Trojan.BadRabbit.29

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\lisp_success.doc.wncryt
<Drive name for removable media>:\applicantform_en.doc.wncryt
<Drive name for removable media>:\ovp25012015.doc.wncryt
<Drive name for removable media>:\508softwareandos.doc.wncryt
<Drive name for removable media>:\fi51.doc.wncryt
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc.wncryt
<Drive name for removable media>:\weeklysheet1215.doc.wncryt
<Drive name for removable media>:\thlps_keeper_mayer_1965.docx.wncryt
<Drive name for removable media>:\adhd_and_obesity.docx.wncryt
<Drive name for removable media>:\sdszfo.docx.wncryt
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx.wncryt
<Drive name for removable media>:\glidescope_review_rev_010.docx.wncryt
<Drive name for removable media>:\nwfieldnotes1966.docx.wncryt
<Drive name for removable media>:\file_p_00000000_1371597592.docx.wncryt
<Drive name for removable media>:\@please_read_me@.txt
<Drive name for removable media>:\@wanadecryptor@.exe

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Reads files which store third party applications passwords

%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\weeklysheet1215.doc
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\delete.avi

Modifies file system

Creates the following files

%TEMP%\_mei16802\vcruntime140.dll
%TEMP%\_mei16802\_brotli.cp310-win_amd64.pyd
%TEMP%\_mei16802\_bz2.pyd
%TEMP%\_mei16802\_cffi_backend.cp310-win_amd64.pyd
%TEMP%\_mei16802\_ctypes.pyd
%TEMP%\_mei16802\_decimal.pyd
%TEMP%\_mei16802\_hashlib.pyd
%TEMP%\_mei16802\_lzma.pyd
%TEMP%\_mei16802\_queue.pyd
%TEMP%\_mei16802\_socket.pyd
%TEMP%\_mei16802\_ssl.pyd
%TEMP%\_mei16802\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei16802\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei16802\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei16802\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei16802\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei16802\base_library.zip
%TEMP%\_mei16802\certifi\cacert.pem
%TEMP%\_mei16802\cryptography-42.0.7.dist-info\installer
%TEMP%\_mei16802\cryptography-42.0.7.dist-info\license
%TEMP%\_mei16802\cryptography-42.0.7.dist-info\license.apache
%TEMP%\_mei16802\cryptography-42.0.7.dist-info\license.bsd
%TEMP%\_mei16802\cryptography-42.0.7.dist-info\metadata
%TEMP%\_mei16802\cryptography-42.0.7.dist-info\record
%TEMP%\_mei16802\cryptography-42.0.7.dist-info\wheel
%TEMP%\_mei16802\cryptography-42.0.7.dist-info\top_level.txt
%TEMP%\_mei16802\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei16802\libcrypto-1_1.dll
%TEMP%\_mei16802\libffi-7.dll
%TEMP%\_mei16802\libssl-1_1.dll
%TEMP%\_mei16802\python3.dll
%TEMP%\_mei16802\python310.dll
%TEMP%\_mei16802\select.pyd
%TEMP%\_mei16802\ucrtbase.dll
%TEMP%\_mei16802\unicodedata.pyd
<SYSTEM32>\windowspowershell\v1.0\wannacrypt0r.exe
%WINDIR%\syswow64\windowspowershell\v1.0\b.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\c.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_bulgarian.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_chinese (simplified).wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_chinese (traditional).wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_croatian.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_czech.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_danish.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_dutch.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_english.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_filipino.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_finnish.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_french.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_german.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_greek.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_indonesian.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_italian.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_japanese.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_korean.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_latvian.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_norwegian.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_polish.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_portuguese.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_romanian.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_russian.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_slovak.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_spanish.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_swedish.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_turkish.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\msg\m_vietnamese.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\r.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\s.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\t.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\taskdl.exe
%WINDIR%\syswow64\windowspowershell\v1.0\taskse.exe
%WINDIR%\syswow64\windowspowershell\v1.0\u.wnry
%WINDIR%\syswow64\windowspowershell\v1.0\00000000.pky
%WINDIR%\syswow64\windowspowershell\v1.0\00000000.eky
%WINDIR%\syswow64\windowspowershell\v1.0\00000000.res
%WINDIR%\syswow64\windowspowershell\v1.0\@wanadecryptor@.exe
%WINDIR%\syswow64\windowspowershell\v1.0\190941766439939.bat
%WINDIR%\syswow64\windowspowershell\v1.0\@please_read_me@.txt
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncryt
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncryt
%HOMEPATH%\desktop\glidescope_review_rev_010.docx.wncryt
%HOMEPATH%\desktop\nwfieldnotes1966.docx.wncryt
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc.wncryt
%WINDIR%\syswow64\windowspowershell\v1.0\m.vbs
%HOMEPATH%\desktop\weeklysheet1215.doc.wncryt
%HOMEPATH%\desktop\@please_read_me@.txt
%HOMEPATH%\desktop\@wanadecryptor@.exe
%HOMEPATH%\desktop\archer.avi.wncryt
%HOMEPATH%\desktop\default.bmp.wncryt
%HOMEPATH%\desktop\delete.avi.wncryt
%WINDIR%\syswow64\windowspowershell\v1.0\@wanadecryptor@.exe.lnk
C:\@please_read_me@.txt
C:\@wanadecryptor@.exe
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\@please_read_me@.txt
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\@wanadecryptor@.exe
C:\recovery\windowsre\@please_read_me@.txt
C:\recovery\windowsre\@wanadecryptor@.exe
%ALLUSERSPROFILE%\microsoft\appv\setup\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\appv\setup\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\diagnosis\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\network\downloader\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\network\downloader\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\uev\scripts\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\uev\scripts\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\user account pictures\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\windows\caches\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\windows\caches\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\@wanadecryptor@.exe.lnk
%LOCALAPPDATA%\@please_read_me@.txt
%LOCALAPPDATA%\@wanadecryptor@.exe.lnk
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_10[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_11[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_12[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_13[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_14[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_15[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_16[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_17[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_18[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_19[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_20[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_21[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_22[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_23[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_24[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_25[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_26[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_27[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_28[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_29[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_2[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_3[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_4[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_5[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_6[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_7[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_8[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_9[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.0.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.0.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsconversions.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsglobals.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appssynonyms.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsconversions.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsglobals.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingssynonyms.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.0.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.0.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678985908530147.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986116913057.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986733179726.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678987880972005.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678989939868207.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678992605195845.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678993617257337.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994176510543.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994514315348.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678997188779717.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998364928099.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998646131207.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999296595607.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999588120541.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000033359704.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000600569277.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000729483910.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679004887860863.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679006410337295.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679008721437407.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\settingscache.txt.wncryt
%ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.wncryt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\welcomefax.tif.wncryt
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.wncryt
%WINDIR%\syswow64\windowspowershell\v1.0\f.wnry
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlskey.der.wncryt
%APPDATA%\microsoft\templates\normal.dotm.wncryt
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js.wncryt
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js.wncryt
%APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js.wncryt
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js.wncryt
%ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.wncryt
%ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.wncryt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.wncryt
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlscert.der.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.1.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.2.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.1.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.2.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.1.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.2.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.1.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.2.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\localstate\diagoutputdir\logfile_august_11_2024__6_41_11.txt.wncryt
%APPDATA%\microsoft\templates\~$normal.dotm.wncryt
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt.wncryt
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt.wncryt
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\alternateservices.txt.wncryt
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt.wncryt
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\securitypreloadstate.txt.wncryt
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sitesecurityservicestate.txt.wncryt
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.wncryt
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.wncryt
C:\recovery\windowsre\winre.wim.wncryt
%ALLUSERSPROFILE%\desktop\@wanadecryptor@.bmp
%ALLUSERSPROFILE%\desktop\@wanadecryptor@.exe
C:\users\default\desktop\@wanadecryptor@.bmp
C:\users\default\desktop\@wanadecryptor@.exe
C:\users\default user\desktop\@wanadecryptor@.bmp
C:\users\default user\desktop\@wanadecryptor@.exe
C:\users\public\desktop\@wanadecryptor@.bmp
C:\users\public\desktop\@wanadecryptor@.exe
%HOMEPATH%\desktop\@wanadecryptor@.bmp
%TEMP%\hibsys.wncryt

Deletes following files that it created itself

%TEMP%\_mei16802\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei16802\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei16802\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei16802\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei16802\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei16802\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei16802\base_library.zip
%TEMP%\_mei16802\certifi\cacert.pem
%TEMP%\_mei16802\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei16802\cryptography-42.0.7.dist-info\installer
%TEMP%\_mei16802\cryptography-42.0.7.dist-info\license
%TEMP%\_mei16802\cryptography-42.0.7.dist-info\license.apache
%TEMP%\_mei16802\cryptography-42.0.7.dist-info\license.bsd
%TEMP%\_mei16802\cryptography-42.0.7.dist-info\metadata
%TEMP%\_mei16802\cryptography-42.0.7.dist-info\record
%TEMP%\_mei16802\cryptography-42.0.7.dist-info\top_level.txt
%TEMP%\_mei16802\cryptography-42.0.7.dist-info\wheel
%TEMP%\_mei16802\libcrypto-1_1.dll
%TEMP%\_mei16802\libffi-7.dll
%TEMP%\_mei16802\libssl-1_1.dll
%TEMP%\_mei16802\python3.dll
%TEMP%\_mei16802\python310.dll
%TEMP%\_mei16802\select.pyd
%TEMP%\_mei16802\ucrtbase.dll
%TEMP%\_mei16802\unicodedata.pyd
%TEMP%\_mei16802\vcruntime140.dll
%TEMP%\_mei16802\_brotli.cp310-win_amd64.pyd
%TEMP%\_mei16802\_bz2.pyd
%TEMP%\_mei16802\_cffi_backend.cp310-win_amd64.pyd
%TEMP%\_mei16802\_ctypes.pyd
%TEMP%\_mei16802\_decimal.pyd
%TEMP%\_mei16802\_hashlib.pyd
%TEMP%\_mei16802\_lzma.pyd
%TEMP%\_mei16802\_queue.pyd
%TEMP%\_mei16802\_socket.pyd
%TEMP%\_mei16802\_ssl.pyd

Moves the following files

from %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncryt to %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncry
from %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncryt to %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncry
from %HOMEPATH%\desktop\glidescope_review_rev_010.docx.wncryt to %HOMEPATH%\desktop\glidescope_review_rev_010.docx.wncry
from %HOMEPATH%\desktop\nwfieldnotes1966.docx.wncryt to %HOMEPATH%\desktop\nwfieldnotes1966.docx.wncry
from %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc.wncryt to %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc.wncry
from %HOMEPATH%\desktop\weeklysheet1215.doc.wncryt to %HOMEPATH%\desktop\weeklysheet1215.doc.wncry
from %HOMEPATH%\desktop\archer.avi.wncryt to %HOMEPATH%\desktop\archer.avi.wncry
from %HOMEPATH%\desktop\default.bmp.wncryt to %HOMEPATH%\desktop\default.bmp.wncry
from %HOMEPATH%\desktop\delete.avi.wncryt to %HOMEPATH%\desktop\delete.avi.wncry
from %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.wncryt to %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_10[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_10[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_11[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_11[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_12[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_12[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_13[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_13[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_14[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_14[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_15[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_15[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_16[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_16[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_17[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_17[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_18[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_18[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_19[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_19[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_20[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_20[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_21[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_21[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_22[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_22[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_23[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_23[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_24[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_24[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_25[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_25[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_26[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_26[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_27[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_27[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_28[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_28[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_29[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_29[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_2[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_2[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_3[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_3[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_4[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_4[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_5[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_5[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_6[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_6[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_7[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_7[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_8[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_8[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_9[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_9[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.0.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.0.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.0.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.0.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsconversions.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsconversions.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsglobals.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsglobals.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appssynonyms.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appssynonyms.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsconversions.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsconversions.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsglobals.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsglobals.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingssynonyms.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingssynonyms.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.0.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.0.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.0.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.0.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678985908530147.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678985908530147.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986116913057.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986116913057.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986733179726.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986733179726.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678987880972005.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678987880972005.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678989939868207.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678989939868207.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678992605195845.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678992605195845.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678993617257337.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678993617257337.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994176510543.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994176510543.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994514315348.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994514315348.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678997188779717.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678997188779717.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998364928099.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998364928099.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998646131207.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998646131207.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999296595607.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999296595607.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999588120541.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999588120541.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000033359704.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000033359704.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000600569277.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000600569277.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000729483910.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000729483910.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679004887860863.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679004887860863.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679006410337295.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679006410337295.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679008721437407.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679008721437407.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\settingscache.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\settingscache.txt.wncry
from %ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.wncryt to %ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.wncry
from %ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\welcomefax.tif.wncryt to %ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\welcomefax.tif.wncry
from %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.wncryt to %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.wncry
from %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlskey.der.wncryt to %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlskey.der.wncry
from %APPDATA%\microsoft\templates\normal.dotm.wncryt to %APPDATA%\microsoft\templates\normal.dotm.wncry
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js.wncryt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js.wncry
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js.wncryt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js.wncry
from %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js.wncryt to %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js.wncry
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js.wncryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js.wncry
from %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.wncryt to %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.wncry
from %ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.wncryt to %ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.wncry
from %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.wncryt to %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.wncry
from %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlscert.der.wncryt to %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlscert.der.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.1.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.1.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.2.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.2.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.1.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.1.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.2.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.2.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.1.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.1.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.2.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.2.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.1.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.1.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.2.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.2.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\localstate\diagoutputdir\logfile_august_11_2024__6_41_11.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\localstate\diagoutputdir\logfile_august_11_2024__6_41_11.txt.wncry
from %APPDATA%\microsoft\templates\~$normal.dotm.wncryt to %APPDATA%\microsoft\templates\~$normal.dotm.wncry
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt.wncryt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt.wncry
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt.wncryt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt.wncry
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\alternateservices.txt.wncryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\alternateservices.txt.wncry
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt.wncryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt.wncry
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\securitypreloadstate.txt.wncryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\securitypreloadstate.txt.wncry
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sitesecurityservicestate.txt.wncryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sitesecurityservicestate.txt.wncry
from C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.wncryt to C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.wncry
from C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.wncryt to C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.wncry
from C:\recovery\windowsre\winre.wim.wncryt to C:\recovery\windowsre\winre.wim.wncry

Modifies the following files

%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\weeklysheet1215.doc
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\delete.avi
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\ovp25012015.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\weeklysheet1215.doc
<Drive name for removable media>:\thlps_keeper_mayer_1965.docx
<Drive name for removable media>:\adhd_and_obesity.docx
<Drive name for removable media>:\sdszfo.docx
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
<Drive name for removable media>:\glidescope_review_rev_010.docx
<Drive name for removable media>:\nwfieldnotes1966.docx
<Drive name for removable media>:\file_p_00000000_1371597592.docx
%APPDATA%\microsoft\windows\themes\transcodedwallpaper

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'ra#.####ubusercontent.com':443
'localhost':9050

TCP

Other

'ra#.####ubusercontent.com':443

UDP

DNS ASK ra#.####ubusercontent.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'Wana Decrypt0r 2.0'

Creates and executes the following

'<SYSTEM32>\windowspowershell\v1.0\wannacrypt0r.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\taskdl.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\@wanadecryptor@.exe' co
'%WINDIR%\syswow64\windowspowershell\v1.0\@wanadecryptor@.exe' vs
'%WINDIR%\syswow64\windowspowershell\v1.0\taskse.exe' <SYSTEM32>\WindowsPowerShell\v1.0\@WanaDecryptor@.exe
'%WINDIR%\syswow64\windowspowershell\v1.0\@wanadecryptor@.exe'

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\cmd.exe' /c start WannaCrypt0r.exe
'%WINDIR%\syswow64\attrib.exe' +h .
'%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q
'%WINDIR%\syswow64\cmd.exe' /c 190941766439939.bat
'%WINDIR%\syswow64\cscript.exe' //nologo m.vbs
'%WINDIR%\syswow64\attrib.exe' +h +s D:\$RECYCLE
'%WINDIR%\syswow64\cmd.exe' /c start /b @WanaDecryptor@.exe vs
'%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "gvmqcurqksapohi404" /t REG_SZ /d "\"<SYSTEM32>\WindowsPowerShell\v1.0\tasksche.exe\"" /f
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "gvmqcurqksapohi404" /t REG_SZ /d "\"<SYSTEM32>\WindowsPowerShell\v1.0\tasksche.exe\"" /f
'%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...
'%WINDIR%\syswow64\attrib.exe' +h .' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\taskdl.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c 190941766439939.bat' (with hidden window)
'%WINDIR%\syswow64\attrib.exe' +h +s D:\$RECYCLE' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\@wanadecryptor@.exe' co' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c start /b @WanaDecryptor@.exe vs' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\taskdata\tor\taskhsvc.exe' ' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\taskse.exe' <SYSTEM32>\WindowsPowerShell\v1.0\@WanaDecryptor@.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "gvmqcurqksapohi404" /t REG_SZ /d "\"<SYSTEM32>\WindowsPowerShell\v1.0\tasksche.exe\"" /f' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...' (with hidden window)

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial