Trojan.Encoder.34099

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\asaprojectcompetition.pptx
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\middaugh_keynote.pptx

Malicious functions

Injects code into

the following system processes:

%WINDIR%\syswow64\cmd.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc

Modifies file system

Creates the following files

%HOMEPATH%\desktop\1.bmp
%HOMEPATH%\desktop\@please_read_me@.txt

Deletes the following files

%HOMEPATH%\desktop\1.bmp

Moves the following files

from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\ffjcext.zip to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\ffjcext.zip.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\bg_pattern_rhp.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\bg_pattern_rhp.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\bg_patterns_header.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\bg_patterns_header.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\images\new_icons_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\images\new_icons_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\images\new_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\images\new_icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\images\icons_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\images\icons_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\images\icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\images\icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\images\files_icons2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\images\files_icons2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\images\files_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\home\images\files_icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\comb_field_white@1x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\comb_field_white@1x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_sign_white@1x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_sign_white@1x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_roundrect_white@1x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_roundrect_white@1x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_line_white@1x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_line_white@1x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_filleddot_white@1x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_filleddot_white@1x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_delete@1x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_delete@1x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_crossmark_white@1x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_crossmark_white@1x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_checkmark_white@1x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_checkmark_white@1x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_addblue@1x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_addblue@1x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\x_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\x_2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_typetextfields_white@1x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\@1x\a12_typetextfields_white@1x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\connect-your-devices-2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\connect-your-devices-2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\icons_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\icons_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\combine-files-2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\combine-files-2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\add-comment.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\add-comment.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\add-comment-2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\add-comment-2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\activate-more-tools.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\activate-more-tools.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\activate-more-tools-2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\activate-more-tools-2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\example_icons2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\example_icons2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\example_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\example_icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\edit_pdf_poster2x.jpg.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\edit_pdf_poster.jpg to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\ob-preview\images\edit_pdf_poster.jpg.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\text_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\text_2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\file_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\file_icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\illustrations_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\illustrations_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\illustrations.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\illustrations.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\icons_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\icons_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\bg_pattern_rhp.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\bg_pattern_rhp.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\bg_patterns_header.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\bg_patterns_header.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\new_icons_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\new_icons_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\new_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\new_icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\illustrations_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\illustrations_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\new_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\new_icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\illustrations.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-computer\images\illustrations.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\new_icons_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\images\new_icons_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\combine-files.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\combine-files.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\circle_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\circle_2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\example_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\example_icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\rhp_world_icon_hover_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\rhp_world_icon_hover_2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\rhp_world_icon_hover.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\rhp_world_icon_hover.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\rhp_world_icon_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\rhp_world_icon_2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\rhp_world_icon.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\rhp_world_icon.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\new_icons_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\new_icons_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\new_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\new_icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\illustrations_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\illustrations_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\illustrations.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\illustrations.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\icons_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\icons_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\bg_pattern_rhp.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\bg_pattern_rhp.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\bg_patterns_header.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\add-account\images\bg_patterns_header.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\vscroll-thumb.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\vscroll-thumb.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\hscroll-thumb.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\hscroll-thumb.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\arrow-up.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\arrow-up.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\arrow-right.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\arrow-right.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\arrow-left.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\arrow-left.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\arrow-down.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\win-scrollbar\arrow-down.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\example_icons2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\example_icons2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\rhp_world_icon.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\rhp_world_icon.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\check_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\check_2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\adobe_sign_tag.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\adobe_sign_tag.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\adobe_sign_tag_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\adobe_sign_tag_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\sample-thumb.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\sample-thumb.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\handler@1x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\handler@1x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\faf_icons_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\faf_icons_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\faf_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\faf_icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\faf_field_grabber.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\faf_field_grabber.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\core_icons_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\core_icons_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\core_icons_fw.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\core_icons_fw.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\core_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\core_icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\line_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\line_2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\dot_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\fss\img\tools\dot_2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\warning.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\warning.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\images\rhp_world_icon_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\images\rhp_world_icon_2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\images\rhp_world_icon.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\images\rhp_world_icon.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\images\example_icons2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\images\example_icons2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\images\example_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\images\example_icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover_2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\rhp_world_icon_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\combinepdf\images\rhp_world_icon_2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover_2x.png.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsviewattachmenticons.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsviewattachmenticons.jpg.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\connect-your-devices.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\connect-your-devices.png.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\form.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\form.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\emptydatabase.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\emptydatabase.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\dataset.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\dataset.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\codefile.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\codefile.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\class.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\class.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\assemblyinfointernal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\assemblyinfointernal.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\assemblyinfo.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\assemblyinfo.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\appconfiginternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\appconfiginternal.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\appconfig.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\appconfig.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\aboutbox.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\aboutbox.zip.wannacry
from %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\toolbar.bmp to %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\toolbar.bmp.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\resource.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\resource.zip.wannacry
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\visualelements\splash-620x300.png to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\visualelements\splash-620x300.png.wannacry
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\visualelements\smalllogo.png to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\visualelements\smalllogo.png.wannacry
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\visualelements\logo.png to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\visualelements\logo.png.wannacry
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\installer\chrome.7z to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\installer\chrome.7z.wannacry
from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\secondarytile.png to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\secondarytile.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\interface.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\interface.zip.wannacry
from %ProgramFiles(x86)%\k-lite codec pack\tools\xvid_quant_matrices.zip to %ProgramFiles(x86)%\k-lite codec pack\tools\xvid_quant_matrices.zip.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\dropbox-2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\dropbox-2x.png.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\resourceinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\resourceinternal.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\settingsinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\settingsinternal.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\resourceinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\resourceinternal.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\module.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\module.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\mdiparent.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\mdiparent.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\loginform.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\loginform.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\form.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\form.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\explorer.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\explorer.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\emptydatabase.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\emptydatabase.zip.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\dialog.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\dialog.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\mdiparent.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\mdiparent.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\assemblyinfointernal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\assemblyinfointernal.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\appconfigurationinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\appconfigurationinternal.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\xmlfile.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\xmlfile.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\visualizer.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\visualizer.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\usercontrol.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\usercontrol.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\textfile.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\textfile.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\settingsinternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\settingsinternal.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\settings.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\settings.zip.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\dataset.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\dataset.zip.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\splashscreen.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\splashscreen.zip.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\unified-e-signature-2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\unified-e-signature-2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons__retina_hicontrast_wob.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons__retina_hicontrast_wob.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\organize-pages-2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\organize-pages-2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\new-features-have-arrived.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\new-features-have-arrived.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\new-features-have-arrived-2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\new-features-have-arrived-2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\multi-tab-file-view.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\multi-tab-file-view.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\multi-tab-file-view-2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\multi-tab-file-view-2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\more-inside.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\more-inside.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\more-inside-2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\more-inside-2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\unified-e-signature.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\unified-e-signature.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\watch-tutorials-2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\watch-tutorials-2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\lets-get-started.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\lets-get-started.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\get-e-signatures-2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\get-e-signatures-2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\find-text.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\find-text.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\find-text-2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\find-text-2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\fill-sign.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\fill-sign.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\fill-sign-2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\fill-sign-2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\edit-pdf.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\edit-pdf.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\edit-pdf-2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\edit-pdf-2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\dropbox.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\dropbox.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\lets-get-started-2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\lets-get-started-2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\get-e-signatures.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\get-e-signatures.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\warning_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\aicuc\images\warning_2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\images\cloud_secured.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\images\cloud_secured.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\illustrations_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\illustrations_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\logo_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\logo_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\dummy\fake_logo.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\dummy\fake_logo.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\dummy\adobe-old-logo.jpg to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\dummy\adobe-old-logo.jpg.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\adobe_logo.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\adobe_logo.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\adc_logo.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\email\adc_logo.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\new_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\new_icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\watch-tutorials.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\watch-tutorials.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\organize-pages.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\organize-pages.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\file_info2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\file_info2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\file_info.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\file_info.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\download-btn.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\download-btn.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\core_icons_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\core_icons_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\core_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\core_icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\adc_logo.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\adc_logo.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\images\core_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\images\core_icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\images\cloud_secured_lg.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\send-for-sign\images\cloud_secured_lg.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\illustrations.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\images\illustrations.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons__retina_hicontrast_bow.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons__retina_hicontrast_bow.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons_highcontrast.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons_highcontrast.png.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_automask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_automask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\globebuttonimage.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\globebuttonimage.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\calendarviewbuttonimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\calendarviewbuttonimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\calendartooliconimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\calendartooliconimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\calendartooliconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\calendartooliconimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\wssfilestooliconimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\wssfilestooliconimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\wssfilestooliconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\wssfilestooliconimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\webtoolimagesmask16x16.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\webtoolimagesmask16x16.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\webtoolimages16x16.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\webtoolimages16x16.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\webtooliconimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\webtooliconimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\webtooliconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\webtooliconimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\verisignlogo.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\verisignlogo.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\tipsimagemask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\tipsimagemask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\tipsimage.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\tipsimage.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\taskbariconimagesmask256colors.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\taskbariconimagesmask256colors.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\taskbariconimages256colors.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\taskbariconimages256colors.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\stopiconmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\stopiconmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\spacebackupiconsmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\spacebackupiconsmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\spacebackupicons.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\spacebackupicons.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_contacthigh.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_contacthigh.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_contacthighmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_contacthighmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsoutgoingimagesmall.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsoutgoingimagesmall.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_mediummask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_mediummask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_off.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_off.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsoutgoingimagemasksmall.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsoutgoingimagemasksmall.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsoutgoingimagemask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsoutgoingimagemask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsoutgoingimage.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsoutgoingimage.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsincomingimagesmall.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsincomingimagesmall.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsincomingimagemasksmall.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsincomingimagemasksmall.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsincomingimagemask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsincomingimagemask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsincomingimage.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\commsincomingimage.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_offmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_offmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_auto.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_auto.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\sketchiconimages.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\sketchiconimages.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\shared24x24images.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\shared24x24images.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_highmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_highmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_high.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_high.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_fileoffmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_fileoffmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_fileoff.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_fileoff.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_filehighmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_filehighmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_filehigh.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_filehigh.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_contactlowmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_contactlowmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_contactlow.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_contactlow.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_medium.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_medium.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\shared24x24imagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\shared24x24imagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\shared16x16imagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\shared16x16imagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierwindowmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierwindowmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\datalisticonimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\datalisticonimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\informationiconmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\informationiconmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\informationicon.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\informationicon.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\form_statusimagemask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\form_statusimagemask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\form_statusimage.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\form_statusimage.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\discussiontooliconimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\discussiontooliconimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\discussiontooliconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\discussiontooliconimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\dataviewiconimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\dataviewiconimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\dataviewiconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\dataviewiconimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\messageboxiconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\messageboxiconimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\logintool24x24images.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\logintool24x24images.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\createspaceimagemask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\createspaceimagemask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\createspaceimage.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\createspaceimage.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\chessiconimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\chessiconimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\chessiconimages.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\chessiconimages.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\calendartooliconimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\calendartooliconimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\calendartooliconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\calendartooliconimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\gradient.png to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\gradient.png.wannacry
from %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\arrow.png to %ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\arrow.png.wannacry
from %ProgramFiles%\microsoft office\office14\splashscreen.bmp to %ProgramFiles%\microsoft office\office14\splashscreen.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\datalisticonimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\datalisticonimagesmask.bmp.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\text.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\text.zip.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\logintool24x24imagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\logintool24x24imagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\messagehistoryiconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\messagehistoryiconimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\messageattachmenticonimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\messageattachmenticonimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\shared16x16images.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\shared16x16images.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\questioniconmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\questioniconmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\questionicon.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\questionicon.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\picturestooliconimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\picturestooliconimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\picturestooliconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\picturestooliconimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\outofsynciconimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\outofsynciconimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\outofsynciconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\outofsynciconimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\outlinetooliconimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\outlinetooliconimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\messageattachmenticonimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\messageattachmenticonimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\outlinetooliconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\outlinetooliconimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\logindialogbackground.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\logindialogbackground.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifieruparrow.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifieruparrow.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierdownarrow.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierdownarrow.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierdisableuparrow.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierdisableuparrow.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierdisabledownarrow.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierdisabledownarrow.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierclosebutton.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierclosebutton.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierbackgroundrtl.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierbackgroundrtl.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierbackground.jpg to %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierbackground.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\messagehistoryiconimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\messagehistoryiconimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierwindowmaskrtl.bmp to %ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierwindowmaskrtl.bmp.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\class.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\class.zip.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\messageboxiconimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\messageboxiconimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\unreadiconimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\unreadiconimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\iconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\iconimages.jpg.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\close_x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\close_x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\ccloud_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\ccloud_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\ccloud.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\ccloud.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\apple-touch-icon-72x72-precomposed.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\apple-touch-icon-72x72-precomposed.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\apple-touch-icon-57x57-precomposed.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\apple-touch-icon-57x57-precomposed.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\apple-touch-icon-144x144-precomposed.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\apple-touch-icon-144x144-precomposed.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\apple-touch-icon-114x114-precomposed.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\apple-touch-icon-114x114-precomposed.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\adc_logo.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\adc_logo.png.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\iconimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\welcome tool\iconimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\zoomiconsmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\zoomiconsmask.bmp.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\core_icons_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\core_icons_retina.png.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\zoomicons.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\zoomicons.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\whiteboxmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\whiteboxmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\splashimagemask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\splashimagemask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\splashimage.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\splashimage.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttoolseticonimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttoolseticonimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttoolseticonimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttoolseticonimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttaskiconmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttaskiconmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\globebuttonimagemask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\calendar\globebuttonimagemask.bmp.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\dd_arrow_small.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\dd_arrow_small.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons_hicontrast_wob.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons_hicontrast_wob.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\aic_file_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\aic_file_icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\aic_file_icons_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\aic_file_icons_2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons_hicontrast_bow.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\hi_contrast\core_icons_hicontrast_bow.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highcontrast_wob.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highcontrast_wob.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highcontrast_bow.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highcontrast_bow.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\aic_file_icons_highcontrast.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\aic_file_icons_highcontrast.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\aic_file_icons_hicontrast_wob.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\aic_file_icons_hicontrast_wob.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\aic_file_icons_hicontrast_bow.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\hi_contrast\aic_file_icons_hicontrast_bow.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\cloud_icon.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\cloud_icon.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\aic_file_icons_retina_thumb.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\file_types\aic_file_icons_retina_thumb.png.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttaskicon.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttaskicon.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projectstatusiconsmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projectstatusiconsmask.bmp.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\illustrations.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\illustrations.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\selection-actions.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\selection-actions.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\rhp_icons_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\rhp_icons_2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\rhp_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\rhp_icons.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\logo_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\logo_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\large_trefoil_2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\large_trefoil_2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\large_trefoil.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\large_trefoil.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\japanese_over.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\japanese_over.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\illustrations_retina.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\illustrations_retina.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\selection-actions2x.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\selection-actions2x.png.wannacry
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\core_icons.png to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\static\images\core_icons.png.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projectstatusicons.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projectstatusicons.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\meetingiconmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\meetingiconmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\unreadicon.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\unreadicon.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\inactivetabimage.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\inactivetabimage.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\viewheaderpreview.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\viewheaderpreview.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formtoolimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formtoolimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formsviewattachmenticonsmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formsviewattachmenticonsmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formsviewattachmenticons.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formsviewattachmenticons.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\addtoviewarrowmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\addtoviewarrowmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\addtoviewarrow.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\addtoviewarrow.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\markupiconimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\markupiconimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\embeddedview.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\embeddedview.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\markupiconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\markupiconimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\inactivetabimagemask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\inactivetabimagemask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\bodypanebackground.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\bodypanebackground.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\activetabimagemask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\activetabimagemask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\activetabimage.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\groovedocumentreview\activetabimage.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\wssfilestoolhomepagebackground.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\documentshare\wssfilestoolhomepagebackground.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\discussiontooliconimagesmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\discussiontooliconimagesmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\discussiontooliconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\discussion\discussiontooliconimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\computericonmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\computericonmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\computericon.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\computers\computericon.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\digitalink.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\digitalink.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\unreadiconimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\commondata\unreadiconimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\statictext.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\statictext.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\addtoviewarrow.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\addtoviewarrow.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\meetingicon.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\meetingicon.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\sectionheading.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\sectionheading.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\circleiconsmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\circleiconsmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\circleicons.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\circleicons.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\briefcaseiconmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\briefcaseiconmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\briefcaseicon.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\briefcaseicon.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\infopathwelcomeimage.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\infopathwelcomeimage.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\formsviewattachmenticonsmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\formsviewattachmenticonsmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\formsviewattachmenticons.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\formsviewattachmenticons.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\unformattednumeric.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\unformattednumeric.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\viewheaderpreview.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\viewheaderpreview.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsviewattachmenticonsmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsviewattachmenticonsmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\attachments.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms\fieldtypepreview\attachments.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\addtoviewarrowmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\addtoviewarrowmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\addtoviewarrow.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\addtoviewarrow.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\viewheaderpreview.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\viewheaderpreview.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formtoolimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formtoolimages.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsviewattachmenticonsmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsviewattachmenticonsmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsviewattachmenticons.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsviewattachmenticons.jpg.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\addtoviewarrowmask.bmp to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\addtoviewarrowmask.bmp.wannacry
from %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formtoolimages.jpg to %ProgramFiles%\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formtoolimages.jpg.wannacry
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\usercontrol.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\usercontrol.zip.wannacry

Modifies the following files

%ProgramFiles%\java\jre1.8.0_45\lib\deploy\ffjcext.zip
%ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierbackground.jpg
%ProgramFiles%\microsoft office\office14\groove\toolbmps\messagehistoryiconimagesmask.bmp
%ProgramFiles%\microsoft office\office14\groove\toolbmps\messagehistoryiconimages.jpg
%ProgramFiles%\microsoft office\office14\groove\toolbmps\messageattachmenticonimagesmask.bmp
%ProgramFiles%\microsoft office\office14\groove\toolbmps\messageattachmenticonimages.jpg
%ProgramFiles%\microsoft office\office14\groove\toolbmps\logintool24x24imagesmask.bmp
%ProgramFiles%\microsoft office\office14\groove\toolbmps\logintool24x24images.jpg
%ProgramFiles%\microsoft office\office14\groove\toolbmps\logindialogbackground.jpg
%ProgramFiles%\microsoft office\office14\groove\toolbmps\informationiconmask.bmp
%ProgramFiles%\microsoft office\office14\groove\toolbmps\informationicon.jpg
%ProgramFiles%\microsoft office\office14\groove\toolbmps\form_statusimagemask.bmp
%ProgramFiles%\microsoft office\office14\groove\toolbmps\form_statusimage.jpg
%ProgramFiles%\microsoft office\office14\groove\toolbmps\discussiontooliconimagesmask.bmp
%ProgramFiles%\microsoft office\office14\groove\toolbmps\discussiontooliconimages.jpg
%ProgramFiles%\microsoft office\office14\groove\toolbmps\dataviewiconimagesmask.bmp
%ProgramFiles%\microsoft office\office14\groove\toolbmps\dataviewiconimages.jpg
%ProgramFiles%\microsoft office\office14\groove\toolbmps\datalisticonimagesmask.bmp
%ProgramFiles%\microsoft office\office14\groove\toolbmps\datalisticonimages.jpg
%ProgramFiles%\microsoft office\office14\groove\toolbmps\createspaceimagemask.bmp
%ProgramFiles%\microsoft office\office14\groove\toolbmps\createspaceimage.jpg
%ProgramFiles%\microsoft office\office14\groove\toolbmps\chessiconimagesmask.bmp
%ProgramFiles%\microsoft office\office14\groove\toolbmps\chessiconimages.bmp
%ProgramFiles%\microsoft office\office14\groove\toolbmps\calendartooliconimagesmask.bmp
%ProgramFiles%\microsoft office\office14\groove\toolbmps\calendartooliconimages.jpg
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\gradient.png
%ProgramFiles%\microsoft office\office14\1033\grooveforms5\formsstyles\solutions\arrow.png
%ProgramFiles%\microsoft office\office14\splashscreen.bmp
%ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierbackgroundrtl.jpg
%ProgramFiles%\microsoft office\office14\groove\toolbmps\notifierclosebutton.jpg

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: 'SystemTray_Main' WindowName: ''

Executes the following

'%WINDIR%\syswow64\cmd.exe'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial