It does the following: It skips scanning filenames containing the following strings in its full path name:$Recycle.Bin
AppData
Application Data
ApplicationData
Boot
cache2
Content.IE5
Cookies
DriverStore
DVD Maker
emo_cache_v2
Extensions
GAC_MSIL
Games
GOG Games
History.IE5
httpcache
INetCache
iTunes.Resources
lol_game_client
Microsoft
microsoft shared
My Games
Program Files
Program Files (x86)
ProgramData
steamapps
System Volume Information
System32
Temp
Temporary Internet Files
tmp
Windows
winnt
WinSAT
WinSxS
WinWDF
It scans filenames containing the following extensions:avi
divx
jpeg
jpg
mkv
mov
mpe
mpeg
mpg
pdf
png
qt
rar
rm
sfv
vob
wmv
xvid
zip
It checks if the filename contains the following strings:1 yo
1 yr
10 yo
10 yr
10yo
10yr
1yo
1yr
2 yo
2 yr
2yo
2yr
3 yo
3 yr
3yo
3yr
4 yo
4 yr
4yo
4yr
5 yo
5 yr
5yo
5yr
6 yo
6 yr
6yo
6yr
7 yo
7 yr
7yo
7yr
8 yo
8 yr
8yo
8yr
9 yo
9 yr
9yo
9yr
abused
alice
aliens stars
aliens strs
alinag
alone
alyonag
alyonar
anastasiak
anastasias
anitad
anjelikal
annat
annaz
assorties
babies
barbie
batman
biyankas
builders
candydoll
candydolls
candygirl
candygirls
child
children in cinema
confidential
daisies
dinay
dreams
duchess
elenav
elisam
elizabetas
evag
fa-
fairyland
fallen girls
fallg-
fantasy
flash
forbidden
fresh
fruit
happy
hawaiian breeze
holidays
home
hots
incest
innal
irak
irinab
irynam
issue
jasminp
juliyar
katerynav
kinderkutje
kleuterkutje
la2
larisah
las-
last
last virgins
laurab
lav-
lbs-
lerac
lhv-
liliyay
little
lkd-
lolita
lsb-
lsbar-
lsd
lsh-
lsm
ls
ls-magazine
lsn-
lsv-
lswfall
margaritad
mashap
mashas
mayal
milav
milenas
monikad
mouse
nadyas
nastiak
natashac
ninat
oksana
olgas
olhad
olyay
pedo
pedofilia
pedoland
pedophilia
pionap
porn
preteen
pthc
ptsc
real
ritak
sashad
sashal
sex
sharlottas
short skirts
show
siberian
siberianm
silviyar
sofiyav
sonyam
sp_
special set
stars
stunning dolls
svetlanat
sweet
syuzannar
t-
touch it
twins
ufo-
ulyanaa
ulyanam
underage
valensiyas
valentines
valeriyal
variety
victoriad
victorias
vikaz
violetak
virgins
waterfall
young
yulias
yuliyaz
zinab
It does not encrypt files.
It locks the desktop and displays a customized ransom note depending on the data found inside the computer.Facebook Account Information
Skype Account Information
LinkedIn Account Information
System Information
Geolocation
Webcam Capture
IP Address
PC Name
User Name
Torrent files
Files containing questionable content
It scans for torrent files in the following locations:%Application Data%\uTorrent
%Application Data%\Azureus\active
%Application Data%\Vuze Leap\.resume
%Application Data%\qBittorrent\BT_backup
%Application Data%\deluge\state
It checks the following files to retrieve user's Skype, Facebook, and LinkedIn information:%Application Data%\Skype\shared.xml
%Temporary Internet Files%\Content.IE5\index.dat
%User Profile%\Cookies\index.dat
%User Profile%\Local Settings\History\History.IE5\index.dat
(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\user name\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\user name\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\user name on Windows 2000, XP, and Server 2003, or C:\Users\user name on Windows Vista and 7.)
ls magazine issue little 09 Siberian mouses.avi.rar
2ff7e9595c
Comments