It leaves a ransom note text file called " " in each directory that's been encrypted, pointing to servers on the Tor anonymising network (both via Tor directly and through Internet relays) where the victim can make payment, and changes the Windows background image to a graphic version of the same message.