in ransomware/artifact.lua [409:422]
function utils.GetAllUserProfiles()
local results = {}
local usersDir = GetKnownFolderPath('{0762D272-C50A-4BB0-A382-697DCD729B80}')
local users = ListDir(usersDir)
for _, f in ipairs(users) do
if f.Type == 'DIR' then
table.insert(results, f.Path)
end
end
return results
end