Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Update Task Scheduler' = '"<Full path to file>" /r'
Creates the following files on removable media
- <Drive name for removable media>:\!please read me!.txt
- <Drive name for removable media>:\!wannadecryptor!.exe.lnk
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im MSExchange*
- '%WINDIR%\syswow64\taskkill.exe' /f /im Microsoft.Exchange.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im sqlserver.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im sqlwriter.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\3.jpeg
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpg
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\region-north-karelia.jpeg
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\dial.bmp
Modifies file system
Creates the following files
- <Current directory>\c.wry
- <Current directory>\m.wry
- <Current directory>\r.wry
- <Current directory>\t.wry
- <Current directory>\u.wry
- <Current directory>\!wannadecryptor!.exe
- <Current directory>\326961783287724.bat
- <Current directory>\c.vbs
- <Current directory>\!wannadecryptor!.exe.lnk
- <Current directory>\!please read me!.txt
- <Current directory>\00000000.pky
- <Current directory>\00000000.eky
- <Current directory>\00000000.res
- %HOMEPATH%\desktop\3.jpeg.wcryt
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.wcryt
- <Current directory>\f.wry
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpg.wcryt
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wcryt
- %HOMEPATH%\desktop\applicantform_en.doc.wcryt
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wcryt
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx.wcryt
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx.wcryt
- %HOMEPATH%\desktop\parnas_01.jpeg.wcryt
- %HOMEPATH%\desktop\region-north-karelia.jpeg.wcryt
- %HOMEPATH%\desktop\sdszfo.docx.wcryt
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc.wcryt
- %HOMEPATH%\desktop\!please read me!.txt
- %HOMEPATH%\desktop\!wannadecryptor!.exe.lnk
- C:\!please read me!.txt
- C:\!wannadecryptor!.exe.lnk
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\!please read me!.txt
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\!wannadecryptor!.exe.lnk
- C:\recovery\windowsre\!please read me!.txt
- C:\recovery\windowsre\!wannadecryptor!.exe.lnk
- %ALLUSERSPROFILE%\microsoft\diagnosis\!please read me!.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\!wannadecryptor!.exe.lnk
- %ALLUSERSPROFILE%\microsoft\user account pictures\!please read me!.txt
- %ALLUSERSPROFILE%\microsoft\user account pictures\!wannadecryptor!.exe.lnk
- %LOCALAPPDATA%\!please read me!.txt
- %LOCALAPPDATA%\!wannadecryptor!.exe.lnk
- %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_10[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_11[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_12[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_13[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_14[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_15[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_16[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_17[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_18[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_19[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_20[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_21[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_22[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_23[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_24[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_25[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_26[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_27[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_28[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_29[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_2[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_3[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_4[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_5[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_6[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_7[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_8[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_9[1].txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.0.filtertrie.intermediate.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.0.filtertrie.intermediate.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsconversions.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsglobals.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appssynonyms.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsconversions.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsglobals.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingssynonyms.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.0.filtertrie.intermediate.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.0.filtertrie.intermediate.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678985908530147.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986116913057.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986733179726.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678987880972005.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678989939868207.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678992605195845.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678993617257337.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994176510543.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994514315348.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678997188779717.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998364928099.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998646131207.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999296595607.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999588120541.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000033359704.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000600569277.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000729483910.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679004887860863.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679006410337295.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679008721437407.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\settingscache.txt.wcryt
- %ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.wcryt
- %ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\welcomefax.tif.wcryt
- %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.wcryt
- %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlskey.der.wcryt
- %APPDATA%\microsoft\templates\normal.dotm.wcryt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js.wcryt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js.wcryt
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js.wcryt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js.wcryt
- %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.wcryt
- %ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.wcryt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.wcryt
- %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlscert.der.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.1.filtertrie.intermediate.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.2.filtertrie.intermediate.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.1.filtertrie.intermediate.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.2.filtertrie.intermediate.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.1.filtertrie.intermediate.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.2.filtertrie.intermediate.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.1.filtertrie.intermediate.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.2.filtertrie.intermediate.txt.wcryt
- %LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\localstate\diagoutputdir\logfile_august_11_2024__6_41_11.txt.wcryt
- %APPDATA%\microsoft\templates\~$normal.dotm.wcryt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt.wcryt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt.wcryt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\alternateservices.txt.wcryt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt.wcryt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\securitypreloadstate.txt.wcryt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sitesecurityservicestate.txt.wcryt
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.wcryt
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.wcryt
- C:\recovery\windowsre\winre.wim.wcryt
- %ALLUSERSPROFILE%\desktop\!wannadecryptor!.exe.lnk
- C:\users\default\desktop\!wannadecryptor!.exe.lnk
- C:\users\default user\desktop\!wannadecryptor!.exe.lnk
- C:\users\public\desktop\!wannadecryptor!.exe.lnk
- %TEMP%\hibsys.wcryt
Moves the following files
- from %HOMEPATH%\desktop\3.jpeg.wcryt to %HOMEPATH%\desktop\3.jpeg.wcry
- from %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.wcryt to %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.wcry
- from %HOMEPATH%\desktop\4f0bf7ff71f28.jpg.wcryt to %HOMEPATH%\desktop\4f0bf7ff71f28.jpg.wcry
- from %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wcryt to %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wcry
- from %HOMEPATH%\desktop\applicantform_en.doc.wcryt to %HOMEPATH%\desktop\applicantform_en.doc.wcry
- from %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wcryt to %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wcry
- from %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx.wcryt to %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx.wcry
- from %HOMEPATH%\desktop\holycrosschurchinstructions.docx.wcryt to %HOMEPATH%\desktop\holycrosschurchinstructions.docx.wcry
- from %HOMEPATH%\desktop\parnas_01.jpeg.wcryt to %HOMEPATH%\desktop\parnas_01.jpeg.wcry
- from %HOMEPATH%\desktop\region-north-karelia.jpeg.wcryt to %HOMEPATH%\desktop\region-north-karelia.jpeg.wcry
- from %HOMEPATH%\desktop\sdszfo.docx.wcryt to %HOMEPATH%\desktop\sdszfo.docx.wcry
- from %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc.wcryt to %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc.wcry
- from %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_10[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_10[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_11[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_11[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_12[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_12[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_13[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_13[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt to %TEMP%\1.wcryt
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_14[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_14[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_15[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_15[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_16[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_16[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_17[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_17[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_18[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_18[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_19[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_19[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_20[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_20[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_21[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_21[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_22[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_22[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_23[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_23[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_24[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_24[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_25[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_25[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_26[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_26[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_27[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_27[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_28[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_28[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_29[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_29[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_2[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_2[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_3[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_3[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_4[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_4[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_5[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_5[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_6[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_6[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_7[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_7[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_8[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_8[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_9[1].txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_9[1].txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.0.filtertrie.intermediate.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.0.filtertrie.intermediate.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.0.filtertrie.intermediate.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.0.filtertrie.intermediate.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsconversions.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsconversions.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsglobals.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsglobals.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appssynonyms.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appssynonyms.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsconversions.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsconversions.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsglobals.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsglobals.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingssynonyms.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingssynonyms.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.0.filtertrie.intermediate.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.0.filtertrie.intermediate.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.0.filtertrie.intermediate.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.0.filtertrie.intermediate.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678985908530147.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678985908530147.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986116913057.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986116913057.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986733179726.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986733179726.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678987880972005.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678987880972005.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678989939868207.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678989939868207.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678992605195845.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678992605195845.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678993617257337.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678993617257337.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994176510543.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994176510543.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994514315348.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994514315348.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678997188779717.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678997188779717.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998364928099.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998364928099.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998646131207.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998646131207.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999296595607.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999296595607.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999588120541.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999588120541.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000033359704.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000033359704.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000600569277.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000600569277.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000729483910.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000729483910.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679004887860863.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679004887860863.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679006410337295.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679006410337295.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679008721437407.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679008721437407.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\settingscache.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\settingscache.txt.wcry
- from %ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.wcryt to %ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.wcry
- from %ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\welcomefax.tif.wcryt to %ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\welcomefax.tif.wcry
- from %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.wcryt to %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.wcry
- from %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_1280.db to %TEMP%\5.wcryt
- from %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_32.db to %TEMP%\6.wcryt
- from %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_96.db to %TEMP%\7.wcryt
- from %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\localstate\pinnedtiles\26310719480\squaretile.png to %TEMP%\8.wcryt
- from %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlskey.der.wcryt to %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlskey.der.wcry
- from %APPDATA%\microsoft\templates\normal.dotm.wcryt to %APPDATA%\microsoft\templates\normal.dotm.wcry
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js.wcryt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js.wcry
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js.wcryt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js.wcry
- from %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js.wcryt to %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js.wcry
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js.wcryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js.wcry
- from %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.wcryt to %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.wcry
- from %ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.wcryt to %ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.wcry
- from %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.wcryt to %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.wcry
- from %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlscert.der.wcryt to %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlscert.der.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.1.filtertrie.intermediate.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.1.filtertrie.intermediate.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.2.filtertrie.intermediate.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.2.filtertrie.intermediate.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.1.filtertrie.intermediate.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.1.filtertrie.intermediate.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.2.filtertrie.intermediate.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.2.filtertrie.intermediate.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.1.filtertrie.intermediate.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.1.filtertrie.intermediate.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.2.filtertrie.intermediate.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.2.filtertrie.intermediate.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.1.filtertrie.intermediate.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.1.filtertrie.intermediate.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.2.filtertrie.intermediate.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.2.filtertrie.intermediate.txt.wcry
- from %LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\localstate\diagoutputdir\logfile_august_11_2024__6_41_11.txt.wcryt to %LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\localstate\diagoutputdir\logfile_august_11_2024__6_41_11.txt.wcry
- from %APPDATA%\microsoft\templates\~$normal.dotm.wcryt to %APPDATA%\microsoft\templates\~$normal.dotm.wcry
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt.wcryt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt.wcry
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt.wcryt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt.wcry
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\alternateservices.txt.wcryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\alternateservices.txt.wcry
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt.wcryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt.wcry
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\securitypreloadstate.txt.wcryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\securitypreloadstate.txt.wcry
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sitesecurityservicestate.txt.wcryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sitesecurityservicestate.txt.wcry
- from C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.wcryt to C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.wcry
- from C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.wcryt to C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.wcry
- from C:\recovery\windowsre\winre.wim.wcryt to C:\recovery\windowsre\winre.wim.wcry
Modifies the following files
- %HOMEPATH%\desktop\3.jpeg
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpg
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\region-north-karelia.jpeg
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_10[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_11[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_12[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_13[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_14[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_15[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_16[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_17[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_18[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_19[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_20[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_21[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_22[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_23[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_24[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_25[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_26[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_27[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_28[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_29[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_2[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_3[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_4[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_5[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_6[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_7[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_8[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_9[1].txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.0.filtertrie.intermediate.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.0.filtertrie.intermediate.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsconversions.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsglobals.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appssynonyms.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsconversions.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsglobals.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingssynonyms.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.0.filtertrie.intermediate.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.0.filtertrie.intermediate.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678985908530147.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986116913057.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986733179726.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678987880972005.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678989939868207.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678992605195845.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678993617257337.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994176510543.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994514315348.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678997188779717.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998364928099.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998646131207.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999296595607.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999588120541.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000033359704.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000600569277.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000729483910.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679004887860863.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679006410337295.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679008721437407.txt
- %APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1920_1080_pos2.jpg
- %ALLUSERSPROFILE%\microsoft\diagnosis\eventstore.db
- %ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\eventstore.db
- %ALLUSERSPROFILE%\microsoft\diagnosis\tenantstorage\p-aria\eventstore.db
- %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr.db
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\windows.edb
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\smsinterceptstore.db
- %ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp
- %ALLUSERSPROFILE%\microsoft\user account pictures\guest.png
- %ALLUSERSPROFILE%\microsoft\user account pictures\user-192.png
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.png
- %ALLUSERSPROFILE%\microsoft\windows\caches\cversions.2.db
- %ALLUSERSPROFILE%\microsoft\windows\caches\{098fe311-a2cf-4047-b83d-2e53e386112e}.2.ver0x0000000000000001.db
- %ALLUSERSPROFILE%\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000001.db
- %ALLUSERSPROFILE%\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000002.db
- %ALLUSERSPROFILE%\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000003.db
- %ALLUSERSPROFILE%\microsoft\windows\caches\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db
- %ALLUSERSPROFILE%\microsoft\windows\caches\{f93ec634-2b31-4c08-8fae-44bde07ebd9d}.2.ver0x0000000000000001.db
- %ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\mpenginedb.db
- %LOCALAPPDATA%\connecteddevicesplatform\l.user\activitiescache.db
- %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z
- %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\visualelements\logo.png
- %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\visualelements\smalllogo.png
- %LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_128.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\128.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\128.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\128.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\32.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\48.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\128.png
- %LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_8_0.png
- %LOCALAPPDATA%\microsoft\windows\caches\cversions.1.db
- %LOCALAPPDATA%\microsoft\windows\caches\cversions.3.db
- %LOCALAPPDATA%\microsoft\windows\caches\{384756ba-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db
- %LOCALAPPDATA%\microsoft\windows\caches\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000003.db
- %LOCALAPPDATA%\microsoft\windows\caches\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000004.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_256.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_32.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_96.db
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\localstate\pinnedtiles\26310719480\squaretile.png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\localstate\pinnedtiles\38975140460\squaretile.png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\localstate\pinnedtiles\38975140460\tinytile.png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\localstate\pinnedtiles\6501008900\squaretile.png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\localstate\pinnedtiles\6501008900\tinytile.png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\localstate\pinnedtiles\7603651830\squaretile.png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\localstate\pinnedtiles\7603651830\tinytile.png
- %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlskey.der
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\appdata\cachestorage\cachestorage.edb
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\appdata\indexed db\indexeddb.edb
- %TEMP%\wallpaper.bmp
- %APPDATA%\microsoft\templates\normal.dotm
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js
- %APPDATA%\opera software\opera stable\themes_backup\landscape_photo.zip
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\cert9.db
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\key4.db
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js
- %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt
- %ALLUSERSPROFILE%\microsoft\user account pictures\user-32.png
- %ALLUSERSPROFILE%\microsoft\user account pictures\user-40.png
- %ALLUSERSPROFILE%\microsoft\user account pictures\user-48.png
- %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\secondarytile.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_16.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\16.png
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_1920.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_2560.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_768.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_custom_stream.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_exif.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_sr.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_wide.db
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_wide_alternate.db
- %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlscert.der
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.1.filtertrie.intermediate.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.2.filtertrie.intermediate.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.1.filtertrie.intermediate.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.2.filtertrie.intermediate.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.1.filtertrie.intermediate.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.2.filtertrie.intermediate.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.1.filtertrie.intermediate.txt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.2.filtertrie.intermediate.txt
- %LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\localstate\diagoutputdir\logfile_august_11_2024__6_41_11.txt
- %APPDATA%\Microsoft\Templates\~$Normal.dotm
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\alternateservices.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\securitypreloadstate.txt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sitesecurityservicestate.txt
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab
- C:\recovery\windowsre\winre.wim
Substitutes the following files
- %TEMP%\1.wcryt
- %TEMP%\4.wcryt
- %TEMP%\5.wcryt
- %TEMP%\6.wcryt
- %TEMP%\7.wcryt
- %TEMP%\8.wcryt
- %APPDATA%\Microsoft\Windows\Themes\CachedFiles\CachedImage_1920_1080_POS2.jpg
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'localhost':9050
- 'localhost':9150
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Wanna Decryptor 1.0'
- ClassName: '' WindowName: ''
Creates and executes the following
- '<Current directory>\!wannadecryptor!.exe' f
- '<Current directory>\!wannadecryptor!.exe' c
- '<Current directory>\!wannadecryptor!.exe' v
- '<Current directory>\!wannadecryptor!.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c 326961783287724.bat
- '%WINDIR%\syswow64\cscript.exe' //nologo c.vbs
- '%WINDIR%\syswow64\cmd.exe' /c start /b !WannaDecryptor!.exe v
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...
- '%WINDIR%\syswow64\cmd.exe' /c 326961783287724.bat' (with hidden window)
- '<Current directory>\!wannadecryptor!.exe' f' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im MSExchange*' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im Microsoft.Exchange.*' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im sqlserver.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im sqlwriter.exe' (with hidden window)
- '<Current directory>\!wannadecryptor!.exe' c' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c start /b !WannaDecryptor!.exe v' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...' (with hidden window)
