The files are encrypted with a randomly generated 128-bit AES key in CBC mode with a NULL initialization vector. The key is generated per file, is encrypted with the generated RSA public key, and included in the encrypted file header. Each file encrypted by the malware starts with the string WANACRY. and has the WNCRY extension. Depending on the file properties, the malware may also stage files in a WNCRYT extension