Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'spoolsv.exe' = '"%APPDATA%\Microsoft\Windows\spoolsv.exe" -start'
- <Drive name for removable media>:\sorry you are encrypted.txt
- <Drive name for removable media>:\dotnetfx45_full_setup.exe
- <Drive name for removable media>:\browse.htm
- <Drive name for removable media>:\about.htm
- <Drive name for removable media>:\garden.htm
- <Drive name for removable media>:\adadsi.html
- <Drive name for removable media>:\trivial-merge.html
- <Drive name for removable media>:\tree_view.html
- <Drive name for removable media>:\browse.html
- <Drive name for removable media>:\4f0bf7ff71f28.jpeg
- <Drive name for removable media>:\wrar520.exe
- <Drive name for removable media>:\utorrent.exe
- <Drive name for removable media>:\region-north-karelia.jpeg
- <Drive name for removable media>:\3.jpg
- <Drive name for removable media>:\1189.jpg
- <Drive name for removable media>:\etc6_m_1.mov
- <Drive name for removable media>:\dag2_panel1_320_ref.mov
- <Drive name for removable media>:\firefly1.mov
- <Drive name for removable media>:\video.mp4
- <Drive name for removable media>:\clip_1080_5sec_10mbps_h264.mp4
- <Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.pdf
- <Drive name for removable media>:\7790_preview.pdf
- <Drive name for removable media>:\parnas_01.jpeg
- <Drive name for removable media>:\210252809.jpeg
- <Drive name for removable media>:\skypesetup.exe
- <Drive name for removable media>:\hadac_newsletter_july_2010_final.docx
- <Drive name for removable media>:\file_p_00000000_1371597592.docx
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\adhd_and_obesity.docx
- <Drive name for removable media>:\sdszfo.docx
- <Drive name for removable media>:\glidescope_review_rev_010.docx
- <Drive name for removable media>:\thlps_keeper_mayer_1965.docx
- <Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
- <Drive name for removable media>:\nwfieldnotes1966.docx
- <Drive name for removable media>:\issi2013_template_for_posters.docx
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\ff_ot_user_guide.pdf
- <Drive name for removable media>:\ck_ugo.pem
- %WINDIR%\syswow64\notepad.exe
- %TEMP%\e590be0b.zeppelin
- C:\far2\addons\colors\custom_highlighting\sorry you are encrypted.txt
- C:\far2\addons\colors\sorry you are encrypted.txt
- C:\far2\addons\sorry you are encrypted.txt
- C:\far2\sorry you are encrypted.txt
- C:\documents and settings\sorry you are encrypted.txt
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\sorry you are encrypted.txt
- C:\$recycle.bin\sorry you are encrypted.txt
- C:\sorry you are encrypted.txt
- C:\far2\.zeppelin
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.zeppelin
- C:\$recycle.bin\.zeppelin
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\sorry you are encrypted.txt
- D:\$recycle.bin\sorry you are encrypted.txt
- D:\sorry you are encrypted.txt
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.zeppelin
- D:\$recycle.bin\.zeppelin
- %TEMP%\~temp001.bat
- %TEMP%\5f54ef9a.zeppelin
- %APPDATA%\microsoft\windows\spoolsv.exe
- C:\far2\addons\colors\default_highlighting\sorry you are encrypted.txt
- C:\far2\addons\macros\sorry you are encrypted.txt
- %TEMP%\e590be0b.zeppelin
- %TEMP%\5f54ef9a.zeppelin
- D:\install.log
- C:\far2\farpol.lng
- C:\far2\farhun.lng
- C:\far2\farhun.hlf
- C:\far2\farger.lng
- C:\far2\fareng.lng
- C:\far2\fareng.hlf
- C:\far2\farcze.lng
- C:\far2\far.map
- C:\far2\clearpluginscache.cmd
- C:\far2\changelog_eng
- C:\far2\changelog
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\correct.avi
- C:\far2\farrus.hlf
- C:\far2\farrus.lng
- '%APPDATA%\microsoft\windows\spoolsv.exe' -start
- '%APPDATA%\microsoft\windows\spoolsv.exe' -agent 1
- '%APPDATA%\microsoft\windows\spoolsv.exe' -agent 0
- '%APPDATA%\microsoft\windows\spoolsv.exe' -agent 2
- '%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C %TEMP%\~temp001.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet' (with hidden window)
- '%WINDIR%\syswow64\notepad.exe'
- '%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet
- '%WINDIR%\syswow64\cmd.exe' /C %TEMP%\~temp001.bat
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy ByPass -Command "Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}"