
    'spora[ _-]?ransom',
    'sslmm',
    'stabuniq',
    'stampedo',
    'starloader',
    'starsypound',
    'stegoloader',
    'stinger',
    'strongpity',
    'stuxnet',
    'sunorcal',
    'bayrob',
    'swift',
    'sword',
    'synccrypt',
    'synflooder',
    'synth[ _-]?loader',
    'sys10',
    'syscon',
    'sysget',
    'sysscan',
    'szribi',
    'tabmsgsql',
    '(simbot|taidoor)',
    'taleret',
    'tarsip',
    'tdiscoverer',
    'tdtess',
    'telebot',
    'teledoor',
    '(fakem rat|terminator[ _-]?rat)',
    '(thanatos|alphabot)',
    'threebyte',
    'thumbthief',
    'tidepool',
    'tinyloader',
    'tinytyphon',
    'tinyzbot',
    'gheg',
    '(hatman|trisis|triton)',
    'trochilus[ _-]?rat',
    '(shade|troldesh)',
    'trump[ _-]?ransom',
    'turnedup',
    'tyupkin',
    '(uacme|akagi)',
    'udpos',
    'uiwix',
    'unlock92',
    'upatre',
    'urausy',
    '(uroburos|snake)',
    '(catch|grabnew)',
    'velso',
    'venus[ _-]?locker',
    'vermin',
    'vflooder',
    'zberp',
    '(volgmer|fallchill|manuscrypt)',
    'vreikstadi',
    '(wcry|wana decrypt0r|wannacryptor)',
    'waterspout',
    'webc2[ _-]?adspace',
    'webc2[ _-]?ausov',
    'webc2[ _-]?bolid',
    'webc2[ _-]?cson',
    'webc2[ _-]?div',
    'webc2[ _-]?greencat',
    'webc2[ _-]?head',
    'webc2[ _-]?kt3',
    'webc2[ _-]?qbp',
    'webc2[ _-]?rave',
    'webc2[ _-]?table',
    'webc2[ _-]?ugx',
    'webc2[ _-]?yahoo',
    'wildfire',
    'winmm',
    'winnti',
    'winsloader',
    'wndtest',
    '(woolger|woolenlogger)',
    'xbot[ _-]?pos',
    'xbtl',
    'xp[ _-]?privesc',
    'xpan',
    '(expectra|xpctra)',
    '(xsplus|nokian)',
    '(xaps|shunnael|xtunnel|x-tunnel)',
    '(xxmm|shadowwalker)',
    '(tssl|yahoyah|keyboy)',
    'yty',
    '(max\\+\\+|sirefef|smiscer)',
    'zerot',
    'zeus[ _-]?mailsniffer',
    'zeus[ _-]?sphinx',
    'zezin',
    'zhmimikatz',
    '(zloader|deloader)',
    '(sensocode|zxshell)',
    'zyklon',
    '(abaddon[ _-]?pos|pinkkite)',
    'anel',
    'apocalipto',
    'atmspitter',
    'avcrypt',
    'backspace',
    'backswap',
    '(bwin3[ _-]?bka|bka[ _-]?trojaner)',
    'bozok',
    'brutpos',
    '(centerpos|cerebrus)',
    'chewbacca',
    'cohhoc',
    '(colony|bandios|graybird)',
    '(lojack|computrace)',
    '(crimson|seedoor)',
    'cueisfry',
    'decebal',
    'elirks',
    'empire[ _-]?downloader',
    '(saber|excalibur|sabresac)',
    'firemalv',
    '(former[ _-]?first[ _-]?rat|ff[ _-]?rat)',
    'galaxyloader',
    '(gamapos|pios)',
    'glassrat',
    'glupteba',
    '(fuerboos|goodor)',
    'google[ _-]?drive[ _-]?rat',
    'govrat',
    'gravity[ _-]?rat',
    '(greenshaitan|eoehttp)',
    'gsecdump',
    '(huc packet transmit tool|htran)',
    'iisniff',
    'innaput[ _-]?rat',
    'jackpos',
    'jolob',
    'kwampirs',
    'lamdelin',
    'logedrut',
    'malumpos',
    'micrass',
    'milkmaid',
    '(straxbot|modpos)',
    'nemain',
    '(scouteagle|neteagle)',
    '(new[ _-]?ct|ct)',
    'newposthings',
    'nymaim2',
    'onhat',
    '(owaauth|luckyowa)',
    '(pirpi|cookiecutter|shotput)',
    'pubnubrat',
    'radrat',
    'rdasrv',
    'regeorg',
    '(hussarini|sarhust)',
    '(dbger|lucky ransomware|satan)',
    'schneiken',
    '(shareip|remotecmd)',
    '(sharpknot|bitrep)',
    '(denis|soundbite)',
    'squirtdanger',
    'starcruft',
    'stresspaint',
    'synack',
    'tapaoux',
    '(huntpos|treasurehunter)',
    'medre',
    'vskimmer',
    'w32times',
    'webmonitor',
    'wipbot',
    '(wmighost|wimmie|syndicasec)',
    'wonknu',
    'woody',
    '(darkshare|younglotus)',
    '(zekapab|zebrocy)',
    'zebrocy[ _-]?au3',
    'zhcat',
    '(zoxpng|gresim)',
    'ars[ _-]?loader',
    'ati[ _-]?agent',
    'brambul',
    'cerbu[ _-]?miner',
    'danabot',
    'invisimole',
    'joanap',
    'karius',
    'koadic',
    'navrat',
    'nocturnalstealer',
    'onekeylocker',
    'rapid[ _-]?ransom',
    'sedll',
    'sisfader',
    '(upas|rombrast)',
    'abantes',
    'acridrain',
    'adkoob',
    'advisorsbot',
    'aldibot',
    'alpc[ _-]?lpe',
    '(olmarik|tdl|pihar)',
    '(antilam|latinus)',
    'arkei[ _-]?stealer',
    'ascentloader',
    'atmosphere',
    'aurora',
    'babymetal',
    'bangat',
    'batchwiper',
    'beendoor',
    'bohmini',
    'breakthrough[ _-]?loader',
    'camubot',
    'catchamas',
    'chainshot',
    '(cobint|coolpants)',
    'concealment[ _-]?troy',
    'crenufs',
    'darkmegi',
    'chymine',
    'darkstrat',
    'darktequila',
    'ddkong',
    '(textmate|dnsmessenger)',
    'dramnudge',
    'dubrute',
    'dumador',
    'eredel',
    'felixroot',
    'final1stspy',
    'gamotrol',
    'gauss',
    'gcman',
    '(ghostnet|remosh)',
    'hermes[ _-]?ransom',
    'himan',
    'http[ _-]?troy',
    '(httpdr0pper|httpdropper)',
    'hyperbro',
    'imecab',
    'kardonloader',
    'keymarble',
    'kikothac',
    'kpot[ _-]?stealer',
    'ksl0t',
    '(leouncia|shoco)',
    'litehttp',
    '(lokibot|lokipws|loki)',
    'makadocs',
    'makloader',
    'marap',
    '(mybios|mebromi)',
    'miragefox',
    '(mpk|mpkbot)',
    'mylobot',
    'n40',
    'narilam',
    'ngioweb',
    'nitlove',
    'nokki',
    'nozelesn[ _-]?decryptor',
    'oceansalt',
    'octopus',
    'onionduke',
    'oopsie',
    'orcarat',
    'overlay[ _-]?rat',
    'paladin',
    'parasite[ _-]?http',
    'penco',
    'pipcreat',
    'plaintee',
    'playwork',
    'ployx',
    'pngdowner',
    'portless',
    'poscardstealer',
    'powerpool',
    'prb[ _-]?backdoor',
    'predator',
    'psix',
    'pupy',
    'putabmow',
    'pwnpos',
    '(pylocky|locky locker)',
    'qaccel',
    'rarstar',
    'red[ _-]?gambler',
    'redalpha',
    'regin',
    'rikamanu',
    '(rock|yellowalbatross)',
    'rozena',
    'rtpos',
    'rumish',
    'rustock',
    'ryuk',
    '(sanny|daws)',
    'sidewinder',
    'siluhdur',
    'sobaken',
    'sorgu',
    'spedear',
    'stration',
    'tandfuy',
    'thanatos[ _-]?ransom',
    'thunker',
    'tiop',
    'virdetdoor',
    'waterminer',
    'wellmess',
    'xtunnel[ _-]?net',
    '(yayih|bbsinfo|aumlib)',
    'zedhou',
    'zeroevil',
    'amadey',
    'anatova[ _-]?ransom',
    'artra',
    '(ave[ _-]?maria|warzone rat)',
    'babylon[ _-]?rat',
    'backbend',
    'backnet',
    '(baldr|baldir)',
    'beapy',
    'belonard',
    'berbomthum',
    'biodata',
    'bitter[ _-]?rat',
    'blackcoffee',
    '(blackrouter|blackheart)',
    'brain',
    'breach[ _-]?rat',
    'brushaloader',
    'bubblewrap',
    'cannon',
    'carrotbat',
    'chinachopper',
    'clipbanker',
    'coalabot',
    'coredn',
    'creamsicle',
    'dispenserxfs',
    'dmsniff',
    '(dnspionage|webmask|agent drable)',
    '(toshliph|spy\\.agent\\.orm|driftpin)',
    'electric[ _-]?powder',
    '(elmer|elmost)',
    'evilnum',
    'exaramel',
    'exilerat',
    'farseer',
    'flame',
    'flashflood',
    'flawedgrace',
    'flowershop',
    'gemcutter',
    'glitch[ _-]?pos',
    'grease',
    'grey[ _-]?energy',
    'grillmark',
    'hiddenbee',
    'hoplight',
    'ironhalo',
    'israbye',
    'jcry',
    'karkoff',
    'kerrdown',
    'kibex',
    '(kleptoparasite[ _-]?stealer|joglog)',
    'komprogo',
    'kutaki',
    'lazycat',
    'lightneuron',
    'limerat',
    'lockergoga',
    'lojax',
    'lordix',
    'lowball',
    'lunchmoney',
    'mechanical',
    'megacortex',
    'megumin',
    'merlin',
    '(metamorfo|casbaneiro)',
    '(mimail|mydoom|novarg)',
    'nvisospit',
    '(oficla|sasfis|oldbait)',
    'orangeade',
    'outlook[ _-]?backdoor',
    'ozone',
    'peepy[ _-]?rat',
    'phandoor',
    '(rizzo|phoreal)',
    'pocodown',
    'poorweb',
    'poshc2',
    'powerkatz',
    'powershellrunner',
    'protonbot',
    'qulab',
    'raccoon',
    'rarog',
    'redaman',
    'rietspoof',
    'rifdoor',
    'rising[ _-]?sun',
    '(rms|remote manipulator system)',
    '(robbinhood|robinhood)',
    'roguerobin',
    '(rotocrypt|rotorcrypt|rotor)',
    'sappycache',
    'servhelper',
    'shadowhammer',
    'shipshape',
    'skipper',
    'slub',
    'smrss32',
    '(palyh|sobig)',
    'sodinokibi',
    'spaceship',
    'sparkle',
    '(startpage|easy television access now)',
    'stealthworker',
    '(keypass|djvu|stop)',
    '(sysraw[ _-]?stealer|clipsa)',
    '(finteam|teambot)',
    'tefosteal',
    'termite',
    '(tinimet|tinymet)',
    'trat',
    '(usteal|ufrstealer)',
    '(vegalocker|vega)',
    'vidar',
    'wallyshack',
    '(winpot|atmpot)',
    'wscspl',
    'xpertrat',
    'xwo',
    '(xsphinx|zeus[ _-]?openssl)',
]
