Darkside Ransomware

DarkSide Ransomware skips

Processes

* sql
* oracle
* ocssd
* dbsnmp
* synctime
* agntsvc
* isqlplussvc
* xfssvccon
* mydesktopservice
* ocautoupds
* encsvc
* firefox
* tbirdconfig
* mydesktopqos
* ocomm
* dbeng50
* sqbcoreservice
* excel
* infopath
* msaccess
* mspub
* onenote
* outlook
* steam
* thebat
* thunderbird
* visio
* winword
* wordpad
* notepad

**File names**

* autorun.inf
* boot.ini
* bootfont
* bin
* bootsect
* bak
* desktop.ini
* .iconcache
* .db
* .ntldr
* .ntuser
* .data
* ntuser
* .dat
* .log
* .ntuser
* .ini
* .thumbs

**File extensions**

* adv
* ani
* bat
* cmd
* com
* cpl
* cur
* deskthemepack
* diagcab
* diagcf
* diagpkg
* dll
* drv
* exe
* hlp
* icl
* icns
* ico
* ics
* idx
* ldf
* lnk
* mod
* mpa
* msc
* msp
* msstyles
* msu
* nls
* nomedia
* ocx
* prf
* ps1
* rom
* rtp
* scr
* shs
* spl
* sys
* theme
* themepack
* wpx
* lock
* key
* hta
* msi
* pdb

**Directories**

* $recycle.bin
* bin
* config
* msi
* $windows
* ~bt
* $ws
* windows
* appdata
* application
* data
* boot
* google
* mozilla
* program files
* program files (x86)
* programdata
* system
* volume information
* tor browser
* windows
* old
* intel
* msocache
* perflogs
* x64dbg
* public
* all users
* default