6-13-2018: #Scarab aka DiskDoctor Config

[BACKUPS][DRIVES][SHARES][UPDATEKEY]
[EXTENSION]DiskDoctor[/EXTENSION]
[TARGETS]XXXX,ANUBIS,WANNACRY,DELPHIN,GAGRA,FANNY[/TARGETS]
[ALLFILES]
[MESSAGE]                                                                           /(        )`
     Warning all your files are encrypted !!!                              \ \___   / |
                                                                           /- _  `-/  '
 To receive the decoder, you must send an email to                        (/\/ \ \   /\
 the email address with your personal ID:                                 / /   | `    \
                                                                          O O   ) /    |
           DiskDoctor@protonmail.com                                      `-^--'`<     '
                                                                         (_.)  _  )   /
 In response you will receive further instructions.                       `.___/`    /
                                                                            `-----' /
                  ATTENTION !!!                                <----.     __ / __   \
 * Do not attempt to uninstall the program or run              <----|====O)))==) \) /====
   antivirus software.                                         <----'    `--' `.__,' \
 * Attempts to self-decrypt files will result in the                        |        |
   loss of your data.                                                        \       /
 * Decoders of other users are incompatible with your                   ______( (_  / \______
   data, as each user has a unique encryption key.                    ,'  ,-----'   |        \
                                                                      `--{__________)        \/

                                    Your personal identifier:
=====================================================================================================

{{IDENTIFIER}}

=====================================================================================================
[/MESSAGE][MELT]
[TASKNAME]Local Security Authority Process.exe[/TASKNAME]
[AUTOEXEC][ONCEELEVATE]
[README]HOW TO RECOVER ENCRYPTED FILES.TXT[/README]
[N]3EDCD188AFB1D3B0F5831DC1257E118EA189371CBA8BCEF2FD73FD196ADD9F848FB294A5FC46E96095F50E0265EADD7372BB2AEB41BC533A5E1578670111994BA2C447CE474B7CA25E17492BBF40231F2E64C73F31128168738E7BAD9284ED1167C7663C445A890F82338B8821E47DBFD5515D07DF9F6228778BF5A1E3C14AA92C22CBE5B986D4EE7056964DD84E8C662AF7CA3C0EACF293151F962EACE54A89F4D965FCF3F0E4D81691F0BF680599F24A85193B68093C5204856170FC269BB2C0E1CB7FD8338D9940CCF9F9EDE0065AB6507059F0A2362D021BDC32AE17BC27D6B0285319CA43B936CB70BA45A40D3D075EA4493B02BC7B673B3801853329B2F[/N][E]352D5DA8343F896C388739254CCB73490C00BC76B5789D5675BB9113C472844E29186CA3B7F7A804A1E5A1F9845E4C7DCD64F6EEE55F27DA2D5CBA3BC125CCF80C2AD3B8A8977345295DE1EDA7F4E1AB0F1B6BDF55D7CC478D512CE88A521193908B4BBDAF5D65C974927957DABBA859A774DA7B75458F3FAA5D311E3FCE367821C35733243AACB5D4794FAB65F763D3B3633016709B169E0607F6D2A45A53669E67D9BE721787EC71CA393737854302583B2ACEB81756C01096007EC3046D656B192405BD0F7FA471CA30BC570796247B2A5789B28708E4A285F53B9F49638705245D388E7483AA536067841C021E66B2F63432DCB0EA5F8A237656415DC374D[/E]


Path (blacklist)
:\$RECYCLE.BIN\;\All Users\;\AppData\;\Application Data\;:\Program Files (x86)\;:\Program Files\;:\System Volume Information\;:\Windows\;:\intel\;:\nvidia\;

Process search:
isqlplussvc.exe;ncsvc.exe;msftesql.exe;sqlagent.exe;sqlbrowser.exe;sqlservr.exe;sqlserver.exe;sqlwriter.exe;oracle.exe;ocssd.exe;dbsnmp.exe;synctime.exe;mydesktopqos.exe;agntsvc.exeisqlplussvc.exe;xfssvccon.exe;mydesktopservice.exe;ocautoupds.exe;agntsvc.exeagntsvc.exe;agntsvc.exeencsvc.exe;firefoxconfig.exe;tbirdconfig.exe;ocomm.exe;mysqld.exe;mysqld-nt.exe;mysqld-opt.exe;dbeng50.exe;sqbcoreservice.exe;