b.wnry — Bitmap image used as desktop wallpaper (shown in Figure 2) - c.wnry — Configuration containing Tor command and control (C2) addresses, Bitcoin addresses, and other data - r.wnry — Ransom demand text - s.wnry — ZIP archive containing Tor software to be installed on the victim’s system; saved in TaskData directory - t.wnry — Encrypted DLL containing file-encryption functionality - u.wnry — Main module of the WCry ransomware “decryptor” - taskdl.exe — WNCRYT temporary file cleanup program - taskse.exe — Program that displays decryptor window to RDP sessions - msg — Directory containing Rich Text Format (RTF) ransom demands in multiple languages