Trojan.Encoder.11898

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Update Task Scheduler' = '"<Full path to file>" /r'

Malicious functions:

Executes the following:

'<SYSTEM32>\taskkill.exe' /f /im MSExchange*
'<SYSTEM32>\taskkill.exe' /f /im Microsoft.Exchange.*
'<SYSTEM32>\taskkill.exe' /f /im sqlserver.exe
'<SYSTEM32>\taskkill.exe' /f /im sqlwriter.exe

Modifies file system:

Creates the following files:

<Current directory>\b.wry
C:\Far2\Plugins\TmpPanel\!Please Read Me!.txt
C:\Far2\Plugins\WinSCP\far\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\WinSCP\far\!Please Read Me!.txt
C:\Far2\Plugins\WinSCP\dragext\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\WinSCP\dragext\!Please Read Me!.txt
C:\Far2\Plugins\WinSCP\core\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\WinSCP\core\!Please Read Me!.txt
C:\Far2\Plugins\WinSCP\console\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\WinSCP\console\!Please Read Me!.txt
C:\Far2\Plugins\WinSCP\components\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\WinSCP\components\!Please Read Me!.txt
C:\Far2\Plugins\WinSCP\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\WinSCP\!Please Read Me!.txt
C:\Far2\Plugins\TmpPanel\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\ProcList\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\WinSCP\fari\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\ProcList\!Please Read Me!.txt
C:\Far2\Plugins\Network\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\Network\!Please Read Me!.txt
C:\Far2\Plugins\MacroView\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\MacroView\!Please Read Me!.txt
C:\Far2\Plugins\HlfViewer\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\HlfViewer\!Please Read Me!.txt
C:\Far2\Plugins\FTP\lib\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\FTP\lib\!Please Read Me!.txt
C:\Far2\Plugins\FTP\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\FTP\!Please Read Me!.txt
C:\Far2\Plugins\Compare\!Please Read Me!.txt
C:\Far2\Plugins\WinSCP\filezilla\!Please Read Me!.txt
<STUBS_DIR>\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\WinSCP\windows\!WannaDecryptor!.exe.lnk
C:\Far2\PluginSDK\!Please Read Me!.txt
<STUBS_DIR>\!Please Read Me!.txt
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\!WannaDecryptor!.exe.lnk
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\!Please Read Me!.txt
C:\RECYCLER\!WannaDecryptor!.exe.lnk
C:\RECYCLER\!Please Read Me!.txt
C:\Muldrop\!WannaDecryptor!.exe.lnk
C:\Muldrop\!Please Read Me!.txt
C:\Far2\PluginSDK\Headers.pas\!WannaDecryptor!.exe.lnk
C:\Far2\PluginSDK\Headers.pas\!Please Read Me!.txt
C:\Far2\PluginSDK\Headers.c\!WannaDecryptor!.exe.lnk
C:\Far2\PluginSDK\Headers.c\!Please Read Me!.txt
C:\Far2\PluginSDK\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\FileCase\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\FileCase\!Please Read Me!.txt
C:\Far2\Plugins\WinSCP\filezilla\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\WinSCP\resource\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\WinSCP\resource\!Please Read Me!.txt
C:\Far2\Plugins\WinSCP\release\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\WinSCP\release\!Please Read Me!.txt
C:\Far2\Plugins\WinSCP\putty\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\WinSCP\putty\!Please Read Me!.txt
C:\Far2\Plugins\WinSCP\packages\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\WinSCP\packages\!Please Read Me!.txt
C:\Far2\Plugins\WinSCP\lib\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\WinSCP\lib\!Please Read Me!.txt
C:\Far2\Plugins\WinSCP\forms\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\WinSCP\forms\!Please Read Me!.txt
C:\Far2\Plugins\WinSCP\windows\!Please Read Me!.txt
C:\Far2\Plugins\WinSCP\fari\!Please Read Me!.txt
C:\Far2\Plugins\FarCmds\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\FarCmds\!Please Read Me!.txt
<STUBS_DIR>\360tray\!Please Read Me!.txt
C:\Far2\Addons\XLat\Russian\!Please Read Me!.txt
C:\Far2\Plugins\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\!Please Read Me!.txt
C:\Far2\FExcept\!WannaDecryptor!.exe.lnk
C:\Far2\FExcept\!Please Read Me!.txt
C:\Far2\Encyclopedia\!WannaDecryptor!.exe.lnk
C:\Far2\Encyclopedia\!Please Read Me!.txt
C:\Far2\Documentation\rus\!WannaDecryptor!.exe.lnk
C:\Far2\Documentation\rus\!Please Read Me!.txt
C:\Far2\Documentation\eng\!WannaDecryptor!.exe.lnk
C:\Far2\Documentation\eng\!Please Read Me!.txt
C:\Far2\Documentation\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\Align\!Please Read Me!.txt
C:\Far2\Documentation\!Please Read Me!.txt
C:\Far2\Addons\XLat\Russian\!WannaDecryptor!.exe.lnk
C:\Far2\Addons\XLat\!WannaDecryptor!.exe.lnk
C:\Far2\Addons\XLat\!Please Read Me!.txt
C:\Far2\Addons\Shell\!WannaDecryptor!.exe.lnk
C:\Far2\Addons\Shell\!Please Read Me!.txt
C:\Far2\Addons\SetUp\!WannaDecryptor!.exe.lnk
C:\Far2\Addons\SetUp\!Please Read Me!.txt
C:\Far2\Addons\Macros\!WannaDecryptor!.exe.lnk
C:\Far2\Addons\Macros\!Please Read Me!.txt
C:\Far2\Addons\Colors\Default Highlighting\!WannaDecryptor!.exe.lnk
C:\Far2\Addons\Colors\Default Highlighting\!Please Read Me!.txt
C:\Far2\Addons\Colors\Custom Highlighting\!WannaDecryptor!.exe.lnk
C:\Far2\Addons\Colors\Custom Highlighting\!Please Read Me!.txt
C:\Far2\Plugins\7-Zip\!WannaDecryptor!.exe.lnk
C:\Far2\Addons\Colors\!Please Read Me!.txt
C:\Far2\Plugins\arclite\!Please Read Me!.txt
C:\Far2\Plugins\AutoWrap\!Please Read Me!.txt
C:\Far2\Plugins\ExtSearch\sources\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\Align\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\ExtSearch\sources\!Please Read Me!.txt
C:\Far2\Plugins\ExtSearch\keys\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\ExtSearch\keys\!Please Read Me!.txt
C:\Far2\Plugins\ExtSearch\doc\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\ExtSearch\doc\!Please Read Me!.txt
C:\Far2\Plugins\ExtSearch\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\ExtSearch\!Please Read Me!.txt
C:\Far2\Plugins\EMenu\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\EMenu\!Please Read Me!.txt
C:\Far2\Plugins\EditCase\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\EditCase\!Please Read Me!.txt
C:\Far2\Plugins\arclite\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\DrawLine\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\Compare\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\7-Zip\!Please Read Me!.txt
C:\Far2\Plugins\Colorer\hrd\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\Colorer\hrd\!Please Read Me!.txt
C:\Far2\Plugins\Colorer\hrc\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\Colorer\hrc\!Please Read Me!.txt
C:\Far2\Plugins\Colorer\bin\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\Colorer\bin\!Please Read Me!.txt
C:\Far2\Plugins\Colorer\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\Colorer\!Please Read Me!.txt
C:\Far2\Plugins\Brackets\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\Brackets\!Please Read Me!.txt
C:\Far2\Plugins\AutoWrap\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\DrawLine\!Please Read Me!.txt
C:\Far2\Addons\Colors\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\360tray\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\AVGCTRL\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\firefox\!Please Read Me!.txt
<STUBS_DIR>\el_cli\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\el_cli\!Please Read Me!.txt
<STUBS_DIR>\elementclient\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\elementclient\!Please Read Me!.txt
<STUBS_DIR>\elbank\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\elbank\!Please Read Me!.txt
<STUBS_DIR>\ekrn\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\ekrn\!Please Read Me!.txt
<STUBS_DIR>\egni\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\egni\!Please Read Me!.txt
<STUBS_DIR>\ecmd\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\ecmd\!Please Read Me!.txt
<STUBS_DIR>\Drwebwcl\!Please Read Me!.txt
<STUBS_DIR>\fsav\!Please Read Me!.txt
<STUBS_DIR>\Drwebupw\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\Drwebupw\!Please Read Me!.txt
<STUBS_DIR>\drweb386\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\drweb386\!Please Read Me!.txt
<STUBS_DIR>\Drweb32w\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\Drweb32w\!Please Read Me!.txt
<STUBS_DIR>\drweb\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\drweb\!Please Read Me!.txt
<STUBS_DIR>\dnf\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\dnf\!Please Read Me!.txt
<STUBS_DIR>\dekaron\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\dekaron\!Please Read Me!.txt
<STUBS_DIR>\Drwebwcl\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\clntw32\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\fsav\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\intpro\!Please Read Me!.txt
<STUBS_DIR>\InphaseNXD\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\InphaseNXD\!Please Read Me!.txt
<STUBS_DIR>\inbank-start-ff\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\inbank-start-ff\!Please Read Me!.txt
<STUBS_DIR>\iexplore\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\iexplore\!Please Read Me!.txt
<STUBS_DIR>\ICQ\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\ICQ\!Please Read Me!.txt
<STUBS_DIR>\httplook\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\httplook\!Please Read Me!.txt
<STUBS_DIR>\gw\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\gw\!Please Read Me!.txt
<STUBS_DIR>\contactNG\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\firefox\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\GUARD\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\GUARD\!Please Read Me!.txt
<STUBS_DIR>\googletalk\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\googletalk\!Please Read Me!.txt
<STUBS_DIR>\ge\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\ge\!Please Read Me!.txt
<STUBS_DIR>\gc\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\gc\!Please Read Me!.txt
<STUBS_DIR>\fsavgui\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\fsavgui\!Please Read Me!.txt
<STUBS_DIR>\fsavaui\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\fsavaui\!Please Read Me!.txt
<STUBS_DIR>\fsav32\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\GVOnline\!Please Read Me!.txt
<STUBS_DIR>\fsav32\!Please Read Me!.txt
<STUBS_DIR>\contactNG\!Please Read Me!.txt
<STUBS_DIR>\clntw32\!Please Read Me!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\!Please Read Me!.txt
<STUBS_DIR>\AVP\!Please Read Me!.txt
<STUBS_DIR>\BBClient\!Please Read Me!.txt
<STUBS_DIR>\bankcl\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\bankcl\!Please Read Me!.txt
<STUBS_DIR>\AVSYNMGR\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\AVSYNMGR\!Please Read Me!.txt
<STUBS_DIR>\AVPM\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\AVPM\!Please Read Me!.txt
<STUBS_DIR>\AVPCC\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\AVPCC\!Please Read Me!.txt
<STUBS_DIR>\AVP32\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\AVP32\!Please Read Me!.txt
<STUBS_DIR>\AVP\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\BBClient\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\bclient\!Please Read Me!.txt
<STUBS_DIR>\ageofconan\!Please Read Me!.txt
<STUBS_DIR>\AVGCC32\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\AVGCC32\!Please Read Me!.txt
<STUBS_DIR>\avgcc\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\avgcc\!Please Read Me!.txt
<STUBS_DIR>\ashAvSrv\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\ashAvSrv\!Please Read Me!.txt
<STUBS_DIR>\ashAvast\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\ashAvast\!Please Read Me!.txt
<STUBS_DIR>\ash\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\ash\!Please Read Me!.txt
<STUBS_DIR>\aion\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\aion\!Please Read Me!.txt
<STUBS_DIR>\AVGCTRL\!Please Read Me!.txt
<STUBS_DIR>\ageofconan\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\bclient\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\cbmain\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\cbsmain\!Please Read Me!.txt
<STUBS_DIR>\clmain\!Please Read Me!.txt
<STUBS_DIR>\client7\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\client7\!Please Read Me!.txt
<STUBS_DIR>\clbank\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\clbank\!Please Read Me!.txt
<STUBS_DIR>\ClamWin\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\ClamWin\!Please Read Me!.txt
<STUBS_DIR>\chrome\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\chrome\!Please Read Me!.txt
<STUBS_DIR>\ccapp\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\ccapp\!Please Read Me!.txt
<STUBS_DIR>\cbsmain\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\clmain\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\bc_loader\!Please Read Me!.txt
<STUBS_DIR>\bc_loader\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\cbank\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\cbank\!Please Read Me!.txt
<STUBS_DIR>\cabalmain\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\cabalmain\!Please Read Me!.txt
<STUBS_DIR>\bk\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\bk\!Please Read Me!.txt
<STUBS_DIR>\bdsubmit\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\bdsubmit\!Please Read Me!.txt
<STUBS_DIR>\bdss\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\bdss\!Please Read Me!.txt
<STUBS_DIR>\bdagent\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\bdagent\!Please Read Me!.txt
<STUBS_DIR>\cbmain\!Please Read Me!.txt
C:\Far2\Addons\!WannaDecryptor!.exe.lnk
C:\Far2\Addons\!Please Read Me!.txt
C:\Far2\!WannaDecryptor!.exe.lnk
C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat.WCRYT
C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat.WCRYT
C:\Far2\Addons\Colors\export_colors.bat.WCRYT
C:\Far2\Addons\README.TXT.WCRYT
C:\Far2\SaveSettings.cmd.WCRYT
C:\Far2\RestoreSettings.cmd.WCRYT
C:\Far2\ClearPluginsCache.cmd.WCRYT
%HOMEPATH%\Templates\sndrec.wav.WCRYT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.WCRYT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.WCRYT
C:\Documents and Settings\Default User\Templates\sndrec.wav.WCRYT
C:\AUTOEXEC.BAT.WCRYT
C:\Far2\PluginSDK\Headers.pas\PluginW.pas.WCRYT
C:\Far2\PluginSDK\Headers.pas\FarColorW.pas.WCRYT
<STUBS_DIR>\list_short.txt.WCRYT
C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.H.WCRYT
C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.WCRYT
C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.H.WCRYT
C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.WCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.WCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.WCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.WCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.WCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.WCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.WCRYT
C:\Far2\Plugins\Colorer\hrc\auto\types\auto.jar.WCRYT
C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat.WCRYT
C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas.WCRYT
%ALLUSERSPROFILE%\Favorites\!Please Read Me!.txt
<STUBS_DIR>\proc_av.txt.WCRYT
%ALLUSERSPROFILE%\Documents\My Videos\!WannaDecryptor!.exe.lnk
%ALLUSERSPROFILE%\Documents\My Videos\!Please Read Me!.txt
%ALLUSERSPROFILE%\Documents\My Pictures\!WannaDecryptor!.exe.lnk
%ALLUSERSPROFILE%\Documents\My Pictures\!Please Read Me!.txt
%ALLUSERSPROFILE%\Documents\My Music\!WannaDecryptor!.exe.lnk
%ALLUSERSPROFILE%\Documents\My Music\!Please Read Me!.txt
%ALLUSERSPROFILE%\Documents\!WannaDecryptor!.exe.lnk
%ALLUSERSPROFILE%\Documents\!Please Read Me!.txt
%ALLUSERSPROFILE%\Desktop\!WannaDecryptor!.exe.lnk
%ALLUSERSPROFILE%\Desktop\!Please Read Me!.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\!WannaDecryptor!.exe.lnk
%ALLUSERSPROFILE%\Application Data\Microsoft\!Please Read Me!.txt
C:\Far2\Plugins\Colorer\hrc\common.jar.WCRYT
%ALLUSERSPROFILE%\Application Data\!WannaDecryptor!.exe.lnk
C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.WCRYT
%ALLUSERSPROFILE%\!Please Read Me!.txt
C:\Documents and Settings\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\!Please Read Me!.txt
C:\!WannaDecryptor!.exe.lnk
C:\!Please Read Me!.txt
<STUBS_DIR>\runall.bat.WCRYT
<STUBS_DIR>\proc_tools.txt.WCRYT
<STUBS_DIR>\proc_im.txt.WCRYT
<STUBS_DIR>\proc_games.txt.WCRYT
<STUBS_DIR>\proc_fake.txt.WCRYT
<STUBS_DIR>\proc_browsers.txt.WCRYT
<STUBS_DIR>\proc_banks.txt.WCRYT
%ALLUSERSPROFILE%\Application Data\!Please Read Me!.txt
C:\Far2\Addons\Colors\import_colors.bat.WCRYT
%ALLUSERSPROFILE%\DRM\!Please Read Me!.txt
%HOMEPATH%\Templates\quattro.wb2.WCRYT
<LS_APPDATA>\IconCache.db.WCRYT
%HOMEPATH%\Templates\winword.doc.WCRYT
%ALLUSERSPROFILE%\DRM\!WannaDecryptor!.exe.lnk
%HOMEPATH%\Templates\excel4.xls.WCRYT
%HOMEPATH%\Templates\excel.xls.WCRYT
C:\Documents and Settings\Default User\Templates\winword2.doc.WCRYT
C:\Documents and Settings\Default User\Templates\winword.doc.WCRYT
C:\Documents and Settings\Default User\Templates\powerpnt.ppt.WCRYT
C:\Documents and Settings\Default User\Templates\excel4.xls.WCRYT
C:\Documents and Settings\Default User\Templates\excel.xls.WCRYT
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.WCRYT
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.WCRYT
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.WCRYT
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.WCRYT
%HOMEPATH%\Templates\winword2.doc.WCRYT
C:\Far2\Documentation\eng\Arc.Support.txt.WCRYT
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.WCRYT
<Current directory>\00000000.eky
<Current directory>\00000000.pky
<Current directory>\!Please Read Me!.txt
<Current directory>\!WannaDecryptor!.exe.lnk
<Current directory>\c.vbs
<Current directory>\179151525194244.bat
<Current directory>\!WannaDecryptor!.exe
<Current directory>\u.wry
<Current directory>\t.wry
<Current directory>\r.wry
<Current directory>\m.wry
<Current directory>\c.wry
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.WCRYT
<Current directory>\00000000.res
%ALLUSERSPROFILE%\!WannaDecryptor!.exe.lnk
C:\Far2\Documentation\eng\Far.FAQ.txt.WCRYT
<Current directory>\f.wry
C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.WCRYT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.WCRYT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.WCRYT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.WCRYT
C:\Documents and Settings\Default User\Templates\quattro.wb2.WCRYT
C:\startup_local.bat.WCRYT
<STUBS_DIR>\list_full.txt.WCRYT
C:\Far2\Plugins\FTP\Notes_rus.txt.WCRYT
C:\Far2\Plugins\FTP\Notes.txt.WCRYT
C:\Far2\Plugins\FTP\FtpCmds_rus.txt.WCRYT
C:\Far2\Plugins\FTP\FtpCmds.txt.WCRYT
C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.WCRYT
C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.WCRYT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.WCRYT
C:\Far2\Documentation\eng\Bug.Report.txt.WCRYT
%HOMEPATH%\Templates\powerpnt.ppt.WCRYT
C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.WCRYT
C:\Far2\Plugins\Colorer\hrc\changes.txt.WCRYT
C:\Far2\Plugins\7-Zip\far7z.txt.WCRYT
C:\Far2\Documentation\rus\TechInfo.txt.WCRYT
C:\Far2\Documentation\rus\Plugins.Review.txt.WCRYT
C:\Far2\Documentation\rus\Plugins.Install.txt.WCRYT
C:\Far2\Documentation\rus\Far.FAQ.txt.WCRYT
C:\Far2\Documentation\rus\Bug.Report.txt.WCRYT
C:\Far2\Documentation\rus\Arc.Support.txt.WCRYT
C:\Far2\Documentation\eng\TechInfo.txt.WCRYT
C:\Far2\Documentation\eng\Plugins.Review.txt.WCRYT
C:\Far2\Documentation\eng\Plugins.Install.txt.WCRYT
C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.WCRYT
C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT.WCRYT
%ALLUSERSPROFILE%\Favorites\!WannaDecryptor!.exe.lnk
%HOMEPATH%\Local Settings\!Please Read Me!.txt
%APPDATA%\Identities\!WannaDecryptor!.exe.lnk
%HOMEPATH%\Favorites\Links\!WannaDecryptor!.exe.lnk
%HOMEPATH%\Favorites\Links\!Please Read Me!.txt
%HOMEPATH%\Favorites\!WannaDecryptor!.exe.lnk
%HOMEPATH%\Favorites\!Please Read Me!.txt
%HOMEPATH%\Desktop\!WannaDecryptor!.exe.lnk
%HOMEPATH%\Desktop\!Please Read Me!.txt
%HOMEPATH%\Cookies\!WannaDecryptor!.exe.lnk
%HOMEPATH%\Cookies\!Please Read Me!.txt
%APPDATA%\Mozilla\!WannaDecryptor!.exe.lnk
%APPDATA%\Mozilla\!Please Read Me!.txt
%APPDATA%\Microsoft\!WannaDecryptor!.exe.lnk
%APPDATA%\Microsoft\!Please Read Me!.txt
%ALLUSERSPROFILE%\Start Menu\!Please Read Me!.txt
%HOMEPATH%\Local Settings\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\NetworkService\Cookies\!Please Read Me!.txt
%APPDATA%\!Please Read Me!.txt
%HOMEPATH%\!WannaDecryptor!.exe.lnk
%HOMEPATH%\!Please Read Me!.txt
C:\Documents and Settings\NetworkService\Local Settings\Temp\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\NetworkService\Local Settings\Temp\!Please Read Me!.txt
C:\Documents and Settings\NetworkService\Local Settings\History\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\NetworkService\Local Settings\History\!Please Read Me!.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\NetworkService\Local Settings\Application Data\!Please Read Me!.txt
C:\Documents and Settings\NetworkService\Local Settings\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\NetworkService\Local Settings\!Please Read Me!.txt
C:\Documents and Settings\NetworkService\Cookies\!WannaDecryptor!.exe.lnk
%APPDATA%\!WannaDecryptor!.exe.lnk
%APPDATA%\Identities\!Please Read Me!.txt
<LS_APPDATA>\!Please Read Me!.txt
%HOMEPATH%\NetHood\!Please Read Me!.txt
%HOMEPATH%\NetHood\!WannaDecryptor!.exe.lnk
%HOMEPATH%\Templates\!WannaDecryptor!.exe.lnk
%HOMEPATH%\Templates\!Please Read Me!.txt
%HOMEPATH%\Start Menu\Programs\!WannaDecryptor!.exe.lnk
%HOMEPATH%\Start Menu\Programs\!Please Read Me!.txt
%HOMEPATH%\Start Menu\!WannaDecryptor!.exe.lnk
%HOMEPATH%\Start Menu\!Please Read Me!.txt
%HOMEPATH%\SendTo\!WannaDecryptor!.exe.lnk
%HOMEPATH%\SendTo\!Please Read Me!.txt
%HOMEPATH%\Recent\!WannaDecryptor!.exe.lnk
%HOMEPATH%\Recent\!Please Read Me!.txt
%HOMEPATH%\PrintHood\!WannaDecryptor!.exe.lnk
%HOMEPATH%\PrintHood\!Please Read Me!.txt
C:\Far2\!Please Read Me!.txt
<LS_APPDATA>\!WannaDecryptor!.exe.lnk
%HOMEPATH%\Local Settings\History\!Please Read Me!.txt
%HOMEPATH%\My Documents\My Received Files\!Please Read Me!.txt
%HOMEPATH%\My Documents\My Pictures\!WannaDecryptor!.exe.lnk
%HOMEPATH%\My Documents\My Pictures\!Please Read Me!.txt
%HOMEPATH%\My Documents\My Music\!WannaDecryptor!.exe.lnk
%HOMEPATH%\My Documents\My Music\!Please Read Me!.txt
%HOMEPATH%\My Documents\Downloads\!WannaDecryptor!.exe.lnk
%HOMEPATH%\My Documents\Downloads\!Please Read Me!.txt
%HOMEPATH%\My Documents\!WannaDecryptor!.exe.lnk
%HOMEPATH%\My Documents\!Please Read Me!.txt
%TEMP%\!WannaDecryptor!.exe.lnk
%TEMP%\!Please Read Me!.txt
%HOMEPATH%\Local Settings\History\!WannaDecryptor!.exe.lnk
%HOMEPATH%\My Documents\My Received Files\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\GVOnline\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\intpro\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\NetworkService\Application Data\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\Desktop\!Please Read Me!.txt
C:\Documents and Settings\Default User\My Documents\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\My Documents\!Please Read Me!.txt
C:\Documents and Settings\Default User\Local Settings\Temp\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\Local Settings\Temp\!Please Read Me!.txt
C:\Documents and Settings\Default User\Local Settings\History\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\Local Settings\History\!Please Read Me!.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\Local Settings\Application Data\!Please Read Me!.txt
C:\Documents and Settings\Default User\Local Settings\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\Local Settings\!Please Read Me!.txt
C:\Documents and Settings\Default User\Favorites\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\Favorites\!Please Read Me!.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\!Please Read Me!.txt
C:\Documents and Settings\Default User\NetHood\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\Cookies\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\Cookies\!Please Read Me!.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\Application Data\Microsoft\!Please Read Me!.txt
C:\Documents and Settings\Default User\Application Data\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\Application Data\!Please Read Me!.txt
C:\Documents and Settings\Default User\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\!Please Read Me!.txt
%ALLUSERSPROFILE%\Templates\!WannaDecryptor!.exe.lnk
%ALLUSERSPROFILE%\Templates\!Please Read Me!.txt
%ALLUSERSPROFILE%\Start Menu\Programs\!WannaDecryptor!.exe.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\!Please Read Me!.txt
%ALLUSERSPROFILE%\Start Menu\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\Desktop\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\NetworkService\Application Data\Microsoft\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\PrintHood\!Please Read Me!.txt
C:\Documents and Settings\Default User\Recent\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\PrintHood\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\NetworkService\Application Data\!Please Read Me!.txt
C:\Documents and Settings\NetworkService\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\NetworkService\!Please Read Me!.txt
C:\Documents and Settings\LocalService\Local Settings\Temp\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\LocalService\Local Settings\Temp\!Please Read Me!.txt
C:\Documents and Settings\LocalService\Local Settings\History\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\LocalService\Local Settings\History\!Please Read Me!.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\LocalService\Local Settings\Application Data\!Please Read Me!.txt
C:\Documents and Settings\LocalService\Local Settings\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\LocalService\Local Settings\!Please Read Me!.txt
C:\Documents and Settings\LocalService\Cookies\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\Recent\!Please Read Me!.txt
C:\Documents and Settings\LocalService\Cookies\!Please Read Me!.txt
C:\Documents and Settings\Default User\NetHood\!Please Read Me!.txt
C:\Documents and Settings\LocalService\Application Data\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\LocalService\Application Data\!Please Read Me!.txt
C:\Documents and Settings\LocalService\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\LocalService\!Please Read Me!.txt
C:\Documents and Settings\Default User\Templates\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\Templates\!Please Read Me!.txt
C:\Documents and Settings\Default User\Start Menu\Programs\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\Start Menu\Programs\!Please Read Me!.txt
C:\Documents and Settings\Default User\Start Menu\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\Start Menu\!Please Read Me!.txt
C:\Documents and Settings\Default User\SendTo\!WannaDecryptor!.exe.lnk
C:\Documents and Settings\Default User\SendTo\!Please Read Me!.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\!WannaDecryptor!.exe.lnk
<STUBS_DIR>\iscc\!Please Read Me!.txt

Deletes the following files:

<Current directory>\c.vbs

Moves the following files:

from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.WCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.WCRY
from C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas.WCRYT to C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas.WCRY
from C:\Far2\PluginSDK\Headers.pas\FarColorW.pas.WCRYT to C:\Far2\PluginSDK\Headers.pas\FarColorW.pas.WCRY
from C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.H.WCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.H.WCRY
from C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.WCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.WCRY
from C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.H.WCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.H.WCRY
from C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.WCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.WCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.WCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.WCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.WCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.WCRY
from C:\Far2\PluginSDK\Headers.pas\PluginW.pas.WCRYT to C:\Far2\PluginSDK\Headers.pas\PluginW.pas.WCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.WCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.WCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.WCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.WCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.WCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.WCRY
from C:\Far2\Plugins\Colorer\hrc\auto\types\auto.jar.WCRYT to C:\Far2\Plugins\Colorer\hrc\auto\types\auto.jar.WCRY
from C:\Far2\Plugins\Colorer\hrc\common.jar.WCRYT to C:\Far2\Plugins\Colorer\hrc\common.jar.WCRY
from C:\Far2\Addons\Colors\import_colors.bat.WCRYT to C:\Far2\Addons\Colors\import_colors.bat.WCRY
from %HOMEPATH%\Templates\quattro.wb2.WCRYT to %HOMEPATH%\Templates\quattro.wb2.WCRY
from <LS_APPDATA>\IconCache.db.WCRYT to <LS_APPDATA>\IconCache.db.WCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.WCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.WCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.WCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.WCRY
from C:\AUTOEXEC.BAT.WCRYT to C:\AUTOEXEC.BAT.WCRY
from C:\Documents and Settings\Default User\Templates\sndrec.wav.WCRYT to C:\Documents and Settings\Default User\Templates\sndrec.wav.WCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.WCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.WCRY
from <STUBS_DIR>\proc_im.txt.WCRYT to <STUBS_DIR>\proc_im.txt.WCRY
from <STUBS_DIR>\proc_games.txt.WCRYT to <STUBS_DIR>\proc_games.txt.WCRY
from <STUBS_DIR>\proc_fake.txt.WCRYT to <STUBS_DIR>\proc_fake.txt.WCRY
from <STUBS_DIR>\proc_browsers.txt.WCRYT to <STUBS_DIR>\proc_browsers.txt.WCRY
from <STUBS_DIR>\proc_banks.txt.WCRYT to <STUBS_DIR>\proc_banks.txt.WCRY
from <STUBS_DIR>\proc_av.txt.WCRYT to <STUBS_DIR>\proc_av.txt.WCRY
from <STUBS_DIR>\list_short.txt.WCRYT to <STUBS_DIR>\list_short.txt.WCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.WCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.WCRY
from C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat.WCRYT to C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat.WCRY
from C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT.WCRYT to C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT.WCRY
from C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat.WCRYT to C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat.WCRY
from C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat.WCRYT to C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat.WCRY
from C:\Far2\Addons\Colors\export_colors.bat.WCRYT to C:\Far2\Addons\Colors\export_colors.bat.WCRY
from C:\Far2\Addons\README.TXT.WCRYT to C:\Far2\Addons\README.TXT.WCRY
from C:\Far2\SaveSettings.cmd.WCRYT to C:\Far2\SaveSettings.cmd.WCRY
from C:\Far2\RestoreSettings.cmd.WCRYT to C:\Far2\RestoreSettings.cmd.WCRY
from C:\Far2\ClearPluginsCache.cmd.WCRYT to C:\Far2\ClearPluginsCache.cmd.WCRY
from %HOMEPATH%\Templates\sndrec.wav.WCRYT to %HOMEPATH%\Templates\sndrec.wav.WCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.WCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.WCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.WCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.WCRY
from <STUBS_DIR>\proc_tools.txt.WCRYT to <STUBS_DIR>\proc_tools.txt.WCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.WCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.WCRY
from C:\Documents and Settings\Default User\Templates\quattro.wb2.WCRYT to C:\Documents and Settings\Default User\Templates\quattro.wb2.WCRY
from C:\Far2\Documentation\eng\Bug.Report.txt.WCRYT to C:\Far2\Documentation\eng\Bug.Report.txt.WCRY
from C:\Far2\Documentation\eng\Arc.Support.txt.WCRYT to C:\Far2\Documentation\eng\Arc.Support.txt.WCRY
from %HOMEPATH%\Templates\winword2.doc.WCRYT to %HOMEPATH%\Templates\winword2.doc.WCRY
from %HOMEPATH%\Templates\winword.doc.WCRYT to %HOMEPATH%\Templates\winword.doc.WCRY
from %HOMEPATH%\Templates\powerpnt.ppt.WCRYT to %HOMEPATH%\Templates\powerpnt.ppt.WCRY
from %HOMEPATH%\Templates\excel4.xls.WCRYT to %HOMEPATH%\Templates\excel4.xls.WCRY
from C:\Documents and Settings\Default User\Templates\excel.xls to %TEMP%\0.WCRYT
from %HOMEPATH%\Templates\excel.xls.WCRYT to %HOMEPATH%\Templates\excel.xls.WCRY
from C:\Far2\Documentation\eng\Far.FAQ.txt.WCRYT to C:\Far2\Documentation\eng\Far.FAQ.txt.WCRY
from C:\Documents and Settings\Default User\Templates\winword2.doc.WCRYT to C:\Documents and Settings\Default User\Templates\winword2.doc.WCRY
from C:\Documents and Settings\Default User\Templates\powerpnt.ppt.WCRYT to C:\Documents and Settings\Default User\Templates\powerpnt.ppt.WCRY
from C:\Documents and Settings\Default User\Templates\excel4.xls.WCRYT to C:\Documents and Settings\Default User\Templates\excel4.xls.WCRY
from C:\Documents and Settings\Default User\Templates\excel.xls.WCRYT to C:\Documents and Settings\Default User\Templates\excel.xls.WCRY
from %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.WCRYT to %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.WCRY
from %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.WCRYT to %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.WCRY
from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.WCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.WCRY
from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.WCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.WCRY
from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.WCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.WCRY
from C:\Documents and Settings\Default User\Templates\winword.doc.WCRYT to C:\Documents and Settings\Default User\Templates\winword.doc.WCRY
from C:\Far2\Documentation\eng\Plugins.Install.txt.WCRYT to C:\Far2\Documentation\eng\Plugins.Install.txt.WCRY
from C:\Far2\Documentation\eng\Plugins.Review.txt.WCRYT to C:\Far2\Documentation\eng\Plugins.Review.txt.WCRY
from C:\Far2\Documentation\eng\TechInfo.txt.WCRYT to C:\Far2\Documentation\eng\TechInfo.txt.WCRY
from C:\startup_local.bat.WCRYT to C:\startup_local.bat.WCRY
from <STUBS_DIR>\list_full.txt.WCRYT to <STUBS_DIR>\list_full.txt.WCRY
from C:\Far2\Plugins\FTP\Notes_rus.txt.WCRYT to C:\Far2\Plugins\FTP\Notes_rus.txt.WCRY
from C:\Far2\Plugins\FTP\Notes.txt.WCRYT to C:\Far2\Plugins\FTP\Notes.txt.WCRY
from C:\Far2\Plugins\FTP\FtpCmds_rus.txt.WCRYT to C:\Far2\Plugins\FTP\FtpCmds_rus.txt.WCRY
from C:\Far2\Plugins\FTP\FtpCmds.txt.WCRYT to C:\Far2\Plugins\FTP\FtpCmds.txt.WCRY
from C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.WCRYT to C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.WCRY
from C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.WCRYT to C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.WCRY
from C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.WCRYT to C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.WCRY
from C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.WCRYT to C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.WCRY
from C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.WCRYT to C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.WCRY
from C:\Far2\Plugins\Colorer\hrc\changes.txt.WCRYT to C:\Far2\Plugins\Colorer\hrc\changes.txt.WCRY
from C:\Far2\Plugins\7-Zip\far7z.txt.WCRYT to C:\Far2\Plugins\7-Zip\far7z.txt.WCRY
from C:\Far2\Documentation\rus\TechInfo.txt.WCRYT to C:\Far2\Documentation\rus\TechInfo.txt.WCRY
from C:\Far2\Documentation\rus\Plugins.Review.txt.WCRYT to C:\Far2\Documentation\rus\Plugins.Review.txt.WCRY
from C:\Far2\Documentation\rus\Plugins.Install.txt.WCRYT to C:\Far2\Documentation\rus\Plugins.Install.txt.WCRY
from C:\Far2\Documentation\rus\Far.FAQ.txt.WCRYT to C:\Far2\Documentation\rus\Far.FAQ.txt.WCRY
from C:\Far2\Documentation\rus\Bug.Report.txt.WCRYT to C:\Far2\Documentation\rus\Bug.Report.txt.WCRY
from C:\Far2\Documentation\rus\Arc.Support.txt.WCRYT to C:\Far2\Documentation\rus\Arc.Support.txt.WCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.WCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.WCRY
from <STUBS_DIR>\runall.bat.WCRYT to <STUBS_DIR>\runall.bat.WCRY

Changes user data files extensions (Trojan.Encoder).

Network activity:

Connects to:

'localhost':9050
'localhost':9150
'localhost':1038
'dr##box.com':443
'di##.#orproject.org':443

UDP:

DNS ASK www.dr##box.com
DNS ASK di##.#orproject.org

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'Wanna Decryptor 1.0'
ClassName: '' WindowName: ''

Creates and executes the following:

'<Current directory>\!WannaDecryptor!.exe' f

Executes the following:

'<SYSTEM32>\cmd.exe' /c 179151525194244.bat
'<SYSTEM32>\cscript.exe' //nologo c.vbs

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial