Resubmissions

26/10/2026, 00:39

261026-az5gqaaz9s8

26/10/2026, 00:38

261026-azftcstwew6

25/10/2026, 05:36

261025-gaptasfy3m10

25/10/2026, 05:33

261025-f9ab8afy2p10

24/10/2026, 17:29

261024-v2vqhsv1fs10

24/10/2026, 17:23

261024-vx9c4sv1ds10

24/10/2026, 17:18

261024-vvlh9scz4k10

24/10/2026, 05:51

261024-gkjd9shz8j10

24/10/2026, 05:48

261024-ghggwshz7k10

24/10/2026, 04:35

261024-e72s1sfx7x10

Analysis

  • user interaction
    yes
  • max time kernel
    6s
  • max time network
    26s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 03:18

General

  • Target
    https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe
  • Sample261024-dtrkfseb53

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies data under HKEY_USERS 7 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb0266c728,0x7ffb0266c734,0x7ffb0266c740
      2⤵
        PID:2488
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,12805598768149513818,4704821806626555605,262144 --field-trial-handle=2044,i,5748635956738355944,14512458544189339855,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
        2⤵
          PID:3824
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1864,i,688094214427811820,2596470848800559296,524288 --field-trial-handle=2044,i,5748635956738355944,14512458544189339855,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
          2⤵
          • Downloads MZ/PE file
          • System Time Discovery
          PID:5100
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,18156229361194922436,16016957459186662765,524288 --field-trial-handle=2044,i,5748635956738355944,14512458544189339855,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:13
          2⤵
            PID:1156
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,11043462665002127736,10825272091729048673,2097152 --field-trial-handle=2044,i,5748635956738355944,14512458544189339855,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
            2⤵
              PID:3716
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,7569471270685393624,16479685501765962531,2097152 --field-trial-handle=2044,i,5748635956738355944,14512458544189339855,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
              2⤵
                PID:1896
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,2576221943797327732,13814628630169859709,524288 --field-trial-handle=2044,i,5748635956738355944,14512458544189339855,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
                2⤵
                  PID:4488
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5756,i,9984856144216450762,1596057122200368464,2097152 --field-trial-handle=2044,i,5748635956738355944,14512458544189339855,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
                  2⤵
                    PID:2596
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5792,i,3315693728032515829,1777732984407383234,2097152 --field-trial-handle=2044,i,5748635956738355944,14512458544189339855,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
                    2⤵
                      PID:4844
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=6112,i,4540374159796786217,9474155228975865519,2097152 --field-trial-handle=2044,i,5748635956738355944,14512458544189339855,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
                      2⤵
                        PID:2984
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5804,i,11123568837628710552,562492600084613164,2097152 --field-trial-handle=2044,i,5748635956738355944,14512458544189339855,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
                        2⤵
                          PID:3120
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6308,i,8325557571244391456,8209229662747112530,2097152 --field-trial-handle=2044,i,5748635956738355944,14512458544189339855,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
                          2⤵
                            PID:2908
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5616,i,13869341425504835636,8480179793663297390,2097152 --field-trial-handle=2044,i,5748635956738355944,14512458544189339855,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
                            2⤵
                              PID:5804
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6344,i,11637393790705895176,11954775514430638516,2097152 --field-trial-handle=2044,i,5748635956738355944,14512458544189339855,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
                              2⤵
                                PID:4840
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6240,i,13848515203242538864,5888209229427467197,2097152 --field-trial-handle=2044,i,5748635956738355944,14512458544189339855,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
                                2⤵
                                  PID:4192
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,17486214262574602896,9315807247090419249,524288 --field-trial-handle=2044,i,5748635956738355944,14512458544189339855,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
                                  2⤵
                                    PID:944
                                  • C:\Users\Admin\Downloads\WannaCry.exe
                                    "C:\Users\Admin\Downloads\WannaCry.exe"
                                    2⤵
                                      PID:1108
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c 314811792811922.bat
                                        3⤵
                                        • Executes a command shell one-liner
                                        PID:1384
                                        • C:\Windows\SysWOW64\cscript.exe
                                          cscript //nologo c.vbs
                                          4⤵
                                          • Executes a VBScript file via the Windows Script Host.
                                          PID:3816
                                      • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                                        !WannaDecryptor!.exe f
                                        3⤵
                                          PID:4532
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /f /im MSExchange*
                                          3⤵
                                          • Kills process with taskkill
                                          PID:2072
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /f /im Microsoft.Exchange.*
                                          3⤵
                                          • Kills process with taskkill
                                          PID:2604
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /f /im sqlserver.exe
                                          3⤵
                                          • Kills process with taskkill
                                          PID:5860
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /f /im sqlwriter.exe
                                          3⤵
                                          • Kills process with taskkill
                                          PID:2560
                                        • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                                          !WannaDecryptor!.exe c
                                          3⤵
                                            PID:5088
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd.exe /c start /b !WannaDecryptor!.exe v
                                            3⤵
                                            • Executes a command shell one-liner
                                            PID:4956
                                            • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                                              !WannaDecryptor!.exe v
                                              4⤵
                                                PID:3976
                                            • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                                              !WannaDecryptor!.exe
                                              3⤵
                                                PID:4036
                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                            1⤵
                                              PID:464
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                              1⤵
                                                PID:4032
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                1⤵
                                                • Modifies data under HKEY_USERS
                                                PID:260
                                              • C:\Users\Admin\Downloads\WannaCry.exe
                                                "C:\Users\Admin\Downloads\WannaCry.exe" /r
                                                1⤵
                                                  PID:3128

                                                Network

                                                      MITRE ATT&CK Enterprise v16

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      OfficeIntegrator.ps1.WCRY

                                                      • Path C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1.WCRY
                                                      • Size 5KB
                                                      • SHA256 08c419f2b902cfce63e94f663e48be5f581e00dc8599d0adb1ebcfb4055a6ff8
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      stream.x64.en-us.db.WCRY

                                                      • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\89698B49-1327-4BAA-8E7A-5BD174EC0C36\en-us.16\stream.x64.en-us.db.WCRY
                                                      • Size 438KB
                                                      • SHA256 b93e5582e1482bc7ac1993633ab605b7d3fcd4574aa022aa5ffe9ad2fc064b65
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      stream.x64.x-none.db.WCRY

                                                      • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\89698B49-1327-4BAA-8E7A-5BD174EC0C36\x-none.16\stream.x64.x-none.db.WCRY
                                                      • Size 1.8MB
                                                      • SHA256 603fe5f332358b3075330228106e374c6bfa7c014016572595efe99d159d9af5
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      background.png.WCRY

                                                      • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WCRY
                                                      • Size 126KB
                                                      • SHA256 43edfd0a69d86d287911a7b643457d9eca77badea82ee0096e319320702442f4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      device.png.WCRY

                                                      • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WCRY
                                                      • Size 43KB
                                                      • SHA256 05b035bcd4b23d7ab804e92fae98c510a75034256475659a19f9ba9ae6653a54
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      overlay.png.WCRY

                                                      • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WCRY
                                                      • Size 28KB
                                                      • SHA256 02076247c3a5d0fad6e8f82e747ddaa1897ed168b7c8860a665868f63e08b810
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      superbar.png.WCRY

                                                      • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WCRY
                                                      • Size 38KB
                                                      • SHA256 9f7c75f337f7088b6c8159cc7d34682e6532a0aa24c7ada6463a9d9c1bc9a408
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      background.png.WCRY

                                                      • Path C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WCRY
                                                      • Size 126KB
                                                      • SHA256 462a32f22ea2a20ded56d69820e792135d120ba8b0fd89ddb3b20496513f9069
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      watermark.png.WCRY

                                                      • Path C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WCRY
                                                      • Size 28KB
                                                      • SHA256 c214f42eb1fd24bf81ceba58d7aa0b3811392d4b16f99a57eb606af47f238f86
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      EventStore.db.WCRY

                                                      • Path C:\ProgramData\Microsoft\Diagnosis\EventStore.db.WCRY
                                                      • Size 120KB
                                                      • SHA256 4486fc007663716112eff25efc6f788ddfd2714e779f256848a32ca7bf26fc2d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      EventStore.db.WCRY

                                                      • Path C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WCRY
                                                      • Size 48KB
                                                      • SHA256 8115e0a25d6ab6c9c90266a04896de426ecdfe1ba41600cc376f8f83229db5fe
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      EventStore.db.WCRY

                                                      • Path C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WCRY
                                                      • Size 20KB
                                                      • SHA256 1d27181b87e9c6d7eb7cf091eb59a6e2adf27276f820859281c985c093fb2929
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      osver.txt.WCRY

                                                      • Path C:\ProgramData\Microsoft\Diagnosis\osver.txt.WCRY
                                                      • Size 296B
                                                      • SHA256 2b02c1b4f385971ecfdd09cc151a9caf87c9f340ecd20b5594695473c91d365f
                                                      • MD5 SHA1 SHA512 TLSH

                                                      qmgr.db.WCRY

                                                      • Path C:\ProgramData\Microsoft\Network\Downloader\qmgr.db.WCRY
                                                      • Size 768KB
                                                      • SHA256 85ea916f454d3650f786df17f6ebb0aab802c6538fa2db11721c2ee6079dba7e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      PropMap.db.WCRY

                                                      • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\PropMap.db.WCRY
                                                      • Size 76KB
                                                      • SHA256 29606fe636acc59059cbf3b316b1f5023a719145dfad914ccf8edc30ec570157
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SecStore.db.WCRY

                                                      • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\SecStore.db.WCRY
                                                      • Size 36KB
                                                      • SHA256 b1f1ba5226d29eda730a6c2e36c7cf3481b90126b85414e4eb75311cb7dfe405
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      Windows-gather.db.WCRY

                                                      • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows-gather.db.WCRY
                                                      • Size 44KB
                                                      • SHA256 f8cd70e35c8dc6fceb7422dd9ba05c7fd99cbaf5492323c9544812c2f52b4fe7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      Windows-usn.db.WCRY

                                                      • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows-usn.db.WCRY
                                                      • Size 4KB
                                                      • SHA256 a002af12de26389e76b7ec2adeb9a43cdc8a6adc8a4e69c36db3bb7dfbfe9e6b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      Windows.db.WCRY

                                                      • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db.WCRY
                                                      • Size 556KB
                                                      • SHA256 3d9883141de13c939ce4038068ba14a47697668ee9292988ed707f1b95c90ae3
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RegisterInboxTemplates.ps1.WCRY

                                                      • Path C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1.WCRY
                                                      • Size 904B
                                                      • SHA256 11823dddcac12a5818e40e37f52340dbf223847844058a86187c7a29454b24f0
                                                      • MD5 SHA1 SHA512 TLSH

                                                      guest.bmp.WCRY

                                                      • Path C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.WCRY
                                                      • Size 392KB
                                                      • SHA256 115bc2ca4fcef69872a3adc0987a44875735c35f83cf48a79ac3c4290ebe73f0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      guest.png.WCRY

                                                      • Path C:\ProgramData\Microsoft\User Account Pictures\guest.png.WCRY
                                                      • Size 2KB
                                                      • SHA256 9cca64298aec161a27efcf326e10f22b31c4417b215e3e8fabf82c02c001d2ff
                                                      • MD5 SHA1 SHA512 TLSH

                                                      user-192.png.WCRY

                                                      • Path C:\ProgramData\Microsoft\User Account Pictures\user-192.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 ce9a3abaca35fd815a846cb426762cb839429794095a1662fb4c971a2c758ac6
                                                      • MD5 SHA1 SHA512 TLSH

                                                      user-32.png.WCRY

                                                      • Path C:\ProgramData\Microsoft\User Account Pictures\user-32.png.WCRY
                                                      • Size 472B
                                                      • SHA256 8d9e7180d409b7e9c65405f6096a5e4c1b788fd7ebbe66457ce35d22d908a2a3
                                                      • MD5 SHA1 SHA512 TLSH

                                                      user-40.png.WCRY

                                                      • Path C:\ProgramData\Microsoft\User Account Pictures\user-40.png.WCRY
                                                      • Size 504B
                                                      • SHA256 5687d033b7d143485cca1eedcaa114fe49010dd81bf4ee9562ae24ff75c2f1be
                                                      • MD5 SHA1 SHA512 TLSH

                                                      user-48.png.WCRY

                                                      • Path C:\ProgramData\Microsoft\User Account Pictures\user-48.png.WCRY
                                                      • Size 504B
                                                      • SHA256 09eccdc9171131bf030008efdd4edb97f3352daec357a4e814f19b739b37a9c4
                                                      • MD5 SHA1 SHA512 TLSH

                                                      user.bmp.WCRY

                                                      • Path C:\ProgramData\Microsoft\User Account Pictures\user.bmp.WCRY
                                                      • Size 392KB
                                                      • SHA256 04697a4602ed3042e8d25cf1c8b98dbac15f696ba4c28ea790393f1dc4b27b47
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      user.png.WCRY

                                                      • Path C:\ProgramData\Microsoft\User Account Pictures\user.png.WCRY
                                                      • Size 2KB
                                                      • SHA256 e8d225f2f2122e85504a81dd4970bba47c4af3b6afc680fab0bf75f9d3780435
                                                      • MD5 SHA1 SHA512 TLSH

                                                      cversions.2.db.WCRY

                                                      • Path C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db.WCRY
                                                      • Size 16KB
                                                      • SHA256 6191c5932ce80104a8a74678da3e764b57402fcff5b8f873f1c20913570ea16f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      {6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.WCRY

                                                      • Path C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.WCRY
                                                      • Size 297KB
                                                      • SHA256 fcaf0051b9e73678e1799eb03b269238145e2791828f971a328efeadaedbf381
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      {97325AFE-D644-4C0F-8CD6-774E33D6B86C}.2.ver0x0000000000000001.db.WCRY

                                                      • Path C:\ProgramData\Microsoft\Windows\Caches\{97325AFE-D644-4C0F-8CD6-774E33D6B86C}.2.ver0x0000000000000001.db.WCRY
                                                      • Size 1KB
                                                      • SHA256 00728358a2fc3e406ad622a0abaa347c71a77ea8b54509c88b079f7c00dcfef5
                                                      • MD5 SHA1 SHA512 TLSH

                                                      {DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WCRY

                                                      • Path C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WCRY
                                                      • Size 639KB
                                                      • SHA256 0e80f36b21797a5538b0f52713b8d390aa8bb0b3d8b16f2c3b9abc301990cdbb
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ActivitiesCache.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db.WCRY
                                                      • Size 1.0MB
                                                      • SHA256 3b1763ef31d243b4771e372f020a248f57c6880fa96ef6ef0daafb5be7adba2a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      3522f5d4-88e1-4f1b-8242-6e28387c67c7.tmp

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3522f5d4-88e1-4f1b-8242-6e28387c67c7.tmp
                                                      • Size 4KB
                                                      • SHA256 3eec702ff7d2e97873ceef42b89700ad56078ca8e8ad04bda02c7e0ca992a1be
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      546330e0-c4af-4a7d-bbad-aef069bb225e.tmp

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\546330e0-c4af-4a7d-bbad-aef069bb225e.tmp
                                                      • Size 5KB
                                                      • SHA256 63e500d04bd2c3eca9784fc3699a0e097dd1734a4abe5ee669878c4dfaef445a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      settings.dat

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                      • Size 40B
                                                      • SHA256 685b74ac6b47cc67ae7434a98329f9111a7b5c168707e70b55be1a68d729ec12
                                                      • MD5 SHA1 SHA512

                                                      0bcf6f82-701d-467b-9aa6-5b402f1aa21d.tmp

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0bcf6f82-701d-467b-9aa6-5b402f1aa21d.tmp
                                                      • Size 11KB
                                                      • SHA256 8c7577b544ed7b37385a604e13b40c4aea4648d3fae8962db8611e8a63408e51
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      3b2af69e-570a-4272-93f8-01ddca17dd0a.tmp

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3b2af69e-570a-4272-93f8-01ddca17dd0a.tmp
                                                      • Size 11KB
                                                      • SHA256 cc5065966aa83c4e86eaa306413ec0849d3f8680f893c2769d4e28b5fd96eca6
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      7862b73f-b58f-42f6-b538-d9867de76fef.tmp

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7862b73f-b58f-42f6-b538-d9867de76fef.tmp
                                                      • Size 6B
                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                      • MD5 SHA1 SHA512

                                                      data_1

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
                                                      • Size 264KB
                                                      • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                      • MD5 SHA1 SHA512 SSDEEP

                                                      CURRENT

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
                                                      • Size 16B
                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                      • MD5 SHA1 SHA512

                                                      MANIFEST-000001

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
                                                      • Size 41B
                                                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                      • MD5 SHA1 SHA512

                                                      1a328086-1110-4b84-8ae4-9f9d2575f1cf.tmp

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1a328086-1110-4b84-8ae4-9f9d2575f1cf.tmp
                                                      • Size 691B
                                                      • SHA256 521eb9f8f566652108266502c1939cc933fc37b89c3480aeb8c5a1eeec5eb0da
                                                      • MD5 SHA1 SHA512 TLSH

                                                      361cf1d1-a225-4d09-8a40-7c2ff5445173.tmp

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\361cf1d1-a225-4d09-8a40-7c2ff5445173.tmp
                                                      • Size 2B
                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                      • MD5 SHA1 SHA512

                                                      720cc263-c5d8-4828-97ee-50b09a9303dc.tmp

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\720cc263-c5d8-4828-97ee-50b09a9303dc.tmp
                                                      • Size 1KB
                                                      • SHA256 854f4a8d0530b378b766680610673f03002831ac5cfcb9f229a4388b6cb1a388
                                                      • MD5 SHA1 SHA512 TLSH

                                                      128.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png
                                                      • Size 8KB
                                                      • SHA256 fa0d73901ae74d2d2c01f26442a2d489abc53facb18d532c67846bcb2cc6877a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      128.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png.WCRY
                                                      • Size 8KB
                                                      • SHA256 5039d92dd79e2232564b12762e67de9e22c6f5a40c01562b59e2496b9d55e177
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      192.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png
                                                      • Size 5KB
                                                      • SHA256 cca43d465fed69867dfec3ee1faa43fe3cfc4fb118e3762f9f4f318856f2664e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      192.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png.WCRY
                                                      • Size 5KB
                                                      • SHA256 3294fc31f114ea0dc9195f49d5b45526fbfa47f4ac8bda186061b8b053ba91ad
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      256.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png
                                                      • Size 20KB
                                                      • SHA256 ba50637a9a54c98264373add3ad0514b06e6ae59524a3f7a4552f556d1afb78f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      256.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WCRY
                                                      • Size 20KB
                                                      • SHA256 241b3ebe5bcbbdf57c0c3c1d3af42d4a8a2f1cef375ef5d8398dbcaf31a1d7e7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      32.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
                                                      • Size 1KB
                                                      • SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
                                                      • MD5 SHA1 SHA512 TLSH

                                                      32.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png.WCRY
                                                      • Size 2KB
                                                      • SHA256 46b00e70b6197d872d98677f0e97990e1e1af08b963cd1038e2ee3d7494085a8
                                                      • MD5 SHA1 SHA512 TLSH

                                                      48.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
                                                      • Size 2KB
                                                      • SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
                                                      • MD5 SHA1 SHA512 TLSH

                                                      48.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png.WCRY
                                                      • Size 3KB
                                                      • SHA256 f754e76c9562f3f774b595521df6aebf2a85885437de273b1e56e304f1912b45
                                                      • MD5 SHA1 SHA512 TLSH

                                                      64.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
                                                      • Size 3KB
                                                      • SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
                                                      • MD5 SHA1 SHA512 TLSH

                                                      64.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png.WCRY
                                                      • Size 4KB
                                                      • SHA256 58c66a21888281d32a79c81cf264eb4d57ef522b5073c6375b4e695fce70154e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      96.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png
                                                      • Size 5KB
                                                      • SHA256 a5c76c56766d79ac0e66fbbf57806501919a63913fb224b0965041ec3645f9e0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      96.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png.WCRY
                                                      • Size 6KB
                                                      • SHA256 3ba902ad78b961a574e37ddc8d41e993d288cbaa867a08bb13fbef0de9237c4e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      128.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png.WCRY
                                                      • Size 10KB
                                                      • SHA256 5d283b826019cd2e5de1eadd05da9d9bd73f3bdfd502cabe837d92f7e9961579
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      192.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png.WCRY
                                                      • Size 7KB
                                                      • SHA256 f57a51ce0047f1f5d9e45d6097511594f3734d6f1a4b8e83cd1cfb1e036e362f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      256.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WCRY
                                                      • Size 26KB
                                                      • SHA256 f662733e1f1dcf0cd96ca0303bdb737f7d219e7c2f355fb476017dcc59fa9f42
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      32.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 094a872acd26f2025f3fb0a651f3b86472de838e45e63baa3bfb6c396f09f0b3
                                                      • MD5 SHA1 SHA512 TLSH

                                                      48.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png.WCRY
                                                      • Size 2KB
                                                      • SHA256 ba993af3ff67ee9f3f4ed205c44914ced2e1949aa0b75706bc56a91b6fa1faee
                                                      • MD5 SHA1 SHA512 TLSH

                                                      64.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png.WCRY
                                                      • Size 4KB
                                                      • SHA256 4251a8822b3bc6b58f09d72d91ce886b46bb25cc34496c4ec882e79608fc8d4c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      96.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png.WCRY
                                                      • Size 7KB
                                                      • SHA256 2a2163165684e60ef6458c5419ae220938693485311f8cbc24db710adeada472
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      128.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png.WCRY
                                                      • Size 2KB
                                                      • SHA256 e95e8f089b9724f2acd2aa381e03188a3bc472c9574de70a3ccc485ee85d7b0f
                                                      • MD5 SHA1 SHA512 TLSH

                                                      192.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 1172cfc34917316703b2a8185793c320a5d8bd224614c5482df10bca61e02602
                                                      • MD5 SHA1 SHA512 TLSH

                                                      256.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png.WCRY
                                                      • Size 5KB
                                                      • SHA256 2dd10b7d0e3cdef57bf673df27c974a77a165fadc306475645630080b576725c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      32.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 cf326c0e6fae7613da391975b5b1fb980f05bdc2d4afdd82c3264bd6d11a5211
                                                      • MD5 SHA1 SHA512 TLSH

                                                      48.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 5515f46c67d2fcf920ada9303f8cf6834fc0be536310e0f6393c8209f40c212e
                                                      • MD5 SHA1 SHA512 TLSH

                                                      64.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 7025d338338980c644e7e35d7ace9462e4af261ca2136ac85a310903c2daf9ee
                                                      • MD5 SHA1 SHA512 TLSH

                                                      96.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png.WCRY
                                                      • Size 2KB
                                                      • SHA256 f5850de0a39e4b2609897a8b3305660c9294fc516baec90a4bcc442e4ae2b13f
                                                      • MD5 SHA1 SHA512 TLSH

                                                      128.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png
                                                      • Size 5KB
                                                      • SHA256 63be4dfbc222f0c026579113af9aa7dea61e78a166ab9af053b46c1e172240ff
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      128.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png.WCRY
                                                      • Size 5KB
                                                      • SHA256 4990e316d73245d63a663b25a8d2b2ee5e73f20ccc1a1dd4459b689b8d85e80c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      192.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png
                                                      • Size 2KB
                                                      • SHA256 e401220b69a76a298b2e081a5424af69791a4caa3936af85d8862c05f4ced4a8
                                                      • MD5 SHA1 SHA512 TLSH

                                                      192.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png.WCRY
                                                      • Size 3KB
                                                      • SHA256 35345740634ba3c6335a3369a91d325fdbdff7d4a4229f8bc44309b377967acc
                                                      • MD5 SHA1 SHA512 TLSH

                                                      256.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png
                                                      • Size 12KB
                                                      • SHA256 6e8f581f4cee7f8f8af4a9e1059f0d3088b792de7045067d74254e2a6f1f9a6b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      256.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png.WCRY
                                                      • Size 13KB
                                                      • SHA256 dcf02dc6b3b4e87ab97fef554127cb426aa2758cdd9ec377a7b90096c714eb96
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      32.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
                                                      • Size 1KB
                                                      • SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
                                                      • MD5 SHA1 SHA512 TLSH

                                                      32.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 5b212b3bfb015c027261b557fec613cc0272d73c0c270f9fdb7799c97f3dfc22
                                                      • MD5 SHA1 SHA512 TLSH

                                                      48.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
                                                      • Size 2KB
                                                      • SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
                                                      • MD5 SHA1 SHA512 TLSH

                                                      48.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png.WCRY
                                                      • Size 2KB
                                                      • SHA256 87b685045732857f855b1cf1c08f8bd40acd3c92050ef2333a2d3b816815f754
                                                      • MD5 SHA1 SHA512 TLSH

                                                      64.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
                                                      • Size 3KB
                                                      • SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
                                                      • MD5 SHA1 SHA512 TLSH

                                                      64.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png.WCRY
                                                      • Size 3KB
                                                      • SHA256 bc351dc3febfb37df0df6f9d04242ed12e159182272dbc74162441db1726ec35
                                                      • MD5 SHA1 SHA512 TLSH

                                                      96.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png
                                                      • Size 3KB
                                                      • SHA256 00f563fcf365eb53a4037624ab3783dd6e19d2c6689c9892aa30ad2b16577848
                                                      • MD5 SHA1 SHA512 TLSH

                                                      96.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png.WCRY
                                                      • Size 4KB
                                                      • SHA256 96aca834de285d73aaae073bd30b4aa6e59cf702adeed192bb2f9ab8cf1498e6
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      128.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png.WCRY
                                                      • Size 2KB
                                                      • SHA256 63018a4c36d98acd32a4ac7a78cf35d194bd1df4ca886808152fe7eb02b78892
                                                      • MD5 SHA1 SHA512 TLSH

                                                      192.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 75003360a20e1a1e6c5fd45bd320fbf6f48178b6720fc2a55044b823e15b4f46
                                                      • MD5 SHA1 SHA512 TLSH

                                                      256.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png.WCRY
                                                      • Size 4KB
                                                      • SHA256 75c7145093895bdc267aaa42c8adebc9e8c69ee8e1e99a025696272499b185ba
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      32.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 41b57934a20815f1f82518607c28c43edb9e7f499a78353ef4263fdad0542f47
                                                      • MD5 SHA1 SHA512 TLSH

                                                      48.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 7ae3dbecb5d102ad9690fa57f437c11c9b1b76fd6142bd7b78484a654292a518
                                                      • MD5 SHA1 SHA512 TLSH

                                                      64.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 dfcb85dcc8136b627961ff80ab643cd58c7977d6aedea2cec1bbc2d6c87c0370
                                                      • MD5 SHA1 SHA512 TLSH

                                                      96.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 e006c891e53efbd80fa79d109537cfbcace05f5807458048d328e6cf41c7c7a5
                                                      • MD5 SHA1 SHA512 TLSH

                                                      128.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\128.png.WCRY
                                                      • Size 3KB
                                                      • SHA256 658fb45db986b5655366c15f5cd6722f839240ca74de85839ee061c595fe083e
                                                      • MD5 SHA1 SHA512 TLSH

                                                      192.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\192.png.WCRY
                                                      • Size 2KB
                                                      • SHA256 51a7c4c9f0dac57f4675ae5308c048a58f78410052ae1d10162419d3d1e3bc65
                                                      • MD5 SHA1 SHA512 TLSH

                                                      256.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\256.png.WCRY
                                                      • Size 6KB
                                                      • SHA256 5662c5f87675af9c8621f04fc81d389c379633c28fa352690acb23f10760bfbe
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      32.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\32.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 da28bae937e5f58d3cb47313b341cd8828d4d88ad5c30584466c68e59d74348b
                                                      • MD5 SHA1 SHA512 TLSH

                                                      48.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\48.png.WCRY
                                                      • Size 2KB
                                                      • SHA256 34e6bbe179ccb647305c9fc72835427891c5f094d7554ad67d9f81f7778d289d
                                                      • MD5 SHA1 SHA512 TLSH

                                                      64.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\64.png.WCRY
                                                      • Size 2KB
                                                      • SHA256 a0c87e2d82503fa74cee5f77a42b0ed702f7e6db5ee57c54ff02374418f8a04d
                                                      • MD5 SHA1 SHA512 TLSH

                                                      96.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\96.png.WCRY
                                                      • Size 2KB
                                                      • SHA256 e1970c5ce5e55bcb4c2b2c73c1fea1800431e03e43e2c4e5b76e57a232c44018
                                                      • MD5 SHA1 SHA512 TLSH

                                                      128.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png
                                                      • Size 2KB
                                                      • SHA256 3a45652c64d2a35cad427fc4541ab36ac42f11425f2d996edc38a6498d98bae8
                                                      • MD5 SHA1 SHA512 TLSH

                                                      128.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png.WCRY
                                                      • Size 2KB
                                                      • SHA256 85fe60821c8415e0568ab4fffaf2c81a8c2ade24e826a23f86eb48a3d9a1f91f
                                                      • MD5 SHA1 SHA512 TLSH

                                                      192.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png
                                                      • Size 1KB
                                                      • SHA256 56b7a8100c9fd352d2c25b6a9c9a05b47950cf5f84d07ab014a0b7cd2850e5a5
                                                      • MD5 SHA1 SHA512 TLSH

                                                      192.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 32bf53e8a8a667055657907214464c3c63ffa548853e11cf923c88c3276c2714
                                                      • MD5 SHA1 SHA512 TLSH

                                                      256.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png
                                                      • Size 4KB
                                                      • SHA256 55d89ccdc27b413cc831f5496b0caf3ec390bc19270ec3294a5d2d38dec42c24
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      256.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png.WCRY
                                                      • Size 4KB
                                                      • SHA256 8cf64a58d591b9f60ae1823dabd06fc146d86b220d9c77b13573994b6e50875a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      32.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
                                                      • Size 960B
                                                      • SHA256 c6fa451ecd1a8a9533801028bc70cf82ef48eba11bb835e53e6c530b43018938
                                                      • MD5 SHA1 SHA512 TLSH

                                                      32.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 a11d751504894d81f24827ca5a3012ca663b56857cc005a2564a5d9c47a9d387
                                                      • MD5 SHA1 SHA512 TLSH

                                                      48.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
                                                      • Size 1KB
                                                      • SHA256 3fc8b8392989fb26381f0a14bb356cae5f998a4dde004c06a51e974034f9ccfa
                                                      • MD5 SHA1 SHA512 TLSH

                                                      48.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 ba665efb57a91cf1607ac82ebdf2e70c1d035865e3d7a36fe3706209c3939af9
                                                      • MD5 SHA1 SHA512 TLSH

                                                      64.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
                                                      • Size 1KB
                                                      • SHA256 f6ff978b0f4c0d28e96b27b6242565480a73615b03a4b95640f8d20136fc2a91
                                                      • MD5 SHA1 SHA512 TLSH

                                                      64.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 3d9239026e319c7334ec175f7a80c026cf782cf120cd00db86a7540f100cbe14
                                                      • MD5 SHA1 SHA512 TLSH

                                                      96.png

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png
                                                      • Size 1KB
                                                      • SHA256 84a6d2571ed487aec05288f204c16ef239a740d2dfb105bf781c6708b938cf00
                                                      • MD5 SHA1 SHA512 TLSH

                                                      96.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 77add736d79bca3491960ea0be9bd3fa61f6c27ffd398d4468e18a154a65600f
                                                      • MD5 SHA1 SHA512 TLSH

                                                      heavy_ad_intervention_opt_out.db

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db
                                                      • Size 16KB
                                                      • SHA256 3f988de8cc924d73c7490c68529a8b25a9ca22f9578c594f554d1e06e0fac307
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      heavy_ad_intervention_opt_out.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db.WCRY
                                                      • Size 16KB
                                                      • SHA256 38f2447535f9a1c894a736368f07c11fccef0d3f6ae926bcb010c8bcd7ddac3e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      a5003d12-85da-46f5-915b-5467889b1c69.tmp

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a5003d12-85da-46f5-915b-5467889b1c69.tmp
                                                      • Size 5KB
                                                      • SHA256 48eab0320e246a38518ea4bdd08547293a2b715d4bcad563bc7f3304ce79fd83
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      first_party_sets.db

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
                                                      • Size 48KB
                                                      • SHA256 6a12b70d5f50f77dfc800c8a556294f5e50183348cfed1bea12d79771d515ff3
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      first_party_sets.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db.WCRY
                                                      • Size 48KB
                                                      • SHA256 a066b4800f280021502d0d97c0ee1bcc0858c875a6bac4c7d58a28127f1c5570
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      IconCache.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\IconCache.db.WCRY
                                                      • Size 13KB
                                                      • SHA256 1d6017a5aaa8c04bb96c333e4401f8b1da40062e622eb77bc2f7defb54d0e54d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      EdgeEDropSQLite.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WCRY
                                                      • Size 32KB
                                                      • SHA256 8cabac4c8726debd879b24c9d986264fce6030716c0f50065b61e07f58288c26
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      EdgeHubAppUsageSQLite.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WCRY
                                                      • Size 28KB
                                                      • SHA256 f7d43fc053dc8d7f1600b86ac984bebb97056995dd895ceb35b5d58e56408308
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      128.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\128.png.WCRY
                                                      • Size 5KB
                                                      • SHA256 44cc5b8d639b5e2c6c5ef306a6241dec87f895643942041fbcb42d64e10240a1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      offscreendocument_main.js.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\offscreendocument_main.js.WCRY
                                                      • Size 130KB
                                                      • SHA256 5874c48960cf45e4f5fb57518befb911a32bd109a2adce43611b5c0588bebde0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      page_embed_script.js.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\page_embed_script.js.WCRY
                                                      • Size 632B
                                                      • SHA256 0dc5b560528870ec7ec0fab158b08a4c243d886503abf59512e25f9352bfafdf
                                                      • MD5 SHA1 SHA512 TLSH

                                                      service_worker_bin_prod.js.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\service_worker_bin_prod.js.WCRY
                                                      • Size 136KB
                                                      • SHA256 b200ea3d8c2066024ea5d98cad0da8e58e1271b2ceb9734c17198ce98b64cfc0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      index.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.WCRY
                                                      • Size 664B
                                                      • SHA256 5f1c38dd14e3baf53b05f052b30e1e7b1e575493d0f6b19f729190c43a354425
                                                      • MD5 SHA1 SHA512 TLSH

                                                      heavy_ad_intervention_opt_out.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db.WCRY
                                                      • Size 16KB
                                                      • SHA256 88b3cf03f519331a1c0c955b14df0e336777c0f401833de84490738dd2f008d8
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      load_statistics.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db.WCRY
                                                      • Size 84KB
                                                      • SHA256 b36b1f46290b9c726c9d4ac55c0df49d8c1acafca446f8d1f59c3e47cb34c30c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      first_party_sets.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db.WCRY
                                                      • Size 48KB
                                                      • SHA256 cf66f897ed497a009a3ed84c016a45e713bdfd28ae9207b25703724a23efac8b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      mip.policies.sqlite3.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\mip.policies.sqlite3.WCRY
                                                      • Size 36KB
                                                      • SHA256 8054f22abdc5bfbd104afbbdddc4c370867a015bcae45ec3e76537b688226fda
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      excel.exe.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WCRY
                                                      • Size 24KB
                                                      • SHA256 a5a43dfa00f4b0ef0f0c9a8ad4bdd83b0e14db0e8cd4e556c84ef3ef11059122
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      officeclicktorun.exe.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WCRY
                                                      • Size 24KB
                                                      • SHA256 b29787fe89a53c6c3d02cb90255e31b9ce633efddee290504c723f3c81089f43
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      onenote.exe.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\onenote.exe.db.WCRY
                                                      • Size 24KB
                                                      • SHA256 2923af51a53c63471366a70b62e0b5dfcca69be5dd44e010a223a30b53ac9283
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      winword.exe.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db.WCRY
                                                      • Size 24KB
                                                      • SHA256 c6127a6d60644d4797b8dddd497c492a31e5cf213335d295369f5f68a0b17440
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      AppBlue.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png.WCRY
                                                      • Size 5KB
                                                      • SHA256 1f275ccedf4cf693a62a644bcabeed7aeca7491510d4155958119e756f4f1579
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      AppErrorBlue.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png.WCRY
                                                      • Size 7KB
                                                      • SHA256 4de1b317a5868566408770152c7400fa1ba8541f79ef66d8edaa87b1173b8e3e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      AppErrorWhite.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png.WCRY
                                                      • Size 8KB
                                                      • SHA256 333b50f793a0a3b5d137b6f5afe257c619d6102c92f0dd1b4bc8d35e3065d944
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      AppWhite.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png.WCRY
                                                      • Size 3KB
                                                      • SHA256 9a330b99643eba16f2e54011228dc59b033e90fd286f6bc2502e919918f8dcad
                                                      • MD5 SHA1 SHA512 TLSH

                                                      AutoPlayOptIn.gif.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.gif.WCRY
                                                      • Size 374KB
                                                      • SHA256 9c86826662538fbb314a13d828a37d0a647392256ccfcf59146b2e56d8e32107
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      AutoPlayOptIn.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png.WCRY
                                                      • Size 10KB
                                                      • SHA256 f1fe28cec1a5d8d3e3222912df518bb95a4103d77a6029d391a64d642b6808d7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      CollectSyncLogs.bat.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\CollectSyncLogs.bat.WCRY
                                                      • Size 6KB
                                                      • SHA256 021554678a75f376eaed09f5cc44d3b30f24b901557a22c8b7f3ecadfea681de
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ElevatedAppBlue.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png.WCRY
                                                      • Size 7KB
                                                      • SHA256 0f6bb56ba3904c76469cd9be2ca6546dccacb4c34f8e8f31b8e545979e05d4ac
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ElevatedAppWhite.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png.WCRY
                                                      • Size 5KB
                                                      • SHA256 dc0bd98df6590d9fe1f69c00afbaa9d1947a180180054ce9b3f9e87f29b303f2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      Error.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png.WCRY
                                                      • Size 7KB
                                                      • SHA256 6ce9a542b4e7aef54ee395b88ce85bfe701f486feff8959cf09bd6e92cfca6ae
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      KFMHeroToast.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png.WCRY
                                                      • Size 15KB
                                                      • SHA256 2dd07415fecacfaf1675243a77ebe7d82eaaedcfe4fc6116fef2fa86a708c008
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      KFMLockedFileToast.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png.WCRY
                                                      • Size 10KB
                                                      • SHA256 ad6e66afbfaa0b80375179f2e097467e0b5723f784b1d9a157e05a9e7a99a64d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      KFMScanExclusionToast.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png.WCRY
                                                      • Size 10KB
                                                      • SHA256 5981dcaddaa6d390f298e6615bf3a6d7aa2ecc550ddac3f02312c0e2b3b9eb7f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      OneDriveLogo.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png.WCRY
                                                      • Size 4KB
                                                      • SHA256 0979c5eb562792c93b9e70d064c61dcb0b9eff0560fa9147438758445996a8e6
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      QuotaCritical.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png.WCRY
                                                      • Size 8KB
                                                      • SHA256 7122e1a39767a2ddc68af1c22d8fd8892610eaef280363957dfdaebdf070fbd1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      QuotaError.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png.WCRY
                                                      • Size 9KB
                                                      • SHA256 28cf09f2811cb1a766e7b36db63dcb8386a421a3d69967f5ea596c2ee2a31330
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      QuotaNearing.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png.WCRY
                                                      • Size 7KB
                                                      • SHA256 bbd35b2973a31e8db5f1f647515a7b763a112d64186e4ff4f85ac0af400476df
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ScreenshotOptIn.gif.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ScreenshotOptIn.gif.WCRY
                                                      • Size 238KB
                                                      • SHA256 3ecc96bfc1db600d41910c89312f8566620cd9198b1826f4cba7ed64f14b1e72
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ThirdPartyNotices.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt.WCRY
                                                      • Size 48KB
                                                      • SHA256 7e6e98a459df24327fd9c1755a0b3e9cd7b43537b049286547ab3a982586ea2d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      Warning.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png.WCRY
                                                      • Size 2KB
                                                      • SHA256 26dcd02abb9cc17503ca67811c143494fdd471a237aee877df167796dd724cf7
                                                      • MD5 SHA1 SHA512 TLSH

                                                      alertIcon.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png.WCRY
                                                      • Size 1000B
                                                      • SHA256 f4f875329f6a4b56e2cfaf5d556356d2840cedc88b08e48f5bf2eee1ded21882
                                                      • MD5 SHA1 SHA512 TLSH

                                                      acmDismissIcon.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\acmDismissIcon.svg.WCRY
                                                      • Size 2KB
                                                      • SHA256 804f145fb5d7f91820ebc4b3d508b021d0604c040fd3699c3e96a7643b2c762b
                                                      • MD5 SHA1 SHA512 TLSH

                                                      blurrect.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 b6cf9d13e205d0a05bda82b2ba307bf9064bf2d65455eda64917992442762db4
                                                      • MD5 SHA1 SHA512 TLSH

                                                      checkmark_finished.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_finished.svg.WCRY
                                                      • Size 504B
                                                      • SHA256 1b88199c261d430912bdea326efce4c01d9f4d3dba3139145ce4af078f51c7b4
                                                      • MD5 SHA1 SHA512 TLSH

                                                      checkmark_hovered.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_hovered.svg.WCRY
                                                      • Size 680B
                                                      • SHA256 97d3bf37466b66642f80cd0ad52df69581a4fbb258edfb326918514d991ecedc
                                                      • MD5 SHA1 SHA512 TLSH

                                                      checkmark_in_progress.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_in_progress.svg.WCRY
                                                      • Size 680B
                                                      • SHA256 e155e47e8b2ea8f02a5534d8700583e9d35546b0fbd2a5671f672c50ea6de3a2
                                                      • MD5 SHA1 SHA512 TLSH

                                                      checkmark_selected.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_selected.svg.WCRY
                                                      • Size 680B
                                                      • SHA256 6847c00b47ad648d004e5784256d972209f55376bd629c8bb2387e3b21a8dc04
                                                      • MD5 SHA1 SHA512 TLSH

                                                      chevron.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\chevron.svg.WCRY
                                                      • Size 584B
                                                      • SHA256 65575bbce0374d108ffda1fdb04b5f12efc38728843d11429a5726a0e4888505
                                                      • MD5 SHA1 SHA512 TLSH

                                                      chevronUp.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\chevronUp.svg.WCRY
                                                      • Size 552B
                                                      • SHA256 6ecebc1950b4bda4fd76140d603a49606c3f9b2ae6e3dcaae9aadbf24dd98f53
                                                      • MD5 SHA1 SHA512 TLSH

                                                      cloud.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\cloud.svg.WCRY
                                                      • Size 1KB
                                                      • SHA256 5aecb73621dff693cf5c8576b5201f457440df23425cb882eb114e8ad3058cd0
                                                      • MD5 SHA1 SHA512 TLSH

                                                      done_graphic.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\done_graphic.svg.WCRY
                                                      • Size 15KB
                                                      • SHA256 303501249e6ef2d73053f846ba219c689c4f0f60b77afe9d506fc3fd10e0eddd
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      errorIcon.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\errorIcon.svg.WCRY
                                                      • Size 1KB
                                                      • SHA256 9c32087c73023132290f52d81783b272c5692647539a3141ff56375f95d4cbe8
                                                      • MD5 SHA1 SHA512 TLSH

                                                      folderIcon.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folderIcon.svg.WCRY
                                                      • Size 1KB
                                                      • SHA256 4d0d51f27bcfee6b9d3ec21d0935025a5e73275b6e6e27ca2cec3c8c85a3405d
                                                      • MD5 SHA1 SHA512 TLSH

                                                      folder_image_desktop.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folder_image_desktop.svg.WCRY
                                                      • Size 2KB
                                                      • SHA256 8ec98a1fe98e1f3dc1a1aa9f3aa155346bbfb19ba629da494c4d8c8929bc1add
                                                      • MD5 SHA1 SHA512 TLSH

                                                      folder_image_documents.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folder_image_documents.svg.WCRY
                                                      • Size 10KB
                                                      • SHA256 ac82425b3da4e2b511c6e7886ac285c7e51539d4d67f6816b0d2663b9b1fa885
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      folder_image_pictures.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folder_image_pictures.svg.WCRY
                                                      • Size 7KB
                                                      • SHA256 5668728315413032d76e64d71ef56b005ac010d5d54ed212183661e7a8077070
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      globeIcon.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\globeIcon.svg.WCRY
                                                      • Size 2KB
                                                      • SHA256 d0cdbbe9cbc434acac14e949455f1349efd9e1103f3ed3621029f12fccb747cc
                                                      • MD5 SHA1 SHA512 TLSH

                                                      iceBucket.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\iceBucket.svg.WCRY
                                                      • Size 6KB
                                                      • SHA256 67b1fbd0dd00df4ff82a9593a75755dfc84e4740c78c859475a460ca6f7258d5
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      infoIcon.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\infoIcon.svg.WCRY
                                                      • Size 1KB
                                                      • SHA256 df3fa381d312409be2e47c6ef0edd235a70c69aa1b5b2d8bcf27adca91a93b17
                                                      • MD5 SHA1 SHA512 TLSH

                                                      kfm_folders_image.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\kfm_folders_image.svg.WCRY
                                                      • Size 20KB
                                                      • SHA256 00c79fc3a0aae3ddddeb500e3bc7f3ed850873259001bb5c0f5662c875c8cc8f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      loading.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\loading.svg.WCRY
                                                      • Size 1000B
                                                      • SHA256 45b3484f6273428a9525a4275eaa03fba7f3a255c1176d98aecf4959b0686683
                                                      • MD5 SHA1 SHA512 TLSH

                                                      loading_spinner.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\loading_spinner.svg.WCRY
                                                      • Size 712B
                                                      • SHA256 108cf3ffe9849755cdabbcf932d821446b39f35a9cd54a9375d993fd239a8017
                                                      • MD5 SHA1 SHA512 TLSH

                                                      onDemandFiles.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\onDemandFiles.svg.WCRY
                                                      • Size 7KB
                                                      • SHA256 f384c4dac26eeef865dae3c86b7e70bcbf5493c4095902e44289a9813a26ded0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      onDemandFilesDehydrate.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\onDemandFilesDehydrate.svg.WCRY
                                                      • Size 9KB
                                                      • SHA256 de9b7e7a985f549e7d81a775d254974386edf0bf0a2c8a9efcf8ebf1331474b8
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      onDemandSelectiveSync.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\onDemandSelectiveSync.svg.WCRY
                                                      • Size 2KB
                                                      • SHA256 40e2186096e5a566fc6f84d0450b080022a68e3e031ac7e9fde88a65f5591e34
                                                      • MD5 SHA1 SHA512 TLSH

                                                      overflowIcon.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\overflowIcon.svg.WCRY
                                                      • Size 1KB
                                                      • SHA256 2ed7fbbe5e3af2b4e114190010548d56e500da72e12ee450912218a342869432
                                                      • MD5 SHA1 SHA512 TLSH

                                                      overflowIconLarge.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\overflowIconLarge.svg.WCRY
                                                      • Size 1KB
                                                      • SHA256 fd08a7596c3d5c0a945088e9c1819d48129025d8cf01a78f8c027c38905fa3ec
                                                      • MD5 SHA1 SHA512 TLSH

                                                      partiallyFreezing.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\partiallyFreezing.svg.WCRY
                                                      • Size 4KB
                                                      • SHA256 5c3125497c97e6cd84f3af99817b9e6ad02b836de3b051566cbf4bd9b706016d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      paused.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\paused.svg.WCRY
                                                      • Size 600B
                                                      • SHA256 74dac8566076262517b225f22a38c79b0724ca1d1a9257400b8cad5b2f5ac375
                                                      • MD5 SHA1 SHA512 TLSH

                                                      premiumIcon.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\premiumIcon.svg.WCRY
                                                      • Size 664B
                                                      • SHA256 5648420e67f5cc4e7eae1db672e5f28fefc5505b03742054fd779e8c2f9576f0
                                                      • MD5 SHA1 SHA512 TLSH

                                                      recycleBin.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\recycleBin.svg.WCRY
                                                      • Size 3KB
                                                      • SHA256 d67eac9468d1d73053caea4d9dcfdf2836cfbfc66c3d2eb94bd10687140f0655
                                                      • MD5 SHA1 SHA512 TLSH

                                                      shield_icon.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\shield_icon.svg.WCRY
                                                      • Size 1KB
                                                      • SHA256 57a3b5957e288dcbb08aeab5e1e77fdc50d3e0af2056a86815ea9a67c5e880a1
                                                      • MD5 SHA1 SHA512 TLSH

                                                      signIn.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\signIn.svg.WCRY
                                                      • Size 10KB
                                                      • SHA256 4188a82b5911aef5f25349526bbadd990cc563666a2e77c4af1bdc11b6b46e6e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      stackedIceCubes.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\stackedIceCubes.svg.WCRY
                                                      • Size 4KB
                                                      • SHA256 dab142a940dddf0d1a0afae512b80f12a8d1c817ddba5ab69daf3cfdb4edcc5f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      warning-symbol_grey.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\warning-symbol_grey.svg.WCRY
                                                      • Size 536B
                                                      • SHA256 1cb6a7bcb50f2296f6ceb6e18084ba2d1ded38203713e22d37ccd4b14834e559
                                                      • MD5 SHA1 SHA512 TLSH

                                                      waterGlass.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\waterGlass.svg.WCRY
                                                      • Size 2KB
                                                      • SHA256 2a6486c475d3e8273d9150b2da56a49e6a8c4e985b80f4f0a8f651130d118ab6
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveMedTile.contrast-black_scale-100.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png.WCRY
                                                      • Size 936B
                                                      • SHA256 c7255fc6f9f1f16d956a68fb4e22442f783cf1149fbf4fb58a9284704b091036
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveMedTile.contrast-black_scale-125.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 c0b9ab158078576a3dcbcaf7f30d0c6991fd62ae8dfc8a24c30d8c909c57c2f7
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveMedTile.contrast-black_scale-150.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 fdb9688bb56eef21a2828d360d9094143ad8203bd65c48f3e41c5d6239c7ffeb
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveMedTile.contrast-black_scale-200.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 9f864da89a1309b5a5b679df4470182f3daa72d5b90891d5dc68a9299f8f6d51
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveMedTile.contrast-black_scale-400.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png.WCRY
                                                      • Size 3KB
                                                      • SHA256 1f6c510cabe7febfaf9b35fd37a86186a43d112638f43b291d4ad6c1255801fa
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveMedTile.contrast-white_scale-100.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png.WCRY
                                                      • Size 952B
                                                      • SHA256 ed4917e5dda506e30337f8036b2de3239d97da6b438821e9eb595c626739a93d
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveMedTile.contrast-white_scale-125.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 37931256c4b16f7abebf00a38312e7922080dd613ebfcd02c86aca4a332e2bf0
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveMedTile.contrast-white_scale-150.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 4023efdb20dc30aa59a3afaa727f8947ea83e664184ff5dc93dced7df3633d8a
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveMedTile.contrast-white_scale-200.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 6914249bec859aade0b25d8b1384225a0268a7586c12490aa552a7384abeecb3
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveMedTile.contrast-white_scale-400.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png.WCRY
                                                      • Size 3KB
                                                      • SHA256 67a50c3aa00cf9fba55b01b1a219e4071f0d39978b8b04f5e66b11c978f6001b
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveMedTile.scale-100.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png.WCRY
                                                      • Size 936B
                                                      • SHA256 511158ae9d1812c9b631ea14012a0b5f06ddf48fe50093c2b91457a0e4686d6a
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveMedTile.scale-125.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 9f7cdbaadd8c8aac56fc880c0c53f1f4984c075e4450dd28c0eb1a0a5a5000f1
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveMedTile.scale-150.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 ec409985e71fc22dd63b6a7534a5f0b5f1e51d1c641e705a523d85e76e6d7a47
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveMedTile.scale-200.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 fc1fedccb9223024c558e4f70febb671441c72655d2988ab01adec3e243b7a89
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveMedTile.scale-400.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png.WCRY
                                                      • Size 3KB
                                                      • SHA256 46c0ceb6af3016e42272d0b68e424f554360e82b0ed0e65968266c570963e8ae
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveSmallTile.contrast-black_scale-100.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png.WCRY
                                                      • Size 696B
                                                      • SHA256 62499ebf421828513b6381f7bedc9e8e8807ee8532b7b6b47db2f2cce6e12ada
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveSmallTile.contrast-black_scale-125.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png.WCRY
                                                      • Size 808B
                                                      • SHA256 93822537b52ce0337b971b3ed7d509b8af74a87bf6186d470645bd82526895a8
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveSmallTile.contrast-black_scale-150.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png.WCRY
                                                      • Size 872B
                                                      • SHA256 c990e4b2c08bab93d7614e83556692fe1a649d5451487b235d982dc1e96b8562
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveSmallTile.contrast-black_scale-200.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 b8b3e15e2cdcc9d8b9eca0aa4305822104b55119bb9adec7ec01fef4a0383608
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveSmallTile.contrast-black_scale-400.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 0074eabb6b110cdb7362d6130d8717c5f5e1f3a650ccc65d215a06fd34666aed
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveSmallTile.contrast-white_scale-100.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png.WCRY
                                                      • Size 696B
                                                      • SHA256 0b6527e05263d98ed64edaa70c255e311da7cdc3ac7483d3e6bd82bfef012597
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveSmallTile.contrast-white_scale-125.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png.WCRY
                                                      • Size 824B
                                                      • SHA256 32db1808019a419d5ba316058fcfaa5fdb6e69879a69fbe25d79bc396540efda
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveSmallTile.contrast-white_scale-150.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png.WCRY
                                                      • Size 888B
                                                      • SHA256 ea4627bc6942f9ad08a6b2a717626eb9224b162a5ffa3cea007318689fc3ff9f
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveSmallTile.contrast-white_scale-200.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 42eaebbb198a70121944e761c4583904012cfcc6fa91d2d3a47755e1bb0e8a47
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveSmallTile.contrast-white_scale-400.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png.WCRY
                                                      • Size 2KB
                                                      • SHA256 c59715d7e7edcec3a9409ace0912cab868689afc4616b03ef84aa2a926f3998f
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveSmallTile.scale-100.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png.WCRY
                                                      • Size 696B
                                                      • SHA256 c7a344dd09fda48cc8b2577376a67eba7f4b1e14b452e46d518fad8766cf49b4
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveSmallTile.scale-125.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png.WCRY
                                                      • Size 808B
                                                      • SHA256 c0ab3aa22e3d3bcd48e3b22172868098e2b377174eb8f32f056663f13121cc1c
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveSmallTile.scale-150.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png.WCRY
                                                      • Size 872B
                                                      • SHA256 1827e9a93a832f91f1aad12c0ccb23c36d87a1081e34a14a891dc214200a3605
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveSmallTile.scale-200.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 826fbcb41855237419804dd810bae3f1c85f87c20c2de13578bf7e26c326c156
                                                      • MD5 SHA1 SHA512 TLSH

                                                      OneDriveSmallTile.scale-400.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png.WCRY
                                                      • Size 1KB
                                                      • SHA256 69598d526cdb70794d5bad437a2e2047a3ab5e1f6fdd13cac8224bcf229b61a5
                                                      • MD5 SHA1 SHA512 TLSH

                                                      cversions.1.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.1.db.WCRY
                                                      • Size 16KB
                                                      • SHA256 2d9a614ebef8adcae922fa89b5878c003367d49e48517790f81516a20935e836
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      cversions.3.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.3.db.WCRY
                                                      • Size 16KB
                                                      • SHA256 a2a584b5764df3acc4cdc0789be2d4c3ea6618e4118b9dd155988aa66aa46e5d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      {03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WCRY
                                                      • Size 423KB
                                                      • SHA256 7cc4130fa3e7b10c6a84135fd94a1aa82cebce0b24a03efdd0a160ee2da810d1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      {AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000014.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000014.db.WCRY
                                                      • Size 64KB
                                                      • SHA256 83a811102769a5fabfd4570eccf22634e2d3dd00b77e01f1f17fd6e76a547d7f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      iconcache_1280.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db.WCRY
                                                      • Size 312B
                                                      • SHA256 6f4e492ee42d256cbdeb862734782f617cbd71c4eae2bac05a96e364bd3076b3
                                                      • MD5 SHA1 SHA512 TLSH

                                                      iconcache_16.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WCRY
                                                      • Size 1.0MB
                                                      • SHA256 401f51a0d1c35bcb8fe494a2f95962b8535677bc8bc09f1d8740c9aa33c06cb8
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      iconcache_1920.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db.WCRY
                                                      • Size 312B
                                                      • SHA256 3d85621d6b9a20790d52b6631329cdce41d0b7e3cec791e852ef170dae052a46
                                                      • MD5 SHA1 SHA512 TLSH

                                                      iconcache_256.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WCRY
                                                      • Size 312B
                                                      • SHA256 95fe328fd61f472c0d90565aef1791decce6f3201714fdc33806e9cc62503b32
                                                      • MD5 SHA1 SHA512 TLSH

                                                      iconcache_2560.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db.WCRY
                                                      • Size 312B
                                                      • SHA256 8651bce604ec34d0298231624002abb0e8bc7a386d25237271e7936ed6d473b9
                                                      • MD5 SHA1 SHA512 TLSH

                                                      iconcache_32.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WCRY
                                                      • Size 1.0MB
                                                      • SHA256 6f1fc37cb2cf01612fab935052b5f0e83f2d5eb97f434ddedcdde6b5f075fa1b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      iconcache_48.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WCRY
                                                      • Size 2.0MB
                                                      • SHA256 8103aa6fdde3e837ba2261f1aa2f73080d7d6a4f77105843b93bc082cfaf1338
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      iconcache_768.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db.WCRY
                                                      • Size 312B
                                                      • SHA256 e3cc708422d98232545a7c26abcbe56f67f49a8454d37acbba5ad5ca29317ff1
                                                      • MD5 SHA1 SHA512 TLSH

                                                      iconcache_96.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db.WCRY
                                                      • Size 312B
                                                      • SHA256 53bd40f7ec292d9cf8cef71726e7a8ecb9de909dc341d77aed2694f4a9d88aba
                                                      • MD5 SHA1 SHA512 TLSH

                                                      iconcache_custom_stream.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db.WCRY
                                                      • Size 312B
                                                      • SHA256 d46d6899d26fff282dde42433aa9e8711a249f69cff0dffe3ce0343a7fa89e3e
                                                      • MD5 SHA1 SHA512 TLSH

                                                      iconcache_exif.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db.WCRY
                                                      • Size 312B
                                                      • SHA256 9ec309c7664ccd40315cb24b300d2f3085db06a7f3c55b596756f298b278307b
                                                      • MD5 SHA1 SHA512 TLSH

                                                      iconcache_idx.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WCRY
                                                      • Size 28KB
                                                      • SHA256 041c42adcbb4857cb2f06d0644abdc97580519832b54427a60e26893b5b30c4a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      iconcache_sr.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db.WCRY
                                                      • Size 312B
                                                      • SHA256 d37685e1a2fc2483eab316e2abbd63575ecc41dd7558b3093c475362ec388427
                                                      • MD5 SHA1 SHA512 TLSH

                                                      iconcache_wide.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db.WCRY
                                                      • Size 312B
                                                      • SHA256 40ba912c19d78e90e9dfe5f0c0e2bd3c84ed1a38f1db8629c86c601376f115b8
                                                      • MD5 SHA1 SHA512 TLSH

                                                      iconcache_wide_alternate.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.WCRY
                                                      • Size 312B
                                                      • SHA256 3d10a99b2746f16013dd7d0746643bff66a9554de29667fc2d0b0ff4a067599c
                                                      • MD5 SHA1 SHA512 TLSH

                                                      thumbcache_1280.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db.WCRY
                                                      • Size 312B
                                                      • SHA256 7b16d6b8cbec204b21e8409e94a2e1879c712d879c181cbe8b34e602a6598c8d
                                                      • MD5 SHA1 SHA512 TLSH

                                                      thumbcache_16.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WCRY
                                                      • Size 312B
                                                      • SHA256 37240fe473530b5c6ca46bf5f469edf419bca4d291eb047b45ea63b6bc078f3e
                                                      • MD5 SHA1 SHA512 TLSH

                                                      thumbcache_1920.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db.WCRY
                                                      • Size 312B
                                                      • SHA256 7ed6976f8c39f4e86e9adacf110bd56a9fe86aa171906df2d24b25a79e31205a
                                                      • MD5 SHA1 SHA512 TLSH

                                                      thumbcache_256.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WCRY
                                                      • Size 1.0MB
                                                      • SHA256 9f22ec9edec7d12966aed5dc954c5e626507c1a284e0fa2d7a081b4e127d54d9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      thumbcache_2560.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db.WCRY
                                                      • Size 312B
                                                      • SHA256 bcf2c5276fee60e8ecb9e0a6d781781b76509bb0a728704c437c9a3b23a61f0f
                                                      • MD5 SHA1 SHA512 TLSH

                                                      thumbcache_32.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WCRY
                                                      • Size 1.0MB
                                                      • SHA256 4e8934daaad14cb8f58c006293e2ab941fb5118737185972bcd8c96b56f70027
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      thumbcache_48.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WCRY
                                                      • Size 312B
                                                      • SHA256 415bdbe2053e43f21082d3b61075dc50b4522781529ae6e69b1fa074812a78c8
                                                      • MD5 SHA1 SHA512 TLSH

                                                      thumbcache_768.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db.WCRY
                                                      • Size 312B
                                                      • SHA256 c1093a2a81abe1f2284027fe61405356fda026887fc5424ae288fbf84d6d24e1
                                                      • MD5 SHA1 SHA512 TLSH

                                                      thumbcache_96.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WCRY
                                                      • Size 312B
                                                      • SHA256 cc0e5f2c2f54527e93986fc7144d016e7fd5b9cc0db333e50195732ea95e7833
                                                      • MD5 SHA1 SHA512 TLSH

                                                      thumbcache_custom_stream.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.WCRY
                                                      • Size 312B
                                                      • SHA256 961dde0639f817110def01dfa0996a2fef73d2dda88260b96b2f9b98c49d8c04
                                                      • MD5 SHA1 SHA512 TLSH

                                                      thumbcache_exif.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db.WCRY
                                                      • Size 312B
                                                      • SHA256 a1e7246efbe979fae99921ba769e79644148c5aa5b5cdecf8e1f7945ab9d6ddc
                                                      • MD5 SHA1 SHA512 TLSH

                                                      thumbcache_idx.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WCRY
                                                      • Size 7KB
                                                      • SHA256 7e8321892054313b875afed91465b5e4a8f4de1847bbffb2ee19467f235219eb
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      thumbcache_sr.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db.WCRY
                                                      • Size 312B
                                                      • SHA256 673bed12cdbf2323e678f920def065dce7f8b89bc04ce9b4c624e6def6ece625
                                                      • MD5 SHA1 SHA512 TLSH

                                                      thumbcache_wide.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db.WCRY
                                                      • Size 312B
                                                      • SHA256 98d7dbb60b4670d35e4718c5bea614a1909e59063dfe3737dc347295fe5eaf1f
                                                      • MD5 SHA1 SHA512 TLSH

                                                      thumbcache_wide_alternate.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.WCRY
                                                      • Size 312B
                                                      • SHA256 31225fc055271d51d440530024a78b6829a78aa3f21d097cda32e96d1add8c8d
                                                      • MD5 SHA1 SHA512 TLSH

                                                      {8a69d345-d564-463c-aff1-a69d9e530f96}[1].bmp.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H6HGNC2Z\{8a69d345-d564-463c-aff1-a69d9e530f96}[1].bmp.WCRY
                                                      • Size 6KB
                                                      • SHA256 f91bdd54b57da78a38a8c6f63d0355cf9efbf795fac4fac831e279984d5b1bfb
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      wpndatabase.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WCRY
                                                      • Size 1.0MB
                                                      • SHA256 95aa3793a6bdee3dc9c2f4cfc4df7b1e202d05ec5f0cb8cf6a7d4e8e900c731a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      appsconversions.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{44de0100-7fd6-4388-ad84-444f643306d4}\appsconversions.txt.WCRY
                                                      • Size 1.4MB
                                                      • SHA256 a870405fce5a70090e497a03cc58d4319feb2566efd5ad8ae321ec366d16454b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      appsglobals.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{44de0100-7fd6-4388-ad84-444f643306d4}\appsglobals.txt.WCRY
                                                      • Size 331KB
                                                      • SHA256 14deba62ffecbbf68bf152ef0444ff320051c08ef98f3ceb5502f230167acc67
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      appssynonyms.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{44de0100-7fd6-4388-ad84-444f643306d4}\appssynonyms.txt.WCRY
                                                      • Size 374KB
                                                      • SHA256 8b717f7bc8e8594934b2f5da3310552fb6017ff4c7a7a64852359730c3ba9aef
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      settingsconversions.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{44de0100-7fd6-4388-ad84-444f643306d4}\settingsconversions.txt.WCRY
                                                      • Size 520KB
                                                      • SHA256 13f4234a86042e2f0e26ec78eae059b9aaae56ffc46a79d7f72fd06665ccdec1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      settingsglobals.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{44de0100-7fd6-4388-ad84-444f643306d4}\settingsglobals.txt.WCRY
                                                      • Size 61KB
                                                      • SHA256 67900a0b5abf0f471e4c3b97bc1ba70ffbe6645d31339e0ae36c9db86c3b84d2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      settingssynonyms.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{44de0100-7fd6-4388-ad84-444f643306d4}\settingssynonyms.txt.WCRY
                                                      • Size 125KB
                                                      • SHA256 96035953d521d5abb67c9d6636addd8c096d48ac55124acfec82c6f3da8ba4e9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      appsconversions.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d6bd2419-0fed-445a-a2a6-1fffcd84e678}\appsconversions.txt.WCRY
                                                      • Size 1.4MB
                                                      • SHA256 6c2a6f569b354de4b717400d2517fc08fa229ffd7b1eb679689a63cdd0306873
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      appsglobals.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d6bd2419-0fed-445a-a2a6-1fffcd84e678}\appsglobals.txt.WCRY
                                                      • Size 331KB
                                                      • SHA256 fe7e14109ccc3a3b2ba02b97676c04fed361794f83365954971716240db7cb76
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      appssynonyms.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d6bd2419-0fed-445a-a2a6-1fffcd84e678}\appssynonyms.txt.WCRY
                                                      • Size 374KB
                                                      • SHA256 dd9caa6de0af52044ee8047b9f83d088cc2ca1b5f0aa209ec1c1961497d936a5
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      settingsconversions.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d6bd2419-0fed-445a-a2a6-1fffcd84e678}\settingsconversions.txt.WCRY
                                                      • Size 520KB
                                                      • SHA256 ca28369e14303bc8e19e07a71400b0b1c3280a6cbe1fc25e32e970896eb14fb3
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      settingsglobals.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d6bd2419-0fed-445a-a2a6-1fffcd84e678}\settingsglobals.txt.WCRY
                                                      • Size 61KB
                                                      • SHA256 c23b990f657393f52371e84e5cc3b5ba3235b7ab24b19ed2d0f1a3ff7c0b3a9c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      settingssynonyms.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d6bd2419-0fed-445a-a2a6-1fffcd84e678}\settingssynonyms.txt.WCRY
                                                      • Size 125KB
                                                      • SHA256 6a5f3a44233d8a5d13490ab2daef1d2fa326abf7848494c9ac77d006d22a0233
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      AppsIndex.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\Search\AppsIndex.db.WCRY
                                                      • Size 1.0MB
                                                      • SHA256 68defb04e2be1558b81394b3d9660db3fb58e97b744d82a57f647b0ea5992302
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      settings.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\Search\settings.db.WCRY
                                                      • Size 1.2MB
                                                      • SHA256 56dccb74b88b2aab69119ae683997c226df68921bf6d8cc985439db0842540eb
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SettingsCache.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt.WCRY
                                                      • Size 575KB
                                                      • SHA256 cb36ad73b8880193afb68521e27014ab0d806cd6a04d79003b046188fa7bce2e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      1.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\1.WCRYT
                                                      • Size 1KB
                                                      • SHA256 a57ffe3b3cd0a1bafe37e36daa89d2f9afb9446423cba25df883ab0f9aa8293a
                                                      • MD5 SHA1 SHA512 TLSH

                                                      10.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\10.WCRYT
                                                      • Size 1KB
                                                      • SHA256 2ae1736c46f88d30ded3748674c469f6ebd5f824b167abc77511d1a17204a767
                                                      • MD5 SHA1 SHA512 TLSH

                                                      11.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\11.WCRYT
                                                      • Size 5KB
                                                      • SHA256 f214b739d59d1aa2edb41c8809d8132dc5a5775f66c1725e849b9d5f45f8b017
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      12.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\12.WCRYT
                                                      • Size 1KB
                                                      • SHA256 23fb4d1613fb426612119928a7222ca84a9cba4ba081a8b1be7f2565c013c590
                                                      • MD5 SHA1 SHA512 TLSH

                                                      13.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\13.WCRYT
                                                      • Size 1KB
                                                      • SHA256 f2b25026f9dde3d50479d07494efff95f79c2bfa6c7eff6867051a951d38f9e0
                                                      • MD5 SHA1 SHA512 TLSH

                                                      14.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\14.WCRYT
                                                      • Size 1KB
                                                      • SHA256 f25ab19c435c2cb43e7d86b9bf58f46ec8af6228bc4511d4c5cb9d23e1cc4c04
                                                      • MD5 SHA1 SHA512 TLSH

                                                      15.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\15.WCRYT
                                                      • Size 1KB
                                                      • SHA256 2a560cdee5965876269d30cf82a85b83aeac16903d4f325209ca3354b971c25b
                                                      • MD5 SHA1 SHA512 TLSH

                                                      16.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\16.WCRYT
                                                      • Size 1KB
                                                      • SHA256 1ddb7863b4ff09dd3185943cce8261b98d230f7a239df307a4600ab0c20a8322
                                                      • MD5 SHA1 SHA512 TLSH

                                                      17.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\17.WCRYT
                                                      • Size 1KB
                                                      • SHA256 6a379d8e9545ee7885dcff4c53f1ca553dc9fb0cbaa18a0c71c0b75c8883d044
                                                      • MD5 SHA1 SHA512 TLSH

                                                      2.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\2.WCRYT
                                                      • Size 10KB
                                                      • SHA256 fa08e93892e385bac323598be6f2ca5d50deced90b70ec1077ebf85cb9288a01
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      2.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\2.WCRYT
                                                      • Size 1KB
                                                      • SHA256 434382805003287179ce1ced4422245ee09a7ccacbf5920758078614ccd9689a
                                                      • MD5 SHA1 SHA512 TLSH

                                                      3.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\3.WCRYT
                                                      • Size 952B
                                                      • SHA256 e566796c18517e7084e3a892b3291cc189b85e7830800503c256998ab697a507
                                                      • MD5 SHA1 SHA512 TLSH

                                                      3.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\3.WCRYT
                                                      • Size 6KB
                                                      • SHA256 12ad601b8af3cbff9a865c088fbff78b77ab5c6c47e1dbed76b71c5d338b8c83
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      3.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\3.WCRYT
                                                      • Size 6KB
                                                      • SHA256 e207a2f9646cce24336294ad74beb9813c42f1ebf8ad6bee7ac6fedaa617ddf9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      4.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\4.WCRYT
                                                      • Size 25KB
                                                      • SHA256 847ba4105ca81041b22fe8ce37df5581bef4f4cec7a5f2e7895705dc129ef5b1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      5.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\5.WCRYT
                                                      • Size 1KB
                                                      • SHA256 97bbe02ee0327548d5b3bf2b6f00b507ca4425425e04f95e072b3617b3e4e6bd
                                                      • MD5 SHA1 SHA512 TLSH

                                                      5.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\5.WCRYT
                                                      • Size 1KB
                                                      • SHA256 06c00fa3cb29713aa4317b352fc1e1e035c0c7720a42f107cf758fbb21eaed0c
                                                      • MD5 SHA1 SHA512 TLSH

                                                      6.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\6.WCRYT
                                                      • Size 2KB
                                                      • SHA256 444572dc6fc2eb8f1a880711379a0ec4a80d041549fad959fb5678b4c0b08689
                                                      • MD5 SHA1 SHA512 TLSH

                                                      6.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\6.WCRYT
                                                      • Size 1KB
                                                      • SHA256 bebe7c8f23573efeedb8259fd9e866662dfad2c8e974d2715bb5aebdac870f6d
                                                      • MD5 SHA1 SHA512 TLSH

                                                      6.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\6.WCRYT
                                                      • Size 24KB
                                                      • SHA256 5f72c11fd2fa88d8b8bfae1214551f8d5ee07b8895df824fa717ebbcec118a6c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      7.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\7.WCRYT
                                                      • Size 3KB
                                                      • SHA256 bc6ae87a22ff2fe7feca2cb3f83aaebc8f02ad707cda77b51dab26bc9c5be710
                                                      • MD5 SHA1 SHA512 TLSH

                                                      7.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\7.WCRYT
                                                      • Size 2KB
                                                      • SHA256 f5fcedc00655f8a9b63b379feb04ef904a64328e9ef79e7a411de5139d398ebe
                                                      • MD5 SHA1 SHA512 TLSH

                                                      8.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\8.WCRYT
                                                      • Size 6KB
                                                      • SHA256 56a5a2bbd83b4840d2b6f04fea4f3e9b45245404a5fff83cd7e594e423055a7e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      9.WCRYT

                                                      • Path C:\Users\Admin\AppData\Local\Temp\9.WCRYT
                                                      • Size 2KB
                                                      • SHA256 f127267b7d6f1ef83d170f6460343638b3b48d3f96f4bf8dd2896418dfa36c7c
                                                      • MD5 SHA1 SHA512 TLSH

                                                      BroadcastMsg_1789141840.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1789141840.txt.WCRY
                                                      • Size 280B
                                                      • SHA256 7833f64fb45d8cc378f7e918c02150e6b4e6ba7f7bc5cdbddaf0dc381b954509
                                                      • MD5 SHA1 SHA512 TLSH

                                                      dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.WCRY
                                                      • Size 1KB
                                                      • SHA256 47f209a8b37fb239eeacadbae3587a72b0d1cd41c785539403ef90c4e2eacf67
                                                      • MD5 SHA1 SHA512 TLSH

                                                      dd_vcredistMSI3DB0.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI3DB0.txt.WCRY
                                                      • Size 426KB
                                                      • SHA256 63ff7adb1d42ede6591372029bc0d224f8a689dfc1f4349edb93f3b9af406060
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      dd_vcredistMSI3DD7.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI3DD7.txt.WCRY
                                                      • Size 414KB
                                                      • SHA256 73d0d2f9479fc22d1990f5594a79e4cda868a9bf416fe870816d1e087a6afafd
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      dd_vcredistUI3DB0.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI3DB0.txt.WCRY
                                                      • Size 11KB
                                                      • SHA256 a0f915b3e34e576b14b072cf5a58347d9704e9d44df7f284e13382417a7d1f67
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      dd_vcredistUI3DD7.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI3DD7.txt.WCRY
                                                      • Size 11KB
                                                      • SHA256 e2ab7ba0b1516c4ff5cceeabcacb57c927a6f0fb0fbdc549f5b8f9ec8673dd13
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      mapping.csv.WCRY

                                                      • Path C:\Users\Admin\AppData\Local\Temp\mapping.csv.WCRY
                                                      • Size 121KB
                                                      • SHA256 7d37c693daeb1cb0a6356646d4b0cffc6f4541991b4be582c07a66f14bd6a38a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ApproveAssert.pptx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupDebug\ApproveAssert.pptx.WCRY
                                                      • Size 159KB
                                                      • SHA256 c333aacb9cdc98265f3a1f59438fa452f632291fc495d62c507b6d31ae849d6c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ConfirmUninstall.jpg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupDebug\ConfirmUninstall.jpg.WCRY
                                                      • Size 102KB
                                                      • SHA256 a239f124627f4b7db2ba1b906af87d006873a6c593dbfd24c1abea07a2fa7f29
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      DisableUninstall.zip.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupDebug\DisableUninstall.zip.WCRY
                                                      • Size 149KB
                                                      • SHA256 9d819bd1172511ac1e967e32a172c5e32e026a5f83c22aa2931ae9d25b516b61
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      GrantWait.3gp.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupDebug\GrantWait.3gp.WCRY
                                                      • Size 238KB
                                                      • SHA256 c8204c9c553dd72c2b5731de6c03f02824f06ebe5382f5b1d268e277dd4d62ee
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      MountRegister.xls.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupDebug\MountRegister.xls.WCRY
                                                      • Size 264KB
                                                      • SHA256 cc3430c1db36dadab1daa028d65add18171400e6f288aa9f661777ea4007b6f3
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      NewAdd.jpg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupDebug\NewAdd.jpg.WCRY
                                                      • Size 186KB
                                                      • SHA256 2eda3a04cd97bca3d5ae5b1e9fff899641e2b70ace0038864af58d7660404666
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RepairPing.wmv.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupDebug\RepairPing.wmv.WCRY
                                                      • Size 254KB
                                                      • SHA256 b2436908f8884b00b0e6e3a4fac67e9ab4f4d653930a39ae306e4ebf36925dc0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ResetPublish.zip.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupDebug\ResetPublish.zip.WCRY
                                                      • Size 228KB
                                                      • SHA256 0f06b8116ef606359e861656518b93c40bd574ff63334b812359d7cd581e27c2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ResizeShow.wmv.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupDebug\ResizeShow.wmv.WCRY
                                                      • Size 217KB
                                                      • SHA256 23c9715f33cb968b8bb7b0bed869ba6c8ebc6cd13374e6d5bb41c62d0dbf2518
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ResolveUnpublish.pot.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupDebug\ResolveUnpublish.pot.WCRY
                                                      • Size 259KB
                                                      • SHA256 c56a99bb9b8d042212dc5939e26270f6554c8244d76533cfa701339f3b110855
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ShowConvertTo.rtf.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupDebug\ShowConvertTo.rtf.WCRY
                                                      • Size 275KB
                                                      • SHA256 06b1f2c172c3346758c1d4ad28295265bc384f00df88fdb0dd24353944b66d49
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SubmitExport.mp4.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupDebug\SubmitExport.mp4.WCRY
                                                      • Size 180KB
                                                      • SHA256 5971ba9a82ca253516afeb89e6826e8c027a3aa75ab440ba3c14e64f325d04dc
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      TraceMove.wma.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupDebug\TraceMove.wma.WCRY
                                                      • Size 191KB
                                                      • SHA256 079a45511a94d47f83b46bc329ecb8c77a20b7715c15c8c250277488ad4debf4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UseUpdate.mp3.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupDebug\UseUpdate.mp3.WCRY
                                                      • Size 107KB
                                                      • SHA256 58ff3cd62cc0670e162d060a3064f499502f23b43045eb35e5c007360e733685
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      CompareJoin.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupSkip\CompareJoin.txt.WCRY
                                                      • Size 1.1MB
                                                      • SHA256 b6b3f8da210baf7193de44ddba283b78403f39226bcde600699d9b0924b4811d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      CompressMount.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupSkip\CompressMount.png.WCRY
                                                      • Size 919KB
                                                      • SHA256 03ef22cbb7fd82e7b416bc84e80329838dfabb4b4346dafe84af57dff2a5501a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ConnectGet.asf.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupSkip\ConnectGet.asf.WCRY
                                                      • Size 1003KB
                                                      • SHA256 8b06cadd9fd594268348531237cec1cca386c885638a526883e660d49305a8ca
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      DebugRestart.bmp.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupSkip\DebugRestart.bmp.WCRY
                                                      • Size 1.6MB
                                                      • SHA256 f7debc45ebff6df9de09096d74950606346176c9e866c410ff2c1004236eb8e2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      FindRead.vsd.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupSkip\FindRead.vsd.WCRY
                                                      • Size 836KB
                                                      • SHA256 3b266f07be7b083288c75375e3cf35b7d09ab2403582ea9d010398ba7d875ba9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      GetWait.mpeg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupSkip\GetWait.mpeg.WCRY
                                                      • Size 1.4MB
                                                      • SHA256 a6a6a08ed122844ae2c936e9a7e4cdb657952b16e22747c8abad233104d022b2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UnblockJoin.dwg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\BackupSkip\UnblockJoin.dwg.WCRY
                                                      • Size 2.2MB
                                                      • SHA256 da617e4060070d972171b68ccd7739033fbd54a6898cec3b213a160731e7bcd5
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      CheckpointComplete.vsd.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CheckpointComplete.vsd.WCRY
                                                      • Size 278KB
                                                      • SHA256 032eb850de0ebc0206b13ee433e3c46a04a4025250b106e2856ef7c9b1aa0aaf
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ConvertEnter.dwg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\ConvertEnter.dwg.WCRY
                                                      • Size 533KB
                                                      • SHA256 bb9aea8ccd158fb11304c6af7ae697121b53c111790d46d631c407216027148e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      EditSync.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\EditSync.png.WCRY
                                                      • Size 291KB
                                                      • SHA256 3cfcf4eec5a3e18afdfd551def001da8eef2d7e7e72222b20ab9184bdbacf10a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      EnterDeny.jpg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\EnterDeny.jpg.WCRY
                                                      • Size 575KB
                                                      • SHA256 ef9c111e3d039eaf7903ec9ed50fb1f281378b921f140830702cfb9802481af7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ExpandSkip.xlsx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\ExpandSkip.xlsx.WCRY
                                                      • Size 405KB
                                                      • SHA256 002b826dec0dfef28fb33a64b515303ca882d46589ada462a598214efeb0e640
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      FindBackup.zip.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\FindBackup.zip.WCRY
                                                      • Size 717KB
                                                      • SHA256 67a6612ade9175d5cc4b79939ac692eac574cddf736908f226b82f572a9341c7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      InvokeGrant.ppt.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\InvokeGrant.ppt.WCRY
                                                      • Size 646KB
                                                      • SHA256 b304d2e18296653648198d40c83f6f41fd6900215e02a1015f0079f43d4e673e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      NewComplete.xlt.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\NewComplete.xlt.WCRY
                                                      • Size 561KB
                                                      • SHA256 d3408b747bad2b0f8d2346f50d49b2a150a5ba82202a8eb2a2413b044f6b23d5
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ProtectReset.jpeg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\ProtectReset.jpeg.WCRY
                                                      • Size 263KB
                                                      • SHA256 cba50defc474624c7e8e18570ef22e94d3d7bd1c41e9e715b3425a380b90e19f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      PublishPop.odp.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\PublishPop.odp.WCRY
                                                      • Size 376KB
                                                      • SHA256 3a8c10dbe2f871daa551f32ef9c2b2ffaa3e3d5d8a4f3c1dad3f41458ddaa087
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RemoveUnblock.wma.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\RemoveUnblock.wma.WCRY
                                                      • Size 689KB
                                                      • SHA256 d57a3cb8e3c2bfc8bd8b2652ae4cc419825ccf4a33f975adebdcc7deb9a3a8c3
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RequestSplit.ps1.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\RequestSplit.ps1.WCRY
                                                      • Size 447KB
                                                      • SHA256 271e28deb5a4a6179c492d3273fc4bbf713d80f5ed7757d45a64a5b1bd5e4d73
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SkipUnpublish.mpg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\SkipUnpublish.mpg.WCRY
                                                      • Size 504KB
                                                      • SHA256 9d96ba7bacc3eda52d0fec6b1c94e27eaeda1ed16e789a213099589370fd6e97
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      StopInitialize.mpeg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\StopInitialize.mpeg.WCRY
                                                      • Size 618KB
                                                      • SHA256 e2f4506bcad6e19ea6a510c309cf75316cd2f682d33c96d63625248eef352212
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UndoRename.avi.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\UndoRename.avi.WCRY
                                                      • Size 590KB
                                                      • SHA256 86792cd868070804b7eb438fe3766027a0b3a32d5568f6f858dc1bf8c6e8412a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UninstallWatch.mp4.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\UninstallWatch.mp4.WCRY
                                                      • Size 703KB
                                                      • SHA256 d1ba59f64c609dde55f07f206cedf55764efdd5714e86f699846ee7b8204a8b1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UnprotectCheckpoint.asf.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\UnprotectCheckpoint.asf.WCRY
                                                      • Size 661KB
                                                      • SHA256 65a55090972ec81f7872669653aee41b0dc6e1fc09dd5989f11309d6d136d4e5
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      WaitSelect.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompareOpen\WaitSelect.png.WCRY
                                                      • Size 348KB
                                                      • SHA256 d150d22fe599e932ec50b61318e6fd8bee58036c9e6bd0f2fcbbd9b0749272f7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      CompleteRepair.wma.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\CompleteRepair.wma.WCRY
                                                      • Size 427KB
                                                      • SHA256 c6903392ff9f8fce836f44050f9d0d5ff5f024e79869782386f8bcd357214f2e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      CopyConfirm.wmv.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\DisconnectResize\CopyConfirm.wmv.WCRY
                                                      • Size 217KB
                                                      • SHA256 12e34c671f7cfeeee46a747b08a91381fecfe4a3126a88f4a4fe9433f2fdb95f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      EnterGrant.wma.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\DisconnectResize\EnterGrant.wma.WCRY
                                                      • Size 192KB
                                                      • SHA256 dfc8c1a4c172d88ea08d5943990c62fa44708793539151955cd0488068abb7a2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      InstallRegister.odt.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\DisconnectResize\InstallRegister.odt.WCRY
                                                      • Size 333KB
                                                      • SHA256 e5482adaa66323c52a2f544259ae3ff4071e512a1988ac3053eb7bb79a2ffcfb
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      InvokeAssert.rar.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\DisconnectResize\InvokeAssert.rar.WCRY
                                                      • Size 166KB
                                                      • SHA256 117fe8190877484c8be4470cf950d269d5584cfd31cfcac7f6b4e37fe4864fe0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      MoveBlock.pptx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\DisconnectResize\MoveBlock.pptx.WCRY
                                                      • Size 141KB
                                                      • SHA256 fa23ad8cca2481b857bb347076540a92a79061fa55919d5e31f974172a161a26
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      PublishGrant.sql.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\DisconnectResize\PublishGrant.sql.WCRY
                                                      • Size 499KB
                                                      • SHA256 66384f06ec0d9285b39916608d457e1ed2b0a401266e15cf7cbe20486ddbc653
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RequestRemove.asf.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\DisconnectResize\RequestRemove.asf.WCRY
                                                      • Size 358KB
                                                      • SHA256 30402d6321ffafbec8b2c031680b6b0a11af7a8f8e166119535be1f0ace3140b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SetUninstall.vb.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\DisconnectResize\SetUninstall.vb.WCRY
                                                      • Size 128KB
                                                      • SHA256 423701485d3e424b4cc1e9c2c23376bb6034c543ff184dd2d0bc09a3c20a0cf9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      DenyEnable.xlt.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\EnterHide\DenyEnable.xlt.WCRY
                                                      • Size 430KB
                                                      • SHA256 6e8471380449317c5960eecf13356c8a2567503caba44b39ea198f1cb33dd573
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      EnableCompress.gif.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\EnterHide\EnableCompress.gif.WCRY
                                                      • Size 366KB
                                                      • SHA256 b6c030524ee69511d5b4fe3a6c2e9851cf5ffd590a10a3fdd426b41213ccf720
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      FormatRestart.xls.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\EnterHide\FormatRestart.xls.WCRY
                                                      • Size 557KB
                                                      • SHA256 b8b0fd07197565c37056b081fc23cc21de246d55b423a9049fb3c73499bcb66e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ImportRegister.ods.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\EnterHide\ImportRegister.ods.WCRY
                                                      • Size 462KB
                                                      • SHA256 465e7c8ffe48e8ca9f881ad2aed0a1739303ee29d7f86cb2151898a160814716
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      DenyPush.avi.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\GroupClose\DenyPush.avi.WCRY
                                                      • Size 217KB
                                                      • SHA256 a2470630cc8f5b36f113757f9a5ffa56f22932f25ff57e43eb257377cd66a706
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ExpandConvert.potx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\GroupClose\ExpandConvert.potx.WCRY
                                                      • Size 319KB
                                                      • SHA256 d5d9c7cf4b379bc89a3667e98bd0ad5fb0afd1e3ec8db1ce8e660ef69a8829b5
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      InitializeUse.xltx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\GroupClose\InitializeUse.xltx.WCRY
                                                      • Size 293KB
                                                      • SHA256 10492cd14088c65f420ebd5093b05a7d1d309a26f64e6a10aff8800e36a6b2ea
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      InstallMeasure.tiff.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\GroupClose\InstallMeasure.tiff.WCRY
                                                      • Size 198KB
                                                      • SHA256 808d97d686d578e47aa4e16b3cb8ff270ff98084a6c47ffb83b2b60c9d0a512c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      OutTrace.mid.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\GroupClose\OutTrace.mid.WCRY
                                                      • Size 166KB
                                                      • SHA256 f95032a8bdcf53d83918f3b8b96d7f13265ef0678622635c054320a9141a47e4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ReadUninstall.jpeg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\GroupClose\ReadUninstall.jpeg.WCRY
                                                      • Size 332KB
                                                      • SHA256 886aac9f216a04cefb39d651256d278d3f13e0e862d042ea2df1ad082059d9ac
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RedoUpdate.dotx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\GroupClose\RedoUpdate.dotx.WCRY
                                                      • Size 204KB
                                                      • SHA256 6035d7864e23a943d6668b9c62ebe328bda815fb3ef84cfadd4c64a3afafd480
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RevokeApprove.xlsm.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\GroupClose\RevokeApprove.xlsm.WCRY
                                                      • Size 178KB
                                                      • SHA256 f9bacb0c58bd8ae7f38a5fb73b2172f92ee4605dcee776cf1a6b979d6b5943c5
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RevokeExit.doc.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\GroupClose\RevokeExit.doc.WCRY
                                                      • Size 127KB
                                                      • SHA256 7d581b544e9a9f4e5ba6d96e9e7fe685223f9fdcbba3e7b31198f2cf5dc774e6
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UnregisterFormat.dotx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\GroupClose\UnregisterFormat.dotx.WCRY
                                                      • Size 338KB
                                                      • SHA256 6006efa1db00e5e35c611f9b301058c71a4e60db6e06edffef5ba53f85fa9b18
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UseConvertFrom.tif.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\GroupClose\UseConvertFrom.tif.WCRY
                                                      • Size 300KB
                                                      • SHA256 37c927d6dff9326c7f3742e0bf8531f58a1d7933763ef8db0e9004a35a05eaff
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UseRepair.js.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\GroupClose\UseRepair.js.WCRY
                                                      • Size 325KB
                                                      • SHA256 eae293e0314cea58ccb681db9987c3c088bec8ff441065d795736f70adc7fbee
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      BackupRedo.dwg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\BackupRedo.dwg.WCRY
                                                      • Size 262KB
                                                      • SHA256 af04ca2dc4205aa21b235a2559ff4d0243430105e1e4c0cda0a5b00169709284
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      BlockRename.wmv.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\BlockRename.wmv.WCRY
                                                      • Size 198KB
                                                      • SHA256 2358e470ea167c20f464382577876af005ba576785f1c4a6e134ce0498ffbaf1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      CopyConvertTo.js.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\CopyConvertTo.js.WCRY
                                                      • Size 236KB
                                                      • SHA256 40d109ffded6b0ae72eb482d45e2440d481e5d22cdfa95e3024f3cbe68b54f31
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      CopyResume.zip.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\CopyResume.zip.WCRY
                                                      • Size 275KB
                                                      • SHA256 a6f84f893f1d8acaddf0a40e79d7815f51ec380c88c63e2c2f9ae30488b5cd6e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      DisableExport.7z.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\DisableExport.7z.WCRY
                                                      • Size 518KB
                                                      • SHA256 eb8858e1a8c53767bcc53546125d7cd03b1fb9dc6e83ef4386c3bc759a1eca35
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      EnterMove.7z.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\EnterMove.7z.WCRY
                                                      • Size 224KB
                                                      • SHA256 9e98166a088111983120b67a15fd7faafef6db1075aad7ac315fc85495291be1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      FindResize.jpg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\FindResize.jpg.WCRY
                                                      • Size 249KB
                                                      • SHA256 658e52c65bc1af9366ce2df36fab05e465bd880a65d61eaee687d75c71f88de2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      FormatConvert.m3u.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\FormatConvert.m3u.WCRY
                                                      • Size 390KB
                                                      • SHA256 8b5904e0beffbf086b89ec32b15da5615bda09315ee9bc8a4475249d85ff8ac9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      FormatSwitch.zip.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\FormatSwitch.zip.WCRY
                                                      • Size 403KB
                                                      • SHA256 e6bb35fda6487e250b472516c03ef2c56363c722170c2b24314c1d6050af689a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      HideRename.dotx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\HideRename.dotx.WCRY
                                                      • Size 441KB
                                                      • SHA256 c64b08acbc59a1085901c1a11fd60e2ba61fac0c265278d2ab15b798cc93c853
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      MountShow.3g2.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\MountShow.3g2.WCRY
                                                      • Size 479KB
                                                      • SHA256 a7dd2b9df2b14c6ba212f4086306231bbd4e67712440ad8d754fa1791102bb85
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      NewMove.sql.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\NewMove.sql.WCRY
                                                      • Size 569KB
                                                      • SHA256 ab433b12ba5f23662c1a50ab9ab61a9c8a6134b4e2928e4a6e85693703619c19
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ProtectRestore.php.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\ProtectRestore.php.WCRY
                                                      • Size 300KB
                                                      • SHA256 1a20035fee33bf1dde97766da247de163dbe08dd3e512d0badafc6694124b98a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RequestUnlock.dot.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\RequestUnlock.dot.WCRY
                                                      • Size 543KB
                                                      • SHA256 051265bc573be595663c4230889d32b994210df052fc328b55a5226093b616bf
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ResetFormat.vsdx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\ResetFormat.vsdx.WCRY
                                                      • Size 326KB
                                                      • SHA256 8570a638831d92a228b5dae5ba25f245ee087dfd6df2c148d53c1d08ff00358d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SetConfirm.gif.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\SetConfirm.gif.WCRY
                                                      • Size 351KB
                                                      • SHA256 6707d8fdf9bbf0bba4723069397ccbb22c3e01be15759f893d44b196384d3756
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ShowSuspend.mp3.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\ShowSuspend.mp3.WCRY
                                                      • Size 454KB
                                                      • SHA256 1ac747babbb0191ee666a7eb26223f37550ad9ffb15565ea83d13915f307ad05
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SplitGet.odt.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\SplitGet.odt.WCRY
                                                      • Size 530KB
                                                      • SHA256 5cc56d33aeacf0764bb8daa37012b04341cfe875a9315b2557465f3fff0db2d8
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SwitchPublish.sql.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\SwitchPublish.sql.WCRY
                                                      • Size 287KB
                                                      • SHA256 becfb44a39a6ef34a02b6fec3b158f6f3acf76bdf0c7dcdb9fcd93b5c3152ed4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      TestConvertTo.mov.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ImportConvertTo\TestConvertTo.mov.WCRY
                                                      • Size 556KB
                                                      • SHA256 65d058af27905c8f64de8e5bbb496f38247bf0cd905bb362697f1cf6d179d106
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      CompressReceive.rtf.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\CompressReceive.rtf.WCRY
                                                      • Size 193KB
                                                      • SHA256 5c08e0e63c6cc20c9b0c30390ec1478eb6c9905327414cdabc2c45ec8b6792f4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      DismountGroup.odt.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\DismountGroup.odt.WCRY
                                                      • Size 244KB
                                                      • SHA256 c5891f0d1302d8dd500c5f3124a99e3df51b3780a9ac8ec7021e9db4219d082c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ExpandClear.cmd.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\ExpandClear.cmd.WCRY
                                                      • Size 187KB
                                                      • SHA256 7bbaf9bcdb9c9c7f8d16b3b836d6f2dc9f66dada8be5eb91804ae601424955d2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      GroupImport.xltm.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\GroupImport.xltm.WCRY
                                                      • Size 221KB
                                                      • SHA256 3b02d26e769beb587b5a5389a946aabbe21879008bba29fd25e4a3ca1ee2408a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      MergeConvertTo.avi.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\MergeConvertTo.avi.WCRY
                                                      • Size 295KB
                                                      • SHA256 5f96fbd93acbe34075b0bd0ff1cb5d1d61043c3e008aa632c1daa18c4b87762b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      MergeDismount.ppsm.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\MergeDismount.ppsm.WCRY
                                                      • Size 306KB
                                                      • SHA256 61a988932989380f7ec4e11f4939e37ebecc355337f1ad53f1076781f585f54b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      MountDisable.png.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\MountDisable.png.WCRY
                                                      • Size 136KB
                                                      • SHA256 73cc7cc1767c6fcb140f5350a60bda74c83a70ed06cf87560b5101882d10d91d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      MoveConvertTo.iso.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\MoveConvertTo.iso.WCRY
                                                      • Size 272KB
                                                      • SHA256 765f0b9e878e6f993f9816d4c450a2c0b75d041fae8d15c4f24e4938a062a53c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RegisterConfirm.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\RegisterConfirm.svg.WCRY
                                                      • Size 176KB
                                                      • SHA256 378a991e9c42f20a5ac5cd152eee00debf751adcc23cca7ed6f9c5de17760916
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RegisterJoin.jpg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\RegisterJoin.jpg.WCRY
                                                      • Size 147KB
                                                      • SHA256 37faf48b2984bb44185392d4dec9ec2fdae69e3f0afcd170375e9f100414cc36
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RemoveRead.vbs.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\RemoveRead.vbs.WCRY
                                                      • Size 153KB
                                                      • SHA256 1bb788dfdd258b53b2af8b008630cc00f9209e57d1e16a0b03b1b25dc96728d9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ResizeReset.mp3.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\ResizeReset.mp3.WCRY
                                                      • Size 210KB
                                                      • SHA256 c04a4b9b51161b56cec5c6a2b0c59821a66f6a2b2a5744cb04f2185747236b64
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ResumePing.gif.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\ResumePing.gif.WCRY
                                                      • Size 261KB
                                                      • SHA256 b0d0690de7f1a20390c36b09b61a41f7a6f8e27df6d9de4a42a012a02aa61f21
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RevokeResolve.tif.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\RevokeResolve.tif.WCRY
                                                      • Size 204KB
                                                      • SHA256 0974593424bda712cc484a7809e10d786692882050126a2293231f60962e80f2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SaveResolve.3gp.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\SaveResolve.3gp.WCRY
                                                      • Size 142KB
                                                      • SHA256 564bc05137e45dabb5b57afcf66915a93475239f3fe928f584327804105aadfb
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SendMount.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\SendMount.svg.WCRY
                                                      • Size 198KB
                                                      • SHA256 3e6f856cfce09df62e0dde1b5d4bd2dec4b48ce2fbba05b5ef1580875a4f12cc
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SendSearch.mid.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\SendSearch.mid.WCRY
                                                      • Size 238KB
                                                      • SHA256 e89d2b15a544ef010136d061bb30874131e1fd3cfde9ed9ca725d9d152d08028
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SetUpdate.vsd.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\SetUpdate.vsd.WCRY
                                                      • Size 108KB
                                                      • SHA256 ef46ff3cf4df48b56d1386477a246ac6a967d91291974fd4bde08ca6ccee79f3
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ShowStop.vb.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\ShowStop.vb.WCRY
                                                      • Size 266KB
                                                      • SHA256 6f6014e8848b332cacd3754da530b77e25185a64d927b644f874890e428d3a92
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SplitSkip.gif.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\SplitSkip.gif.WCRY
                                                      • Size 130KB
                                                      • SHA256 43b1c0600872a86c554791c5ed3f01e1e4e36d9650ca55f500cafd1a38d4f584
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      StepInvoke.odt.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\StepInvoke.odt.WCRY
                                                      • Size 181KB
                                                      • SHA256 d6b582fb5ceee786087f580564582cdfc3235bbac36d06507365634e59bed51e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UnprotectSubmit.ppt.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\UnprotectSubmit.ppt.WCRY
                                                      • Size 289KB
                                                      • SHA256 02de64a47bfbccc3e077860081bed6704931971962b8c022d9a90590cd1d96e4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      WaitSync.jpeg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InitializeUnprotect\WaitSync.jpeg.WCRY
                                                      • Size 125KB
                                                      • SHA256 c2be6ed3ba87b5cf7ef668d3693829c0cd027cd9a0792e856b72bd6530665142
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      InstallConvertTo.vbs.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InstallConvertTo.vbs.WCRY
                                                      • Size 291KB
                                                      • SHA256 7542251cdab5aec99f453f6ff21f75ca2bcb9bededddf85678c7b8ae7dd52581
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      InstallSubmit.xls.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InstallSubmit.xls.WCRY
                                                      • Size 440KB
                                                      • SHA256 16d4229950d210b8ea7507dc6235a13a729506a9b8be3176b083ed2b4365b905
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      CheckpointPush.mov.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InvokeSubmit\CheckpointPush.mov.WCRY
                                                      • Size 405KB
                                                      • SHA256 d8d3aa3ea191ff92b71ada382e48ffd94a42b32acd456a33095437b63744043e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      CheckpointUnblock.jpeg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InvokeSubmit\CheckpointUnblock.jpeg.WCRY
                                                      • Size 564KB
                                                      • SHA256 eb11526830a06ba7e64b51862de4dd0d0b77a7ee17ff3e06b42d7a555854f179
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ClearApprove.rtf.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InvokeSubmit\ClearApprove.rtf.WCRY
                                                      • Size 468KB
                                                      • SHA256 12f39423f5a8ee7f69a6bcecc0c8ef47f09218ee5f3128d9bd5891f32a82d11c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      DebugInstall.cmd.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InvokeSubmit\DebugInstall.cmd.WCRY
                                                      • Size 325KB
                                                      • SHA256 7e68c78482a3a5942558a818c670fd432ecda85862691f03934e45330e981bcb
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      EditProtect.mp3.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InvokeSubmit\EditProtect.mp3.WCRY
                                                      • Size 341KB
                                                      • SHA256 19da996f7ea24d1d1ad017ffe4202ec7b7ba3bdddbcbfc2551c9e3c1e698f833
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      FormatSuspend.csv.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InvokeSubmit\FormatSuspend.csv.WCRY
                                                      • Size 437KB
                                                      • SHA256 d826d38b0a184a3b748c0da7658ae195d1eb3b785fa05cbff81d1ed332382fc5
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      GetStep.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InvokeSubmit\GetStep.svg.WCRY
                                                      • Size 516KB
                                                      • SHA256 b321a9d4bd181e3b81ed2a4c4a6cceb4594e49989a492162d6b494797673b74f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ReceiveDisable.js.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InvokeSubmit\ReceiveDisable.js.WCRY
                                                      • Size 294KB
                                                      • SHA256 a76a517a2d69d7676f7a947f74c80a3f7074823e3989a63c620017e974e7ae8f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ResizeDeny.raw.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InvokeSubmit\ResizeDeny.raw.WCRY
                                                      • Size 500KB
                                                      • SHA256 32aca1c3658fda01581efea952a2b765047c4cc60921db8ab9e25145c34c4fec
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ResumeBlock.mp3.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InvokeSubmit\ResumeBlock.mp3.WCRY
                                                      • Size 357KB
                                                      • SHA256 0d9fd57c2cba4cc8e371bc59df75e0b9c2281676d64fa89d42e4a32deddd9285
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SelectResize.7z.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InvokeSubmit\SelectResize.7z.WCRY
                                                      • Size 452KB
                                                      • SHA256 55e748d613822aceac579fbff16d27b9fe90cf460ed438738fd78266d88c4fbd
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SwitchBackup.mp3.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InvokeSubmit\SwitchBackup.mp3.WCRY
                                                      • Size 595KB
                                                      • SHA256 4bad9231ec14f0feaf375581ff23b3d066856961c7faa417b0adb48f82b5536d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SyncFormat.tif.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InvokeSubmit\SyncFormat.tif.WCRY
                                                      • Size 421KB
                                                      • SHA256 646a03d14528c95da8953a3333805f66cd682ef85a246254c358f988844eb961
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UnlockPing.csv.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InvokeSubmit\UnlockPing.csv.WCRY
                                                      • Size 1.1MB
                                                      • SHA256 5970435771c225ff3824166a215aac0598fa77a3f446ad1d8cf152cf69f76243
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UnpublishRegister.xlsx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InvokeSubmit\UnpublishRegister.xlsx.WCRY
                                                      • Size 770KB
                                                      • SHA256 c94674746c5dc966326d7ae4fe4a11499cab4976764ab3b5398c205c00179c01
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UseAdd.mpg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\InvokeSubmit\UseAdd.mpg.WCRY
                                                      • Size 707KB
                                                      • SHA256 d6023b3a097d4c61614493e36cc5f4a5cafab6462c880e35483dabf8cf677be3
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      EnterOptimize.mpg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\JoinSuspend\EnterOptimize.mpg.WCRY
                                                      • Size 1.3MB
                                                      • SHA256 3b4d3586dae87e2c1f493b60f17c8eda474b2c384175f6752a93744584a441f4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      MoveInvoke.3gp.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\JoinSuspend\MoveInvoke.3gp.WCRY
                                                      • Size 884KB
                                                      • SHA256 3e9bd5e184466976717f48b45c2875e3da7449be6175205c680dfed8c53b3967
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SelectSync.xlsb.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\JoinSuspend\SelectSync.xlsb.WCRY
                                                      • Size 1.8MB
                                                      • SHA256 741795ad9ae293779b61d1f3ebd7d04d6c826561d2218c1104e18af8f7410d65
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UnregisterSave.pptm.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\JoinSuspend\UnregisterSave.pptm.WCRY
                                                      • Size 1.6MB
                                                      • SHA256 fc7c04ea2d2edbc8cced7ffe33953e22ca9c69d6fbc5be2b5809f846cf788b7d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      LimitReset.csv.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\LimitReset.csv.WCRY
                                                      • Size 183KB
                                                      • SHA256 226b12de71072d53333476dd515067398dce591cfa297cac3df8cb0794c0553a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      TM01840907[[fn=Equations]].dotx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx.WCRY
                                                      • Size 50KB
                                                      • SHA256 3078cfd57d03c3bd7616c05a9c0d680bf0b4afaf0bc9debcc06dfc171b98d03b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.WCRY
                                                      • Size 46KB
                                                      • SHA256 51c3f286107efa97c99e881871bff5057a55fa28b1c7df03db02b33a0eb66757
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      TM03998158[[fn=Element]].dotx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx.WCRY
                                                      • Size 33KB
                                                      • SHA256 5444462df74817931edf6909029e852f23d192ee2e363779e21338236f8a1f8b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      TM03998159[[fn=Insight]].dotx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx.WCRY
                                                      • Size 3.3MB
                                                      • SHA256 05a0e55761609b8b0d90f53d9b3cd408b490aa7b11b0fffc3bd41444dcb748a2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      Normal.dotm.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm.WCRY
                                                      • Size 18KB
                                                      • SHA256 706b8aabc70ea1b9b2ed847205a924ef192314253a975d4e4682668b5b09db58
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      MountUnpublish.vsd.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\MountUnpublish.vsd.WCRY
                                                      • Size 156KB
                                                      • SHA256 8d02ef98a923fa39c09766468c015e1e93f43a661549aa82d3bb77b4ad35e184
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      prefs.js.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\i75izyhx.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\prefs.js.WCRY
                                                      • Size 776B
                                                      • SHA256 397d4eea608eb512403117e787b523d119e3c5fb552df195aab73574f60dd432
                                                      • MD5 SHA1 SHA512 TLSH

                                                      user.js.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\roe4b6uz.Admin\user.js.WCRY
                                                      • Size 536B
                                                      • SHA256 13af60f236fb567afc78bbd28c1525d7cba3f0033ee967bd82cc8a36a4c6f65e
                                                      • MD5 SHA1 SHA512 TLSH

                                                      cert9.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\cert9.db.WCRY
                                                      • Size 224KB
                                                      • SHA256 20bdf78deaeeda6af677ad0a48959506247f073f36ecf3fbf72bd40d59679383
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      key4.db.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\key4.db.WCRY
                                                      • Size 288KB
                                                      • SHA256 91d165734b98cd26aab402405a54f5964c36bbc01a061f004da4405c6dcefa4e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      pkcs11.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\pkcs11.txt.WCRY
                                                      • Size 808B
                                                      • SHA256 0a574a49e09219459e7ca05fd22941a33818b2eb66095e4efff67597c3ac769d
                                                      • MD5 SHA1 SHA512 TLSH

                                                      prefs.js.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs.js.WCRY
                                                      • Size 6KB
                                                      • SHA256 4b7236001d2f82926af5ffa316c084686a365bf145126b2266f676235769a72a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ConvertDismount.zip.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ReadStart\ConvertDismount.zip.WCRY
                                                      • Size 426KB
                                                      • SHA256 52cbe4195f48e740fedc6450e5d0f3a56c06e314aa63af258bb45b88e536209a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      EnterUnregister.vsd.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ReadStart\EnterUnregister.vsd.WCRY
                                                      • Size 1.6MB
                                                      • SHA256 573bf16b9f0f43c2f10a4fdc877b17321c9e1d2e26693944f26e55558ee0d60b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      MountSync.vsdx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ReadStart\MountSync.vsdx.WCRY
                                                      • Size 1.1MB
                                                      • SHA256 bc865d206efffa2abd18f64588cbe7eb72c51666f3256fe803f492dd90c2412e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SuspendInitialize.docm.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\ReadStart\SuspendInitialize.docm.WCRY
                                                      • Size 498KB
                                                      • SHA256 7730a88f89fa500ca5f800262aed4ec24396e2798a133f88e56fec3687f14f19
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ApproveWatch.pptm.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\RepairWatch\ApproveWatch.pptm.WCRY
                                                      • Size 374KB
                                                      • SHA256 90ddc1a45a14874ba158b07e89d8aac054bd6df150b5de3b1413887b288dd039
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      BackupRevoke.mp4.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\RepairWatch\BackupRevoke.mp4.WCRY
                                                      • Size 345KB
                                                      • SHA256 b6c1cbf12aaa0538a90be6cc2c5f2a87808c68ffb6b0ec32622a74907fd7a4ec
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      DismountSplit.m3u.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\RepairWatch\DismountSplit.m3u.WCRY
                                                      • Size 642KB
                                                      • SHA256 62bb5bcd51c773e49ce0d990d3760c9cf6348fe003d829c4329e0e260fe75059
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ExitPush.mov.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\RepairWatch\ExitPush.mov.WCRY
                                                      • Size 416KB
                                                      • SHA256 b36b2b50b6840dd24f5e63b78643589e87441dee7680e5bbb743a6e45a9c4141
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ExportUnprotect.svg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\RepairWatch\ExportUnprotect.svg.WCRY
                                                      • Size 571KB
                                                      • SHA256 0dc85b36fa409da72187c90f4d0b795f6be450d8dd4bf47ecb5545484f762be5
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      PingAdd.bat.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\RepairWatch\PingAdd.bat.WCRY
                                                      • Size 261KB
                                                      • SHA256 97d08b00a765eef40a568b6c0539c4912b4a1145b0077f93b523db1f4535ac9e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RenameHide.mp4.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\RepairWatch\RenameHide.mp4.WCRY
                                                      • Size 500KB
                                                      • SHA256 0216cab383b2834b9929eee5fb27f2467a2de2383d1f89a2e39312f2c114c13e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RepairDebug.cmd.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\RepairWatch\RepairDebug.cmd.WCRY
                                                      • Size 388KB
                                                      • SHA256 a9d10da690cab247992507c96009e35bf6918d7335c9ec2817fe06ded9edcf1a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RequestResolve.mp4.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\RepairWatch\RequestResolve.mp4.WCRY
                                                      • Size 289KB
                                                      • SHA256 e3e591f2f218cb2bcda5e473d8d9aa8832245aa86908df36609ab527466d692d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SendUninstall.rar.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\RepairWatch\SendUninstall.rar.WCRY
                                                      • Size 472KB
                                                      • SHA256 36cb4bf5714cea08d16162eca20cbca83f2fbd451bcda01de03307f5f2793d45
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SetCopy.jpeg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\RepairWatch\SetCopy.jpeg.WCRY
                                                      • Size 543KB
                                                      • SHA256 bc9185465fd4ecfa6ab8cff0652fe76408db8d481e0f21005e9c7b703e48f9bd
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ShowSkip.wmv.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\RepairWatch\ShowSkip.wmv.WCRY
                                                      • Size 670KB
                                                      • SHA256 d735b3bd3720ca604f721efac14d3162b7204882079f6aeea28be705ab86596f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SuspendOpen.pot.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\RepairWatch\SuspendOpen.pot.WCRY
                                                      • Size 585KB
                                                      • SHA256 52513565366e2f322a0175236d3e81671289746746eba6a64186c3f5018c496c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SelectDisable.mpeg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\SelectDisable.mpeg.WCRY
                                                      • Size 250KB
                                                      • SHA256 eea3da90b3a18b655624fa483c291751cffabb762a614931fa63e07fa6f31811
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SyncPush.rar.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\SyncPush.rar.WCRY
                                                      • Size 223KB
                                                      • SHA256 091c5f835e2ce73b67deb3455170e30ae9d4b9b7dbb0d656d0dbcff3347baa79
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      PushPing.xltm.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\TestResolve\PushPing.xltm.WCRY
                                                      • Size 1.5MB
                                                      • SHA256 93b0b0b72e7b9cd30a80e11f989c68b9a48cf0b6062a71d3bbe16eca1ace37c7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ReadUnpublish.zip.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\TestResolve\ReadUnpublish.zip.WCRY
                                                      • Size 2.6MB
                                                      • SHA256 cb1d34301195d37279d9d0be52c0bd4609386fc96bf8136ff97939ff414f7c95
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SetUnprotect.xlsx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\TestResolve\SetUnprotect.xlsx.WCRY
                                                      • Size 698KB
                                                      • SHA256 e823ef836085b59e26ec116de9d2d5b31916746acfc50d893fc5299a0290a9cc
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      AddWait.vsdx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\TraceUnprotect\AddWait.vsdx.WCRY
                                                      • Size 752KB
                                                      • SHA256 80518fc44d38f773a2e1d37fcd02d034ca54ba7c775eb1302c941639abf23b35
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      InstallShow.wma.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\TraceUnprotect\InstallShow.wma.WCRY
                                                      • Size 564KB
                                                      • SHA256 a081269c9248a5fa1e21b959e2ff9efacaedcdeeac74ebdc5ba897dcac74ce5a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ResizeStart.dotm.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\TraceUnprotect\ResizeStart.dotm.WCRY
                                                      • Size 799KB
                                                      • SHA256 d75a6099f5718a778289ae0df8fdbf549124065e2a6fb0047ddff360fec37b37
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SetRequest.3gp.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\TraceUnprotect\SetRequest.3gp.WCRY
                                                      • Size 1.2MB
                                                      • SHA256 3dfa800c9afa28c5cc7e9e123ba04c5fab6085be27cd59d57bc49e7873e724f3
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ApproveResume.xlsx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\UnregisterDebug\ApproveResume.xlsx.WCRY
                                                      • Size 339KB
                                                      • SHA256 ec73ff998fab966a1a855e5e20a5e9f999419dc7ac7e126a3232198d430c300d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      CompareExport.docm.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\UnregisterDebug\CompareExport.docm.WCRY
                                                      • Size 285KB
                                                      • SHA256 deaa43ec3ec5f6847a9c6ae02026c7dfb06aa14a11c6b3ae69067721424e80c7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      DisableBlock.dwg.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\UnregisterDebug\DisableBlock.dwg.WCRY
                                                      • Size 307KB
                                                      • SHA256 b26ab61e872390a35940e27097c611c2efc9b121632d193f71ba8a9158f82355
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      EditSync.csv.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\UnregisterDebug\EditSync.csv.WCRY
                                                      • Size 608KB
                                                      • SHA256 41afc637fe715b31b8085c67c132e34348de2de8f74e3a2bc299aec03ab151d4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      FindUnlock.wma.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\UnregisterDebug\FindUnlock.wma.WCRY
                                                      • Size 479KB
                                                      • SHA256 345287d1705f3cdecd1d26429961796f7dfc244d38e2daef9878dcb8fb5bfcb0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ReceiveResume.raw.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\UnregisterDebug\ReceiveResume.raw.WCRY
                                                      • Size 468KB
                                                      • SHA256 a01daf2d0234473d2e16419bad4f444d8c51cd6c912388f088787d2b684e7761
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RegisterDisable.xls.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\UnregisterDebug\RegisterDisable.xls.WCRY
                                                      • Size 414KB
                                                      • SHA256 3d695d3655937ba9f1763b4e1dd847219bff14ee931c86d4fcde80b6070ed151
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RemoveUnblock.xltm.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\UnregisterDebug\RemoveUnblock.xltm.WCRY
                                                      • Size 544KB
                                                      • SHA256 b6944909465cad9e77a9ed9673086b2db6264c20c54159daa0400c9c4baaef05
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RenameUnregister.js.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\UnregisterDebug\RenameUnregister.js.WCRY
                                                      • Size 242KB
                                                      • SHA256 d8c556154e3f2a1f0cabbf61e962b3bfbbf02a232dfc58158e19c448dbd0938d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RepairEnable.sql.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\UnregisterDebug\RepairEnable.sql.WCRY
                                                      • Size 361KB
                                                      • SHA256 bf54eb46d5fa7ac5227c18ac755cb0e4abed16cf5db1950725583362b7d6468d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ResumeBlock.xltx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\UnregisterDebug\ResumeBlock.xltx.WCRY
                                                      • Size 533KB
                                                      • SHA256 a202dd9904837efd55b610e401ff9458eca8f6a7cf911ffd27edd28b82d9bbae
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RevokeStop.rar.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\UnregisterDebug\RevokeStop.rar.WCRY
                                                      • Size 555KB
                                                      • SHA256 1e95f2c622ee51e2c703e020e1666b8bfbed8f2eec78c1eadf4acd9c1b5aebf9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SearchWatch.rtf.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\UnregisterDebug\SearchWatch.rtf.WCRY
                                                      • Size 371KB
                                                      • SHA256 515a8a6904ce99ad76b364120da04d6ece7d367012dd867e9a4dfccc3242717f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SwitchTest.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\UnregisterDebug\SwitchTest.txt.WCRY
                                                      • Size 490KB
                                                      • SHA256 e331180bf84692511402ec1df39836bb5bf57ccdb1bf867a1656763e53eee057
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      WatchReceive.xlsx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\UnregisterDebug\WatchReceive.xlsx.WCRY
                                                      • Size 425KB
                                                      • SHA256 0869af06acaf7ea56bea23a75c7863488c218a9d665ae3da1d8a4a72b1df080d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      JoinNew.pptx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\WatchGrant\JoinNew.pptx.WCRY
                                                      • Size 836KB
                                                      • SHA256 71aa1fb16b37a8ac2e1d76508db8a69694d0989dbb2f5fb43670abb655c28c22
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RedoBackup.txt.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\WatchGrant\RedoBackup.txt.WCRY
                                                      • Size 1.6MB
                                                      • SHA256 3745fab67508b773764c2072fa18e581a707d607c48f78a7b04711e6d359a3ef
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ResetDisable.xlsx.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\WatchGrant\ResetDisable.xlsx.WCRY
                                                      • Size 1.6MB
                                                      • SHA256 951492b19c2ef01a464fa0cb4155217a27f234027fdce9652c0b0fbfb5c7a934
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SyncProtect.mp4.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\WatchGrant\SyncProtect.mp4.WCRY
                                                      • Size 1.4MB
                                                      • SHA256 eecfbebbc3f2b216f64c328cfaf8be904f8a24666495b5af21be8a4a8bfc32f0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UseResize.3g2.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\WatchGrant\UseResize.3g2.WCRY
                                                      • Size 1.5MB
                                                      • SHA256 f034c36eb814f14113f9b003bc846007a5ead1b647171e8d5b0ac0c07bd7df48
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SendUnblock.pptm.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\WriteSkip\SendUnblock.pptm.WCRY
                                                      • Size 1.3MB
                                                      • SHA256 222c9dd1f83aec8bf8b366044cbe5395ef6300db5c3e16ba557d9c14d9c4fa66
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UnblockConvertFrom.ps1.WCRY

                                                      • Path C:\Users\Admin\AppData\Roaming\WriteSkip\UnblockConvertFrom.ps1.WCRY
                                                      • Size 502KB
                                                      • SHA256 e485e778dfffb36cefc7b57a659d91ead7c8ff270dd2e63cf99f9807e07db0d2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      BlockRemove.vsd.WCRY

                                                      • Path C:\Users\Admin\Desktop\BlockRemove.vsd.WCRY
                                                      • Size 608KB
                                                      • SHA256 996aacd83f60dbf324abf5a747968a0b62b7bf13d07fff3d6ec1218efb2b2cf9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      CompleteCompare.asp.WCRY

                                                      • Path C:\Users\Admin\Desktop\CompleteCompare.asp.WCRY
                                                      • Size 544KB
                                                      • SHA256 73f4d6c923ecf293c33ddcebf8bbbcfba1311a49a9e3905d297c648eaa91280f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ConnectDisconnect.wav.WCRY

                                                      • Path C:\Users\Admin\Desktop\ConnectDisconnect.wav.WCRY
                                                      • Size 640KB
                                                      • SHA256 e08b97c3da236e1cd6ea00ab8a42fc3df6fc9d7c8823dc7bafc3d3b360c9e16c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ConvertToInstall.sql.WCRY

                                                      • Path C:\Users\Admin\Desktop\ConvertToInstall.sql.WCRY
                                                      • Size 480KB
                                                      • SHA256 464dfc28d993ee251cab7562fa0f0afbaaef631b0dadfe16c773e48145d0d57c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      DisconnectExpand.odt.WCRY

                                                      • Path C:\Users\Admin\Desktop\DisconnectExpand.odt.WCRY
                                                      • Size 416KB
                                                      • SHA256 64b21e7fdcb6ca3b4be38a651ee5674f9fbc5634155c9a5b447445ea94cffa2b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      FindResize.mov.WCRY

                                                      • Path C:\Users\Admin\Desktop\FindResize.mov.WCRY
                                                      • Size 896KB
                                                      • SHA256 70ab4ed6efbd856f86a48f335f591cfaad6858716cf9814c7256177ddc7a8972
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      GroupExport.mp4.WCRY

                                                      • Path C:\Users\Admin\Desktop\GroupExport.mp4.WCRY
                                                      • Size 832KB
                                                      • SHA256 e1f264feb3f83213e2792a187bb787f13a9fcf4ee8c28c4d7a772d0667d17845
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ImportUnlock.xlsx.WCRY

                                                      • Path C:\Users\Admin\Desktop\ImportUnlock.xlsx.WCRY
                                                      • Size 12KB
                                                      • SHA256 fbb1ca301149ba11e4a54d56b34a2faaa935adb8c6031fa35c67f89e839c048d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      InvokeExpand.wma.WCRY

                                                      • Path C:\Users\Admin\Desktop\InvokeExpand.wma.WCRY
                                                      • Size 736KB
                                                      • SHA256 77b9625776e6c821458febc96f66698dd567e63910b100170c823a821f94cd25
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      OptimizeMove.odp.WCRY

                                                      • Path C:\Users\Admin\Desktop\OptimizeMove.odp.WCRY
                                                      • Size 960KB
                                                      • SHA256 498b745e9f97118118078a248c805a830e570a38613008740aaff53353155212
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      PublishResume.xlsx.WCRY

                                                      • Path C:\Users\Admin\Desktop\PublishResume.xlsx.WCRY
                                                      • Size 11KB
                                                      • SHA256 6100b8eef8fbe1ae80e39103159b036609fb3c60b76622ae5f0b7f068de47d39
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ResetComplete.xlt.WCRY

                                                      • Path C:\Users\Admin\Desktop\ResetComplete.xlt.WCRY
                                                      • Size 384KB
                                                      • SHA256 d5059cc33d1130ea90d67d262388ac6c121405eee0bcc759bb460d9f35a560ca
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SetClear.cmd.WCRY

                                                      • Path C:\Users\Admin\Desktop\SetClear.cmd.WCRY
                                                      • Size 864KB
                                                      • SHA256 716e4ca494edd59811ede0ed72d0d02a11ba67bae87559aaab578222e2620271
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SubmitResize.zip.WCRY

                                                      • Path C:\Users\Admin\Desktop\SubmitResize.zip.WCRY
                                                      • Size 928KB
                                                      • SHA256 34cc820722e5efae3297b1072c45e53c3fa3bf98d91ba79932c3518eb4daa156
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SwitchWait.mpeg.WCRY

                                                      • Path C:\Users\Admin\Desktop\SwitchWait.mpeg.WCRY
                                                      • Size 672KB
                                                      • SHA256 476cd06478f9599bcfefc494e9bba1743a68845d5477f7f1a9603c5786d14a18
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      WaitBackup.xls.WCRY

                                                      • Path C:\Users\Admin\Desktop\WaitBackup.xls.WCRY
                                                      • Size 992KB
                                                      • SHA256 f91a567389443a31e2651daa976cda5e059d5ef62b62d439f6cd6b685bea05c3
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ConnectSwitch.xlt.WCRY

                                                      • Path C:\Users\Admin\Documents\ConnectSwitch.xlt.WCRY
                                                      • Size 804KB
                                                      • SHA256 db06f5337d846286e7e8f052cb508f60fa29485b51a1629704b054fbf4754b23
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      DisableOptimize.xlsb.WCRY

                                                      • Path C:\Users\Admin\Documents\DisableOptimize.xlsb.WCRY
                                                      • Size 881KB
                                                      • SHA256 324d5a2c6d309a2dafadbddd5a8363c96007ace704f949b8ba43d713c43fe3db
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      DisableResolve.xls.WCRY

                                                      • Path C:\Users\Admin\Documents\DisableResolve.xls.WCRY
                                                      • Size 957KB
                                                      • SHA256 c7487a4413de3fea6fb2d5781e3a599f47b914b6d4085319f0461c295c6f6ece
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      DisconnectOptimize.pps.WCRY

                                                      • Path C:\Users\Admin\Documents\DisconnectOptimize.pps.WCRY
                                                      • Size 1.4MB
                                                      • SHA256 b279cbf703d41a6b8891243449da983a7b83b51fe0d51e46313fa56c017cf088
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ImportInitialize.ppsx.WCRY

                                                      • Path C:\Users\Admin\Documents\ImportInitialize.ppsx.WCRY
                                                      • Size 2.8MB
                                                      • SHA256 1364d086e6c61af1cf880f2d8410ef50957a2ec35cc8b3af7f9f58f515f5517e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      Open Notebook.onetoc2.WCRY

                                                      • Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.WCRY
                                                      • Size 6KB
                                                      • SHA256 bdbc72c475a8ade34eabc4c54dc2c8c610a494bba8048226feae1a117086f253
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      Outlook Data File - ksrgwhulyp.pst.WCRY

                                                      • Path C:\Users\Admin\Documents\Outlook Files\Outlook Data File - ksrgwhulyp.pst.WCRY
                                                      • Size 265KB
                                                      • SHA256 79741c97abe1f4f530cf9cd62a476c75276d0091001ad2415b84a50552a5a266
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RedoUnpublish.docx.WCRY

                                                      • Path C:\Users\Admin\Documents\RedoUnpublish.docx.WCRY
                                                      • Size 19KB
                                                      • SHA256 3d13378281ce012ff508a934155d977ad08a5d5ac9606a1cafacb9bde4feacce
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RemoveUninstall.pdf.WCRY

                                                      • Path C:\Users\Admin\Documents\RemoveUninstall.pdf.WCRY
                                                      • Size 1.8MB
                                                      • SHA256 33526977f813f7ee9eba78f1f377482b99443d77af73b9838f29fd5d2f0bb590
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RenameMerge.ppsm.WCRY

                                                      • Path C:\Users\Admin\Documents\RenameMerge.ppsm.WCRY
                                                      • Size 1.5MB
                                                      • SHA256 1e4215e590e9f68f2d7bfb81d2ef3b572a9f039c87a69ce95fb09b50a59a1766
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RestoreMerge.docx.WCRY

                                                      • Path C:\Users\Admin\Documents\RestoreMerge.docx.WCRY
                                                      • Size 13KB
                                                      • SHA256 918b527f6d9daa091763ca27f2148d0eaafe72cc8fbce9790bc0922aabcbec97
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SaveWait.docx.WCRY

                                                      • Path C:\Users\Admin\Documents\SaveWait.docx.WCRY
                                                      • Size 17KB
                                                      • SHA256 fa49c771d879f968edf52b0e915dfc4c6a243d054de77d8cb92e85e8580794f3
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UnlockMeasure.docx.WCRY

                                                      • Path C:\Users\Admin\Documents\UnlockMeasure.docx.WCRY
                                                      • Size 20KB
                                                      • SHA256 d0b6ad4d02e50a16f90b17bf7b709b819efd3186363c5847837ba168980f4b63
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UnprotectResume.xlsx.WCRY

                                                      • Path C:\Users\Admin\Documents\UnprotectResume.xlsx.WCRY
                                                      • Size 11KB
                                                      • SHA256 2b465742a716691cebbad2f3b01e26efe0ebebe80932a616e0c664def79495bc
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UnprotectSwitch.odt.WCRY

                                                      • Path C:\Users\Admin\Documents\UnprotectSwitch.odt.WCRY
                                                      • Size 1.1MB
                                                      • SHA256 85bada473f31a5cb9f148633b1ed8f89dec8c17da8e4d43176c92e4a564fdcc8
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      WriteMount.xlsx.WCRY

                                                      • Path C:\Users\Admin\Documents\WriteMount.xlsx.WCRY
                                                      • Size 10KB
                                                      • SHA256 34ac446da606a8c7703e683b5dee5ffa590626bafe880ff9341322fbf54056a1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      !WannaDecryptor!.exe.lnk

                                                      • Path C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk
                                                      • Size 570B
                                                      • SHA256 f9c9db310f50044fc5097ab96b26ca540a5783b83b90039f2ae34d915c842c55
                                                      • MD5 SHA1 SHA512 TLSH

                                                      00000000.res

                                                      • Path C:\Users\Admin\Downloads\00000000.res
                                                      • Size 136B
                                                      • SHA256 4c317ff4d6a69da6e265e75a9ec1afec3229ccd91b5541535fc93ca0779592fd
                                                      • MD5 SHA1 SHA512 TLSH

                                                      00000000.res

                                                      • Path C:\Users\Admin\Downloads\00000000.res
                                                      • Size 136B
                                                      • SHA256 80748dcd6b1fe5fdb5fe6a71fb8d077947698fc78b06ec3c059d8e741d227716
                                                      • MD5 SHA1 SHA512

                                                      314811792811922.bat

                                                      • Path C:\Users\Admin\Downloads\314811792811922.bat
                                                      • Size 318B
                                                      • SHA256 4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44
                                                      • MD5 SHA1 SHA512 TLSH

                                                      991bd9cf-36ed-4083-82f8-e00f90237e62.tmp

                                                      • Path C:\Users\Admin\Downloads\991bd9cf-36ed-4083-82f8-e00f90237e62.tmp
                                                      • Size 224KB
                                                      • SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      c.vbs

                                                      • Path C:\Users\Admin\Downloads\c.vbs
                                                      • Size 201B
                                                      • SHA256 5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1
                                                      • MD5 SHA1 SHA512 TLSH

                                                      c.wry

                                                      • Path C:\Users\Admin\Downloads\c.wry
                                                      • Size 628B
                                                      • SHA256 bf22e8e18db1638673f47591a13d18ee58d8c6019314bab5a90be82ae3dc9538
                                                      • MD5 SHA1 SHA512 TLSH

                                                      c.wry

                                                      • Path C:\Users\Admin\Downloads\c.wry
                                                      • Size 628B
                                                      • SHA256 a69c8a47df06fe3cae8ed9a7150672431ac878d7cd42aa4f049d52b1e81846e8
                                                      • MD5 SHA1 SHA512 TLSH

                                                      m.wry

                                                      • Path C:\Users\Admin\Downloads\m.wry
                                                      • Size 42KB
                                                      • SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      r.wry

                                                      • Path C:\Users\Admin\Downloads\r.wry
                                                      • Size 729B
                                                      • SHA256 c9e9dc06f500ae39bfeb4671233cc97bb6dab58d97bb94aba4a2e0e509418d35
                                                      • MD5 SHA1 SHA512 TLSH

                                                      t.wry

                                                      • Path C:\Users\Admin\Downloads\t.wry
                                                      • Size 68KB
                                                      • SHA256 a7dd727b4e0707026186fcab24ff922da50368e1a4825350bd9c4828c739a825
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      u.wry

                                                      • Path C:\Users\Admin\Downloads\u.wry
                                                      • Size 236KB
                                                      • SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      BackupHide.dot.WCRY

                                                      • Path C:\Users\Admin\Music\BackupHide.dot.WCRY
                                                      • Size 215KB
                                                      • SHA256 5b325ce0a31862cb034ea7ffd46e5dd788c60390e7bd9ab2bca0fc43be215f45
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      DebugResume.avi.WCRY

                                                      • Path C:\Users\Admin\Music\DebugResume.avi.WCRY
                                                      • Size 522KB
                                                      • SHA256 f338b6e58852ec0ed8bf05c50671fa4726a4fb3e330d902e377a339937de13c9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      FindConvert.xlsx.WCRY

                                                      • Path C:\Users\Admin\Music\FindConvert.xlsx.WCRY
                                                      • Size 157KB
                                                      • SHA256 7a06acf9cf887f63b92b5bd36bf50086dba67300d125fd8be6e9be5818835f7a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      FormatCompare.wmv.WCRY

                                                      • Path C:\Users\Admin\Music\FormatCompare.wmv.WCRY
                                                      • Size 180KB
                                                      • SHA256 53553df7e607af8d916ae2f44c640e3387822b69e57676c171e1932330220a30
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      LimitRead.raw.WCRY

                                                      • Path C:\Users\Admin\Music\LimitRead.raw.WCRY
                                                      • Size 273KB
                                                      • SHA256 7d9e14317f6f4856354ddbb8ad79888a7a75f42860f323b4961d109e0a49eb9b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RenameClear.wmv.WCRY

                                                      • Path C:\Users\Admin\Music\RenameClear.wmv.WCRY
                                                      • Size 342KB
                                                      • SHA256 762757e816af80314639630b6a15b02f72f59179fa550da59aa58242f5eb5c41
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RenameJoin.vsdx.WCRY

                                                      • Path C:\Users\Admin\Music\RenameJoin.vsdx.WCRY
                                                      • Size 145KB
                                                      • SHA256 c75b44c42a8470270b236c2b3fd6c1163980284f7541984cb1d9fed9e2ae1f54
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ResumeSync.pot.WCRY

                                                      • Path C:\Users\Admin\Music\ResumeSync.pot.WCRY
                                                      • Size 296KB
                                                      • SHA256 1a77be695fd116c01febca38bca1fe18e92a49e7782f7e7d21d93b270e6bf826
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      StartSplit.sql.WCRY

                                                      • Path C:\Users\Admin\Music\StartSplit.sql.WCRY
                                                      • Size 377KB
                                                      • SHA256 0b152a346e0de5502f48ba455d598e1a83993138cd6936ca85f1b5f6e3068850
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UnpublishOptimize.wma.WCRY

                                                      • Path C:\Users\Admin\Music\UnpublishOptimize.wma.WCRY
                                                      • Size 203KB
                                                      • SHA256 3d875ee3d018dcde3ab7bef70b94c93b37f2c32619abd2cc2af75fb9e228a558
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      WriteProtect.wma.WCRY

                                                      • Path C:\Users\Admin\Music\WriteProtect.wma.WCRY
                                                      • Size 133KB
                                                      • SHA256 7293dc8cb34472a935cf2b3e152169357bf5503aa92f1a819c4351058a38fb64
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      CompressBlock.dwg.WCRY

                                                      • Path C:\Users\Admin\Pictures\CompressBlock.dwg.WCRY
                                                      • Size 462KB
                                                      • SHA256 4d79744f921f8a9d70fd3a04f30d0bfa23624dbd3a41043bdc9f8d37b7d6c942
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ConvertToSkip.jpg.WCRY

                                                      • Path C:\Users\Admin\Pictures\ConvertToSkip.jpg.WCRY
                                                      • Size 350KB
                                                      • SHA256 9a1cbc02127d8e6f7a7c84df173f42099c74d4c1cb97b1f51c25c036b3980ec1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      EnableSync.raw.WCRY

                                                      • Path C:\Users\Admin\Pictures\EnableSync.raw.WCRY
                                                      • Size 302KB
                                                      • SHA256 7f380a8cbd5607cecf70d8076ab45d7bebd96e128349cfa9970c117016e5430a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      LockUninstall.tiff.WCRY

                                                      • Path C:\Users\Admin\Pictures\LockUninstall.tiff.WCRY
                                                      • Size 940KB
                                                      • SHA256 53fcba60b82bbfdc58602baceb71b24251bff54192506cf8191d3a49c786b945
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      PushAdd.jpg.WCRY

                                                      • Path C:\Users\Admin\Pictures\PushAdd.jpg.WCRY
                                                      • Size 653KB
                                                      • SHA256 27e2428ace5ec9b4472a3b03f1883870a386bb54e0d834b20cde9db61c13f78d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RemoveWrite.jpeg.WCRY

                                                      • Path C:\Users\Admin\Pictures\RemoveWrite.jpeg.WCRY
                                                      • Size 685KB
                                                      • SHA256 1fcecf146318d2e1f130bdcea5901465e948a1515095cfaa77aacaed541e48ef
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      RepairConvert.raw.WCRY

                                                      • Path C:\Users\Admin\Pictures\RepairConvert.raw.WCRY
                                                      • Size 334KB
                                                      • SHA256 7bec300f394b5a2198f20126da61bf51eebef977601ee2c6bd9baea5437a44ed
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SendRevoke.jpg.WCRY

                                                      • Path C:\Users\Admin\Pictures\SendRevoke.jpg.WCRY
                                                      • Size 318KB
                                                      • SHA256 fb9d865c6cf3bd8cf2be948e0fe1e1a8f8153e6c15ca129bf93e62938c169386
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      ShowMount.bmp.WCRY

                                                      • Path C:\Users\Admin\Pictures\ShowMount.bmp.WCRY
                                                      • Size 589KB
                                                      • SHA256 6d784642aa107808b738b69e0c607e887a6ce34963e16a6772b7ff9cacd1b07a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SplitAssert.raw.WCRY

                                                      • Path C:\Users\Admin\Pictures\SplitAssert.raw.WCRY
                                                      • Size 621KB
                                                      • SHA256 17efa4293c7f5796ae0063eddd0f59c12cf3b0dac95ea0fce1df315188b0b75e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      StopRepair.png.WCRY

                                                      • Path C:\Users\Admin\Pictures\StopRepair.png.WCRY
                                                      • Size 669KB
                                                      • SHA256 379717297d895c6d538c68de19c60905e6d300002b620bbe4f5bc3b5bc40b48d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SubmitJoin.svg.WCRY

                                                      • Path C:\Users\Admin\Pictures\SubmitJoin.svg.WCRY
                                                      • Size 430KB
                                                      • SHA256 37c10507b00df3f4374819dfd2e8eba4e87d12a0624bf2f4165ba19a7eb8b194
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      SwitchComplete.jpeg.WCRY

                                                      • Path C:\Users\Admin\Pictures\SwitchComplete.jpeg.WCRY
                                                      • Size 637KB
                                                      • SHA256 ca2e981b612c6430a64000fbdff50e065dad8abcc26442b3d7821328ca099dca
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UnblockApprove.jpg.WCRY

                                                      • Path C:\Users\Admin\Pictures\UnblockApprove.jpg.WCRY
                                                      • Size 366KB
                                                      • SHA256 704e578ae4a19fed502860eb68d1077abf819187cb646b3fc860395a4d7f8671
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UninstallConvert.png.WCRY

                                                      • Path C:\Users\Admin\Pictures\UninstallConvert.png.WCRY
                                                      • Size 509KB
                                                      • SHA256 6033f21613012bdbc32805b320c40a8f7f422071ed9ad89d18d524556e4f5aba
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      UnlockMount.bmp.WCRY

                                                      • Path C:\Users\Admin\Pictures\UnlockMount.bmp.WCRY
                                                      • Size 414KB
                                                      • SHA256 2dbf0c43525963bdd30b5563690c74e1fd8f5a4fba2397e610bd2c4019226acc
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      sDJnM.jpg.WCRY

                                                      • Path C:\Users\Admin\Pictures\sDJnM.jpg.WCRY
                                                      • Size 25KB
                                                      • SHA256 4b461f503038d5e01bc57aef6be62cae1809a679e4b2428031bf64ba6fcdcf72
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                      memory/1108-185-0x0000000010000000-0x0000000010012000-memory.dmp