Trojan.Encoder.15138

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'falrqtcr472' = '"<Current directory>\tasksche.exe"'

Malicious functions:

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Creates and executes the following:

'<Current directory>\taskse.exe' <Current directory>\@WanaDecryptor@.exe
'<Current directory>\@WanaDecryptor@.exe'
'<Current directory>\TaskData\Tor\taskhsvc.exe'
'<Current directory>\taskdl.exe'
'<Current directory>\@WanaDecryptor@.exe' co
'<Current directory>\@WanaDecryptor@.exe' vs

Executes the following:

'<SYSTEM32>\taskkill.exe' /f /im MSExchange*
'<SYSTEM32>\taskkill.exe' /f /im Microsoft.Exchange.*
'<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...
'<SYSTEM32>\taskkill.exe' /f /im mysqld.exe
'<SYSTEM32>\taskkill.exe' /f /im sqlwriter.exe
'<SYSTEM32>\taskkill.exe' /f /im sqlserver.exe
'<SYSTEM32>\cscript.exe' //nologo m.vbs
'<SYSTEM32>\cmd.exe' /c 88651510161498.bat
'<SYSTEM32>\attrib.exe' +h .
'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "falrqtcr472" /t REG_SZ /d "\"<Current directory>\tasksche.exe\"" /f
'<SYSTEM32>\cmd.exe' /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "falrqtcr472" /t REG_SZ /d "\"<Current directory>\tasksche.exe\"" /f
'<SYSTEM32>\cmd.exe' /c start /b @WanaDecryptor@.exe vs

Modifies file system:

Creates the following files:

%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.WNCRYT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.WNCRYT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.WNCRYT
%HOMEPATH%\Templates\quattro.wb2.WNCRYT
<LS_APPDATA>\IconCache.db.WNCRYT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.WNCRYT
<STUBS_DIR>\@Please_Read_Me@.txt
<STUBS_DIR>\list_full.txt.WNCRYT
C:\Far2\PluginSDK\Headers.pas\@WanaDecryptor@.exe
C:\Documents and Settings\Default User\Templates\quattro.wb2.WNCRYT
C:\startup_local.bat.WNCRYT
<STUBS_DIR>\@WanaDecryptor@.exe
C:\Far2\Addons\Colors\import_colors.bat.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.WNCRYT
<Current directory>\f.wnry
C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.H.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.WNCRYT
C:\Far2\Plugins\Colorer\hrc\auto\types\auto.jar.WNCRYT
C:\Far2\Plugins\Colorer\hrc\common.jar.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.WNCRYT
C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.WNCRYT
C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.WNCRYT
C:\Far2\Plugins\Colorer\hrc\@WanaDecryptor@.exe.lnk
C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.WNCRYT
C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.WNCRYT
C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.WNCRYT
C:\Far2\Plugins\7-Zip\@Please_Read_Me@.txt
C:\Far2\Plugins\7-Zip\far7z.txt.WNCRYT
C:\Far2\Documentation\rus\@WanaDecryptor@.exe
C:\Far2\Plugins\Colorer\hrc\@Please_Read_Me@.txt
C:\Far2\Plugins\Colorer\hrc\changes.txt.WNCRYT
C:\Far2\Plugins\7-Zip\@WanaDecryptor@.exe
C:\Far2\Plugins\ExtSearch\doc\@Please_Read_Me@.txt
C:\Far2\Plugins\FTP\Notes_rus.txt.WNCRYT
C:\Far2\Plugins\FTP\Notes.txt.WNCRYT
C:\Far2\Plugins\FTP\FtpCmds_rus.txt.WNCRYT
C:\Far2\PluginSDK\Headers.pas\@Please_Read_Me@.txt
C:\Far2\Plugins\FTP\@WanaDecryptor@.exe
C:\Far2\Plugins\FTP\@Please_Read_Me@.txt
C:\Far2\Plugins\ExtSearch\sources\@WanaDecryptor@.exe.lnk
C:\Far2\Plugins\ExtSearch\sources\@Please_Read_Me@.txt
C:\Far2\Plugins\ExtSearch\doc\@WanaDecryptor@.exe.lnk
C:\Far2\Plugins\FTP\FtpCmds.txt.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\RegExp\@WanaDecryptor@.exe.lnk
C:\Far2\Plugins\ExtSearch\sources\RegExp\@Please_Read_Me@.txt
%ALLUSERSPROFILE%\Desktop\@WanaDecryptor@.bmp
<STUBS_DIR>\runall.bat.WNCRYT
<STUBS_DIR>\proc_tools.txt.WNCRYT
C:\Documents and Settings\Default User\Desktop\@WanaDecryptor@.exe
C:\Documents and Settings\Default User\Desktop\@WanaDecryptor@.bmp
%ALLUSERSPROFILE%\Desktop\@WanaDecryptor@.exe
<STUBS_DIR>\proc_browsers.txt.WNCRYT
<STUBS_DIR>\proc_banks.txt.WNCRYT
<STUBS_DIR>\proc_av.txt.WNCRYT
<STUBS_DIR>\proc_im.txt.WNCRYT
<STUBS_DIR>\proc_games.txt.WNCRYT
<STUBS_DIR>\proc_fake.txt.WNCRYT
%HOMEPATH%\Desktop\@WanaDecryptor@.bmp
<Current directory>\TaskData\Tor\tor.exe
<Current directory>\TaskData\Tor\ssleay32.dll
<Current directory>\TaskData\Tor\libssp-0.dll
%APPDATA%\tor\state.tmp
<Current directory>\TaskData\Tor\taskhsvc.exe
<Current directory>\TaskData\Tor\zlib1.dll
<Current directory>\TaskData\Tor\libevent-2-0-5.dll
<Current directory>\TaskData\Tor\libeay32.dll
%HOMEPATH%\Desktop\@WanaDecryptor@.exe
<Current directory>\TaskData\Tor\libgcc_s_sjlj-1.dll
<Current directory>\TaskData\Tor\libevent_extra-2-0-5.dll
<Current directory>\TaskData\Tor\libevent_core-2-0-5.dll
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRYT
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak.WNCRYT
<Current directory>\m.vbs.WNCRYT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.WNCRYT
%APPDATA%\Microsoft\Internet Explorer\brndlog.bak.WNCRYT
C:\Documents and Settings\Default User\Templates\sndrec.wav.WNCRYT
C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas.WNCRYT
C:\Far2\PluginSDK\Headers.pas\FarColorW.pas.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.H.WNCRYT
<Current directory>\88651510161498.bat.WNCRYT
C:\AUTOEXEC.BAT.WNCRYT
C:\Far2\PluginSDK\Headers.pas\PluginW.pas.WNCRYT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT.WNCRYT
C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat.WNCRYT
C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat.WNCRYT
<STUBS_DIR>\list_short.txt.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat.WNCRYT
C:\Far2\RestoreSettings.cmd.WNCRYT
C:\Far2\ClearPluginsCache.cmd.WNCRYT
%HOMEPATH%\Templates\sndrec.wav.WNCRYT
C:\Far2\Addons\Colors\export_colors.bat.WNCRYT
C:\Far2\Addons\README.TXT.WNCRYT
C:\Far2\SaveSettings.cmd.WNCRYT
<Current directory>\taskdl.exe
<Current directory>\t.wnry
<Current directory>\s.wnry
<Current directory>\00000000.pky
<Current directory>\u.wnry
<Current directory>\taskse.exe
<Current directory>\msg\m_swedish.wnry
<Current directory>\msg\m_spanish.wnry
<Current directory>\msg\m_slovak.wnry
<Current directory>\r.wnry
<Current directory>\msg\m_vietnamese.wnry
<Current directory>\msg\m_turkish.wnry
<Current directory>\00000000.eky
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.WNCRYT
<Current directory>\m.vbs
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.WNCRYT
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.WNCRYT
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\@Please_Read_Me@.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.WNCRYT
<Current directory>\88651510161498.bat
<Current directory>\@WanaDecryptor@.exe
<Current directory>\00000000.res
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.WNCRYT
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\@Please_Read_Me@.txt
<Current directory>\@Please_Read_Me@.txt
<Current directory>\msg\m_dutch.wnry
<Current directory>\msg\m_danish.wnry
<Current directory>\msg\m_czech.wnry
<Current directory>\msg\m_finnish.wnry
<Current directory>\msg\m_filipino.wnry
<Current directory>\msg\m_english.wnry
<Current directory>\msg\m_bulgarian.wnry
<Current directory>\c.wnry
<Current directory>\b.wnry
<Current directory>\msg\m_croatian.wnry
<Current directory>\msg\m_chinese (traditional).wnry
<Current directory>\msg\m_chinese (simplified).wnry
<Current directory>\msg\m_french.wnry
<Current directory>\msg\m_polish.wnry
<Current directory>\msg\m_norwegian.wnry
<Current directory>\msg\m_latvian.wnry
<Current directory>\msg\m_russian.wnry
<Current directory>\msg\m_romanian.wnry
<Current directory>\msg\m_portuguese.wnry
<Current directory>\msg\m_indonesian.wnry
<Current directory>\msg\m_greek.wnry
<Current directory>\msg\m_german.wnry
<Current directory>\msg\m_korean.wnry
<Current directory>\msg\m_japanese.wnry
<Current directory>\msg\m_italian.wnry
C:\Far2\Addons\Colors\Default Highlighting\@Please_Read_Me@.txt
C:\Far2\Addons\Colors\Custom Highlighting\@WanaDecryptor@.exe.lnk
C:\Far2\Addons\Colors\Custom Highlighting\@Please_Read_Me@.txt
C:\Far2\Documentation\eng\Bug.Report.txt.WNCRYT
C:\Far2\Documentation\eng\Arc.Support.txt.WNCRYT
C:\Far2\Addons\Colors\Default Highlighting\@WanaDecryptor@.exe.lnk
C:\Far2\Addons\@Please_Read_Me@.txt
C:\Far2\@WanaDecryptor@.exe
C:\Far2\@Please_Read_Me@.txt
C:\Far2\Addons\Colors\@WanaDecryptor@.exe
C:\Far2\Addons\Colors\@Please_Read_Me@.txt
C:\Far2\Addons\@WanaDecryptor@.exe
C:\Far2\Documentation\eng\Far.FAQ.txt.WNCRYT
C:\Far2\Documentation\rus\Plugins.Install.txt.WNCRYT
C:\Far2\Documentation\rus\Far.FAQ.txt.WNCRYT
C:\Far2\Documentation\rus\Bug.Report.txt.WNCRYT
C:\Far2\Documentation\rus\@Please_Read_Me@.txt
C:\Far2\Documentation\rus\TechInfo.txt.WNCRYT
C:\Far2\Documentation\rus\Plugins.Review.txt.WNCRYT
C:\Far2\Documentation\eng\TechInfo.txt.WNCRYT
C:\Far2\Documentation\eng\Plugins.Review.txt.WNCRYT
C:\Far2\Documentation\eng\Plugins.Install.txt.WNCRYT
C:\Far2\Documentation\rus\Arc.Support.txt.WNCRYT
C:\Far2\Documentation\eng\@WanaDecryptor@.exe
C:\Far2\Documentation\eng\@Please_Read_Me@.txt
C:\Documents and Settings\Default User\Templates\powerpnt.ppt.WNCRYT
C:\Documents and Settings\Default User\Templates\excel4.xls.WNCRYT
<Current directory>\@WanaDecryptor@.exe.lnk
C:\Documents and Settings\Default User\Templates\@Please_Read_Me@.txt
C:\Documents and Settings\Default User\Templates\winword2.doc.WNCRYT
C:\Documents and Settings\Default User\Templates\winword.doc.WNCRYT
C:\@WanaDecryptor@.exe
C:\@Please_Read_Me@.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.WNCRYT
C:\Documents and Settings\Default User\Templates\excel.xls.WNCRYT
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\@Please_Read_Me@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\@Please_Read_Me@.txt
C:\Documents and Settings\Default User\Templates\@WanaDecryptor@.exe
%HOMEPATH%\Templates\winword.doc.WNCRYT
%HOMEPATH%\Templates\powerpnt.ppt.WNCRYT
%HOMEPATH%\Templates\excel4.xls.WNCRYT
%HOMEPATH%\Templates\@WanaDecryptor@.exe
%HOMEPATH%\Templates\@Please_Read_Me@.txt
%HOMEPATH%\Templates\winword2.doc.WNCRYT
%APPDATA%\Microsoft\Internet Explorer\@WanaDecryptor@.exe.lnk
%APPDATA%\Microsoft\Internet Explorer\@Please_Read_Me@.txt
%APPDATA%\Microsoft\Internet Explorer\brndlog.txt.WNCRYT
%HOMEPATH%\Templates\excel.xls.WNCRYT
<LS_APPDATA>\@WanaDecryptor@.exe.lnk
<LS_APPDATA>\@Please_Read_Me@.txt

Deletes the following files:

<Current directory>\m.vbs

Moves the following files:

from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp to %TEMP%\51.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp to %TEMP%\50.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp to %TEMP%\49.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp to %TEMP%\54.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp to %TEMP%\53.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp to %TEMP%\52.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp to %TEMP%\48.WNCRYT
from <STUBS_DIR>\list_full.txt to %TEMP%\44.WNCRYT
from C:\Far2\Plugins\FTP\Notes_rus.txt to %TEMP%\43.WNCRYT
from C:\Far2\Plugins\FTP\Notes.txt to %TEMP%\42.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp to %TEMP%\47.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp to %TEMP%\46.WNCRYT
from C:\startup_local.bat to %TEMP%\45.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp to %TEMP%\64.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp to %TEMP%\63.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp to %TEMP%\62.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp to %TEMP%\67.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp to %TEMP%\66.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp to %TEMP%\65.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp to %TEMP%\61.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp to %TEMP%\57.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp to %TEMP%\56.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp to %TEMP%\55.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp to %TEMP%\60.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp to %TEMP%\59.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp to %TEMP%\58.WNCRYT
from C:\Far2\Plugins\FTP\FtpCmds_rus.txt to %TEMP%\41.WNCRYT
from C:\Far2\Documentation\eng\Plugins.Install.txt to %TEMP%\24.WNCRYT
from C:\Far2\Documentation\eng\Far.FAQ.txt to %TEMP%\23.WNCRYT
from C:\Far2\Documentation\eng\Bug.Report.txt to %TEMP%\22.WNCRYT
from C:\Far2\Documentation\rus\Arc.Support.txt to %TEMP%\27.WNCRYT
from C:\Far2\Documentation\eng\TechInfo.txt to %TEMP%\26.WNCRYT
from C:\Far2\Documentation\eng\Plugins.Review.txt to %TEMP%\25.WNCRYT
from C:\Far2\Documentation\eng\Arc.Support.txt to %TEMP%\21.WNCRYT
from %HOMEPATH%\Templates\excel4.xls to %TEMP%\17.WNCRYT
from %HOMEPATH%\Templates\excel.xls to %TEMP%\16.WNCRYT
from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt to %TEMP%\15.WNCRYT
from %HOMEPATH%\Templates\winword2.doc to %TEMP%\20.WNCRYT
from %HOMEPATH%\Templates\winword.doc to %TEMP%\19.WNCRYT
from %HOMEPATH%\Templates\powerpnt.ppt to %TEMP%\18.WNCRYT
from C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT to %TEMP%\37.WNCRYT
from C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT to %TEMP%\36.WNCRYT
from C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT to %TEMP%\35.WNCRYT
from C:\Far2\Plugins\FTP\FtpCmds.txt to %TEMP%\40.WNCRYT
from C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT to %TEMP%\39.WNCRYT
from C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT to %TEMP%\38.WNCRYT
from C:\Far2\Plugins\Colorer\hrc\changes.txt to %TEMP%\34.WNCRYT
from C:\Far2\Documentation\rus\Plugins.Install.txt to %TEMP%\30.WNCRYT
from C:\Far2\Documentation\rus\Far.FAQ.txt to %TEMP%\29.WNCRYT
from C:\Far2\Documentation\rus\Bug.Report.txt to %TEMP%\28.WNCRYT
from C:\Far2\Plugins\7-Zip\far7z.txt to %TEMP%\33.WNCRYT
from C:\Far2\Documentation\rus\TechInfo.txt to %TEMP%\32.WNCRYT
from C:\Far2\Documentation\rus\Plugins.Review.txt to %TEMP%\31.WNCRYT
from C:\Far2\SaveSettings.cmd to %TEMP%\108.WNCRYT
from C:\Far2\RestoreSettings.cmd to %TEMP%\107.WNCRYT
from C:\Far2\ClearPluginsCache.cmd to %TEMP%\106.WNCRYT
from C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat to %TEMP%\111.WNCRYT
from C:\Far2\Addons\Colors\export_colors.bat to %TEMP%\110.WNCRYT
from C:\Far2\Addons\README.TXT to %TEMP%\109.WNCRYT
from %HOMEPATH%\Templates\sndrec.wav to %TEMP%\105.WNCRYT
from C:\Documents and Settings\Default User\Templates\sndrec.wav to %TEMP%\101.WNCRYT
from C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt to %TEMP%\100.WNCRYT
from C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak to %TEMP%\99.WNCRYT
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js to %TEMP%\104.WNCRYT
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak to %TEMP%\103.WNCRYT
from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak to %TEMP%\102.WNCRYT
from <STUBS_DIR>\proc_games.txt to %TEMP%\121.WNCRYT
from <STUBS_DIR>\proc_fake.txt to %TEMP%\120.WNCRYT
from <STUBS_DIR>\proc_browsers.txt to %TEMP%\119.WNCRYT
from <STUBS_DIR>\runall.bat to %TEMP%\124.WNCRYT
from <STUBS_DIR>\proc_tools.txt to %TEMP%\123.WNCRYT
from <STUBS_DIR>\proc_im.txt to %TEMP%\122.WNCRYT
from <STUBS_DIR>\proc_banks.txt to %TEMP%\118.WNCRYT
from C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat to %TEMP%\114.WNCRYT
from C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT to %TEMP%\113.WNCRYT
from C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat to %TEMP%\112.WNCRYT
from <STUBS_DIR>\proc_av.txt to %TEMP%\117.WNCRYT
from <STUBS_DIR>\list_short.txt to %TEMP%\116.WNCRYT
from C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp to %TEMP%\115.WNCRYT
from C:\AUTOEXEC.BAT to %TEMP%\96.WNCRYT
from %HOMEPATH%\Templates\quattro.wb2 to %TEMP%\79.WNCRYT
from <LS_APPDATA>\IconCache.db to %TEMP%\78.WNCRYT
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %TEMP%\77.WNCRYT
from C:\Far2\Plugins\Colorer\hrc\auto\types\auto.jar to %TEMP%\82.WNCRYT
from C:\Far2\Plugins\Colorer\hrc\common.jar to %TEMP%\81.WNCRYT
from C:\Far2\Addons\Colors\import_colors.bat to %TEMP%\80.WNCRYT
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js to %TEMP%\76.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp to %TEMP%\70.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp to %TEMP%\69.WNCRYT
from %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp to %TEMP%\68.WNCRYT
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %TEMP%\75.WNCRYT
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %TEMP%\74.WNCRYT
from C:\Documents and Settings\Default User\Templates\quattro.wb2 to %TEMP%\73.WNCRYT
from C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.H to %TEMP%\92.WNCRYT
from C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP to %TEMP%\91.WNCRYT
from C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.H to %TEMP%\90.WNCRYT
from C:\Far2\PluginSDK\Headers.pas\PluginW.pas to %TEMP%\95.WNCRYT
from C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas to %TEMP%\94.WNCRYT
from C:\Far2\PluginSDK\Headers.pas\FarColorW.pas to %TEMP%\93.WNCRYT
from C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP to %TEMP%\89.WNCRYT
from C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp to %TEMP%\85.WNCRYT
from C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp to %TEMP%\84.WNCRYT
from C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp to %TEMP%\83.WNCRYT
from C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp to %TEMP%\88.WNCRYT
from C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp to %TEMP%\87.WNCRYT
from C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp to %TEMP%\86.WNCRYT
from C:\Far2\Plugins\FTP\FtpCmds.txt.WNCRYT to C:\Far2\Plugins\FTP\FtpCmds.txt.WNCRY
from C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.WNCRY
from C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.WNCRY
from C:\Far2\Plugins\FTP\Notes_rus.txt.WNCRYT to C:\Far2\Plugins\FTP\Notes_rus.txt.WNCRY
from C:\Far2\Plugins\FTP\Notes.txt.WNCRYT to C:\Far2\Plugins\FTP\Notes.txt.WNCRY
from C:\Far2\Plugins\FTP\FtpCmds_rus.txt.WNCRYT to C:\Far2\Plugins\FTP\FtpCmds_rus.txt.WNCRY
from C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.WNCRY
from C:\Far2\Plugins\7-Zip\far7z.txt.WNCRYT to C:\Far2\Plugins\7-Zip\far7z.txt.WNCRY
from C:\Far2\Documentation\rus\TechInfo.txt.WNCRYT to C:\Far2\Documentation\rus\TechInfo.txt.WNCRY
from C:\Far2\Documentation\rus\Plugins.Review.txt.WNCRYT to C:\Far2\Documentation\rus\Plugins.Review.txt.WNCRY
from C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.WNCRY
from C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.WNCRY
from C:\Far2\Plugins\Colorer\hrc\changes.txt.WNCRYT to C:\Far2\Plugins\Colorer\hrc\changes.txt.WNCRY
from C:\Far2\Addons\Colors\import_colors.bat.WNCRYT to C:\Far2\Addons\Colors\import_colors.bat.WNCRY
from %HOMEPATH%\Templates\quattro.wb2.WNCRYT to %HOMEPATH%\Templates\quattro.wb2.WNCRY
from <LS_APPDATA>\IconCache.db.WNCRYT to <LS_APPDATA>\IconCache.db.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.WNCRY
from C:\Far2\Plugins\Colorer\hrc\auto\types\auto.jar.WNCRYT to C:\Far2\Plugins\Colorer\hrc\auto\types\auto.jar.WNCRY
from C:\Far2\Plugins\Colorer\hrc\common.jar.WNCRYT to C:\Far2\Plugins\Colorer\hrc\common.jar.WNCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.WNCRY
from C:\Documents and Settings\Default User\Templates\quattro.wb2.WNCRYT to C:\Documents and Settings\Default User\Templates\quattro.wb2.WNCRY
from C:\startup_local.bat.WNCRYT to C:\startup_local.bat.WNCRY
from <STUBS_DIR>\list_full.txt.WNCRYT to <STUBS_DIR>\list_full.txt.WNCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.WNCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.WNCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.WNCRY
from C:\Far2\Documentation\rus\Plugins.Install.txt.WNCRYT to C:\Far2\Documentation\rus\Plugins.Install.txt.WNCRY
from C:\Documents and Settings\Default User\Templates\winword.doc.WNCRYT to C:\Documents and Settings\Default User\Templates\winword.doc.WNCRY
from C:\Documents and Settings\Default User\Templates\powerpnt.ppt.WNCRYT to C:\Documents and Settings\Default User\Templates\powerpnt.ppt.WNCRY
from C:\Documents and Settings\Default User\Templates\excel4.xls.WNCRYT to C:\Documents and Settings\Default User\Templates\excel4.xls.WNCRY
from %HOMEPATH%\Templates\excel.xls.WNCRYT to %HOMEPATH%\Templates\excel.xls.WNCRY
from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.WNCRYT to %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.WNCRY
from C:\Documents and Settings\Default User\Templates\winword2.doc.WNCRYT to C:\Documents and Settings\Default User\Templates\winword2.doc.WNCRY
from C:\Documents and Settings\Default User\Templates\excel.xls.WNCRYT to C:\Documents and Settings\Default User\Templates\excel.xls.WNCRY
from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.WNCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.WNCRY
from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.WNCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.WNCRY
from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.WNCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.WNCRY
from %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.WNCRYT to %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.WNCRY
from %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.WNCRYT to %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.WNCRY
from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.WNCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.WNCRY
from C:\Far2\Documentation\eng\TechInfo.txt.WNCRYT to C:\Far2\Documentation\eng\TechInfo.txt.WNCRY
from C:\Far2\Documentation\eng\Plugins.Review.txt.WNCRYT to C:\Far2\Documentation\eng\Plugins.Review.txt.WNCRY
from C:\Far2\Documentation\eng\Plugins.Install.txt.WNCRYT to C:\Far2\Documentation\eng\Plugins.Install.txt.WNCRY
from C:\Far2\Documentation\rus\Far.FAQ.txt.WNCRYT to C:\Far2\Documentation\rus\Far.FAQ.txt.WNCRY
from C:\Far2\Documentation\rus\Bug.Report.txt.WNCRYT to C:\Far2\Documentation\rus\Bug.Report.txt.WNCRY
from C:\Far2\Documentation\rus\Arc.Support.txt.WNCRYT to C:\Far2\Documentation\rus\Arc.Support.txt.WNCRY
from C:\Far2\Documentation\eng\Far.FAQ.txt.WNCRYT to C:\Far2\Documentation\eng\Far.FAQ.txt.WNCRY
from %HOMEPATH%\Templates\winword.doc.WNCRYT to %HOMEPATH%\Templates\winword.doc.WNCRY
from %HOMEPATH%\Templates\powerpnt.ppt.WNCRYT to %HOMEPATH%\Templates\powerpnt.ppt.WNCRY
from %HOMEPATH%\Templates\excel4.xls.WNCRYT to %HOMEPATH%\Templates\excel4.xls.WNCRY
from C:\Far2\Documentation\eng\Bug.Report.txt.WNCRYT to C:\Far2\Documentation\eng\Bug.Report.txt.WNCRY
from C:\Far2\Documentation\eng\Arc.Support.txt.WNCRYT to C:\Far2\Documentation\eng\Arc.Support.txt.WNCRY
from %HOMEPATH%\Templates\winword2.doc.WNCRYT to %HOMEPATH%\Templates\winword2.doc.WNCRY
from <STUBS_DIR>\proc_fake.txt.WNCRYT to <STUBS_DIR>\proc_fake.txt.WNCRY
from <STUBS_DIR>\proc_browsers.txt.WNCRYT to <STUBS_DIR>\proc_browsers.txt.WNCRY
from <STUBS_DIR>\proc_banks.txt.WNCRYT to <STUBS_DIR>\proc_banks.txt.WNCRY
from <STUBS_DIR>\proc_tools.txt.WNCRYT to <STUBS_DIR>\proc_tools.txt.WNCRY
from <STUBS_DIR>\proc_im.txt.WNCRYT to <STUBS_DIR>\proc_im.txt.WNCRY
from <STUBS_DIR>\proc_games.txt.WNCRYT to <STUBS_DIR>\proc_games.txt.WNCRY
from <STUBS_DIR>\proc_av.txt.WNCRYT to <STUBS_DIR>\proc_av.txt.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT.WNCRY
from C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat.WNCRYT to C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat.WNCRY
from C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat.WNCRYT to C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat.WNCRY
from <STUBS_DIR>\list_short.txt.WNCRYT to <STUBS_DIR>\list_short.txt.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat.WNCRY
from C:\Documents and Settings\Default User\Templates\excel4.xls to %TEMP%\11.WNCRYT
from C:\Documents and Settings\Default User\Templates\excel.xls to %TEMP%\10.WNCRYT
from %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma to %TEMP%\5.WNCRYT
from C:\Documents and Settings\Default User\Templates\winword2.doc to %TEMP%\14.WNCRYT
from C:\Documents and Settings\Default User\Templates\winword.doc to %TEMP%\13.WNCRYT
from C:\Documents and Settings\Default User\Templates\powerpnt.ppt to %TEMP%\12.WNCRYT
from %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma to %TEMP%\4.WNCRYT
from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg to %TEMP%\0.WNCRYT
from %APPDATA%\tor\state.tmp to %APPDATA%\tor\state
from <STUBS_DIR>\runall.bat.WNCRYT to <STUBS_DIR>\runall.bat.WNCRY
from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg to %TEMP%\3.WNCRYT
from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg to %TEMP%\2.WNCRYT
from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg to %TEMP%\1.WNCRYT
from C:\Far2\Addons\Colors\export_colors.bat.WNCRYT to C:\Far2\Addons\Colors\export_colors.bat.WNCRY
from C:\Far2\PluginSDK\Headers.pas\FarColorW.pas.WNCRYT to C:\Far2\PluginSDK\Headers.pas\FarColorW.pas.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.H.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.H.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.WNCRY
from C:\AUTOEXEC.BAT.WNCRYT to C:\AUTOEXEC.BAT.WNCRY
from C:\Far2\PluginSDK\Headers.pas\PluginW.pas.WNCRYT to C:\Far2\PluginSDK\Headers.pas\PluginW.pas.WNCRY
from C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas.WNCRYT to C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.H.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.H.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.WNCRY
from C:\Far2\ClearPluginsCache.cmd.WNCRYT to C:\Far2\ClearPluginsCache.cmd.WNCRY
from %HOMEPATH%\Templates\sndrec.wav.WNCRYT to %HOMEPATH%\Templates\sndrec.wav.WNCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.WNCRY
from C:\Far2\Addons\README.TXT.WNCRYT to C:\Far2\Addons\README.TXT.WNCRY
from C:\Far2\SaveSettings.cmd.WNCRYT to C:\Far2\SaveSettings.cmd.WNCRY
from C:\Far2\RestoreSettings.cmd.WNCRYT to C:\Far2\RestoreSettings.cmd.WNCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.WNCRY
from C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak.WNCRYT to C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak.WNCRY
from <Current directory>\m.vbs.WNCRYT to <Current directory>\m.vbs.WNCRY
from <Current directory>\88651510161498.bat.WNCRYT to <Current directory>\88651510161498.bat.WNCRY
from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.WNCRYT to %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.WNCRY
from C:\Documents and Settings\Default User\Templates\sndrec.wav.WNCRYT to C:\Documents and Settings\Default User\Templates\sndrec.wav.WNCRY
from C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRYT to C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRY

Changes user data files extensions (Trojan.Encoder).

Network activity:

Connects to:

'37.##7.195.87':443
'17#.#5.193.9':80
'85.##4.62.48':443
'17#.#2.197.82':443
'19#.#3.244.244':443
'95.##3.48.12':443
'localhost':1036
'localhost':9050
'51.##4.246.203':9001
'21#.#39.217.18':1337
'19#.#09.206.212':443

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: ''
ClassName: '' WindowName: 'Wana Decrypt0r 2.0'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial