Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'falrqtcr472' = '"%TEMP%\IXP000.TMP\tasksche.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\@WanaDecryptor@.exe.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\x.vbs.WNCRYT
- %HOMEPATH%\Start Menu\Programs\Startup\x.vbs
- %HOMEPATH%\Start Menu\Programs\Startup\@Please_Read_Me@.txt
Malicious functions:
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Creates and executes the following:
- '%TEMP%\IXP000.TMP\taskse.exe' %TEMP%\IXP000.TMP\@WanaDecryptor@.exe
- '%TEMP%\IXP000.TMP\@WanaDecryptor@.exe'
- '%TEMP%\IXP000.TMP\taskdl.exe'
- '%TEMP%\IXP000.TMP\@WanaDecryptor@.exe' co
Executes the following:
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "falrqtcr472" /t REG_SZ /d "\"%TEMP%\IXP000.TMP\tasksche.exe\"" /f
- '<SYSTEM32>\taskkill.exe' /f /im Microsoft.Exchange.*
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...
- '<SYSTEM32>\cmd.exe' /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "falrqtcr472" /t REG_SZ /d "\"%TEMP%\IXP000.TMP\tasksche.exe\"" /f
- '<SYSTEM32>\taskkill.exe' /f /im sqlwriter.exe
- '<SYSTEM32>\taskkill.exe' /f /im mysqld.exe
- '<SYSTEM32>\taskkill.exe' /f /im MSExchange*
- '<SYSTEM32>\taskkill.exe' /f /im sqlserver.exe
- '%TEMP%\IXP000.TMP\TaskData\Tor\taskhsvc.exe'
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE'
- '<SYSTEM32>\attrib.exe' +h .
- '%TEMP%\IXP000.TMP\1.xyz'
- '<SYSTEM32>\cmd.exe' /c echo on error resume next:CreateObject("WScript.Shell").Run "%TEMP%\IXP000.TMP\1.xyz",1: >"%HOMEPATH%\Start Menu\Programs\Startup\x.vbs"
- '<SYSTEM32>\cmd.exe' /c start /b @WanaDecryptor@.exe vs
- '%TEMP%\IXP000.TMP\@WanaDecryptor@.exe' vs
- '<SYSTEM32>\cmd.exe' /c 40291500909941.bat
- '<SYSTEM32>\cscript.exe' //nologo m.vbs
Injects code into
the following user processes:
- 1.xyz
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
a large number of user processes.
Modifies file system:
Creates the following files:
- C:\Documents and Settings\Default User\Templates\quattro.wb2.WNCRYT
- C:\startup_local.bat.WNCRYT
- <STUBS_DIR>\@WanaDecryptor@.exe
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.WNCRYT
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.WNCRYT
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.WNCRYT
- C:\Far2\PluginSDK\Headers.pas\@Please_Read_Me@.txt
- C:\Far2\Plugins\FTP\@WanaDecryptor@.exe
- C:\Far2\Plugins\FTP\@Please_Read_Me@.txt
- <STUBS_DIR>\@Please_Read_Me@.txt
- <STUBS_DIR>\list_full.txt.WNCRYT
- C:\Far2\PluginSDK\Headers.pas\@WanaDecryptor@.exe
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.WNCRYT
- C:\Far2\Addons\Colors\import_colors.bat.WNCRYT
- %HOMEPATH%\Templates\quattro.wb2.WNCRYT
- <LS_APPDATA>\IconCache.db.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.WNCRYT
- C:\Far2\Plugins\Colorer\hrc\auto\types\auto.jar.WNCRYT
- C:\Far2\Plugins\Colorer\hrc\common.jar.WNCRYT
- C:\Far2\Plugins\Colorer\hrc\@WanaDecryptor@.exe.lnk
- C:\Far2\Plugins\Colorer\hrc\@Please_Read_Me@.txt
- C:\Far2\Plugins\Colorer\hrc\changes.txt.WNCRYT
- %TEMP%\IXP000.TMP\f.wnry
- C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.WNCRYT
- C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.WNCRYT
- C:\Far2\Documentation\rus\@WanaDecryptor@.exe
- C:\Far2\Documentation\rus\@Please_Read_Me@.txt
- C:\Far2\Documentation\rus\TechInfo.txt.WNCRYT
- C:\Far2\Plugins\7-Zip\@WanaDecryptor@.exe
- C:\Far2\Plugins\7-Zip\@Please_Read_Me@.txt
- C:\Far2\Plugins\7-Zip\far7z.txt.WNCRYT
- C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.WNCRYT
- C:\Far2\Plugins\FTP\FtpCmds.txt.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\RegExp\@WanaDecryptor@.exe.lnk
- C:\Far2\Plugins\ExtSearch\sources\RegExp\@Please_Read_Me@.txt
- C:\Far2\Plugins\FTP\Notes_rus.txt.WNCRYT
- C:\Far2\Plugins\FTP\Notes.txt.WNCRYT
- C:\Far2\Plugins\FTP\FtpCmds_rus.txt.WNCRYT
- C:\Far2\Plugins\ExtSearch\doc\@Please_Read_Me@.txt
- C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.WNCRYT
- C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\@WanaDecryptor@.exe.lnk
- C:\Far2\Plugins\ExtSearch\sources\@Please_Read_Me@.txt
- C:\Far2\Plugins\ExtSearch\doc\@WanaDecryptor@.exe.lnk
- %ALLUSERSPROFILE%\Desktop\@WanaDecryptor@.bmp
- <STUBS_DIR>\runall.bat.WNCRYT
- <STUBS_DIR>\proc_tools.txt.WNCRYT
- C:\Documents and Settings\Default User\Desktop\@WanaDecryptor@.exe
- C:\Documents and Settings\Default User\Desktop\@WanaDecryptor@.bmp
- %ALLUSERSPROFILE%\Desktop\@WanaDecryptor@.exe
- <STUBS_DIR>\proc_browsers.txt.WNCRYT
- <STUBS_DIR>\proc_banks.txt.WNCRYT
- <STUBS_DIR>\proc_av.txt.WNCRYT
- <STUBS_DIR>\proc_im.txt.WNCRYT
- <STUBS_DIR>\proc_games.txt.WNCRYT
- <STUBS_DIR>\proc_fake.txt.WNCRYT
- %HOMEPATH%\Desktop\@WanaDecryptor@.bmp
- %TEMP%\IXP000.TMP\TaskData\Tor\tor.exe
- %TEMP%\IXP000.TMP\TaskData\Tor\ssleay32.dll
- %TEMP%\IXP000.TMP\TaskData\Tor\libssp-0.dll
- %APPDATA%\tor\state.tmp
- %TEMP%\IXP000.TMP\TaskData\Tor\taskhsvc.exe
- %TEMP%\IXP000.TMP\TaskData\Tor\zlib1.dll
- %TEMP%\IXP000.TMP\TaskData\Tor\libevent-2-0-5.dll
- %TEMP%\IXP000.TMP\TaskData\Tor\libeay32.dll
- %HOMEPATH%\Desktop\@WanaDecryptor@.exe
- %TEMP%\IXP000.TMP\TaskData\Tor\libgcc_s_sjlj-1.dll
- %TEMP%\IXP000.TMP\TaskData\Tor\libevent_extra-2-0-5.dll
- %TEMP%\IXP000.TMP\TaskData\Tor\libevent_core-2-0-5.dll
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRYT
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak.WNCRYT
- C:\AUTOEXEC.BAT.WNCRYT
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.WNCRYT
- %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.WNCRYT
- C:\Documents and Settings\Default User\Templates\sndrec.wav.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.H.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.H.WNCRYT
- C:\Far2\PluginSDK\Headers.pas\PluginW.pas.WNCRYT
- C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas.WNCRYT
- C:\Far2\PluginSDK\Headers.pas\FarColorW.pas.WNCRYT
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT.WNCRYT
- C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat.WNCRYT
- C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat.WNCRYT
- <STUBS_DIR>\list_short.txt.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.WNCRYT
- C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat.WNCRYT
- C:\Far2\RestoreSettings.cmd.WNCRYT
- C:\Far2\ClearPluginsCache.cmd.WNCRYT
- %HOMEPATH%\Templates\sndrec.wav.WNCRYT
- C:\Far2\Addons\Colors\export_colors.bat.WNCRYT
- C:\Far2\Addons\README.TXT.WNCRYT
- C:\Far2\SaveSettings.cmd.WNCRYT
- C:\Far2\Documentation\rus\Plugins.Review.txt.WNCRYT
- %TEMP%\IXP000.TMP\msg\m_vietnamese.wnry
- %TEMP%\IXP000.TMP\msg\m_turkish.wnry
- %TEMP%\IXP000.TMP\msg\m_swedish.wnry
- %TEMP%\IXP000.TMP\t.wnry
- %TEMP%\IXP000.TMP\s.wnry
- %TEMP%\IXP000.TMP\r.wnry
- %TEMP%\IXP000.TMP\msg\m_romanian.wnry
- %TEMP%\IXP000.TMP\msg\m_portuguese.wnry
- %TEMP%\IXP000.TMP\msg\m_polish.wnry
- %TEMP%\IXP000.TMP\msg\m_spanish.wnry
- %TEMP%\IXP000.TMP\msg\m_slovak.wnry
- %TEMP%\IXP000.TMP\msg\m_russian.wnry
- %TEMP%\IXP000.TMP\taskdl.exe
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\@Please_Read_Me@.txt
- %TEMP%\IXP000.TMP\@Please_Read_Me@.txt
- %TEMP%\IXP000.TMP\40291500909941.bat
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.WNCRYT
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.WNCRYT
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.WNCRYT
- %TEMP%\IXP000.TMP\00000000.pky
- %TEMP%\IXP000.TMP\u.wnry
- %TEMP%\IXP000.TMP\taskse.exe
- %TEMP%\IXP000.TMP\@WanaDecryptor@.exe
- %TEMP%\IXP000.TMP\00000000.res
- %TEMP%\IXP000.TMP\00000000.eky
- %TEMP%\IXP000.TMP\msg\m_chinese (traditional).wnry
- %TEMP%\IXP000.TMP\msg\m_chinese (simplified).wnry
- %TEMP%\IXP000.TMP\msg\m_bulgarian.wnry
- %TEMP%\IXP000.TMP\msg\m_danish.wnry
- %TEMP%\IXP000.TMP\msg\m_czech.wnry
- %TEMP%\IXP000.TMP\msg\m_croatian.wnry
- <LS_APPDATA>\CSIDL_
- %TEMP%\IXP000.TMP\1.xy_
- %TEMP%\IXP000.TMP\1.xyz
- %TEMP%\IXP000.TMP\c.wnry
- %TEMP%\IXP000.TMP\b.wnry
- <LS_APPDATA>\CSIDL_X
- %TEMP%\IXP000.TMP\msg\m_dutch.wnry
- %TEMP%\IXP000.TMP\msg\m_japanese.wnry
- %TEMP%\IXP000.TMP\msg\m_italian.wnry
- %TEMP%\IXP000.TMP\msg\m_indonesian.wnry
- %TEMP%\IXP000.TMP\msg\m_norwegian.wnry
- %TEMP%\IXP000.TMP\msg\m_latvian.wnry
- %TEMP%\IXP000.TMP\msg\m_korean.wnry
- %TEMP%\IXP000.TMP\msg\m_finnish.wnry
- %TEMP%\IXP000.TMP\msg\m_filipino.wnry
- %TEMP%\IXP000.TMP\msg\m_english.wnry
- %TEMP%\IXP000.TMP\msg\m_greek.wnry
- %TEMP%\IXP000.TMP\msg\m_german.wnry
- %TEMP%\IXP000.TMP\msg\m_french.wnry
- C:\Far2\Addons\Colors\@WanaDecryptor@.exe
- C:\Far2\Addons\Colors\@Please_Read_Me@.txt
- C:\Far2\Addons\@WanaDecryptor@.exe
- C:\Far2\Addons\Colors\Default Highlighting\@Please_Read_Me@.txt
- C:\Far2\Addons\Colors\Custom Highlighting\@WanaDecryptor@.exe.lnk
- C:\Far2\Addons\Colors\Custom Highlighting\@Please_Read_Me@.txt
- %HOMEPATH%\Templates\@WanaDecryptor@.exe
- %HOMEPATH%\Templates\@Please_Read_Me@.txt
- %HOMEPATH%\Templates\winword2.doc.WNCRYT
- C:\Far2\Addons\@Please_Read_Me@.txt
- C:\Far2\@WanaDecryptor@.exe
- C:\Far2\@Please_Read_Me@.txt
- C:\Far2\Addons\Colors\Default Highlighting\@WanaDecryptor@.exe.lnk
- C:\Far2\Documentation\rus\Arc.Support.txt.WNCRYT
- C:\Far2\Documentation\eng\@WanaDecryptor@.exe
- C:\Far2\Documentation\eng\@Please_Read_Me@.txt
- C:\Far2\Documentation\rus\Plugins.Install.txt.WNCRYT
- C:\Far2\Documentation\rus\Far.FAQ.txt.WNCRYT
- C:\Far2\Documentation\rus\Bug.Report.txt.WNCRYT
- C:\Far2\Documentation\eng\Far.FAQ.txt.WNCRYT
- C:\Far2\Documentation\eng\Bug.Report.txt.WNCRYT
- C:\Far2\Documentation\eng\Arc.Support.txt.WNCRYT
- C:\Far2\Documentation\eng\TechInfo.txt.WNCRYT
- C:\Far2\Documentation\eng\Plugins.Review.txt.WNCRYT
- C:\Far2\Documentation\eng\Plugins.Install.txt.WNCRYT
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\@Please_Read_Me@.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\@Please_Read_Me@.txt
- %TEMP%\IXP000.TMP\m.vbs
- C:\Documents and Settings\Default User\Templates\powerpnt.ppt.WNCRYT
- C:\Documents and Settings\Default User\Templates\excel4.xls.WNCRYT
- C:\Documents and Settings\Default User\Templates\excel.xls.WNCRYT
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.WNCRYT
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\@Please_Read_Me@.txt
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.WNCRYT
- C:\@WanaDecryptor@.exe
- C:\@Please_Read_Me@.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.WNCRYT
- C:\Documents and Settings\Default User\Templates\winword.doc.WNCRYT
- %HOMEPATH%\Templates\excel.xls.WNCRYT
- <LS_APPDATA>\@WanaDecryptor@.exe.lnk
- <LS_APPDATA>\@Please_Read_Me@.txt
- %HOMEPATH%\Templates\winword.doc.WNCRYT
- %HOMEPATH%\Templates\powerpnt.ppt.WNCRYT
- %HOMEPATH%\Templates\excel4.xls.WNCRYT
- C:\Documents and Settings\Default User\Templates\@WanaDecryptor@.exe
- C:\Documents and Settings\Default User\Templates\@Please_Read_Me@.txt
- C:\Documents and Settings\Default User\Templates\winword2.doc.WNCRYT
- %TEMP%\IXP000.TMP\@WanaDecryptor@.exe.lnk
- %APPDATA%\Microsoft\Internet Explorer\@Please_Read_Me@.txt
- %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.WNCRYT
Sets the 'hidden' attribute to the following files:
- <LS_APPDATA>\CSIDL_X
- <LS_APPDATA>\CSIDL_
Deletes the following files:
- %TEMP%\103.WNCRYT
- %TEMP%\IXP000.TMP\m.vbs
Moves the following files:
- from C:\Far2\PluginSDK\Headers.pas\FarColorW.pas.WNCRYT to C:\Far2\PluginSDK\Headers.pas\FarColorW.pas.WNCRY
- from C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas.WNCRYT to C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.H.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.H.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.H.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.H.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.WNCRY
- from C:\Far2\PluginSDK\Headers.pas\PluginW.pas.WNCRYT to C:\Far2\PluginSDK\Headers.pas\PluginW.pas.WNCRY
- from C:\Documents and Settings\Default User\Templates\sndrec.wav.WNCRYT to C:\Documents and Settings\Default User\Templates\sndrec.wav.WNCRY
- from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.WNCRYT to %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.WNCRY
- from C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRYT to C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRY
- from C:\AUTOEXEC.BAT.WNCRYT to C:\AUTOEXEC.BAT.WNCRY
- from C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak.WNCRYT to C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.WNCRY
- from C:\Far2\Plugins\Colorer\hrc\common.jar.WNCRYT to C:\Far2\Plugins\Colorer\hrc\common.jar.WNCRY
- from C:\Far2\Plugins\Colorer\hrc\auto\types\auto.jar.WNCRYT to C:\Far2\Plugins\Colorer\hrc\auto\types\auto.jar.WNCRY
- from C:\Far2\Addons\Colors\import_colors.bat.WNCRYT to C:\Far2\Addons\Colors\import_colors.bat.WNCRY
- from <LS_APPDATA>\IconCache.db.WNCRYT to <LS_APPDATA>\IconCache.db.WNCRY
- from %HOMEPATH%\Templates\quattro.wb2.WNCRYT to %HOMEPATH%\Templates\quattro.wb2.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.WNCRY
- from <STUBS_DIR>\proc_banks.txt.WNCRYT to <STUBS_DIR>\proc_banks.txt.WNCRY
- from <STUBS_DIR>\proc_browsers.txt.WNCRYT to <STUBS_DIR>\proc_browsers.txt.WNCRY
- from <STUBS_DIR>\proc_av.txt.WNCRYT to <STUBS_DIR>\proc_av.txt.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.WNCRY
- from <STUBS_DIR>\list_short.txt.WNCRYT to <STUBS_DIR>\list_short.txt.WNCRY
- from <STUBS_DIR>\proc_fake.txt.WNCRYT to <STUBS_DIR>\proc_fake.txt.WNCRY
- from <STUBS_DIR>\runall.bat.WNCRYT to <STUBS_DIR>\runall.bat.WNCRY
- from %APPDATA%\tor\state.tmp to %APPDATA%\tor\state
- from <STUBS_DIR>\proc_tools.txt.WNCRYT to <STUBS_DIR>\proc_tools.txt.WNCRY
- from <STUBS_DIR>\proc_games.txt.WNCRYT to <STUBS_DIR>\proc_games.txt.WNCRY
- from <STUBS_DIR>\proc_im.txt.WNCRYT to <STUBS_DIR>\proc_im.txt.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat.WNCRY
- from C:\Far2\ClearPluginsCache.cmd.WNCRYT to C:\Far2\ClearPluginsCache.cmd.WNCRY
- from C:\Far2\RestoreSettings.cmd.WNCRYT to C:\Far2\RestoreSettings.cmd.WNCRY
- from %HOMEPATH%\Templates\sndrec.wav.WNCRYT to %HOMEPATH%\Templates\sndrec.wav.WNCRY
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.WNCRY
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.WNCRY
- from C:\Far2\SaveSettings.cmd.WNCRYT to C:\Far2\SaveSettings.cmd.WNCRY
- from C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat.WNCRYT to C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat.WNCRY
- from C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT.WNCRY
- from C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat.WNCRYT to C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat.WNCRY
- from C:\Far2\Addons\README.TXT.WNCRYT to C:\Far2\Addons\README.TXT.WNCRY
- from C:\Far2\Addons\Colors\export_colors.bat.WNCRYT to C:\Far2\Addons\Colors\export_colors.bat.WNCRY
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.WNCRY
- from %HOMEPATH%\Templates\winword.doc.WNCRYT to %HOMEPATH%\Templates\winword.doc.WNCRY
- from %HOMEPATH%\Templates\winword2.doc.WNCRYT to %HOMEPATH%\Templates\winword2.doc.WNCRY
- from %HOMEPATH%\Templates\powerpnt.ppt.WNCRYT to %HOMEPATH%\Templates\powerpnt.ppt.WNCRY
- from %HOMEPATH%\Templates\excel.xls.WNCRYT to %HOMEPATH%\Templates\excel.xls.WNCRY
- from %HOMEPATH%\Templates\excel4.xls.WNCRYT to %HOMEPATH%\Templates\excel4.xls.WNCRY
- from C:\Far2\Documentation\eng\Arc.Support.txt.WNCRYT to C:\Far2\Documentation\eng\Arc.Support.txt.WNCRY
- from C:\Far2\Documentation\eng\Plugins.Review.txt.WNCRYT to C:\Far2\Documentation\eng\Plugins.Review.txt.WNCRY
- from C:\Far2\Documentation\eng\TechInfo.txt.WNCRYT to C:\Far2\Documentation\eng\TechInfo.txt.WNCRY
- from C:\Far2\Documentation\eng\Plugins.Install.txt.WNCRYT to C:\Far2\Documentation\eng\Plugins.Install.txt.WNCRY
- from C:\Far2\Documentation\eng\Bug.Report.txt.WNCRYT to C:\Far2\Documentation\eng\Bug.Report.txt.WNCRY
- from C:\Far2\Documentation\eng\Far.FAQ.txt.WNCRYT to C:\Far2\Documentation\eng\Far.FAQ.txt.WNCRY
- from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.WNCRYT to %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.WNCRY
- from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.WNCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.WNCRY
- from %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.WNCRYT to %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.WNCRY
- from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.WNCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.WNCRY
- from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.WNCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.WNCRY
- from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.WNCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.WNCRY
- from %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.WNCRYT to %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.WNCRY
- from C:\Documents and Settings\Default User\Templates\winword.doc.WNCRYT to C:\Documents and Settings\Default User\Templates\winword.doc.WNCRY
- from C:\Documents and Settings\Default User\Templates\winword2.doc.WNCRYT to C:\Documents and Settings\Default User\Templates\winword2.doc.WNCRY
- from C:\Documents and Settings\Default User\Templates\powerpnt.ppt.WNCRYT to C:\Documents and Settings\Default User\Templates\powerpnt.ppt.WNCRY
- from C:\Documents and Settings\Default User\Templates\excel.xls.WNCRYT to C:\Documents and Settings\Default User\Templates\excel.xls.WNCRY
- from C:\Documents and Settings\Default User\Templates\excel4.xls.WNCRYT to C:\Documents and Settings\Default User\Templates\excel4.xls.WNCRY
- from C:\Far2\Plugins\FTP\Notes.txt.WNCRYT to C:\Far2\Plugins\FTP\Notes.txt.WNCRY
- from C:\Far2\Plugins\FTP\Notes_rus.txt.WNCRYT to C:\Far2\Plugins\FTP\Notes_rus.txt.WNCRY
- from C:\Far2\Plugins\FTP\FtpCmds_rus.txt.WNCRYT to C:\Far2\Plugins\FTP\FtpCmds_rus.txt.WNCRY
- from C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.WNCRY
- from C:\Far2\Plugins\FTP\FtpCmds.txt.WNCRYT to C:\Far2\Plugins\FTP\FtpCmds.txt.WNCRY
- from <STUBS_DIR>\list_full.txt.WNCRYT to <STUBS_DIR>\list_full.txt.WNCRY
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.WNCRY
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.WNCRY
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.WNCRY
- from C:\startup_local.bat.WNCRYT to C:\startup_local.bat.WNCRY
- from C:\Documents and Settings\Default User\Templates\quattro.wb2.WNCRYT to C:\Documents and Settings\Default User\Templates\quattro.wb2.WNCRY
- from C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.WNCRY
- from C:\Far2\Documentation\rus\Plugins.Install.txt.WNCRYT to C:\Far2\Documentation\rus\Plugins.Install.txt.WNCRY
- from C:\Far2\Documentation\rus\Plugins.Review.txt.WNCRYT to C:\Far2\Documentation\rus\Plugins.Review.txt.WNCRY
- from C:\Far2\Documentation\rus\Far.FAQ.txt.WNCRYT to C:\Far2\Documentation\rus\Far.FAQ.txt.WNCRY
- from C:\Far2\Documentation\rus\Arc.Support.txt.WNCRYT to C:\Far2\Documentation\rus\Arc.Support.txt.WNCRY
- from C:\Far2\Documentation\rus\Bug.Report.txt.WNCRYT to C:\Far2\Documentation\rus\Bug.Report.txt.WNCRY
- from C:\Far2\Documentation\rus\TechInfo.txt.WNCRYT to C:\Far2\Documentation\rus\TechInfo.txt.WNCRY
- from C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.WNCRY
- from C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.WNCRY
- from C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.WNCRY
- from C:\Far2\Plugins\7-Zip\far7z.txt.WNCRYT to C:\Far2\Plugins\7-Zip\far7z.txt.WNCRY
- from C:\Far2\Plugins\Colorer\hrc\changes.txt.WNCRYT to C:\Far2\Plugins\Colorer\hrc\changes.txt.WNCRY
Changes user data files extensions (Trojan.Encoder).
Network activity:
Connects to:
- '19#.#54.238.52':443
- '62.##0.129.246':443
- '17#.#2.197.82':443
- '37.##7.195.87':443
- '19#.#3.244.244':443
- 'localhost':1037
- 'localhost':9050
- '80.##7.137.19':443
- '21#.#1.66.117':9002
- '19#.#09.206.212':443
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: '' WindowName: 'Wana Decrypt0r 2.0'
