wannacry | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry[.]exe

user interaction
yes
max time kernel
82s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe
Sample261024-e4ejbasvc1

Score

10^/10

defense_evasion discovery execution wannacry persistence ransomware worm

Malware Config

Extracted

Path

C:\!Please Read Me!.txt

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	892	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
3688	WannaCry.exe
1812	WannaCry.exe
1484	!WannaDecryptor!.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2700	cscript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3496	cmd.exe
3244	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
892	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
2960	taskkill.exe
2940	taskkill.exe
544	taskkill.exe
4024	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1484	!WannaDecryptor!.exe
1484	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 412	2692	chrome.exe	86
PID 2692 wrote to memory of 872	2692	chrome.exe	87
PID 2692 wrote to memory of 872	2692	chrome.exe	87
PID 2692 wrote to memory of 892	2692	chrome.exe	88
PID 2692 wrote to memory of 4348	2692	chrome.exe	89
PID 2692 wrote to memory of 4348	2692	chrome.exe	89
PID 2692 wrote to memory of 4440	2692	chrome.exe	91
PID 2692 wrote to memory of 1224	2692	chrome.exe	92
PID 2692 wrote to memory of 4440	2692	chrome.exe	91
PID 2692 wrote to memory of 1224	2692	chrome.exe	92
PID 2692 wrote to memory of 1588	2692	chrome.exe	93
PID 2692 wrote to memory of 1656	2692	chrome.exe	99
PID 2692 wrote to memory of 1916	2692	chrome.exe	104
PID 2692 wrote to memory of 3676	2692	chrome.exe	105
PID 2692 wrote to memory of 1800	2692	chrome.exe	106
PID 2692 wrote to memory of 3196	2692	chrome.exe	108
PID 2692 wrote to memory of 3196	2692	chrome.exe	108
PID 2692 wrote to memory of 908	2692	chrome.exe	109
PID 2692 wrote to memory of 908	2692	chrome.exe	109
PID 2692 wrote to memory of 3244	2692	chrome.exe	110
PID 2692 wrote to memory of 3244	2692	chrome.exe	110
PID 2692 wrote to memory of 3268	2692	chrome.exe	111
PID 2692 wrote to memory of 3268	2692	chrome.exe	111
PID 2692 wrote to memory of 3688	2692	chrome.exe	112
PID 3688 wrote to memory of 3496	3688	WannaCry.exe	114
PID 3496 wrote to memory of 2700	3496	cmd.exe	116
PID 3688 wrote to memory of 1484	3688	WannaCry.exe	119
PID 3688 wrote to memory of 4024	3688	WannaCry.exe	120
PID 3688 wrote to memory of 544	3688	WannaCry.exe	121
PID 3688 wrote to memory of 2940	3688	WannaCry.exe	122
PID 3688 wrote to memory of 2960	3688	WannaCry.exe	123

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc66c3c728,0x7ffc66c3c734,0x7ffc66c3c740
  2⤵
  PID:412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,13361153856867575355,2251611078373276637,262144 --field-trial-handle=1992,i,2253468379933334410,4318446799979418369,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1628,i,1728592482125826812,16983123633166809445,524288 --field-trial-handle=1992,i,2253468379933334410,4318446799979418369,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,5935024570706025443,9771467651059758060,524288 --field-trial-handle=1992,i,2253468379933334410,4318446799979418369,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,7787440969563861007,12438359249040664074,2097152 --field-trial-handle=1992,i,2253468379933334410,4318446799979418369,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,13733038392023920023,7441744075289362804,2097152 --field-trial-handle=1992,i,2253468379933334410,4318446799979418369,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,6930737535384664094,1259100532229400747,524288 --field-trial-handle=1992,i,2253468379933334410,4318446799979418369,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,5945630984173312602,232348225083957672,524288 --field-trial-handle=1992,i,2253468379933334410,4318446799979418369,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,13351380445056843443,7939810121037756082,524288 --field-trial-handle=1992,i,2253468379933334410,4318446799979418369,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,16116552482921207322,6023639696686686252,524288 --field-trial-handle=1992,i,2253468379933334410,4318446799979418369,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,5088505117849759622,17437357730325494793,524288 --field-trial-handle=1992,i,2253468379933334410,4318446799979418369,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5820,i,17357509929024127889,785851219171724280,2097152 --field-trial-handle=1992,i,2253468379933334410,4318446799979418369,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3960,i,3072980297229418219,4614015487220493044,2097152 --field-trial-handle=1992,i,2253468379933334410,4318446799979418369,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3404,i,6082724829159776512,2726696939048484443,2097152 --field-trial-handle=1992,i,2253468379933334410,4318446799979418369,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6028,i,13336938543063257376,9948124205684181056,2097152 --field-trial-handle=1992,i,2253468379933334410,4318446799979418369,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:3268
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 249601792816273.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo c.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:2700
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe f
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MSExchange*
    3⤵
    - Kills process with taskkill
    PID:4024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Microsoft.Exchange.*
    3⤵
    - Kills process with taskkill
    PID:544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlserver.exe
    3⤵
    - Kills process with taskkill
    PID:2940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlwriter.exe
    3⤵
    - Kills process with taskkill
    PID:2960
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe c
    3⤵
    PID:7088
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b !WannaDecryptor!.exe v
    3⤵
    - Executes a command shell one-liner
    PID:3244
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe v
      4⤵
      PID:2724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3900

C:\Users\Admin\Downloads\WannaCry.exe
"C:\Users\Admin\Downloads\WannaCry.exe" /r
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

!Please Read Me!.txt

Path C:\!Please Read Me!.txt
Size 797B
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b
TLSH
T1DC01F12EAD5572115BB2C572357DA197EA02925F022E0352B907C13917BC13655FE4F1
MD5 SHA1 SHA512 TLSH

Submit Download

osver.txt.WCRY

Path C:\ProgramData\Microsoft\Diagnosis\osver.txt.WCRY
Size 296B
SHA256 658c0ca555bfa1364388c284e0548543bbf56ba831412bea25334641b7fdbf09
MD5 83e642e06d04f0f2e6164cf3b851a4d6
SHA1 6ed9edd27e8927d46535e228fa185ecb096e3c73
SHA512 4ccb7c0eb42db7f9c40dbe27dbf66b9d1b3462b256045ce2459af3fd9beb9777e113fd4cc715b7411916322d0b07b9c27cdacc241d20ce1a8c2d920a77a4328b
TLSH
T17FE0EBE44807254481BE633E040CF68BA7E20BBC2E88DF8116E08B3225ACB940F82605
MD5 SHA1 SHA512 TLSH

Submit Download

RegisterInboxTemplates.ps1.WCRY

Path C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1.WCRY
Size 904B
SHA256 d1408b479edf81d467bc774fde5844c49e7ce4c1406c131680083159cfdd6548
MD5 56c57fe3c07492cde5d8c00af4dc0447
SHA1 db06e6fdccc87e3898a1aedd70d8614fcaef9e09
SHA512 fd0aee6eda27f0312962d9e3bb56a1ccb1d49fb4495870dae45bf59523c8b4ce3119b06ac0ddad0c67b082127fc463ba5760a159c359f8b8b967784b1e38faf6
TLSH
T1C911B750606B0887E4633BAD0ED4BABBF7F250B8556048E0553D3033DDDB61F2F44694
MD5 SHA1 SHA512 TLSH

Submit Download

user-32.png.WCRY

Path C:\ProgramData\Microsoft\User Account Pictures\user-32.png.WCRY
Size 728B
SHA256 ea73318f40d2dc1c6cf924e2e28116c73319a9395dd1f4d90f98f7c689c3d37b
MD5 6f76ad32bc1f62bbaa3d7a6dc9c31f84
SHA1 3528d66ffd57cf2c0becca4979d6ce60449356bc
SHA512 f873c969ff86e9e63f778f9b6e12a93de2ca0dd481da2608f0f50e9deeb888e22c2b766b674e759d719eb1578d1ac929a4ad744f2836e2fcb42ee51a47cd6a97
TLSH
T1690165F58CCAB584E63FE312DF6D499AE5C402B124722A144DE51496CD9D933AA80A82
MD5 SHA1 SHA512 TLSH

Submit Download

user-40.png.WCRY

Path C:\ProgramData\Microsoft\User Account Pictures\user-40.png.WCRY
Size 808B
SHA256 ee47f5ba87497b58b65650b40ba1bdc4cbab68f306ee59b95d7d4fce890638c6
MD5 e52186b0e2addaae2cf3a19c4e813cc8
SHA1 3b45b885a4aee3b4de9d79bd2a3cfb3c739038f4
SHA512 ffb7abd854a824be1b948cf23d6797e3ec8063129b5f698e4ded3b1a420e1fac8d57f1b0c856d3c7af2c1dc8a730dd9aa3c233d7bc5c03c186fa2a0cd243a588
TLSH
T1BD0181052B1A58B2B32C67E3ADC2C1784AB9382862371EF108081968A3EC1240C872CA
MD5 SHA1 SHA512 TLSH

Submit Download

user-48.png.WCRY

Path C:\ProgramData\Microsoft\User Account Pictures\user-48.png.WCRY
Size 904B
SHA256 01d191fe708d0a7719dded24aece929aa1b83a749dc878f829d799e3341f3e20
MD5 32aa656a07aee3a9cffe640b243c7fd8
SHA1 dc1e37fab8e6f9e20d85ef219dcd6469b0b379d1
SHA512 9e0466396e195ac7c692caf56a739499c0a9e4439b6399472b68ef3a9b1c5de35a5ed6fc908546d6a4ccb49e433ea95487a698cb82b5c118924aa532ee9f30e2
TLSH
T13F11630B523661D5EBE281712D2CC411BE74E4C741A4E4A2A6516B97993B9FE38D1124
MD5 SHA1 SHA512 TLSH

Submit Download

WelcomeScan.jpg.WCRY

Path C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WCRY
Size 504KB
SHA256 d1bf466537880befa5a1288d59ce69097c5598b986eae3907ad4f67a2c602f60
MD5 641af25d273bcfb9c0c9b3cd7736db66
SHA1 8eb3b8ed99e6b9b40a5b423f7f7a45a94a858218
SHA512 4ecb456ffc1e3c1b2fe8e522c65d9649dbe8bc1333e8a14840963fd9624e89865d13bab9ee357a49d4dc8b08d613edbb46745e4d7559abd5b809fe32f16f36c5
SSDEEP 12288:7T6Wq8crZxLo5NNQNFw5nwag4k/Ce6TJ4FCFiJxmmgWrSJL1qVApP:7T6tZrZGNmUwauqeEikKxmmzOzd
TLSH
T196B4232B5FF2AAAFE31899AD22334655F3E677D2C382D05CD592CA23D451F4662F0384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21f4fbae-3413-43d8-833d-8edbd6c4a7b1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\21f4fbae-3413-43d8-833d-8edbd6c4a7b1.tmp
Size 130KB
SHA256 52dfc7b64574df073bad145d1253ab00a86f2a9974eb3a3c104c73a8088a76ec
MD5 4d62da2199dabb652ee8940b64a05b7d
SHA1 069cd06403131d930c19ca4883d65452bad4febb
SHA512 14463a01af38fc5e6d180969a117aa13fc83237f256530faccad80a8007efd1e9cc1ab3d18fd79e719b706249346ea208f849feecdbf1656e6bf2ba5eeabeaaa
SSDEEP 3072:xEK+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:SK+hFD+7t56OD9ZfSApprE
TLSH
T152D31232AA95D8BBC9FC6541B157A300DE766CED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a23c35b-02ed-4099-84cd-646b4d8fce2d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2a23c35b-02ed-4099-84cd-646b4d8fce2d.tmp
Size 131KB
SHA256 407f45f923177527cc5e26760d7a72fe1b2b7e20293e522270ef405512c245f3
MD5 26a64ca6607288ac0a05a570afa18cba
SHA1 ee2d22118021132d00826ca39854afd72f6dc100
SHA512 dbb5d21ca9da8defb7259bdf3ee7045562b37c857df5ee6b1f9c08d863e2f7343fa6066573a477715c3fa9159789222467cec98efee7974f974ffbc02a50466a
SSDEEP 3072:9Bw+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:Lw+hFD+7t56OD9ZfSApprE
TLSH
T199D31232AA95D8BBC9FD6541F157A300DDB6ACED41DE2A09444A5F8ED09FC4C07A3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98eefe8f-77ec-4eaa-b436-a26ca291a858.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\98eefe8f-77ec-4eaa-b436-a26ca291a858.tmp
Size 131KB
SHA256 1f55e4ebdd854630c1db6b82a375ad6b4a782ea1e97b4ef587774d489d1387a3
MD5 f9f37915dd787cf1d9d83ec2dbf6cf1e
SHA1 6d796941500ab92e60a5dcfc997d1ed317fcf1cd
SHA512 3c0504860b12e15be88cc5bd67c5208fc9607bcd9d7095619cb3f169440f2f607800f0b4d8314c6341a6b3dfbf02dfb2bee321612ae98086504d29149534aeda
SSDEEP 3072:9BGy+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:LGy+hFD+7t56OD9ZfSApprE
TLSH
T183D30232AA95D8BB89F97541F147A304DDB668ED41DE2A09444A9F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19097bbb-1437-45b3-ad85-9cadfebb5cd3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\19097bbb-1437-45b3-ad85-9cadfebb5cd3.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

25efe537-ea41-491f-bd3a-26b1bdbc3afc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\25efe537-ea41-491f-bd3a-26b1bdbc3afc.tmp
Size 12KB
SHA256 f1ddb99c4e28f8d545e8155c9303c97540adf6cc97feaa3a8c07f0c956366002
MD5 3a56da61dde09b0293b0f8cfffc7d543
SHA1 981ac9bcadb2ceebb121f08d529a1cdcf4dbead4
SHA512 5648d1754abcb7d7ed2a99397d6c44cb3eb2c6da7e7be370f4c97162dfb9702ff08f4321b60dba9de1e66e884cf07d6138238ff1103321ddba82de589b4306de
SSDEEP 192:iRBkw8imv7Up2PRp0Lb9/Hsb+WNn2U4Unc2+723PeYIkxkw+aEVyIsnAUgE:iRBk0SA6XshwB4v2k23PnxxeaAE
TLSH
T1AB42936EAD20793B6CDBC21AF9527B53D3F5102125A02E84E6FC8D3C29E76CD6227117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

317c23c4-74f0-4744-8beb-ee394cad4e61.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\317c23c4-74f0-4744-8beb-ee394cad4e61.tmp
Size 13KB
SHA256 cbff59adc7b520f0de2985ad921ee12da5b00aa0aaadd64b2862a8b11ece7f19
MD5 8620b09f169758aa6d92f2e7b8a4c29c
SHA1 c265bb3d46a3af238c08a66240583a655be69a0e
SHA512 017bb2738ebc633e2b1824b1fe90215df48c3e3ec2d222610a597c250ca9b406bd8560dd6e15c6ddcea319cc301407ec464c4569fc29dfb4f74923aa99fdceb8
SSDEEP 384:s2jGN7KxkXqKf/pUZNCgVLH2Hfgsl1/XODGN+ErU3pxHG4xHk4V4:s2GN7KxkXqKf/pUZNCgVLH2HfgszvO61
TLSH
T1C4520A27A88C9A3F0FD8C54DD8177F4FADF101566268492452FB9C1903A5BDB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

384ac352-af00-4ccd-9a91-02ccc426ffad.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\384ac352-af00-4ccd-9a91-02ccc426ffad.tmp
Size 11KB
SHA256 5e3088b447f388c22f918491ec2c37d51b4da2034e6aea666a687fcf25cee97b
MD5 67b019d0436e2426751cab9c32c2ebff
SHA1 45df038355530344d839cd2b1793536eccc538da
SHA512 534a85fd019733e4b0dbd3496ca19932a53c01027b6e565b0c33682bf46962faadfff341b9be7fee6c6af686367cbb9a4363b9114577756de5cf5512c80f61ff
SSDEEP 192:iRBkw8f5v7UpAPRp2v9/Hsb+WNn2U4PA723PeYIkxkw+asVyIsnAUge:iRBkRZAUXchwB4Py23PnxxeaIe
TLSH
T1ED42932DAD20793B6CDBC21AFA627B53D7F9102124902E84E6FC8D3C29E75CC6227517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4593c9f-b7ac-4f4d-bd1a-23bfdc605775.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b4593c9f-b7ac-4f4d-bd1a-23bfdc605775.tmp
Size 2KB
SHA256 718645c0dc81ac143991ac4fc88c0cb89d4aa8c891da4db17374808af9becb84
MD5 a791ca326e2b3a6ffd7f1bfaff1e5a63
SHA1 9a005dc22d9e75cd06533489fbfd816ee3214cbb
SHA512 32737f5206ed6db9fefe70932d9a25cf6c81fe5d5e48d675cb88d150f9c13c798a517c930e93aca5423750cff621729ded907bf03300d83d472452ee2015dbba
TLSH
T1B851AEF787F4CA7D891192F4EB146E2FCE6D0914536C386689D4AE5B53E2872E10074F
MD5 SHA1 SHA512 TLSH

Submit Download

c79cdd6a-506c-4181-a862-2f6b9b3e0b18.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c79cdd6a-506c-4181-a862-2f6b9b3e0b18.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

48.png.WCRY

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png.WCRY
Size 1KB
SHA256 52bacca83c754f3eb3cd7d73f7658f656fc1bbd1730662ea763c4c5763b00ac7
MD5 e89c7c5eff330c33f50891d50cdbca96
SHA1 1d651fd5cc542e8113c6109b23a2cdc63a1c770d
SHA512 b8b6ca75518a83e02cadc83fc3fabd21d9d0f435987a9ac240f9aeb72b84bffe89509ae0680004b77c07e36b839b8e51b2647d96082eda6d95f209ffb60ed1e0
TLSH
T1B831B8E723356DCCDD706DD76E6F5CB4D18F8881DC98A184A0D995FF811B0E22E25004
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

eff1191b-1336-4d5d-9ea6-07dd0c90f969.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eff1191b-1336-4d5d-9ea6-07dd0c90f969.tmp
Size 11KB
SHA256 5b57e621f7dd5a9eb187c43b71cf15dfa5855c8618582627dbad1e7b4c6b9fb0
MD5 84c353bc70d00731041d6e396e19e901
SHA1 eb5aa67eaede6b9079b305b3e8373fd9492b6782
SHA512 6100bf17517de4f7f5e62653839e6b125f1c83a4c000ee888faceda2136f8c1e0311d800e7086b117ce057c3a80afc25628c7ee1cf084c5f3e93f3d4630f1141
SSDEEP 192:iRBkw8ftv7UpAPRp2v9/Hsb+WNn2U4PT723PeYIkxkw+agVyIsnAUgE:iRBkRNAUXchwB4P323PnxxeakE
TLSH
T1CB42942DAD10793B6CDBC21AFA527B53D7F9102124902E84E6FC8D3C29E75CD6227517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7e010ed-1e54-4690-a032-94cdbd8da659.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f7e010ed-1e54-4690-a032-94cdbd8da659.tmp
Size 414B
SHA256 69ccabd28030ffbda4ade159e51f688964973baef5025a679c928cb46e24cf5e
MD5 df6df5fbc96bf0ef747bed1fe7e80541
SHA1 3e037026bf9a0c5a4beb213ab6af136827417fd7
SHA512 aa2cf3ee29a72896aa32cf332e6e7af8eb535c63dd2b0f4141505ce7720524ea34d96daf7253afd49c6523075348b006e22afd39cf548a57700df682c08d3939
TLSH
T18BE02BE5C951DC7B19FD072950940746E75513572781465F373DD91C8FF5236018686C
MD5 SHA1 SHA512 TLSH

Submit Download

b7062317-9632-4f4a-826d-84e0c71423c7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b7062317-9632-4f4a-826d-84e0c71423c7.tmp
Size 131KB
SHA256 56a993dad918f9f2df546bc4941fcffa72e89658e14f5103a63f62c2f8d0a7d6
MD5 f701b0155be4ac223188d1d817a07482
SHA1 e060f8d1fd340a7a1cb0573479906e47d9c2dfef
SHA512 21cd4919a746df07a2f4abbe0281946343c4cc31484b5024297ff2272c16468e5caa638ff655d6ac0125ca36621167b15d90caff8f5000c484ebccab3a533ac5
SSDEEP 3072:mBw+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:ew+hFD+7t56OD9ZfSApprE
TLSH
T1CDD31232AA95D8BBC9FD6541F157A300CDB6ACED41DE2A09444A5F8ED09FC4C07A3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt.WCRY
Size 48KB
SHA256 4c282ec74a49480069db156de410153899a41a022d959b739336824106a53d3f
MD5 a0fa00267c0b67d8d12c5a3eb0288eeb
SHA1 5a6bf1e401c4642b017a3a6c3d678fd7fc7c30a2
SHA512 e30ab0d3753a9745dde822245a150048938f9693b437202610e84ff073d87f34b4d635d78176e73912211742b4c6263ca81edeaabdd9adf9174442ea97c882f4
SSDEEP 768:A2CGOkI8DwtqeY3PrSMAnh3xtU+9ZYS3CeG2AxC1s1eWZhS5hyT:ZCLEDeY3Pr4hBtoS3Cx2AxkpWz3T
TLSH
T19E23019205FF5BC77523B8A64E704CA5CE50C91C4A2DF0E9D8BAA0072D9A967833DD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

folder_image_desktop.svg.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folder_image_desktop.svg.WCRY
Size 2KB
SHA256 ec1119eb72eb096dea206a2191063715045cdcd1a38c46995c8b6d00a5eae80d
MD5 97dee420ebd4eba1c7ce14284174e5bf
SHA1 d4c6441ff0327b4a09d00de5622787807888e70b
SHA512 38ef2296b745df1b24b282459aaf551d0588d93ded9502356cf58a94ee224a899ec19a04c21c595b7065e0b0fc78695998f81e0484a742fb6eebe4ae73b11dd6
TLSH
T17A413E0B3D2DCEC229D0E27F9FC2E58C1AF2591765C532D119E0417D8D796AC08866D7
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.contrast-black_scale-125.png.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png.WCRY
Size 808B
SHA256 46d61dc0c8f251827d3e913f120d67d01d2aa315eceec2b52f82b674a2323319
MD5 2ecbb51e4d39525ce1a0b8a6489fcdc6
SHA1 d8c341f82a83461cdcd4326e00caa87bebb39019
SHA512 c2eeb7f865c2ce4035c49ec9bf8ea1cab219a23dd65f5a127477de8677f463075b7c88b589c931ae54db4a821ffc7e9cb119c825e942892486c518c89e6e0a9a
TLSH
T1350146B1C6C48094E9C5FB2A5DE438581FE21337A896575019B96939C9CCD08B83D449
MD5 SHA1 SHA512 TLSH

Submit Download

thumbcache_2560.db.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db.WCRY
Size 312B
SHA256 d256c51ae876391eaab92b3d96c6d5274462fb768d4c4848696108ad6ccc801f
MD5 216d7eb94c66a4f693273a77b293c1c7
SHA1 2ad069633ade944cb9e0c33946357c560ec013a4
SHA512 bf2fd3c645dec4d51da28bab59fb5a1b907cc78229881646a49b22316ca3c7fdb668ece6f771340b0c95e0c1c459ea659b72c93fd77980290bc3fc2e98ec9a36
TLSH
T18BE07D0A14A66977D502547845DC205876543FDF01065E5B1941D42D9179C10B4B805C
MD5 SHA1 SHA512 TLSH

Submit Download

thumbcache_48.db.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WCRY
Size 312B
SHA256 8fd3c0eeaf1b5ea20f060c077ce5c9070d1e1452005ae10aa6674f54b1ddf335
MD5 b2f7eb7b34e1390440d25ba0213c7341
SHA1 9ee603abc748d9454597f6210df1f1dd7cdd117e
SHA512 d2ec31b0d2b1ef3df6fcecfedb9603154b894c231248880e068b76126bd55c316767492891182680ddffab0ee6ffdc79184aeca2f9397d815bcf9fca8b0cb5dd
TLSH
T10BE07D72B2D71788C0A64C7408C574541A1CDF21A26F4CA820A6B4D781CDC8216F4803
MD5 SHA1 SHA512 TLSH

Submit Download

thumbcache_768.db.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db.WCRY
Size 312B
SHA256 21927a4da6fba410a19372a49655034db42d8b80dd1d2b7f181965eabfacc687
MD5 45fe9c9755a369336addc64a5ddb0939
SHA1 0a3b8ddfe817c625a5403a2d579bb923f3177234
SHA512 80d5c0114c38e78d6175086508ceb10d31dcb7ec4eea0806aa8541eb8b838f15363a29804275f0161268eb0634080b36bf369f0b450ce51106afa343c89d2757
TLSH
T12FE072FC08D21BADEB1EACB502113828CE10048183B0A2F110A2787A026AB99DB08B78
MD5 SHA1 SHA512 TLSH

Submit Download

thumbcache_custom_stream.db.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.WCRY
Size 312B
SHA256 c6d7c7f84f166b959f21a153e8d581a644fb85d9303f3b67da0dcf7070dfb22d
MD5 e4b2f356c82d7b0081823d436aa33524
SHA1 6872aa6bc19c698d442105704257bf794cfffd18
SHA512 5d2ca932b6585ee1996f44b79cdc0c246b53b6bf70778c06bffe1e32b626a08b0e1b7ba3c79c287aa9d3f92e4c3a64728555496a7dad0674af02b2e75fefa118
TLSH
T119E0E76040031507C447767CA41475559D7786F7300C67F59E6F43360C65D5FD1D5DC4
MD5 SHA1 SHA512 TLSH

Submit Download

thumbcache_exif.db.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db.WCRY
Size 312B
SHA256 5dc1bc5c402852e02a4347bbfd97e24c7b0487a4aec2081887cef7b924b6f6c4
MD5 3721046ad34a073fbaf1c6dd3828bfe2
SHA1 7994c136ff146e7cf22284237242e4e68f8f1f9e
SHA512 67c3610ed425cc1a75d88b16ed72dcbf4a21cdab80c75c8300db61865ae555afb901e613e99059ad31edd9b9f66a5180e7e06e6e33e7bc6e227efaff29ec9625
TLSH
T10AE07D4799000DDCC98E683C1554209B1120785E170889B9D9348354DAF64BD88EE201
MD5 SHA1 SHA512 TLSH

Submit Download

thumbcache_sr.db.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db.WCRY
Size 312B
SHA256 30bd445cf86774e00867cf022f8b1a2cf099e7d62a2fc63a889df9f6f29c0071
MD5 457b65dc6ee672c62d3e7210a63b4119
SHA1 4eee4a3f3533a361ca160de3f8aefaccdccb81dc
SHA512 4667e7047b842ec6bd4f5909e05fc80f756ffacf150a9fc99be63c714f7761fb156e3512b37b08750f9fa18412ab4a654da0152ee8f713a96dfd9df016092923
TLSH
T137E07D3D55F021ECF9213236B6A8AA2340454915567121D532324F521D192046678C4D
MD5 SHA1 SHA512 TLSH

Submit Download

thumbcache_wide.db.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db.WCRY
Size 312B
SHA256 d3b020fa4bfb591b21b7b64b98cedcb69cb6e72827cb32e30c95e184eb90713e
MD5 1d564e67ef2992a34ec3db0be63f008c
SHA1 1217e1b2936b4900235ac3059ff86d41fe168746
SHA512 f7d5a3fa14dcd8d1b562002dc24825066c4040e522b551e9d6cdb13d9ababac8968ea2f4d657008926fac22ac96a7b8fce5c6825850ad44ec70e72b323380f43
TLSH
T136E02D0DB7AED391960AF43818C8089AA253D092D058E4C32C39C8C2410C21120B01FC
MD5 SHA1 SHA512 TLSH

Submit Download

thumbcache_wide_alternate.db.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.WCRY
Size 312B
SHA256 ea4a915f0fbcae4d80547344f8f24354c8a80b1424b9d2ae897cd2cc82973fec
MD5 121fe18108155bb815cdf63409a81f9c
SHA1 d9d7e934954a866e7426630d451a0e654e925e0e
SHA512 50a068257bb69e6da28f59c3886d02ecc489b5912d6d304d8a2cfd475e4060f3753c0a1f90347994f82db9474f140f122967702a7b3bb8b0878d4341eeb39a9c
TLSH
T141E026D4B4010EA39D9B753503BF22052A7B931BB4441202FA9071089050637110628D
MD5 SHA1 SHA512 TLSH

Submit Download

squaretile.png.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png.WCRY
Size 1KB
SHA256 044b78216e3c5cd2f5ba9099690deb0216b856abb9a66d2086fddae170d8c7e9
MD5 307e2da14fb6e45933e76bdb8a780686
SHA1 eac21008e978ab26de4beee69ae97b56ca2cb908
SHA512 22293921e34865fb1f8094d98ff7f076b523f45e3624681c0010eb099a763ba0042112625e5672913862a2f62e17e6ada09de887e0eeb76855cd72ab718ac260
TLSH
T1B33118CB0A5677609CC42C7A7AE31816E21687E2D4A1D32B057F1D53E821CCB4C06A37
MD5 SHA1 SHA512 TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_10[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_10[1].txt.WCRY
Size 197KB
SHA256 00a1ca18daa63b38c365a50e1b0eea39c5fcf2388a515f34062be10e2544fbe8
MD5 34713b3659e3dc6b5322da1263cc844d
SHA1 eb482b09b488f4115e74f67fd67181c39e9fc8d9
SHA512 383c0fc46d18e07bfa47ea3fe4b5c17def413ee52b1600699a260df8b2a13643b1842e5ec475ae9f309661fac8fec989d2f1f9439fb5b2ddf9627d64e3d0c9f6
SSDEEP 6144:7JmiJ5yF9imDIjSyhxntWparD079DbAOHqF:oizyFEMsSyhxtZHOGOHw
TLSH
T10E141306B2D8C4F7E5FB52DF0EA3192ADD360986936B06C90C93950E9E145A18B73BF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_11[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_11[1].txt.WCRY
Size 33KB
SHA256 99c57262442add294f879a1a68a87abae7d1e736a0069e4c810bca75af670932
MD5 b6e5633e0ca72d6f0df091f528bd25f2
SHA1 fef3fa578412aa2b8c18767ef929b01710f4d6a9
SHA512 fb551a75d6194fcefc897ca56b6d13d95e8cb82834305a81412e91ee9000c012000353d06f29fa365ae856c3f4e57be3070c65dc62595bef906d015bde1bb7bd
SSDEEP 768:iVKjdSsbR3yp2zyOQX0zm+awR6gZ3+pG7uvZFqTpzQt05RxQ+Ceh:iKjd1b0AyO7GRgZOUw7u5fvlh
TLSH
T173F2F0770B9124F1DACAEA28BD26C27D60467C242D28B61D02927BFB64C3F7D592A750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_12[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_12[1].txt.WCRY
Size 221KB
SHA256 046b450ad1cf8c62913b522ae5debb5aef324687abbfc7f196a41156c62a8a9f
MD5 abfe526893528f3153b114f8cb68c4db
SHA1 2788ec6a60fd74fc1bd044e7989a4fd918c2433e
SHA512 f7a158cd4d9edf41060c0f603da6ffb0034d5dc6e9ef40574150aa5da9fc4142e26bd5ea081401fb25ff398938b820ff9061c13d5358ec36bb9e51eb3c043f35
SSDEEP 3072:UR0HXTPv9bH78X135Ww+MMgAWPlYO2u1NExDU/0T29CVuFbncN63wPQttz+aToeR:UmDPvZH78R5XM5slIufExD109XwP6Xb/
TLSH
T11124236D456B0F0BE566E1CB621145E389BBC22CC7795D08CE231FEB9F09C289BB6705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_13[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_13[1].txt.WCRY
Size 52KB
SHA256 f7821fb4a9f36479c098e935ea69fff723d804e3149240815b748c410b87217a
MD5 0065b28b95ce869ca72414b25aa3ab10
SHA1 61a14e6a5680bc636f8e3d8055ab7c559455dd2f
SHA512 a130042b630cdbb19968ef8540a37631f1b6a2db34d38071395d4d108e3e38c4f70d7c8c664ce9a7c0d4fd01ba462804e1229bd1d8cb699a01083ee803876985
SSDEEP 768:Y0PZfIUOckMohge3DcHYDqXX3DNY/bQj+6CrqmPQsd1Vkc+24NxBA0efX0:pfyLhvDd8nh6Qy6C2mPQ8M2ixBA0wE
TLSH
T15833012A63157D3CA1F0E3BD5930201B5268C49319ABD21FF678E59BD2835B3B40A5BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_14[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_14[1].txt.WCRY
Size 7KB
SHA256 4196393523db8e94fd4dd9f03d3bf29fc89a4f231f0dda5ba55ce5120917c591
MD5 636d0a4b622c11a3d1ef2f3cb9790491
SHA1 05b2dc8475bb20aad36fde4cb787eff3e50227ce
SHA512 3ef3b318938ae6a4314f07723a401f1c9a0097ed45ec2e646c43dd4d2e2afa2f3df45fbca96e2fccafb30c8e4b9d78a2cfe1064279ed809059b6d6bdbbcdd8ab
SSDEEP 192:jXyFjNr7+PSK/cUcVmwlkEUoE/RqF2qUk8ZMoOzgL0fndea82P0B/:SB7+LWVSEJE/RqMqUNFOMoPYaON
TLSH
T1FFF1AFBFB9A9F90CC433748664527324405237038D1C38CBD691D66F38EA4AE56615A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_15[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_15[1].txt.WCRY
Size 120KB
SHA256 060d829cbb99df573c123ff0c3cc55ef75c09ae2677bad3406a899d911faf0d4
MD5 f5d9cf1a14cc1c81f73845494b2cfa65
SHA1 cc7b1a8e0caf6bb3953c6db808e1195c86de4022
SHA512 7fc91d96a70ac798a6f224d3a2d3bdc2ee4c9ba070af7868174d7819e6a38e40861f9071e31d7cf8cf34b0b8603b91c7a15072c7c5a4b52fedeab3fad08e2226
SSDEEP 3072:VNrLxdY1kwQ5wrfzkphPrXjmLcl2gm/sIDWt0Omq:VZfY1tQyw9rXjhjQV1q
TLSH
T1ABC3122CEA3F84B42190C664D6C3AA4683AE20BEE0F5F035798471951FC9B277FD8B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_16[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_16[1].txt.WCRY
Size 92KB
SHA256 51a1cf975ffd8a8b9f4730994994cee37ebe5abe6f46478ffb3d260155b28eb2
MD5 49c4f27c755d5f9210b7f5620b72eb17
SHA1 1f933e8786d6f80d63f873f4ac8360658da2df92
SHA512 106409092d863a8efe6f6075ad71e46621234740dd2d4519bf242752466b08944e4795ed654e3bcc1af82a853dd18cdbe23a5412be5da1e3ab2fa89e6e151bc2
SSDEEP 1536:wKBB+m4HgIy1M2dOo98/IIx4rRNBVktWS+JMtVG0jPi/BTJ9VeNvLy4pXIWZxK3M:M12X98AfpkfFW/HIX9xK3ciU
TLSH
T1809312CC22934612DC867BF06824C9C2E516ACC7BAEFBE1A6D2DB42C7646F747C50257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_17[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_17[1].txt.WCRY
Size 6KB
SHA256 0cd3b7ab344b2536d9dbaca3f3c03a237b4591579ec4004b50657742e7702aa7
MD5 93fdac3bf08f8786bbad32573f822793
SHA1 0b594944917855c27673a3056559861862573887
SHA512 80d2bfa02fb29f8e00272c3d2f402f838905a305f9a2dea2e7ba60f56e3919c969515a54aeb513c15211b5275ba8804e57545ce88afffa007a4e3b25eeac9603
SSDEEP 192:62GuQTbui/lrKGMUCi4Wx5ZUpNZN40cmCIBazlek:62GuQPzp1CiLZSnRLwzlek
TLSH
T1FBE1BF945AEA15B5EF1C77434905382143BC35187D071FF4DFDE92626C4B85D3C60B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_18[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_18[1].txt.WCRY
Size 119KB
SHA256 a4be1decad87ac0f8fb94925311ea5716167193e4dec9fae624975ac728bcbf3
MD5 3016a44d2987652fa036cc7dbe27dd2b
SHA1 1bf7d69e8b66dcb662e2d9c1d89fc781fe9f1b72
SHA512 fd60016c63d8505a3be04dfbd6c06ad97a0531b9e780a17f36df3a00f74a6443802ed3fa8e68e3944df0611fba9855b09f6f36e85913b478283a1c9b816fc889
SSDEEP 1536:RKdt9X1MaUaQFjY09QTvAelMFIOltWcw6Gnc09+t2VuFyCEJt+0nkE05JJ3e82ld:at5GDjxQkWMPtWcSuUCa+0nkEoO82X
TLSH
T131C3124A131DC0E6CAE96D59FF1CF795B9D8F23D400575D3E3AD82A128D4B98D8DCA80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_19[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_19[1].txt.WCRY
Size 118KB
SHA256 c0e88323a1a4f798f8f0ea33e49b1a734432dfa10ce51de750a2b2a58be17fa9
MD5 8926b85e242de213d0edb0fcd371a59b
SHA1 c77d877ce724cf97f86da1e6b1a5d05168213f80
SHA512 ae8246276d3fee3aa306d58e49ff89e54156ce775199e93cde48b452e851f2ad396bc91417309ced7d6944fa763756a06536c343ff82bd0936f25e9de0aca38b
SSDEEP 3072:lBJ7JnRUlIWgR1uWb2lXCod0Te/7hDbXJ29YecIC:l77p+6v5baXCZqlDb0TC
TLSH
T11CC3136A42C153F10F4EDD09B7FC0C29A68A1E50F5B2DB449D244E54F79361ACCAD5CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_20[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_20[1].txt.WCRY
Size 64KB
SHA256 ee45c2dfcfed8868d1e865ae4e4f5fefe4a9fe2992dcd646f0a69ce9f0379a7c
MD5 b7e8a840bd2c3216a68d6d8000091753
SHA1 51ffd3fe632ceaef9391fa264fd53b80617822ad
SHA512 1f8b216142c64b7ffb0d548fe2f07fce4bc43e2405a8d1370c9ba9a6f115b08cc4402d974bcd841c4f7cd3e96a6770b930efe3df93a84a363666e8c1da85cc8b
SSDEEP 1536:3rFFt2SI59X5LVmllKYuXyWxYfLARpR4mg45ta2UnW9rTTT:bh2SIXpV4KYSBp4wq2UnWpTTT
TLSH
T16153026BF0A5CB10A5BB7772244836FDF63A1F4AFC2141E063EFB049E9186118D385B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_21[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_21[1].txt.WCRY
Size 44KB
SHA256 53ae5e11fd9886259f930daff1a411b42310cb8c6a136d5b52db9da6abb4b06d
MD5 70b537471c12b40826520f3b511dd5e1
SHA1 f4222184e7076a2825447c704a77bb1369e655fd
SHA512 d674624367e986172280d86799239c684fefdbc18109bf805a11ef05401eacfaf4edea7c3c54be27dd3262c1310d61e2dbbf45183f8498223cd32b11a9311926
SSDEEP 768:ja0h1cJPyJM6RI0ZuLbu/XQILhWy8xtVdaykA1eAFhC5LlwR3vllH6x1a03djvzJ:jaCJFsPu/vd8xJuoevLi/3HMp3dj/l
TLSH
T17D23F11295F4FE84F0BE5AE0F52ABB25D92138480CC1A7EAC9D8CD5406C61F538643DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_22[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_22[1].txt.WCRY
Size 197KB
SHA256 139f17aff35fc048a2c909208bcfeb868517e0c49f39538e9c0053c158b81059
MD5 c0ea6af7404ceb3c7f40c1c46cab70ea
SHA1 0c700d8bb2d2e05af831bb620b627c6828f25002
SHA512 aa8130825b1c3b7ee626c07677d299180aac1d57a83a0217ca779243e6ddb494b46995b5674c6af49e2bcc34767dde97aa3f6234071045c209456bb6a700496c
SSDEEP 6144:BewF8/oT0p6jh/VHoA3STtOpIRPlXamMGfOJ1q4+0:WAw8dVHoAWtSIFlqmqYJ0
TLSH
T1AE14239D18739791F33C729EEA47B8BFC01A64C8D51AB16FC607AE25653978D2003CE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_23[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_23[1].txt.WCRY
Size 15KB
SHA256 dbb0986d1bddc5ffe4c140624fdf0469ff71eaec3bdd7ef5647e844e17320a76
MD5 24574eee3c36082c16cb3cb41889b3e5
SHA1 381c885f90817bbf8c37c91448671ffb719555a4
SHA512 a09b04d0b6c55033ce61ab6834f7f36f93d6b70a6d3dc3c7622d091b7802a53911f1e3a1a546171cf4031ee7e1ac5b59fe1e6d92de4e75691f5aae9d693037d2
SSDEEP 384:76X5tyQq90XV+M/f4vTVmHviHlwDEEtsGjb8MB7jalFZnw52:76X5ty/+XomwpmaiowsGjbxWM2
TLSH
T15472BF2DAD088E70480CAC112D748FDE6F678DAA417534F89C57A5EA70AEE239051B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_24[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_24[1].txt.WCRY
Size 48KB
SHA256 8fd6cc484fc6ae1b8844d985ea9ec7c2a23ddc2440d6088ddd3405812e283e1b
MD5 22d85263f988588ce5076f7b69665ac6
SHA1 bef11ad3e0e7e7445bfdce094b4d499aa2c91726
SHA512 070c1898316a424953eb29f560627540ca24e0e3e81cb98179475fe7262edb14ff1a9fefe84f0f86d92a6aaec391b91da64aa1989a6e6bb92d9e038e114cdd45
SSDEEP 1536:rKDbu4YQOyFnt5Luf+YWDkD/kRyUoxwj51/IZikr1g:rSYQOyFXLu5WID/kcI3g4
TLSH
T1BA2302524031E8D3C28199ABCF52EF4E4F898BB89F6C408E8F8CE7842E345D5B71651D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_25[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_25[1].txt.WCRY
Size 39KB
SHA256 89a1a9c7cafecaad316f47f4270af377e4a70826893fdb4528aa48605a16bf18
MD5 f90e7ba654ab644f88b813818edb9a27
SHA1 900178c2a1cf0143bafa3747afdd27612a61d785
SHA512 7b75f8fc001d6818ee068e00241a02f007eefe38cca84825d865713be07ce5a9cce0fb847434f7ed2242d4a7424c2861720d9bcee7375505e92331d9332845be
SSDEEP 768:HRiNRUdxco6gI7QsPlYZPwvCWFGIMLfYSXiZ+XI6KcdUbDAi+4Zpx/6QKrR3q1pq:HR68uTEmYFICWY0+fTqDAi+4ZpxWR3n
TLSH
T1CE03F1D7628F7B14A8E8E0880FA3D5183443CB4EB6E6648F304592404AFDDACB56569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_26[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_26[1].txt.WCRY
Size 780KB
SHA256 44233d06478e8e178c8e0ef1468d6702e8c923be4d18fa294a730f946e62441d
MD5 36a834738c36a856570794cc6e5d4160
SHA1 113905b74db73bb196940c5914f43b69bc0ffec5
SHA512 667ceed110f159c06267a49d692faa2eb18515a772b8bbbe14b61bf42a0482732110821aa582c13ba477ac779f6daaea95a45ab160ce851b5474c41ccf8aeb60
SSDEEP 12288:Zs0EIlXBuzvmBtiBE9q/Upw4cA9sUu/JF6V0NYzytqnn4jS00IDmJd4Xbhqlrrmi:ZaoXGBoI94xPeejnnMS00ZJmLhqBKZA
TLSH
T14D0533CB4E2216B8DE896B9F9707C1B0694F75803E0DD1A7AD525BF72888476A0FD0DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_27[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_27[1].txt.WCRY
Size 87KB
SHA256 4164feb1a0116ce79c2e3ef6e0b78947c2a25857d770e5513906e4e04f7fb67f
MD5 f530d26b001437f1535e6e2e6d62a92d
SHA1 80f947aff3527c804ecf3a8729b61568de8f5e4c
SHA512 69beb7abec838f97c5173ff8b73516dc6cfed85e96fd64ceafcad1f4709bce99124436d30ac0ac22f73a1cb76180a7009a84dbfd51e036b7d35f92540cfc4113
SSDEEP 1536:TQQrNeN0DohMGhFylXYPgktj44pN8O3pZgh1QorxIgUqb6J2/0jEWpDe:rDDohMGFylXSBpOopZgvQjC6+3WpDe
TLSH
T1C49312534C1D2993EA5353BFF98AEBCFA1259628F3C2DA13C094D48A3986D6F3761C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_28[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_28[1].txt.WCRY
Size 181KB
SHA256 605a90bb123c6a68b38d35e82b21c3a857731f71147a8d1c1022f67bef623108
MD5 47d4d05ec72b57393ea75b9da8b3c447
SHA1 4f1cdc990e525aaa1ee62adc7e6f56b344722ad9
SHA512 1836905adaea839e4e64f788ec76a47c8cd5b9a17a25192e9cada2b25a1c464191d0fb9ca678a4530547c23e5050cdf4c2d61112e013c90cf0648ce161863fb4
SSDEEP 3072:xR881NPgNExDgqrxzwMrnWyGwMUb+tiWjG4wnlxH4Zt8W3ZtkwfWYP96ZbVFDM:X882cbhwGozwnlxYL9jR16u
TLSH
T14D041258887AFB22008CF81B2B66A3FC546B4FACAB15AD7382F05C10257DD7279B5645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_29[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_29[1].txt.WCRY
Size 17KB
SHA256 558e276995752ac5b806b9eb1c03a46d287fc1dbe110dab8447e53fc526f60c0
MD5 136ec0471b8a2cd572eb4fa3037c089a
SHA1 75faa001d225501026b982613157932dde4a9fdd
SHA512 0eea3c35972a7f76b29ea5f970219dada867a23b124b81c69a76f58fe6f66618cf6cb61ac417a7044de2924762061bd2cd88691fbefcd56c69a62860808252fc
SSDEEP 384:UFl5LFztnoYYqNEdu7luXX/FMePINr9DFOXJPYDkStgpIY:UzzztnWqioZuN5QNraXJPPSGl
TLSH
T18D82D1294522417C22330062E8F964B07AE0DD4FB0B9F58B38BA659E6E5B7FB4764D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_2[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_2[1].txt.WCRY
Size 72KB
SHA256 89615ed9bc4d4bc6413c7602283de46b0bf4acab025821ce5336a160fa463074
MD5 bffc8a2026515365b86dfa5ed7bb483f
SHA1 aa075329c575f1f572df7491c7c930e2ac7ad5f0
SHA512 f84cd3c6394f38e355221690ec76eccb820c312de87edb5c89a066e0b689596c8aa590d8b7c34a0bfab336c23393abc52f93247dfe31772aeef2a2f13771ea52
SSDEEP 1536:ET5jdZ9UNvWYJkZ+9g1NxzaCWAZVVJyy9C4FSZ65U7x:ET5n9OOuPe5EmGy9C4F9q7x
TLSH
T1E17302C3924C54B8796034527A2F15B6B9C1C145ACE1FBBF24F3F86B522E498B34267E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_3[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_3[1].txt.WCRY
Size 18KB
SHA256 18e70d5812eb74cb58fa05b8be6a37e992c9f4ed84aababf676e3cfd356ef217
MD5 f4e74122cef7c89dc6012b5a4092b069
SHA1 b7f5af6fceefdde29eb332a3f13080fbb983b568
SHA512 e8689b59b0db083fa92957ab251ff4fb2fe7b358a06a96159aa2771159d32bc87486079c767891f1a4f1e5d9de266d97f2615d7e9d3fcdd5d104ed16e1353f47
SSDEEP 384:2Ki/BlLb7Gj6vvfQm0bsSw3nPMpTx54JskoT+mJqJ57vEUS1s:bi/D7o6vQm0bsStxCskoCms57ma
TLSH
T11A92CF974E239EB8507D00B63031A4E9412287A15D4244BD6D307DAFA3CEBE99D6B1FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_4[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_4[1].txt.WCRY
Size 20KB
SHA256 c5b35182bddfa5582a3c8655a3501b28ba3920ca9145088c915e339bf8410990
MD5 cf7fb5e63f729d575e7f8a41e28477ee
SHA1 fe06cc3ac9c6a33337ace7a7d20e7f29f9c9a513
SHA512 36cf1a2b6a376d6960e92537a982fba4389a58e47e6ead6eadb1a90f38f32e6a012b9393f6064e4d5b942268446bfd1302e61fb78922b2388e16506d9db67254
SSDEEP 384:RTnS+RM9SpKQ6pUfeNJioDJLHE0lzw1DvEQP7:RTnSSaUfhoDJznlAow
TLSH
T18692D0BFC8936694D131A65EB58810C63B1F058AC3918FAA0B1354E78CD71DF4E6F562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_5[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_5[1].txt.WCRY
Size 1KB
SHA256 b42285c3c00b0e2223e2d9a9e50cb0548c068d953699cf4217b3836680629514
MD5 cd6d19ea1c93339b7020509cba1d6479
SHA1 a1a75665fc9b205c182ff371f0a343379af0a936
SHA512 996723c0aa492fbf4bc09fef99c6e2ecae6dabf3aecc98885250f4d093d333d1c86b91ec2d57ebc776eee155bfd2450dcdecac5ec240ccea7bd4303546cf818a
TLSH
T13D312AAED0701A98789BD32044626F0B93182C1F5BF1820A7306463406BDA735BCB233
MD5 SHA1 SHA512 TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_6[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_6[1].txt.WCRY
Size 36KB
SHA256 531c060adf1656827389244d16b3f86038dfb647c893e180ba818d2051ef89df
MD5 0b5682a2f4b8aa82d15fe784ec258d2d
SHA1 29b47b87c82edd1faab5caf337860dbcd9f79c60
SHA512 f05f752946187abea7ad422704dc649d552633d8b0c4eef3b254e51c7000ac7dfe72d311760c5f28130e81c3c3868dab77251ef0e644053c6ddc94b1429f986f
SSDEEP 768:R/nG6gjRr12SB76QMfeko/CVm4M8MFMhixTFaypw56DXGRLdzceOL:BMVMQwVxm4M8MFMhYZpw56DgI7
TLSH
T152F2E259344DCA5A4835ED02A0FFD2206F2D9EB722BA581C14ECE1CF3265FED14E86B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_7[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_7[1].txt.WCRY
Size 165KB
SHA256 482817871832bc9de096bc1c4d279c1e38b0fabe6f36f4f72d1bc6df9116a410
MD5 bcf605febffac8eeff12c1c03681e961
SHA1 2b105f3231a746b93ceb3d1efa379bf3736001a7
SHA512 cc9438878fc60a58ea8198665e30e2ddf37e9db3d70457cf31e2863de62fe7ac15d8281942a71c8ac64f6b729b2af2acfdd62347f1f5f7e7cf9dae5254af19d0
SSDEEP 3072:Wbc0OfZmPiyxsQwsqV+drJhr4Wtrq2jtia9d49orL215Dx9F8O:WlOfZ/OsFArJhrdY2Bia49oHeDx9v
TLSH
T1D6F313650EC88B8554CF85F7DA852109D97573EBC83242867CB32E31C9FEC2E968A5B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_8[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_8[1].txt.WCRY
Size 50KB
SHA256 d97d0d45a402b3ed23036a39737cf88dd55fa8d81927bed6e31c72e72491bc3a
MD5 b3d33c4fd4569fec5886db6d3955cafc
SHA1 62d2160bdb4bb6ccff717bca4befbb3f75751beb
SHA512 69d68b4d87ee3711c77a9b2f2d1232710a84fc22b1171065acc890e59b1feaf7ab66576a4c552561819a984fbc5aee8e3ec5795f1dc67de6850b82a58cab8559
SSDEEP 1536:FGg9EfDwZN5o8RMU+ljWZLgAmpsmRfhiHoOfwx67:/zLafNWZ0Vprfh2o/K
TLSH
T1653302482B36791B86FB6824AD30C56708D53E2A48C70B6D23C7E31770D8E3B79795AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_9[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_9[1].txt.WCRY
Size 67KB
SHA256 2fe2691c75db4239a16d2f621502a063a97218928af24eb11fb138d5ba8d3dbd
MD5 3efa4e751b9011ed5fad7649a8471afa
SHA1 e52268d4094289d7419f7b6b5da75ada80e876ff
SHA512 ff2e2fe5e8d51058149a987832c570927552d5f8d5aae40d7c914c8b90620301140af92ff0ee0550049d5cf4a3265a34fc0cb17b00f41088e36d9d8fc4421c47
SSDEEP 1536:SIIRbsEyx+oi9gN9o4IFmmpmBoLzxzS9zkfb0aaoEpuIJsl:SIRxDi/hmme95kz06Epu4G
TLSH
T1CB6301D903D536522DB3E1BC783E042A6912117D7586BCAC9FB90924EE233EB92414EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0.0.filtertrie.intermediate.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{0a816c64-560d-4d72-92d2-a73eecdb1bc7}\0.0.filtertrie.intermediate.txt.WCRY
Size 30KB
SHA256 a2b0be49502b751c0b38939cf4417599157db8567165b69d5f0c67b11055eb09
MD5 54ff9eb5711025babc718519e095ddc3
SHA1 694996acfe49e92d7f8515cfc585b817d8a80cd4
SHA512 0335c11547b9aa72cd03d3d935d22715026a8308104a39628897225b2a310046a5d688648edafe450a0dc15cca33d8d4658157a6a2d1303488fa6d12c33d9d94
SSDEEP 768:kFoy9WohxcM770aKmv6hCqwEFjmunf9/47yZWQ77x:XaLzrwaKmv6hCq5FiuV5NB
TLSH
T1F9E2E1E5E0125DDAE622A421DBFEB450AE57F3068270B2E59FC2152F1789EFD81CB201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0.1.filtertrie.intermediate.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{0a816c64-560d-4d72-92d2-a73eecdb1bc7}\0.1.filtertrie.intermediate.txt.WCRY
Size 296B
SHA256 49140673c30180559785594d9c815ea671733b2ed0608dbaf91b211279565569
MD5 4208d843bb850c6541d8de2f0800ec49
SHA1 0bef6d0727081076b3f85881347ad6b912242e8a
SHA512 8ed05a7ec470c531ef076360491e10ff5d92fbcf2e168b5869d154cea7274c1c66c79fe5ec216e66f7391dba1b40671ec7aa974c474ce6e992de79e13182d410
TLSH
T183E07D895F941A62FC12A1B6C17A50654B4A016A1C7040898840AA7039DE51741C047D
MD5 SHA1 SHA512 TLSH

Submit Download

0.2.filtertrie.intermediate.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{0a816c64-560d-4d72-92d2-a73eecdb1bc7}\0.2.filtertrie.intermediate.txt.WCRY
Size 296B
SHA256 4065415faab035bf5f544a03cd81f18c1b5fff74f6c527189a37f5af2d74d971
MD5 f5445be97743acbd19ba75fda9fd85d9
SHA1 693cbf74c2be8b1bfa26d28adabe56421f84d3fc
SHA512 38c375dec61361f37ae4a4994329613af9695e8df2091389c208ebdc03e8e5c80c687773752dec4bc296468787def68aa929e87845aa8c3facd0a4d798118051
TLSH
T1ABE02B640D6EE3D1D9E8FCF924E7420707FE43636BEA275F0488518E12760CD1AC1253
MD5 SHA1 SHA512 TLSH

Submit Download

0.0.filtertrie.intermediate.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{45aad7b1-b856-4b22-89d8-aaf193e48771}\0.0.filtertrie.intermediate.txt.WCRY
Size 30KB
SHA256 9688ecb93058bc8b24dfd8185ec3ab1124da5d0e03b4827c406771e94731e5e6
MD5 83d68185791044d66b5fc55f064a7010
SHA1 d2c0904737195f3ccc6a6e0c6be82cc21c4b0cb2
SHA512 44352b075116fd10b09fd54cc6e19f7fa62b9a7fdda917e66cc79db786d9da1c601418b8f72efd031a843f367568ae376e294b8a6c1f6ac64f39246bcbb55850
SSDEEP 768:uJRJiGlva+dizgKikxPPs+zIUjqgs9orqX1q34B3LhZfsO9:urA0Ddi09kxPEnUxxql/Zkk
TLSH
T160E2F12BBC9DB6047F0E4E80F6E971271BD454A1CD2A6B1AAB7531802CA7953637473C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0.1.filtertrie.intermediate.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{45aad7b1-b856-4b22-89d8-aaf193e48771}\0.1.filtertrie.intermediate.txt.WCRY
Size 296B
SHA256 cda35ac5b33e470bb160cc21380ef22eb44a95e10d050a0abc3cd9ddd979d4d4
MD5 e7ed6dc4d80675487b249356ef57399a
SHA1 7d0a4411b28175cf657853d565c8eda0fd72c0d1
SHA512 bf57b3d14e55c411ec599c8f08c5bb60b80eff174cfa9dccd88eae4bf2c4f95b712af8b5efbf4e8fe7176c5571efe0123a134be2de5539b432cd05a1eb0409ac
TLSH
T17FE0EB3BF1BD4893D547F975B868B64087C121B2C34808DC241080E8EB020C608FA6DA
MD5 SHA1 SHA512 TLSH

Submit Download

0.2.filtertrie.intermediate.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{45aad7b1-b856-4b22-89d8-aaf193e48771}\0.2.filtertrie.intermediate.txt.WCRY
Size 296B
SHA256 eb0a7f4b444bda07a47e69c34971bd6d1185e3d406ac9270ec8aced007f63c67
MD5 9b338a90a209bda0501125d4eca2c1a1
SHA1 162d22aac5f23baef4cbe4267ff88eb92dd03387
SHA512 a53de67cfe4df2ae29029a1a5c4022e11012f5547223173cbd4d9a844534bc50be40f7ee676d7cbb6d4486f550465a649d86b119c3ba28107539b47329ef8565
TLSH
T1F5E0B7308041E0302A918CB80C37364D3F3F3100A4440B7A0C00E1E323B4D30B1C1984
MD5 SHA1 SHA512 TLSH

Submit Download

appsconversions.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{3e623085-a474-4d32-addd-e19bf2387dfe}\appsconversions.txt.WCRY
Size 1.4MB
SHA256 363a976f3d2b30a3ac4e657c36f6f4af5e9203bcbab671c717d08f2915a69513
MD5 cc0ce652a26f1065f7dad02767fb7c29
SHA1 49b1aaf6abb6ea97ca1ae3449fc4b5ee87524f78
SHA512 3f0de6d334801007c62b354fb0f8913035f8effb3c3772ea5b4b50c77af07f5763a389db5d4b9f5957eeeb9ab90d6bc855c3e7f1c204716bb471d428be294558
SSDEEP 24576:QhH9MwtNin5S6SXsJO+Ood8N4JQkDhQznLHcldzNn90klSXdOR2+sU5CZJYEi:QHywtEo6XN4NYQkhNnaklydOigCZO1
TLSH
T1E765337CE572730879406908D47829DE174140E22A8D3669F60FA0E86CDD6BEDACDDFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appsglobals.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{3e623085-a474-4d32-addd-e19bf2387dfe}\appsglobals.txt.WCRY
Size 343KB
SHA256 9e2396562c8774ece842dc6001cba1c5fa45ed6eb3b87f841e938d1da61af461
MD5 1682c8a14a1dc8a97c6e44a546865c14
SHA1 afa06b026195e8cd8f88f9760a5d98ab8bb3c7dc
SHA512 5d9e31102f1754f2c4973ab4952bc9da88e8180f5911ed792f44d94299f29f9a3c549e930c74947763562c4a1776878c15095eb7ad93e3cf79ddff6c2c5d85f3
SSDEEP 6144:KBH6kYp/deVt4xzO03cQxg1VexKiby15PbY1zPphyfcK6FxYXHQWLiSl9L9LIIqR:K5I/IV8zhcFbexKiby5jY1LccK6FxOLI
TLSH
T165742378A9C843AE402AEC5619E843BFF741231F5E7650B2F98941DDDB5B2FC863D062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appssynonyms.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{3e623085-a474-4d32-addd-e19bf2387dfe}\appssynonyms.txt.WCRY
Size 238KB
SHA256 4c017368b8c27864ce4ddf7c9959e897614c6fd9406a35819be24916afc05223
MD5 bd3e5cc55ad41134841192a17c497760
SHA1 3028355c3d0b06ff3ea5072b9e82a3b4f3af4cf6
SHA512 2ca17177ab83afaf8b1d35ae9ce2f153e55d4113595055078726eb942c5f8604cf1e541988a1ad17215b4e5113d5054d3390b7fb28721a6f28bee537fd47eafe
SSDEEP 6144:7lV3Chx2K9y7CLgoe2YeEVyro1/vzVr2WV/MX4AI:33ix6CS2YeE8riV3
TLSH
T1E534225AF3D4DF9AEEB307651147FABA6FD0B196F034B6D83CC209128AF529C1076681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settingsconversions.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{3e623085-a474-4d32-addd-e19bf2387dfe}\settingsconversions.txt.WCRY
Size 520KB
SHA256 0f20b1df920c6f90afe0b6d2a012b54a2f925fa24ed59099c7f73519f50e0ac9
MD5 b5f7ee289e55763e49ebe8dbc8e6f1d9
SHA1 a4a009bf74185c3bf37d66b58dad87e4be95c2e5
SHA512 75b1e9f355901ec74a51507a98bbb6752ed85aa938299abbe8ba22035fce9a507fed7e553b422274596058fb79d61dffa6656a4f1792d51fdabc575d3a62ed30
SSDEEP 12288:M3An1fYQaDzZ8Buu/BfjBFGlHPLfzEDngo+QrYqQgkdZzQyyNx:MwZKF8BuTougXx
TLSH
T1D9B423B7EB785025DC9D3E816F06FE8BAC19BEBE0B4B4BAE5D35204881E0297C0535D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0.1.filtertrie.intermediate.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{50380eee-e9ac-4912-b8af-f3feb67d06f3}\0.1.filtertrie.intermediate.txt.WCRY
Size 296B
SHA256 3ef29392bce81bd036d8d5f384640f88e031f41d5c3f740fb2dee887031e43fb
MD5 4bd4ef98bcab3cedfc6ccf99ab6156eb
SHA1 710398ee01118e34484cd6020fed25740d04c67f
SHA512 727971cf126f55fe7cce531c29441b8eddab53d27b8793687361fdd8117c3d0a576a0a0499ecba27309dde6329608f88326d42c9254787962474d026f8f5402d
TLSH
T1D7E07D3F10492145F09B1173C81B91324E38F08F29DC50D10654D8F01B3A2D29A41CCA
MD5 SHA1 SHA512 TLSH

Submit Download

0.2.filtertrie.intermediate.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{50380eee-e9ac-4912-b8af-f3feb67d06f3}\0.2.filtertrie.intermediate.txt.WCRY
Size 296B
SHA256 21c0a998af79048ef1081e771ef35cd4023621a00fdaf14615d8377f5cb6cd2c
MD5 ee6e60ca1ce1034e2fa240170f34e3c3
SHA1 e6fd829f441ded551e1a6d6a305b3fddcff5252a
SHA512 13eb959640f34ca7824ad02507cbd729d95da3f7efc62057c333b529c87f885be6a056278bf41c2e58a38de55255165ff5fcf5d46f42776469e052f6263eb3b8
TLSH
T1F0E0EBF0C3EE9D88E923CA3E0EB8A03043C8B80F280270848828B24C22CE591A51C4A2
MD5 SHA1 SHA512 TLSH

Submit Download

AppCache134336129995974525.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336129995974525.txt.WCRY
Size 60KB
SHA256 8746cc3cd4873392a4d79ebb0bc4e68785d6cde019fa916df4f5e68b36ba1184
MD5 c1e54a36c7efae5073155dc1ce198b13
SHA1 df6b3af5d69f41406587a7d32383d2a7802bac02
SHA512 7daed4b66d3afc2efb5a566642f8f250c1477368103ac04a9d9063aad548f6f32f69feb68e905f2f81caf42df76b8546889c7fcefa6167cda7fe6f8314cee5ca
SSDEEP 1536:LH1ceUVD6vRqzLzZ1gkqCdA77eZHpIUYnIsXhiiU6b:rebD4P/Cdy7eh35sRFL
TLSH
T1685302ABFAF9594086193CF94AC126F891160A714CE75AA0274B7E53C6BFD90FC421CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134336130897295586.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130897295586.txt.WCRY
Size 47KB
SHA256 9d7bd905f3325866bed25d45196260f56426949ab6d301588f8fa5db1e449410
MD5 142ad804d7692f96caee8ef5612b9839
SHA1 a14a1afac52e1e6ce26a7697201df2d3f9275a0f
SHA512 01dd376e021bc2b212efedba5a850860e95d16eff04e43011fd96c4c712f90fc518f208e6ccb424692838436206a292e449a3ee039c85a98f5615a333d2e093e
SSDEEP 768:f9ezy1Sc2cuFMgsDKntL/vfH5H6/drdRotLMcevdGynQLVxjbvJpFhvQ0f5p5nrk:f9nNVdKntL/3YVxRotMcMdGy+VfpFpfK
TLSH
T1CE23F190CF2BB3ABD8724B75A1972ECCDA42EB7253B3758E976B0AC08F754569030061
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134336140638938508.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336140638938508.txt.WCRY
Size 82KB
SHA256 5510af339d49f3ab716deb9cb71003f09266da72ad9d34470145332b5a50e06c
MD5 d5694ac39be796dc9740e5606b58751e
SHA1 aebb61000918a6ce497e8b4690010398648b1b82
SHA512 32f321a10ac2cc68566f88297b2aadd874b3131f383b8a2440705cb653e5217b9071997a877f36944e726b7cc81d2b17238921a97db6da5e24a2c95537e2fd7a
SSDEEP 1536:b9JLOff2tLhv5W6QV6ZpN7Z3FuLr4+8ya6+3vMQUtxFKqa2O6OaMfxdIEML:h4fILhhfQV6Z3t434Vya6+DUtxM12Obs
TLSH
T15C8313CB29978CE661470E5570E67F4A9FD78F6D29BE0C5232D2533A4ED8050790C8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SettingsCache.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WCRY
Size 670KB
SHA256 14154524e51632e92ed4b7854dfdae4bf24caa69511f1e823ab8219ea4f6eece
MD5 3869fed5d6ba215e1a7374759c137863
SHA1 506ea49cd5cadbb0e54b1eb18f815584cad4e654
SHA512 1d0d2d2fd932f4ac4352cb93a1e10fe7f1c89add15c9c7a8a44c1e993127ae63a69bf04de0b2835a7cf6c768a98b5985c496c4fb69eb9dfe64708223bb84138d
SSDEEP 12288:tQbXvhonqermbTWJoHI7Lu5SzN3CwVOhx+waCEQJNna9yK:CzhaDrmbTWJoHIOYhCx+wzJJNiyK
TLSH
T13FE423608460F1458A0980C6EF97481BE1DB220CF967C631DECFDA7FDBBA545AAA0177
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BroadcastMsg_1789140070.txt.WCRY

Path C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1789140070.txt.WCRY
Size 280B
SHA256 bfad88f2895b156f3138aa37f1f79ebd6dbc76bb2b88dc158e7b6874e8567225
MD5 b51a669f7bb5481c8d6cb94adfa92195
SHA1 27382c50133766adf701b63c17ff556ed39c88a4
SHA512 954bcdeb93c1d514dc52129869f799f97823715b15ec33e0a4707d4f051884db8e24ad1e3efd96e8c2f8db6cd3c9d08d7f2f9e19029675284e4564979519c514
TLSH
T1E8D095E7E11E0461E732F37548CF5903501CD724955550E45111D1990734D7C504174C
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredistMSI27D9.txt.WCRY

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI27D9.txt.WCRY
Size 425KB
SHA256 92278e5cf633fb75f1c3c627eeb2047c13a0f17595e0b1b19ea19c0e929a5096
MD5 ac74ca00ded8becf8ce1c731a24fcf08
SHA1 688f1421f4332a3eb81fa064796845c1309cfe87
SHA512 5124095da4e6b77c60dec5fbe0d150bc2c224d37f7c9fee2a0bfeebc6c5afa53623e383d88ab268502b2919cc3e3612f25dfb12e560efda0346b5587cdcc19d0
SSDEEP 6144:zZpq7zg8fO26F0rUyFiYq757AhlX5VvpquZWRxMQl9Cc5tnVjdm+/JIn5dx72:zW7z5rUEPNrVv8xNGaxdm+/mFi
TLSH
T1C29423ABB97788DF7B60F341A93EBCC1A4D0C7584DBA20252D1FB5D1606468CE273686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mapping.csv.WCRY

Path C:\Users\Admin\AppData\Local\Temp\mapping.csv.WCRY
Size 121KB
SHA256 53984d4e6adaa7ab2f3496c647b10b33a95b653bd831ffa5ac25c9f05fdf97ef
MD5 cf8d74382c15c3fcf091c4e878b7598b
SHA1 515b6a2d39e2413aa71d4bd2866dfdde452d5852
SHA512 145465b306abbf9ab01bca7a9dd1322643e43ab78f3655167e082ea9dbe02ad0e7613fd8fdbbcf2ad02cd6df726a2e8e5daaaf23422be7d7faacec7b0a6979cc
SSDEEP 1536:Pxoam22mbrg/mUxfFDf8YEDOECGS0imozGVyoNCoaANgUcK2W631WsN+ShiGZ:WeBXWbFDf8YECECx8NglK2W6lnwSh9
TLSH
T189C312B58984D8D06B3251F0E14597AE2279D8860ECFB5064FA52FD8BCBA7104F15EF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

page_embed_script.js.WCRY

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4572_475450178\CRX_INSTALL\page_embed_script.js.WCRY
Size 632B
SHA256 d69ab7684537d7981efec608557d0209095fac1c6ad1e450ef51f450e067ee07
MD5 50a736b53b9ef5a0c377062f22dccab0
SHA1 279607b33d5b6d83671e9ff7db3183e3d3d02e62
SHA512 4ff2e0daefafeab6ae480b9850f462f72723a4329d202a7862353d41801ab9a978a55fbc7aa42cbea627f93d073ab99f20f46ff308ff4d045e44d60dfc6e023e
TLSH
T101F002679CA06F0950551FF197B4B6739BDB9203BABC1AD5C2AA53E16A252430D30D28
MD5 SHA1 SHA512 TLSH

Submit Download

RepairUnregister.docx.WCRY

Path C:\Users\Admin\AppData\Roaming\CheckpointResize\RepairUnregister.docx.WCRY
Size 546KB
SHA256 9dfc7a347a7b8efa252dd36e4534be76a2a57ab9d6e207e0a05386a1bdfea28c
MD5 e5c366688a0982e1d82f2d1e87891e06
SHA1 2f0021043a6926cb8332716f86d0d28460b04b1a
SHA512 05ac7439e059dbd627b139e8ebdc8ef60096f7c57f5908b647e93b86f119121c6eacaedaea42d7fb15582fbfa8db00498adaf71fda6c1bfe75d4253004a360f4
SSDEEP 12288:KHUjcn8rqRO3rqMcs1+7qPKZwyrnK8+uUKlIgW4zsk1cTeJIYzPqM7I:KHUjNqRIrvcsNUwC5lTWRkWQx7qMs
TLSH
T1C0C433B799FB6DF7008190A7286E744FC1D72A0C1003E828D766BBAE516DE497336F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchRemove.pptx.WCRY

Path C:\Users\Admin\AppData\Roaming\GetRestore\SearchRemove.pptx.WCRY
Size 628KB
SHA256 aa535acc4e9835a01010985dd1ee847452830e8aa34703f1ea2f4c372fb952f3
MD5 dcd1e707a48eacadd411c9750188ea3c
SHA1 e9c893802bcb2123ea131570290127e13f723cc1
SHA512 0e0ced6dc92ccd38d45f14209a1b3fb681dc6618e1ed2710d0f8fcd78abe61278d560d8ddf066e0d5177a9ff626ab66cd920d9580af8956e52bd79005ee3d863
SSDEEP 12288:mfJWKkkA+2eQ4PTMMOYAtqTWxdA/IvlM/nOuLVqtM+exlfiJs9iuVm:Qpk1z1ST/OYAKWxdA0aO2UtBexlKAm
TLSH
T151D4234FFD38E2CD9CB8487611BE08BA636B516F0A971936213F5AD7C1A608699C0F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopResize.avi.WCRY

Path C:\Users\Admin\AppData\Roaming\ImportDeny\PopResize.avi.WCRY
Size 526KB
SHA256 7205fd1ae2ae435c47d04c6a020fa397e8d6cf41666d738448b23a478c6aace7
MD5 a0817a486744bcb7bedb9d2768ee38d9
SHA1 476b657c335a8967f19ed441e198036aca1bf180
SHA512 c02c4cb261e2765a2096674226f0ff54d3a2002c1cf5213e9560500db835cb516d0146a64493d8b66781e0a10174808732eb2c1ec208ccb10e3da33b5e0f4ae8
SSDEEP 12288:nICRB7YKuEihADFwgDgzkqXDqg/j7ksa6Acv7tMporTD0:hBFih6FJ8FqEkf6EKrTD0
TLSH
T1C8B423648D9060B093B5ED6EA9164CBD6CEFFDCB78F991E531A7A1F444C48DA8033893
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CachedImage_1920_1080_POS4.jpg.WCRY

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1920_1080_POS4.jpg.WCRY
Size 76KB
SHA256 8b28aac7fd4f07d1d78fc49ac1332f82ea20a7abe80dd15f1ddeca071e0282e2
MD5 260b97ea36044b30ddaee3f8abb0a56d
SHA1 d4d2d32d5a60f0f92344ecf56e60ef810255d5a6
SHA512 1f0a09986dac42cee7457fc5f6f65694e300f534f4af82bfe5c6e67b59f05f0e87b31cef69de5657ad3d3b5fa2a18d212067e61448a066a3b56b5e4cb9e866b0
SSDEEP 1536:1xQXz3Z+5lPsWIFbur9jxuCNQFIRFPuzhTLaGM1JFIM:1xQXzZ+5lPsDW9xuCCFIXIJn8fIM
TLSH
T1447302FCBB54096248B3A0E3DBB912CA87E813BCC66D6DFCC85D65412A54AD7FC72490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js.WCRY

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\uug57dpp.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\prefs.js.WCRY
Size 776B
SHA256 112cfe1546dafccb50567b1fd11188346581d38974041f339590c2cc10ea8c54
MD5 b638092b4b64af4f4cc1e4e92192ae79
SHA1 5456511d94e9d25801eb3b3800bd8ea8a15b3952
SHA512 278ad624c824942caba7852f143a7e1c2167c228b60116871f74fe1221dbb389bb4aef03969a21da3e65700d18199eb88aad6005973cf155cffb0b527cc2a988
TLSH
T14E01418FE60844A0C38C0ADE2B35A3749BDE8B5BE9055A9620C842062086E71DA97819
MD5 SHA1 SHA512 TLSH

Submit Download

user.js.WCRY

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ww62gjg.Admin\user.js.WCRY
Size 536B
SHA256 ab3dcd4fc90640033d3a2d869a8a2a5682bb473dcc04573937084faab574d60c
MD5 301c11063e8a6be94be39e304c22ec00
SHA1 34e2172856c46278d2f4ad4fe93740ea236bc223
SHA512 140590b00ee1b48dd2ef9754dd3ab3b86f65792a4e7b0fb25d0d4f39d2c0389aea209411050a7574401b8599a3601010203892c12c1c65d2016f781ca54ac7a4
TLSH
T1C0F07502FB0751E8E02190FF4DB6C26A11593B43F506476B7B46E368D2974C256D3338
MD5 SHA1 SHA512 TLSH

Submit Download

pkcs11.txt.WCRY

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\pkcs11.txt.WCRY
Size 808B
SHA256 959f4ec25375b1372f02f93370a6205528ad96ed422f9643bec439e28412edc4
MD5 809dbd6ea7edd74013a48e295fe8e972
SHA1 659eade689fc0656902cfa887efe02332f33dbd0
SHA512 b8abe0b6b67829470c81beab9d8541453f12d2f373cee9557022769ab895435e735eb9743831e271f578508e10162ced63d95d6c245ae1b348ab593760878652
TLSH
T177018672354E5144DA2E4F28934B415667A35EC548D5A7F4486C03A86489653B083646
MD5 SHA1 SHA512 TLSH

Submit Download

SyncLock.js.WCRY

Path C:\Users\Admin\AppData\Roaming\ProtectMeasure\SyncLock.js.WCRY
Size 161KB
SHA256 d75180ccde657f42f573c5ba3a13d8538532d31d6c7c806eeb441eb05edc7a2d
MD5 13e37bda4c7ff455c95f99c1e2b11c41
SHA1 cafb559e3e6e535c67dc7a343f0ce53501feb2f9
SHA512 ecb9347925c120b1bbc896b5978d6e3ed9fd6ed3147df14840bf11e32e88227fb39c85949e03da715f4016459ac404aa926c7a59d176724a03680d709f748a70
SSDEEP 3072:7a3v95rthQcGwM1Xh4OeY7KIXU5QOtGwGV8NlX2EbwHm7rie:7491thMwM1R4FwKIEyOkwG0XLbwGye
TLSH
T16FF312665FA06CBF801EEB17A64F04BEC79D201C240754EA24F8A1D93A5CC51FED7A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OutConvertFrom.dwg.WCRY

Path C:\Users\Admin\AppData\Roaming\RestartDisable\OutConvertFrom.dwg.WCRY
Size 1.2MB
SHA256 b906727175647efd19c0d1c7380d011a2f213833e38af4a5dd336e6feefa3950
MD5 6ccc437f24730a22d81264d6d2c390b6
SHA1 87010f1b385f38bbe4f773838c5172d82ea41c7e
SHA512 85dad5755fa7ed3475ea1c727c8493a8d586dc5179eb6769a1719cc8b141fc33c1a591297c9948d154592e51fe83abfad7b1bb4639a268463fe99e22533dd40a
SSDEEP 24576:DyTjZx00AGvtdLYfXz+5iw8rYyxub+th0UeKIKdb8AvQuAhbVlyNqLM:+nuquXq7FB+AUv3vQu8bVANqLM
TLSH
T11F4533715483D0336F609CF63165B6BA692748BAD573B60F02FA3F0EF582241AE057AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddDismount.sql.WCRY

Path C:\Users\Admin\Desktop\AddDismount.sql.WCRY
Size 827KB
SHA256 4431a19b60eeac0324303060f09f33c69831850f917b9397ae01bf76e8b004f9
MD5 c25a10c1b1f014dc461d88105e8c9d66
SHA1 1e2f37b65ba44a20336df6c507d6f5b07bf53503
SHA512 5fdb9b9342c0acfad063b0b30ca6c11938869ae7f2a6f386edac5fea9e7853348c6010f9935b5cc7ede1df61e788c005d24e0face8b8d22506ea3f27aeebba0b
SSDEEP 24576:u+0eHezPa1sbFsTXtgI1bLs1hJiNLVSLwW:4esxsd1bLsPKL8sW
TLSH
T1B1053362F76352BAB09A826C24313B06D68B5D98F37CCCC21D45F909DDF394127A62ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareImport.xlsx.WCRY

Path C:\Users\Admin\Desktop\CompareImport.xlsx.WCRY
Size 11KB
SHA256 5c39445ea39d421f04e649672664ad798a645ec6e3d01e16a217d9a6aff162e9
MD5 9ad9e687d950a465148d3bd430cd537a
SHA1 36145d65fa195ab96ca7c34d55a0ce9c7970b719
SHA512 8132c474876225331fd43983be7da27be3b1f7a2367d91ff3076bbbdf70a9a6acec5b38d1a076ec5ae43ac938dcf47560411b4cc9d1f6a40bcd267e0add29b6c
SSDEEP 192:psKvZpG0mYG1z+wfl1xs0BKriTEdMGJwSHnllHJjLqKEck9/gluLRkT:qKRU0Szp1x8o3sTnllpi+ka0c
TLSH
T17132C04D24838DD08F0D98196ACAFA82D2549EDDDD173FC3365B55C06993347B970B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressUninstall.png.WCRY

Path C:\Users\Admin\Desktop\CompressUninstall.png.WCRY
Size 901KB
SHA256 b15e3e7dbca95deeb6b99ba3104126632056aeeead6e526d9496ea726fefe398
MD5 4694630c1d998a3e2a0df0d7a9862746
SHA1 7b729ae821a655b5f8825feec2130c794c2335d7
SHA512 90d45c149774096b131d5e7509210c36bbc16f3b9d60bd680566ae7a30afdae3318a929256f3f70a23d62563bbfff8178c8e4b40f022c2c8928fce2253786281
SSDEEP 24576:OMcRpmiYYqkFJj53B8MdfrPHrSkSJg5TAkbYtpaxNz+VOxd:OtRpHYYqkFJTFdffSTg1zp0Oxd
TLSH
T165153357F8AB2F0569236FBBC1A1A30D6B01DBBB2171F7ED5654E97A3E48291406300D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetSend.sql.WCRY

Path C:\Users\Admin\Desktop\GetSend.sql.WCRY
Size 496KB
SHA256 b426109780dea37650d7c0a1d46d23d8a0edb334cb272205fd2779c359fbe07d
MD5 4c68c062399d5f643e8072ef9e735cb4
SHA1 24d8827539723747b70723a2d8461ca2cee47a8c
SHA512 f3694b76fd96df32b8257201eca2744f0c5f1e67b5e928aa9b8ac7f16b616f339ab45307ea0f15764733feda1fbbcb89124ea3b23bd604a0ae25d53815597d20
SSDEEP 12288:AFISxE9eN+9ShcKBuu5WlH0xNfUpL4OQH4eL9Ym3Nv+k6L:8xNcoTK94D4ehbvj6L
TLSH
T165B423CCE2D3C307EA28AB2BBC17C0A96DE6C6FC5014982DA35192DF4C759611E99F4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountRedo.tiff.WCRY

Path C:\Users\Admin\Desktop\MountRedo.tiff.WCRY
Size 791KB
SHA256 e84f6e21cfb5c89a2f478e6458fb485086dda70e5d595a90d928166a95fa7762
MD5 f21a2329d56ec04aae417e14fe28be59
SHA1 bbc0d4ee7329eb6d9e8d5021d9a564b73dbfe192
SHA512 36bc62300d2dcdfce6d202d221c0e9ef1c039e85950be683a63986e33e8389da8ba757e2f752112ebe199eb108d745fe83b4f308dfdea8470475530baaf704dd
SSDEEP 24576:d8fwgOCMdsI0yzNro7EHiNVX7aY8NcSm6XojYrEEj:meC6R0y5M7EiNZ7aZN1oj4T
TLSH
T1430533AEAAF603815D5F8EA4D5C426C6E384DC3445769FBC3F9B6B20EA1C19C4839F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenSubmit.potx.WCRY

Path C:\Users\Admin\Desktop\OpenSubmit.potx.WCRY
Size 717KB
SHA256 3e24c8f45a2bd56554a069dc38f7a1d89dd2159b5666a0ca8fd2d28759e7299e
MD5 fef57c340e957ed0e1109e92d9409ecd
SHA1 0f187018708edbe0cd1ab58a8f571de42c7fbded
SHA512 064d255791b8b0f9f5307f3ab929775edbb8e7e08c08173d8fd8b0a089c6c0dacbdfc5789895b3fbbce0453c5580a17b65b0059ca7d6896ccc82766288ce80fd
SSDEEP 12288:Sfc4+eZ3VJquGryKxxqw6U9/TvR8/9j9DQCo2p8jshGiuA9MolVtN+1uI4QnkLk7:Sf+Q3VJqhrN3qwRLi9j9magsdayVz+1l
TLSH
T1ABF43337C7707CBE9E2D4311AD683525542B53CF0A5749E9FC0C2976A29C1C6AE92C4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReceiveSwitch.avi.WCRY

Path C:\Users\Admin\Desktop\ReceiveSwitch.avi.WCRY
Size 570KB
SHA256 d0074e0fc936a87fad2775f9fbfc751c169d405c7f60a75509ea62d0af7b84f3
MD5 e56a541cbf386c8dba93a3d6f896d298
SHA1 c357636221aafc821636b5c38095fa7d996b6c5d
SHA512 89a2ef92758571e8b2628d81023933f0c7b4cdd953fdd3cf9cb1959dbbcc564ab15b17a54e3827a4241f87a9899a5aa1352ecdac6c0e3c5e041504d7a16c0f61
SSDEEP 12288:id8dcnbSV9EItgOo5ef8RB2nnecy1K4oTawyzuClzJXQkB/DikMGc0:id8sq9EHX59c9WcbTGJgSDTc0
TLSH
T1D2C4235C79C9D5A0706A363C42CC02ECF7A2D59BF49163D4A86BDAF23248C5F4F50976
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchRedo.txt.WCRY

Path C:\Users\Admin\Desktop\SearchRedo.txt.WCRY
Size 1.6MB
SHA256 e9d3b219b153265b47a49bd175835d27ae06325e18a9d104abb3b777a535ed00
MD5 72560eb302786056f3d3b75b8b0c589c
SHA1 014bf47a766f48fa2e8e886b79ac840b1673c477
SHA512 12d8eb408ff66d58b0d88b23edfdd0ed1f91244431a5f1bc35bd1200503f128df279417c2f7b15415643e68a7c461b9fc6ec2889e9d20407b3a50a0da5f14530
SSDEEP 49152:DnjEmkAObp5EfRk9IT6hsqKHMxTWjvg+07+yw:U9p5Mi2muqKsxTWjg+07+H
TLSH
T1207533F26E7A0B35658BC5BFA3EB48BF8B0ED06243B6F40069D5D6F92DE40C81916507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaitSet.avi.WCRY

Path C:\Users\Admin\Desktop\WaitSet.avi.WCRY
Size 754KB
SHA256 149cf41862d6fc30be4c1b7a56d58e945c22531c5a5baa14b973c007b5d3bd78
MD5 df6256fa488495fd32b670faddd48a58
SHA1 d18f1b53362a9463df523a4672100a6bce4b172d
SHA512 89709108eea8b0ccd1987bc995fb09c01126cf4b27298309e505d50d20da9f3efa1b0e4ad2e27ec2a6cbb1951241ec9c565ae1a22cf35118c4a3abc2f2618ab4
SSDEEP 12288:/WYJ5oOEPXF3uQmnQhDgPqLG6RfTUiBwQJIZlNAgUdidhLodK4zrQIrH2mX3F/6/:N+hftuQmQhDgPqy6RrNFJ1gUYxodXrQx
TLSH
T13CF4234991979FE1CC8196A4538571C9F8E6806A46B9FAFC263A33CC1F194C7DBCD283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaitStep.m3u.WCRY

Path C:\Users\Admin\Desktop\WaitStep.m3u.WCRY
Size 607KB
SHA256 10dd4f4f921529d1e053c6713c3898fb17b451849ba3a9ed8ecf115a52513384
MD5 e2d0c3c47c716302ae98b53db7fe9eb6
SHA1 35ecf2f04985eb90668ee0c50b884e96c33fe63f
SHA512 3841da98eefdd132eecb61152152d376b95b40b7b3fe358b3d15dd8b015e745265c0ff204f839eebc2a8463affe2d295b0bbc94b0ccecb2af17cfa1153e749e8
SSDEEP 12288:LkOjt3seN0OBSdGts6xS4IwsYk6SFBUmpYB88NaxaHoHZr+e2Z072:kC02dttMIsb60zaBtaxgjeM
TLSH
T192D423BB8EA9D78BB9017E4F47C5963121D630D4DB242EE0FB56FAD70D78984D283814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApproveSearch.docx.WCRY

Path C:\Users\Admin\Documents\ApproveSearch.docx.WCRY
Size 14KB
SHA256 66d86379522d1dd6c1c565865c5e6b7dc10f596e5505f81f1ffead1fede34b65
MD5 05f85c05a1e5f90f9349cdd8587a6a9a
SHA1 27dd74278f7fb70aeca7fd635bafd27701c19a9f
SHA512 dc34a5cc938609040af20594cdd624773aed55616de2bdc43446900e4ca6252e9a876c2dd43eac2826b3951a8ee6f178766faf00da80662e20f9aa7959815756
SSDEEP 384:G0aq8SZ4qJbts0jZVNWKG+lpbctXds7j1MsFRklI:GSYQbKijRGQp4tXdy1brkq
TLSH
T10A52C0674AC54410D5786FD9FE288DA1C699E4238F9CCA221EC01A425E2D3DFC27AC71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertMove.odp.WCRY

Path C:\Users\Admin\Documents\AssertMove.odp.WCRY
Size 966KB
SHA256 824ee789086400501ef6ebfba7b1491cd1aafcdb3d7d209f36a7e109a61038b6
MD5 e80b6a38feb9a0f10122fec9640f392d
SHA1 0bdf5d61d58dbc665bc59f864df65e9a435969c7
SHA512 7ba585d7c45b01c9e6ea593bae28706fe664b04744cf0c397b5e7b483ec52579cd7894fb737fef7ddee882d2a39093cdb61653fcc17b60b0406325692b955461
SSDEEP 24576:M7cfvINFXizv7u9EohUynuGx/tVL3V1gDLRVz1yEzo4MA:Vvo8v7clnuolVL3HgJXy5A
TLSH
T13E2533F201EEC60700C5DCA75059E22A6D6FE3BF0F1499F2ABF5A65E124372D94890ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupMeasure.potm.WCRY

Path C:\Users\Admin\Documents\BackupMeasure.potm.WCRY
Size 826KB
SHA256 aea6cf679183b050780d78a1904bc112f4275f4e7da719e492ba1349ca66cfb2
MD5 41cb340ed77866eb94e8af6671435d13
SHA1 09a75719831f762f562fb1339cd0ad8edb67d2b3
SHA512 53ef296320e24a80e888e6fa403aeec52de8cff2b8a376a2e6e3dd83edb3d621e45c3f0bde2038b3339263812af29f7d694629659d1ba724a8215bb060f8106d
SSDEEP 24576:ZeE394Ng/3TJCCQgijyKQdDWYamdkwNuJTa:064Ng/DJC2IyKQhWYaEus
TLSH
T1BA0533121FCEF08560D619BEF61C759D92D9BD570028246CF9F7AF0F00AA35EBE81A94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockMount.docx.WCRY

Path C:\Users\Admin\Documents\BlockMount.docx.WCRY
Size 14KB
SHA256 90cdb954599ff5801db4d00f40833227b3ccb3f7d0b8b5bf92e2664dd16d5808
MD5 d19c76e24ed52a692cd51c32d36fba8c
SHA1 72933cd3ffec5cabeb41b2496682899a3b4e225d
SHA512 dce6cfeac9ad52c11b280a6a53a89ed7061703bc0287a69f4fe7671188cec5b97de1bdf7d93c2cf129f7b434d3c3a1dbcc9213e23319c8bf21c99e664c68a4a2
SSDEEP 384:RwKjD84raRK33/qrO9NnzHKyXvsOwdKrgfwywDiB:9jD84raEfqy9Nn7f/Q8rRyJ
TLSH
T18762CFAD38EEB14044236C55CC5DBA2BA393F39167E9779C08D6D003EE2D166173A0CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointResolve.ppt.WCRY

Path C:\Users\Admin\Documents\CheckpointResolve.ppt.WCRY
Size 798KB
SHA256 97c45b121de3d78d5f9b1c76cb6baf2c37ac496559122f479f06cc3977ac3ccf
MD5 3c0f48c66f9407d87c2cafe3840275a8
SHA1 7a3c725e10ae6becede1fef3c8ca6fad94d6f97b
SHA512 6c5a9aceff3551be8d471b9d395c87817279c93347c2c9bc5fd5588d11eab5b6bf1c88c6ff68b81099462bba1ffcb00bb505b685f743cd5b087d0ea945ca6f5d
SSDEEP 24576:+DgELOgTeINfC45gke6Un2cxPN8M9e8oyrh:+Db6V1ndCyrh
TLSH
T1DB052319FE67CC7F21A1FEEE3FA3676A1340249F216C190C5B84CB7450C68A9A2B4775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressSync.xlsb.WCRY

Path C:\Users\Admin\Documents\CompressSync.xlsb.WCRY
Size 658KB
SHA256 ec680fef90f1f881a1e09aab7442b376f7c54c9d5218803e87311d9af61d6e6e
MD5 6b8003bf91f3213620b2c9e6f10d72e2
SHA1 740439fabd48fc28604965e96ecfb6ef39501b1a
SHA512 b4c512709c7b4ea0331208ac8ce435628988c7fc11a97ac572abf0c56905d875559b0a6d94019372b57d5b40d390538f2cb53145657683561a9c2dcdb37f94ac
SSDEEP 12288:ePsVUmbNOf/L9/kQRx7izO4XaMS1lsX3qnyvXlw1HtD5rMnOsJfCyYV:qGtpO9bi+ROqyvXyBtNrMnhqyYV
TLSH
T14BE43379A0825F87E441760AA3E062F6CA379A13DCD308955394A53B3D147E9DC2FE87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectRepair.xlsm.WCRY

Path C:\Users\Admin\Documents\ConnectRepair.xlsm.WCRY
Size 882KB
SHA256 138616b7905da460c548e02b0ebe83c1854537e4d7dd271bb884dc973faffe7f
MD5 6173c8a531fd50df13559aae392602cb
SHA1 ee9c0896f0c27e2c590c765bbe7c23394d76e603
SHA512 e1f3992ba753601249016df06659d16211078cbc081378e04f37e2b64391c9b659888ba4e049c9ee2808b9b84ec535bb3a857212c527c6359377ab1766e7e390
SSDEEP 24576:d8cR34K4/U6xtNlh0lBqO46UE2aafli1ISmkf:BoKaZlh0nqhE2aelLSN
TLSH
T1891533FE5DA4993A6F9268580C1B4EA78538BDD11F346D7888263CF12B415BE33FA4D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertStep.xlsx.WCRY

Path C:\Users\Admin\Documents\ConvertStep.xlsx.WCRY
Size 12KB
SHA256 4bfe1466aee7168c20980b19d3da9c848e7b5d33b78e500baf0ab277c9a10c61
MD5 dfdd120a1608b0e3bc87dfc3f62fd7cf
SHA1 cfabbe839628c4d465600e9c524015d25d6de707
SHA512 b8e57ff708d04fcec31a65d016f04e45e80d817ef8eda0bbb05c573f552917755e92f1f2cb7a12ac5738976f3dac5ea02ca98ac0cd59794c08166a2261ad80cc
SSDEEP 384:osuTPU+uxcHwYOWBKxRtVNFnIWj9LMQba:osB+uxcHwYbBKxRtVzP9AQba
TLSH
T15942B07EF656D92AAEDB046BB00181E3915C2384397E4BE47ED6E62C42055732C7F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenyRestore.vsd.WCRY

Path C:\Users\Admin\Documents\DenyRestore.vsd.WCRY
Size 854KB
SHA256 0fe2e180f6fdadeff325fc81ae988ea4606c302aa6b74a4f2405f7f6a46a3c02
MD5 acaf816c40e7be8b0cb04e22dbbdb4b3
SHA1 90e6ea97de34f692855588cc08ec6fe1efedd9e2
SHA512 c11f2f4703da7c959f4dd6d55f2e6e80c879ef2de647bc4e6a9d0aa412863a60ec1f76723fa63948b183a18f23a2485b4e22a77238159c9303b814689a07e2c8
SSDEEP 24576:SMncQvheNhvW3tCJE6KnGqNmtyCzo3Gd04:JcNnM06DGqZCzoQ
TLSH
T1501533913B97A1895372006C5F1042FCD5EB25C2CD1D72BAFAB7949210ABC6BF02B75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpandDisconnect.pdf.WCRY

Path C:\Users\Admin\Documents\ExpandDisconnect.pdf.WCRY
Size 686KB
SHA256 4d9c48d69caea13dbe966edbf21b9a1c929263f4621f6c13a46ffe61dcdb51ed
MD5 f0f3bfebc7571315d1cd7a758293e3cb
SHA1 76a69fb42b51b2f1e6524f8e714be561f5078c6f
SHA512 7db963f5b65096a0711b63be4660183e8d8bcd15b8b0665766c3861e44b2c8c67686362883d09552ac4d841117ad3c06ae7f116ca0251637a91d5fe2684c03c1
SSDEEP 12288:p9TNZ80jXO6DEO9LXsGsu68JckT5A/GhEYzDVRG+ujMM44jANykQnU2LOm:p9TNyEtlgu7CXuzD/kQb4jAHm
TLSH
T1C2E433BE57A4738132C8D99B7751028A4BD95E7456C3A3DBA8FB1131FCB22083E4D6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatRegister.ppt.WCRY

Path C:\Users\Admin\Documents\FormatRegister.ppt.WCRY
Size 742KB
SHA256 1fa0f8b45744aeddb6487dbff9edc82b99993e9bd7b832a8ba7dccdbb67961f4
MD5 9bef5dcaf51f16d4f4557441a4d3bfde
SHA1 8ff8b7ba422b9e5e83d720827d91c25f53630b9c
SHA512 2cfa1a2b8efde468e22106924a91ad24b516e7b7704f70bdbaead58a15158e91bbe73ee9369e92229255b47ddc5fbfad84eceabbe5b130d6ceaa0ac9417edf00
SSDEEP 12288:mGPexfZYIAWrW/Lj8gZ9gfq7XvDi+Esu56f8nGFAfH0EXGXC1sdRuR06XvN2BIm7:m/LAWrQLjxGsg6EG+fUvy1sdRX6V8Im7
TLSH
T12AF423F1B4B0A11EF76AA3B8CD1802D51F4062929726616B056A077CC6EDFCF5E2F153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetTrace.ppt.WCRY

Path C:\Users\Admin\Documents\GetTrace.ppt.WCRY
Size 938KB
SHA256 0729cbb50ec4111d9a2d3b232052d8c4abfaa5b91a44e54bffd96164df2f73b8
MD5 a2dd3132e5fb8f01d863a6e52a40b1b0
SHA1 3c8d41ba474d19796e0f0f063282be37445ab65d
SHA512 02bbb1d61ed18e4ffae9b2d9220b0f752a02272bf553d3b18af0f9d223966bde94acdebc899d16399456d351cc7694b64d748120a50fe8a19e768f4cb1f6aa97
SSDEEP 12288:m1GaxoH8tHllrFr7r1MJ6DksGni/UzZSLhmXMDG8nRQGkPy5e56R2sF+2w6JzM:lIoc1BvRMJTVSLhmcDGXy5tfY2DJzM
TLSH
T1D21533EB6D5B6D2F0505CE8C740E72730781732812A765B94C2A6ED74C067BE9D0EBB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrantMerge.ods.WCRY

Path C:\Users\Admin\Documents\GrantMerge.ods.WCRY
Size 770KB
SHA256 a674282313f3a3a06e63d5fa1a6159a55c391507340d1a5c08298ae617d019e3
MD5 528c2971b32049fae7ab77bdb1806506
SHA1 01a66c36d1c302eae0748a19063034017b2b1aa0
SHA512 03616d0a91cfe9a028f69be3c645730f9290316e17fdfbaaca93e79394fa1bb1d542e2ba6cb1a267c5c268776fe0b42f8d797c37132ece4002537eecabdf6cc7
SSDEEP 12288:oRX+s0EP+i6QFz4WoWZ9WD+Pa0PaJV6LLBoiPsy5+uaUrq2Q0UwNUztt:ohHRmYFEWCyCJVYBD5+u3rvS4ct
TLSH
T18CF4337E8823F34A9417BC6D2E3A774C0A325D767883BE0EFE554F615B44446138AA3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitUnlock.xlt.WCRY

Path C:\Users\Admin\Documents\LimitUnlock.xlt.WCRY
Size 714KB
SHA256 abddbc87d433929c3335e50493ca6b2d3f7b35956f266d7a9e51117aa594138e
MD5 02e93ea6a4cb3159bb7927d05fcda405
SHA1 29f2edb3e9a49e6a18fd2ecbe9df6a960ae679a0
SHA512 d78680bc04f04891680e767f90451116b850494a4e7271d72858978117748e2237fa902b93701920079056d442a5654181035f2448bc9fa62c3b4c80d7f43ad8
SSDEEP 12288:PiEIErAukkiuUv1iZm74vu2/iWb8yUN2vIrhSR1CaOzr1Szqv6EgIZRTkWti+2h4:PidCkkatiZmMWAiSUNSShA8aOzw41ZRp
TLSH
T1C1F433DB08C05705C6A3BCFD54CC3A584CF1AD3C96DFB04A665A24F64D8B7A6086ECB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Open Notebook.onetoc2.WCRY

Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.WCRY
Size 6KB
SHA256 7f4458265b5bf3e2dc34c3c722b342880db0212cf6176368573bc18dff9123c4
MD5 5e2a6220115e35788207f0a1b725e7d5
SHA1 3147fedb580c236bfbde320637ede8015fca6abe
SHA512 30520b178cc0b56508733fc87b0bc95d78f3cc0e40352362e55fd85c5c874510884632eb0ca07ad3c11a87eabd3b7add7979710b9013b8f9e3fd44da9a82212f
SSDEEP 96:aYTXonD0g56lgKC6c1x8ELfaPIMJnJYTJ3rUhqfSc21VIYCeh/OUIa:vMD0gqQ6I8ELf3QIRUhf+YfAUIa
TLSH
T157D17F91039054113BB93621DADCB16460223199BCF38FA1558580ABFF4DC8FAFD1261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OutPing.xlsb.WCRY

Path C:\Users\Admin\Documents\OutPing.xlsb.WCRY
Size 1.1MB
SHA256 b646abc9a974c824373c737b441c19b173d8b77f45180d0ffd57f6cc8b84a1d8
MD5 71356c578fa40db56ac90455342ef32f
SHA1 ca4f153b9314041fd125ccd0e5d650fd876fd45f
SHA512 22169b819c3d9fcfc6ac5da25fe7f2f0d56161f61253cce50ecebab92d21b3eba040b6a6450454e1d20fa7776b81294c4375322b2c47f1ce7ccc83791e39adbf
SSDEEP 24576:ap/yJODJjgNSYj7lTK9zAtoCdRWEyosqrMZ5OhLyeLnZ:apcODZgNSK/Hsx+hLnZ
TLSH
T1333533E464479DDDB60B801482AAB8C5EBF84ECE69DC2519D40818C5BCB2E6EC7BD4D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Outlook Data File - rcamhngqtd.pst.WCRY

Path C:\Users\Admin\Documents\Outlook Files\Outlook Data File - rcamhngqtd.pst.WCRY
Size 265KB
SHA256 f422b4e116b98b4e688993a7393bf9e4960ea729eb38b8a48efb71bb15abe785
MD5 acd05caa739ab1569094b9f281f770ae
SHA1 8783d907b1e65091defa097b985b24a310ffca5b
SHA512 e52970c378e12dd8f9657d1658e37c11f68be58a44cdef3c08b90ea3cf7e401cb0267a91d5eaf3d6e33675cc4cd80113344ab27d767cc47a5decf2d85eec19a8
SSDEEP 6144:sbfdEzvAlLcOT6zJS1ou7hmJmkhk2aKdfJgFkP6aoPTSsx:shEUlgmmSdlS+2aKNJgFkKPD
TLSH
T18944233262D62E7DBCF780B6593FC9B24C378BBC615D754189F22A49C23F199A15003D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingAssert.vsdx.WCRY

Path C:\Users\Admin\Documents\PingAssert.vsdx.WCRY
Size 434KB
SHA256 320d6825249060eadb377f5ea6924ebf7ccb3276271e8be90c4efe0c84e92eea
MD5 ed8aa7a573732891467efa3cff0d0c70
SHA1 e1800258a01942c83963815466a8c759d66da777
SHA512 9e2829e6e783c7ad6e5fad0b0944dc3658fa02d84581a32af351ecbdffb2c27f714e2f9c6483ebb679d3b07e145f2afeec187101731a46b9185258a7230d9ec3
SSDEEP 12288:e4yxomSOjioV05GWqt4zgZ2OuyJ6rpJ92vgyGLB9:QxoOlVOqtygbVJ6rpfPys9
TLSH
T1EC9423EBF806F215ED62D20463D5DDE9EDBAC9D03BC04C418FC9E919A7ED0640F9A518
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingRemove.potx.WCRY

Path C:\Users\Admin\Documents\PingRemove.potx.WCRY
Size 1.6MB
SHA256 692d5ea1f9126736aa11924e5b36f1ebd6325605ff1e86a5f780eec729730e48
MD5 073aa12ae0268ab0b65083a07270ecc4
SHA1 e6aaff252e71a1a1e55250fba1352190fabe4df8
SHA512 804ef7ba6750c236e9ecbb2bd409ff171eb5b1b81b245e3a2b2d18dd3bc8c59c8d774bb6d9627296b5a2eb9c7afeab1f8c21f133ab4109b6ada0a5d7c471c3e1
SSDEEP 49152:q13ewSt1A2InHph9HPUS1kh/rmxyMbpE+dI:s3/St1A2InBHPUh/qxyMbnG
TLSH
T1487533C8581DFB05A10E409BFB870471132E42AE6ED2E45B3C5BE79DA91E116E2F6FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveSubmit.ods.WCRY

Path C:\Users\Admin\Documents\RemoveSubmit.ods.WCRY
Size 1.0MB
SHA256 ae44f8404c8115a7095822de1cb6c7cce256e2e7d3c3c4d5df47b5dc117d9cb0
MD5 ac38395e2444f5fc011f5abc8d51ba01
SHA1 9f09bd0d7dfe73bdb6134465fe8b1fcb858a3af9
SHA512 0b5e34f1322deda023a12a83576d1b3750691e4d0617e4e28a76e7bcbdc09064a9f1786b2f168845a80a00e1879e5987a145084f63d3f1385076d8389ae8e7bf
SSDEEP 24576:kNH6P6ZU06LiQKCIgX6HZG8KIGqpbu4KF+AF9yQH:PP6R6hKhgqHZ5XGql6yQH
TLSH
T12D3533495F6CC5D02179FBB524D2D7CE0E9985EA572D383DD9AB186C0C13817E3A3E0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairPop.xls.WCRY

Path C:\Users\Admin\Documents\RepairPop.xls.WCRY
Size 574KB
SHA256 da3eb0acd494694496ec00161900d10d3e64a462857b8e51d34962a28ac71b35
MD5 87488a24684b5a01211048ee85a667ba
SHA1 672ba25f3a16df3cc78b681fe582d59791543670
SHA512 e60dc09e5bb1ad5eff8aeed708bf34f68a219ee7e6a77187ff335f1cf7e3a93f6e717fa6e9b8e3037c2e0c6077612ffdb6c6a6dbc3d1f903796553bd36871022
SSDEEP 12288:Dt6ig6WoQnaiPwr4tJSitjIEd1YOlzmfqo9CtR4E5W+JfhX:JLInar8HW/fqo9CtRo+Jf1
TLSH
T1CDC423E4F55B6A4FC8B287DC25830BF998F92F991007164BBED74078B27A8CC8059F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetWrite.pot.WCRY

Path C:\Users\Admin\Documents\SetWrite.pot.WCRY
Size 1.1MB
SHA256 0c5dd5267c96859494f280d21e030659bc1ec930ebcf2401f95f035bdb11fbd9
MD5 a583e2d6b1b7622fdd62eeea3c4317cc
SHA1 cc3fc7381ef5cc1d7a149fb0d7e5018f6bb8dab9
SHA512 f69390abaa7dbc20dc98b1785d63d4812a17976c02532579c6fbbdb62cfb297b3a92370e614af4ff490d41be715ab58ffa68aab47208ebc6b021a81b74fbb20d
SSDEEP 24576:S3mvb7W5tX+XPz5z3ajj2RwWgNSZ/mXisf3AzKEoR/ZMasZ:XD70tUF36K2WN/mffwkHMasZ
TLSH
T1953533D7A055B3C6BF7C550BD305F62D59D8C6799EAC3C028DEEEA4AB3D806310CA849
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowUndo.dotm.WCRY

Path C:\Users\Admin\Documents\ShowUndo.dotm.WCRY
Size 994KB
SHA256 1ce3462f61116582732d2d7a645e8477f63baa5c895181518d66679072fb8d0e
MD5 3c88f282643160e6df0d46b00dc93522
SHA1 7b43dab0e6e43956ae0cc9d019bae015979d9459
SHA512 7d1cae1832f8b999070fc5ceddba76bedc8d8a6592e087183af428aba010459301521e2e5c3003cc78ba8e9accd4eab36a1e1bd1d426f5b71ddd619cda73393f
SSDEEP 12288:rGHV9ogIymtvE19lUSsZhnofw1pAdQIp9YvzhgDFvgPBrhNzFdK7aoT5rub3A7KX:SHVGgIztvEqD2wLLCtwbN5oVd2QZQ6Xg
TLSH
T1BB25333FD3381771008FB74066742CA201AD77AC48177E9AB5A91DF1879AC4B5F8E94B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StopBackup.odt.WCRY

Path C:\Users\Admin\Documents\StopBackup.odt.WCRY
Size 406KB
SHA256 82a5a71667ccf5d022aa0fb1185d2557894975f1f23c8a5832e601870ef8c0d8
MD5 4e13c740cc0bc08dfdd9a1b2a2952b4e
SHA1 3336f9306fb3eec9b58e352cf58d0fce7dd50aa3
SHA512 370244c8336d46ad9eca88d3538f58137eed0204a3f60e0437e1fea3fe93e361969171d7bc3af5bd2122259686de61b912004861bcb8170c6f07bccd7aaa6e7f
SSDEEP 6144:F2GmSEOveqTX6xrmAbw90vJOyVSxyLfdtlkWbwUoqfhBYz1IJTMIQq0mtgKDZyPF:kNShveE3AsSAUGWb+ERTMIP4oGLRJx
TLSH
T1029423B74FF0E4C2A1CEDB41F624380AF713055545F1A1F05A36B974A74E2EAD69A83C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SyncWatch.dotm.WCRY

Path C:\Users\Admin\Documents\SyncWatch.dotm.WCRY
Size 462KB
SHA256 02c500557d8e46faa9bdfbcbdd3da489851e30bbfd860136f5f5158bdc22685a
MD5 077b1de29194e781a4d291d4914e3540
SHA1 387c49164e0213e819072bbdebd3aa9136b44378
SHA512 b0080eabdefb77540713d27ba5c1d3847998946fcc2a05b8121e45ec92fdb1126df0ce239de2dd924ae528386a590880a217d9a9d90525f2cf0b511a1da22051
SSDEEP 12288:dXD7btd56TXVvjj7Uc1XFu0Ov7OLzKAxGbYZpqtU:lD75d56DVd1XFu0PLVyYu+
TLSH
T1EBA4235858CE096FD8FB62161BE50D36ECE737DFD9D026880F612AFE0095E0626C59B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TracePop.pps.WCRY

Path C:\Users\Admin\Documents\TracePop.pps.WCRY
Size 1.1MB
SHA256 6219a754f73f052ff820f9ee03640a815444a0b759767842ca15a6a6fc209c78
MD5 99c7aae24cc0bd801cf9cbec78a8f996
SHA1 9f14e5d8f28334016f1a48cf2dac7500d7501758
SHA512 7cf4ca1571f1c34207438da7ff3cf6635af8ee66c36d221354169acf4257e5f3500a6d3cc98058d4a4979e7e71a043d57ec32233b88ce9c70de4fd5a3fe57850
SSDEEP 24576:zkVbQWeKKvBrZf887Ayit2Gw8ElrBk7VyJEKX53n2HhxGEz5yWyWeNde:QVeKKUkq2GHElTJEKX532OEt7yRi
TLSH
T14D3533F3ADC8A4308EA7E71DA8A16C46E180B9C55C1F20E61298FD179D577FB0F63498
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UninstallRename.pptm.WCRY

Path C:\Users\Admin\Documents\UninstallRename.pptm.WCRY
Size 1022KB
SHA256 02eac376b515dfa56b2a3914cb6a4dd4d320ed54343928faf147210ff8c583e1
MD5 f1b7376e7f769f2a31247e1373773786
SHA1 92d16f3412c467a58582eac6f43a61cea8ee7abc
SHA512 9cf7257af08bb19168dd619d464eff95077e47dc9a966a23f035d99d2d697ce483981aeb4184f66d89607f7c58b86c41b9eeb0557de53834482350062ed2031c
SSDEEP 24576:XW43CVLz1d29Qy6X3Naysp6FCOzw/l1i5rgfNgr:ILhE9Q/oysI8+gl+rSi
TLSH
T15A25334F3132E4E11C02AFBCBB89BA47FBDDBF9524A56FE4503E065E58604E2E44916C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

!WannaDecryptor!.exe.lnk

Path C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk
Size 590B
SHA256 80b08a267adc923061225692e496e337f63bb27d2f05a4c87f31ebd2e25bd7cb
MD5 778dab97c8f61d604f5da2b8d34de1f0
SHA1 12af70eecfaf941ee9f43ee2de59120ac302cb3a
SHA512 0999921d646e910712acde7d49e67ac437aa5162db3b3aee98407158fa188a7e9e2b14500b8f6be009179eb037f3f973c8868934bb928395cb325ebc6fc142d3
TLSH
T14BF00E181AE36F5AEBA0933F0E31834A49713C84912B2B4F0AD06719D96242087889A7
MD5 SHA1 SHA512 TLSH

Submit Download

00000000.res

Path C:\Users\Admin\Downloads\00000000.res
Size 136B
SHA256 bd401120e04a2b7d8a2fa3279d8a4f34cd7d489e9d8acd522295451e43081fec
MD5 938ca98871155997f906848914b39b81
SHA1 6975f0faa7e3de53bd97bd4c5c34329b702baf41
SHA512 db64bc62bcbc37261ece4cde935d9d7296f0a7aa3bfd49bacdd09b2acd6d7b382eafe5af6f8a2bca5fda80eb02066153bf48afd7faaf7260d8fc857db43bbd52
MD5 SHA1 SHA512

Submit Download

00000000.res

Path C:\Users\Admin\Downloads\00000000.res
Size 136B
SHA256 61efd12819a9935ecb19bfe925b3d29b442ce8cda812713201fb94c79153bded
MD5 4f4774d8f68f5201143876d618ae9597
SHA1 1e0618776dec9f951f84e46b054d44ba19e8f766
SHA512 ffe2e76eb0e206320eae548a1167e66f876fe1f165df59743efe11c76f64f2e2df7555676a5eb9c7a8a5d485be9901fa355e849b9a58dddd9b4b934a23a5cea7
TLSH
T15EC0041515DD5155CD1351FDC5C004D1470400C133113177531145300D430070301C15
MD5 SHA1 SHA512 TLSH

Submit Download

249601792816273.bat

Path C:\Users\Admin\Downloads\249601792816273.bat
Size 318B
SHA256 4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44
MD5 a261428b490a45438c0d55781a9c6e75
SHA1 e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e
SHA512 304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40
TLSH
T16CE0861D7588F57512435242C93EA1EC91D55C925702AE18DFB7ED54A6005BC096E003
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 920994.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 920994.crdownload
Size 192KB
SHA256 e075474d9381efdf8ccaccb0fc8c8cddb4bd759e7a9cbd6d8f303a01ddcb31b6
MD5 1b31a3bde194921aa71566447dfec514
SHA1 10d974e054900d1975dd3017b0f8847a163eeedb
SHA512 58f8d1bad8335ace16982f6ffc69626fd5ab56f3744f182a31ae96f952b1d2ca7a426009f88c82ca9106ce962cfca9fdf3222a1bb453da555cb816949f04b1f9
SSDEEP 3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLa:+5RwTs/dSXj84mRXPemxdBlPvLzLa
TLSH
T19E1401A7BB50D73FC0B201327411D5BB4DAA5DD5E5B8CB4BD35D0A604E058889FA3A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 920994.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 920994.crdownload
Size 224KB
SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
MD5 5c7fb0927db37372da25f270708103a2
SHA1 120ed9279d85cbfa56e5b7779ffa7162074f7a29
SHA512 a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
SSDEEP 3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ
TLSH
T1A024015A7A61877FD0B20532746194FB4EFE0DD3F5A89A4FE74D0A501F048884BE3A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c.vbs

Path C:\Users\Admin\Downloads\c.vbs
Size 201B
SHA256 5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1
MD5 02b937ceef5da308c5689fcdb3fb12e9
SHA1 fa5490ea513c1b0ee01038c18cb641a51f459507
SHA512 843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653
TLSH
T1DED0122EA4D9E9675263A153463AD64CC5E258607B21B7119F92EE08736043C0E7E043
MD5 SHA1 SHA512 TLSH

Submit Download

c.wry

Path C:\Users\Admin\Downloads\c.wry
Size 628B
SHA256 bf22e8e18db1638673f47591a13d18ee58d8c6019314bab5a90be82ae3dc9538
MD5 663e55df21852bc8870b86bc38e58262
SHA1 1c691bf030ecfce78a9476fbdef3afe61724e6a9
SHA512 6a54be1fa549633a2fd888c559207437b8f6efda98bb18d491c8749f39e9754f1e680fa8e2d623777b5f665b2c04d19385c75ce4e61fb251db16018963a9a6f9
TLSH
T155F012046281190CDD18023D001045538530CB4412008B8244204042827C1F36844134
MD5 SHA1 SHA512 TLSH

Submit Download

c.wry

Path C:\Users\Admin\Downloads\c.wry
Size 628B
SHA256 cb7a05e99b8644fc7fb0c4a2997f375a44da690e2b9c75c77c627ed15d580dd0
MD5 f7a1409ae62e2d0e1c0cddd788464893
SHA1 7834b0771906ddfb090c54e5a9887a9f369800d2
SHA512 9043660c0f5d1ff4cb3315ecfe173b3f87d4fdb85e3da6f0ea209d800a7579eac5a863f565201428cb52d5d1a76850b1a6095d4b90eaf6dff68c84732695a469
TLSH
T11AF012046286560CDE18123D001045538630CB4422105A9244214042877D1B36844135
MD5 SHA1 SHA512 TLSH

Submit Download

m.wry

Path C:\Users\Admin\Downloads\m.wry
Size 42KB
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496
SSDEEP 384:S9sLTK3SWTsPzy3EFejoJQBO21z4oCTeo75Y3kmA31dv61QyU:S9s3mjoJb21zZrS14I
TLSH
T12D1320B800425795D26323E4FB27F0497B2BF41464E584D876EBC2BD717FDACE660A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r.wry

Path C:\Users\Admin\Downloads\r.wry
Size 729B
SHA256 c9e9dc06f500ae39bfeb4671233cc97bb6dab58d97bb94aba4a2e0e509418d35
MD5 880e6a619106b3def7e1255f67cb8099
SHA1 8b3a90b2103a92d9facbfb1f64cb0841d97b4de7
SHA512 c35ca30e0131ae4ee3429610ce4914a36b681d2c406f67816f725aa336969c2996347268cb3d19c22abaa4e2740ae86f4210b872610a38b4fa09ee80fcf36243
TLSH
T10001106EAE5576110BB1C972317EA157FA06419F022D0262BC0A913D17BC17620FB4F1
MD5 SHA1 SHA512 TLSH

Submit Download

t.wry

Path C:\Users\Admin\Downloads\t.wry
Size 68KB
SHA256 a7dd727b4e0707026186fcab24ff922da50368e1a4825350bd9c4828c739a825
MD5 5557ee73699322602d9ae8294e64ce10
SHA1 1759643cf8bfd0fb8447fd31c5b616397c27be96
SHA512 77740de21603fe5dbb0d9971e18ec438a9df7aaa5cea6bd6ef5410e0ab38a06ce77fbaeb8fc68e0177323e6f21d0cee9410e21b7e77e8d60cc17f7d93fdb3d5e
SSDEEP 1536:L/MNGh1blJ3aMfSSPz/chKRb7Z3DK1YwVp2sQ6plKRPNV0BCg:L/sQES7b/jZ3AYgp+Na
TLSH
T1376302D7EBB42A9F7E210D483894BEAC3325834644F3515FE091DF061A68BBCA39529D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

u.wry

Path C:\Users\Admin\Downloads\u.wry
Size 236KB
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5
SSDEEP 3072:KeJJ0eIVAnbWOECR+uJ/0EJzBelG4t1nXFnQamKNQHFZde5tHEGaa:bqrVOEgZJcYelG4tQamKN2ex
TLSH
T16A34A416ACD3812DF3D736B88001C7BCA8A72E1095261B7BB694F8DC18367E5CE6651E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearClose.jpg.WCRY

Path C:\Users\Admin\Music\ClearClose.jpg.WCRY
Size 303KB
SHA256 923b23fc4d1e95c2e01c5c08fa3113411b40bfc36e05c173c505cc8a941dd852
MD5 ed0419759982c93fd8285b6e58aa51bb
SHA1 9bd1748b9082b3c11ff546bfe461a0a06d0dff15
SHA512 e5e046691bfb35371e64e4fdb172519de563b1a075bb4ffc6057a049e1de721fd5c3d56e933e09c10897a5d2c42222f568ede84f7990967d3adc1d3188d34cf3
SSDEEP 6144:h9elx4i1u8tlLK9DMtoU0lRxpxEkRwDOYVfBHohSVJ2ahaJ8NZ:hBAu8TEgoU0XZP4OYtBHohSV9xZ
TLSH
T18B642395F11D4CCB0D2B2A92636063A136E37F6D18513FE1FE5658720A7A49035C3E7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectCopy.jpeg.WCRY

Path C:\Users\Admin\Pictures\SelectCopy.jpeg.WCRY
Size 190KB
SHA256 8a83d5e233aee104032e54e961ee2840e5dfc698648c81600d1de959dc38e1a2
MD5 93e77e6360cc5fa2e4e4c0377f000b17
SHA1 55d963a5606a7b15cffb43215b2cb7a0ee647deb
SHA512 b312cfc756cba15f7cbc387eee8e2fea6c7ea92e60bfed839abfcbd3fd88c65bfeea000806140703fbc2b51ef9c6a5d8ce948fb223ab02005290f863d3394e7e
SSDEEP 3072:YWoUJO84QE6k/8ngRtj+hFvFa2mJiSCbOEzNM5QWRAB7hNx0kwrIMFCMVGItoV1p:hXk/ggXj+XtatTWZ8C7hNxIr0MVGnuz6
TLSH
T109141272B41C8BED5B41B56956403722FA1353A83DC5F55A07EE7FC2B92831E8F4448E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplitTrace.raw.WCRY

Path C:\Users\Admin\Pictures\SplitTrace.raw.WCRY
Size 152KB
SHA256 8ca44486df847e83bdba5f1e255a22c693b81aafce14d1227fb1de4d5c3db5e3
MD5 974a7b06190845508108ec847c1f5ea5
SHA1 b40c84ef0cda7a243de578fa7fe9ab4af97e0e83
SHA512 88e4826a3eca31e5559e4ca40c885c0c8d2430589ed9b05876cc78127c96d1e0b9421356196c37510dd2f30e6cba079a3523c60c7c8f33331d9da05b72854152
SSDEEP 3072:1z2TP2v5R2RAXkYXO1U90UwqUwmxMSz+KhSqZLz9xVobhdv4MML2WF:awWRPYXO1dqU5xF+yxdz98/v4M62WF
TLSH
T161E31256709ADBCCFC78D70C17A8741C29BD2A98B74C3D4832691BF4B748E106D8E58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchProtect.jpg.WCRY

Path C:\Users\Admin\Pictures\WatchProtect.jpg.WCRY
Size 254KB
SHA256 a47f11fa30d895a96fe9d5d047615f52a695ad34ba35f49bc2393f0accb80269
MD5 eeaf4c2f35c966e19fd7c8f263662003
SHA1 b1dd2d82064b1b01cfb8a6292478fb94abcdf76a
SHA512 97ba8031fc6966dfa4feb198de32f9b3548f7bd3de2e11c9876deedd5cd57f2c638d5e7ccfdb96e087db6359618156c089a967b64a03b1526060a694538ba07b
SSDEEP 6144:Hbualn/U23yHe7wyEkOM6ne262wllqOosg0SpL9MH0Io9jD:K6P3Ke63e2illq79MUIS
TLSH
T1DF4423ED28174E4DB709AC0A2642274BB504CEE59C6EB9772C311E69377533B23BD836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3688-177-0x0000000010000000-0x0000000010012000-memory.dmp

Download