Hi all,

I was wondering if you guys knew known Ransomware that could be triggered by these Yara rules below. They are common patterns, but I noticed just Wannacry and Ryuk had triggered them.
As many ransomware names as possible if you can!
If you know any malware that can, for instance, set registry value under CurrentVersion/Run, please let me know because it'll be really appreciated

I did managed to get many ransomware from https://samples.vx-underground.org/samples/Families/ , which is great for me, but I want more ransomware names (in addition to Wannacry and Ryuk).

These strings are the Yara rules

        $s1 = "CurrentVersion\\\\Run" ascii wide nocase
    $s2 = "CurrentVersion\\\\RunOnce" ascii wide nocase
    $s3 = "SYSTEM\\\\ControlSet001\\Control" ascii wide nocase
    $s4 = "Explorer\\\\User Shell Folders" ascii wide nocase
    $s5 = "Explorer\\\\Shell Folders" ascii wide nocase
    $s6 = "SYSTEM\\\\ControlSet001\\\\Enum\\\\Root" ascii wide nocase
    $s7 = "CurrentVersion\\\\Extensions" ascii wide nocase
    $s8 = "Explorer\\\\User Shell Folders" ascii wide nocase
    $s9 = "Explorer\\\\ShellFolders" ascii wide nocase
    $s10 = "CurrentVersion\\\\Winlogon" ascii wide nocase
    $s11 = "CurrentVersion\\\\Policies\\\\Explorer\\\\Run" ascii wide nocase
    $s12 = "CurrentVersion\\\\IniFileMapping\\\\system.ini\\\\boot" ascii wide nocase
        $s13 = "CurrentControlSet\\services" ascii wide nocase
        $s14 = "CurrentVersion\\RunServicesOnce" ascii wide nocase
        $s15 = "CurrentVersion\\RunServices" ascii wide nocase
        $s16 = "CurrentVersion\\Windows\\AppInit_DLLs" ascii wide nocase 
        $s17 = "Control\\Session Manager" ascii wide nocase 
        $s18 = "CurrentControlSet\\Control\\SecurityProviders" ascii wide nocase                 
    $s19 = "CurrentVersion\\RunOnceEx" ascii wide nocase 
        $s20 = "CurrentVersion\\Terminal" ascii wide nocase
        $s21 = "Microsoft\\Active Setup\\Installed Components" ascii wide nocase                 
    $s22 = "Scripts\\Startup" ascii wide nocase 
        $s23 = "Scripts\\Logon" ascii wide nocase 
        $s24 = "Scripts\\Logoff" ascii wide nocase 
        $s25 = "CurrentVersion\\Windows\\Load" ascii wide nocase 
        $s26 = "Policies\\Explorer\\Run" ascii wide nocase 
        $s27 = "Control\\hivelist" ascii wide nocase
        $s28 = "CurrentVersion\\Explorer" ascii wide nocase