wannacry | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry[.]exe

user interaction
yes
max time kernel
50s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe
Sample261024-e72s1sfx7x

Score

10^/10

defense_evasion discovery execution wannacry persistence ransomware worm

Malware Config

Extracted

Path

C:\!Please Read Me!.txt

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	984	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
2284	WannaCry.exe
604	WannaCry.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
10	raw.githubusercontent.com
11	raw.githubusercontent.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4332	cscript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3048	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
984	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
3000	taskkill.exe
4780	taskkill.exe
2484	taskkill.exe
1280	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3668	chrome.exe
3668	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe
Token: SeShutdownPrivilege	3668	chrome.exe
Token: SeCreatePagefilePrivilege	3668	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe
3668	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 4468	3668	chrome.exe	85
PID 3668 wrote to memory of 984	3668	chrome.exe	86
PID 3668 wrote to memory of 2456	3668	chrome.exe	87
PID 3668 wrote to memory of 2456	3668	chrome.exe	87
PID 3668 wrote to memory of 4164	3668	chrome.exe	88
PID 3668 wrote to memory of 4164	3668	chrome.exe	88
PID 3668 wrote to memory of 1236	3668	chrome.exe	89
PID 3668 wrote to memory of 2152	3668	chrome.exe	90
PID 3668 wrote to memory of 1236	3668	chrome.exe	89
PID 3668 wrote to memory of 2152	3668	chrome.exe	90
PID 3668 wrote to memory of 3568	3668	chrome.exe	92
PID 3668 wrote to memory of 5080	3668	chrome.exe	99
PID 3668 wrote to memory of 3000	3668	chrome.exe	102
PID 3668 wrote to memory of 3000	3668	chrome.exe	102
PID 3668 wrote to memory of 4968	3668	chrome.exe	103
PID 3668 wrote to memory of 4968	3668	chrome.exe	103
PID 3668 wrote to memory of 388	3668	chrome.exe	104
PID 3668 wrote to memory of 388	3668	chrome.exe	104
PID 3668 wrote to memory of 4780	3668	chrome.exe	105
PID 3668 wrote to memory of 4780	3668	chrome.exe	105
PID 3668 wrote to memory of 3324	3668	chrome.exe	106
PID 3668 wrote to memory of 3324	3668	chrome.exe	106
PID 3668 wrote to memory of 3212	3668	chrome.exe	108
PID 3668 wrote to memory of 4020	3668	chrome.exe	109
PID 3668 wrote to memory of 1416	3668	chrome.exe	110
PID 3668 wrote to memory of 4528	3668	chrome.exe	111
PID 3668 wrote to memory of 4528	3668	chrome.exe	111
PID 3668 wrote to memory of 2284	3668	chrome.exe	113
PID 2284 wrote to memory of 3048	2284	WannaCry.exe	115
PID 3048 wrote to memory of 4332	3048	cmd.exe	117

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb936ec728,0x7ffb936ec734,0x7ffb936ec740
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,15278851070686461197,16312012054892487061,524288 --field-trial-handle=1572,i,8679032982394846429,17505825325075879841,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2068 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,12723139804141302913,9515137475841520746,262144 --field-trial-handle=1572,i,8679032982394846429,17505825325075879841,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,8258823290193733111,10870912187543591540,524288 --field-trial-handle=1572,i,8679032982394846429,17505825325075879841,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1756 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2972,i,6105209334315055213,5412082887790930316,2097152 --field-trial-handle=1572,i,8679032982394846429,17505825325075879841,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,13882247991756413222,2843835586580299385,2097152 --field-trial-handle=1572,i,8679032982394846429,17505825325075879841,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,8598444286685224248,2191401763676829674,524288 --field-trial-handle=1572,i,8679032982394846429,17505825325075879841,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5284,i,8835400200019408456,15684906884220487639,524288 --field-trial-handle=1572,i,8679032982394846429,17505825325075879841,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5744,i,6570782391622409743,3058215249439681072,2097152 --field-trial-handle=1572,i,8679032982394846429,17505825325075879841,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3944,i,13980167221864238245,9690389672417765535,2097152 --field-trial-handle=1572,i,8679032982394846429,17505825325075879841,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3268,i,12869146447222033923,16331008114367995534,2097152 --field-trial-handle=1572,i,8679032982394846429,17505825325075879841,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5696,i,11624406819321593800,1490989303055629313,2097152 --field-trial-handle=1572,i,8679032982394846429,17505825325075879841,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3364,i,6883144722447212710,2939298370188598676,2097152 --field-trial-handle=1572,i,8679032982394846429,17505825325075879841,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,18370643325281864703,6383651102103761079,524288 --field-trial-handle=1572,i,8679032982394846429,17505825325075879841,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,5206784091942465387,5050263923344845218,524288 --field-trial-handle=1572,i,8679032982394846429,17505825325075879841,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,17447543210202169773,8816260394675146083,524288 --field-trial-handle=1572,i,8679032982394846429,17505825325075879841,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5844,i,6806777134628030629,17639358839358340103,2097152 --field-trial-handle=1572,i,8679032982394846429,17505825325075879841,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4528
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 292181792816591.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo c.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:4332
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe f
    3⤵
    PID:2360
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MSExchange*
    3⤵
    - Kills process with taskkill
    PID:1280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Microsoft.Exchange.*
    3⤵
    - Kills process with taskkill
    PID:2484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlserver.exe
    3⤵
    - Kills process with taskkill
    PID:4780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlwriter.exe
    3⤵
    - Kills process with taskkill
    PID:3000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3396

C:\Users\Admin\Downloads\WannaCry.exe
"C:\Users\Admin\Downloads\WannaCry.exe" /r
1⤵
- Executes dropped EXE
PID:604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

!Please Read Me!.txt

Path C:\!Please Read Me!.txt
Size 797B
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b
TLSH
T1DC01F12EAD5572115BB2C572357DA197EA02925F022E0352B907C13917BC13655FE4F1
MD5 SHA1 SHA512 TLSH

Submit Download

!WannaDecryptor!.exe.lnk

Path C:\!WannaDecryptor!.exe.lnk
Size 590B
SHA256 507c0c94d0ccf236052aafc4d50deec47daa187812cdbd51da08091460b2e041
MD5 8cdfe0f19ae815d77b34c178a3dcfe13
SHA1 d6bb7b0a352db5605ed151fc0ce4744b66585f22
SHA512 f60a75f65ef302c6f0b758a9a155964fb004e86af86bb61ebc4a8cd5b2bbbbb967ec559b588dd045fb5fb3818ae510b46e505bf4595e8843072d9f3582261098
TLSH
T197F0545025E75A1BC6D1C23E1234C30FCE707D588657A7CF13C47212C9F18214B4CAAB
MD5 SHA1 SHA512 TLSH

Submit Download

osver.txt.WCRY

Path C:\ProgramData\Microsoft\Diagnosis\osver.txt.WCRY
Size 296B
SHA256 8cce492615535b710c89809b527675db08a50fe2ad29a7e38ebe1123ce9b4f2e
MD5 84908b7d9715991c05725cdd63caae7e
SHA1 60a8babd0f52d3f2aebfc45a9df49754b1112766
SHA512 6927ad62d7e38df09f76ac6be7dee529fccedd8d2a57aeb3077d89ccbae036eb4f7148cfd44d70800ad3834b505737459d8f30b12542e4f105997ba0604a3683
TLSH
T126E0E750D06BE48FC0835165C7681B4DE3972711125DF50888574234446E080C5558DA
MD5 SHA1 SHA512 TLSH

Submit Download

RegisterInboxTemplates.ps1.WCRY

Path C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1.WCRY
Size 904B
SHA256 fa63b256f2c71a05cab58a5f74917cc267a4d2bef2aeef77e2e0b4fd05036fa0
MD5 1ddd44ecdcc5c7e9e9a38fa7f5551449
SHA1 034c2daa57a7a12c6498b3e1f7ab00460e12455d
SHA512 7fba17e2e1b5b982d9cabc951afc25bc0d2fb207a7bda40b0f89e8bfdb25f24a6047a3eac3574104df3c5fc1088dd79c9a5de76860e5f4deefc05d0a7503894e
TLSH
T1D911632918632B89E2BE8EF48F41A449D4503B60AC6C07466EE4B82BB039B853173513
MD5 SHA1 SHA512 TLSH

Submit Download

user-32.png.WCRY

Path C:\ProgramData\Microsoft\User Account Pictures\user-32.png.WCRY
Size 728B
SHA256 f8c0cb1c351b46327913cd18a8af71d0d390b3c180ecdb1a62edc281890eb976
MD5 99a175b7584e00f4cbe71ec816c1c3bc
SHA1 00d6c7cc136a4cb1dc06331c057854c1fd289496
SHA512 7c8cb01dfcdc1963a7cbebdce2756a8323dbb5df21b8468ecdad9799e9862a83b3dc79b1ff8963b3a96477a67ab481a6f74e0f7a5c419fc53d1bdadf773c8e2f
TLSH
T18301659FDD021303F3C720E7156DB3552F38E79C11E115E77448C09E649399358916F2
MD5 SHA1 SHA512 TLSH

Submit Download

user-40.png.WCRY

Path C:\ProgramData\Microsoft\User Account Pictures\user-40.png.WCRY
Size 808B
SHA256 724f16e662488feb512f87231c27d53fd871bcf3f896edd8685ba2420cc046d1
MD5 c3fef8817e64f578f2cdd13e00e3ebe0
SHA1 6f33aa2a4698c0a7d06ff3329f53c76811deaffd
SHA512 18c8f0c4a2488d75e8e5006c0c33ef083845c7fdeb1783fef67deb673b34b2083fdcebb9f00de142dc2d1e3b4835cb00f4a5b225449eb50017ea70ed29d5f482
TLSH
T1CB01C5C723883FE4F040787254887193B7FF155A2459B0DA6C05F23D4B0771BA32569D
MD5 SHA1 SHA512 TLSH

Submit Download

user-48.png.WCRY

Path C:\ProgramData\Microsoft\User Account Pictures\user-48.png.WCRY
Size 904B
SHA256 3b91ef810ab34a825fa2c36ac56c6e19455ad972341eebb58cf5ae50897a0938
MD5 075cdc416b12a122341cc6a485b24b08
SHA1 8d9b84cc73e6914efa357de41157b3b74b4619cb
SHA512 dd946105f346b2c488af9d82306871a31e7cd640bab21c6aee2a8e6e1c1776f604332ace6a45b9c9664081dde07f5351f65c7317f4837804410eac1b7a3fa0f6
TLSH
T1C7112BDA8025C32BDC0150A3945C0392FD2DCD02C8F174830FC81CA86F67931048806E
MD5 SHA1 SHA512 TLSH

Submit Download

WelcomeScan.jpg.WCRY

Path C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WCRY
Size 504KB
SHA256 5bbf097631321ae95f7a9e0e2f6816c422be6dd137bc8e001b4faac4a28136dd
MD5 1dab794ce87253e58708a777b2186e73
SHA1 f5bb3cd855026af6c6ccb0e59a97dc53f1906ef8
SHA512 1958bcbbf060f559e6416539b0777e4ac9f922f5e354deb7f2050da61db26dab85a5ef8df6c7dff34a49502efc2bb8d47eb934a0b698d1faa9b805a04fffcdb6
SSDEEP 12288:u4b5tpa7qfwiAGuR4KbloESJYiyguTV3Yf/W32xLI5d9:ueDpEc/Aw2vNins3YxRIn9
TLSH
T1E0B423F8D0BFA7B4271C3AE1EAAF0E208D95FEDC49FD92C1C952667898146850DF5107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ac77770-a3e0-4f12-b40f-66d09ed7076a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1ac77770-a3e0-4f12-b40f-66d09ed7076a.tmp
Size 130KB
SHA256 381019d6581d64eec5f2e297ae05a015f367ac653e48ffb2dbe0fcb28c6920de
MD5 a869fa15dd549d3472701a3562fa5a3f
SHA1 b1a18307be964f6c0f48a42520aae591d955da50
SHA512 d8d9eb53fd6b68c92eeb3ee1b5e33dea7089dd2df39d4a878cafec095347e6cea07b8e244a9c5dbf9bc810155b17f63377a3f0c94a1a7d41ef69b4a8a3fbe86c
SSDEEP 3072:xFI+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:LI+hFD+7t56OD9ZfSApprE
TLSH
T13ED31232AA95D8BBC9FC6541B157A300DE766CED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

280032b8-7cab-4f32-bb02-a3c3e8f42ba9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\280032b8-7cab-4f32-bb02-a3c3e8f42ba9.tmp
Size 131KB
SHA256 e652edcedef01a59c7e84264b1ca765130a3922fe5741f9dca7c0cea1d128764
MD5 22e434acfbea84bad1c8b319bed1370f
SHA1 9dcc30cf7b456adbf7322de896d311c8b238df7c
SHA512 4b7c35de7913bc8f8aa8f4b30148f3c91231feab9a8041c24f523cf0178ca70c3544118cae3a738a78b10fffddfb3fbc73f85e6b37d10f07613862b85d9c69a8
SSDEEP 3072:Ji++lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:w++hFD+7t56OD9ZfSApprE
TLSH
T1A2D31232AA95D8B7C9FD6541F157A300DDB668ED41EE3A09444A5F8EE09FC4C07A3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84a29394-fa70-4a70-9db2-62318c3af379.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\84a29394-fa70-4a70-9db2-62318c3af379.tmp
Size 131KB
SHA256 5efe8327a386c1a4cf5b3aa26e89651f373799ec2e47dd6940517a22b53c9345
MD5 6ab59fbfe456f6ea6b0c044aa9b50f3b
SHA1 92328ffd25906aa4278cdfe1c46be91b083e397e
SHA512 6e38a5ec078ab57f58752e186319e6c97c725768c8ded76d8eb25bbfd546a3052182b8802177e06812513b9c9c81ffbdca575e6a7aefb14b312353f71b812dae
SSDEEP 3072:Ki++lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:9++hFD+7t56OD9ZfSApprE
TLSH
T1DFD31232AA95D8B7C9FD6541F157A300DDB668ED41EE3A09444A5F8EE09FC4C07A3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4be76df7-0a12-43eb-8d3a-8be2ba8021ca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4be76df7-0a12-43eb-8d3a-8be2ba8021ca.tmp
Size 11KB
SHA256 2a5a8a71eb7d093c4465e3197c38fd51310fa569cbca64c5c53e8cf7dfce7b9f
MD5 cda2b032399b11b90fcc82cec3541dda
SHA1 c3b1fb2345d1c6fd772cb795b6e9f61886366fce
SHA512 be1209d41814f807115196755c2c858888bbcce2e5b9b93e23feec5d66f7530229db472676a1b8b05d0e52a8502de87b6f11df1d92d2d0829a6c1b0bbc8d61a6
SSDEEP 192:iRrMw8Eiv7UpAPRp2v9/Hsb+WNnNEPnne62Kjq7+VyIsnAUge:iRrMeuAUXchwCPT2KjO2e
TLSH
T19142732DAD50797B6CDBC21AFA627B63D6F5103224902E84E6FC8D7C19E75CC222B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5028a6a3-196b-4468-9394-cc130bc03540.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5028a6a3-196b-4468-9394-cc130bc03540.tmp
Size 12KB
SHA256 db36a08810dbad9854a7c551b771f7511bf86356e0fb154030f97e81aec10f2e
MD5 7d620b898116408265638e75141c19fa
SHA1 ff8834fc52dba604f088e0ada032f370c926ada8
SHA512 af97d13b486e5781c6062f17ad0748796920954b7fd150adf5c1d1fef4a275e1baefc008e9731ffb1d4e15b9d467c9862eee282dfd1d6782122fc4e4eb32f0a8
SSDEEP 192:iRrMw8xPv7UpAPRp2eD9/HYMb+WNnNEPnne62Kjq7+VyIsnAUge:iRrMfHAUXDhXCPT2KjO2e
TLSH
T13F42942DAD507A7B6CDBC21AFA627B67D6F5103224902E80E6FC8D7C19E75CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

0d2682b9-15bd-423f-903b-95c077681ec3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0d2682b9-15bd-423f-903b-95c077681ec3.tmp
Size 2KB
SHA256 d90db0e26584a6921797c12f33948e107f176a6aa540de4525956afb48d99e98
MD5 ba8805c670a8c3d7f28f17b1d494a25a
SHA1 078e6e4fc9457a6207747eb40218818d6f4525ec
SHA512 b7eaa7ac0f0576e931cc4541d78bbd98fdeafa77eb9e6a47bde123c9e3917587db8d0d1ef6c9b9a043eb0fc8a456a5af0706fb4241eaee68508aa584e87419cc
TLSH
T174416AB7C3D88A7DC901A6F8AB156F1FCE290A14532C3D16C8D4AE1F53E29F6D20058E
MD5 SHA1 SHA512 TLSH

Submit Download

d424dd9f-38af-4304-b5ea-865b2725de3a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d424dd9f-38af-4304-b5ea-865b2725de3a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

bfebb89f-a0a1-47a9-882c-73f002aeaf3d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bfebb89f-a0a1-47a9-882c-73f002aeaf3d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c4659c99-061b-4e03-94a2-9b2ef7b51fce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c4659c99-061b-4e03-94a2-9b2ef7b51fce.tmp
Size 13KB
SHA256 cbff59adc7b520f0de2985ad921ee12da5b00aa0aaadd64b2862a8b11ece7f19
MD5 8620b09f169758aa6d92f2e7b8a4c29c
SHA1 c265bb3d46a3af238c08a66240583a655be69a0e
SHA512 017bb2738ebc633e2b1824b1fe90215df48c3e3ec2d222610a597c250ca9b406bd8560dd6e15c6ddcea319cc301407ec464c4569fc29dfb4f74923aa99fdceb8
SSDEEP 384:s2jGN7KxkXqKf/pUZNCgVLH2Hfgsl1/XODGN+ErU3pxHG4xHk4V4:s2GN7KxkXqKf/pUZNCgVLH2HfgszvO61
TLSH
T1C4520A27A88C9A3F0FD8C54DD8177F4FADF101566268492452FB9C1903A5BDB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0b79578-30fb-43e7-aefd-a14e31a0e118.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e0b79578-30fb-43e7-aefd-a14e31a0e118.tmp
Size 414B
SHA256 27be286f4b552e8c4a96a5bc05fad740bc59ed80839b1ad69aab8bee519a3c8d
MD5 8eca82b2984ef4a2295ad87bde259670
SHA1 c8a19027153e587f4ad45df65d3439caed942327
SHA512 6a01283a29d52985037a68e7bf584256beb2b608d325f9008d7af8510afd853604733cc5bb06464508c64d13dc83481ba6464093558ac474f4b3c8609437ea8e
TLSH
T197E061A5C961AC7719FC072C20694746EA50135727918A5F373CD91CCFF5237018686C
MD5 SHA1 SHA512 TLSH

Submit Download

load_statistics.db.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db.WCRY
Size 4KB
SHA256 55a4321e83b38f9662f31c1f6d230972ecc7287197f54f5d786bce19fe8d74ea
MD5 ce36ec4e703330eb0bc99b3949c5591b
SHA1 756533d06897ba040d2b04eb5c84b4bb15b0c793
SHA512 3d5c4e79ba01c577fcd5e5f29f4ccf2a48a84cef3f1f1ed51f54d8146e898372a8f16fe64380cac6d3d211ec445966dc39fc2687fea8942dd2e3c572b01bb7ba
SSDEEP 96:WJr28ekPuXCX+zldNe+LzHWhvfPaX4AqVVq3niTU7z3vl:WJjxmXCX+zldN52hvfPGyVAiTgzN
TLSH
T112916D9992969C02C0BBEC6195F4E9FBBE0DD550F4B8344B0729093F64D87B4B44EB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt.WCRY
Size 48KB
SHA256 ba4702b37f1668ef498b5088a6e7166a638af33f14ea84e2b6498874d8350ef8
MD5 a623f5b215a076dedd035f40ffc2f9c0
SHA1 d0cf4b6fd26aaf0793d0b5009196ad5c006161b2
SHA512 23ae8f961b78fe5cce1982a7ada2b684e3b3694a88294a9fee93c02c21fc275445af2221af6e9105419793ade305b385e5cc610f8488268d804ffd96a201f57d
SSDEEP 768:/vZ9cfCp1oAH48x657WD0Jx/IidpYHgHbTrhAvmJqUXyUE0hI43FMrw4ICa6ok:pmfwthwRJRIQYA7Tr2vm4gnEtMM3ICae
TLSH
T1AC2301C9E519BDD2A9A280F26C2C3237125559B83B2F2FD37F3665EC870DE05C9980B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSmallTile.scale-100.png.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png.WCRY
Size 696B
SHA256 ba23ef1069316c9dd4414a642c22371a45715239dbc7e1f266481faeec768aca
MD5 7911a0fa76e6fcdec3a754afdaf3dd89
SHA1 dce553511147b805d2a6eb45a1fae4e71dc1f0f7
SHA512 2cc91e7285325afc8f78c603e48bd8ac9bc830c9a4c3dd935a5ab871065899de9df5041426216ca633dbd3dc7510c5a0711ad404f1995f8264df02d8cdb696e2
TLSH
T18C019455A85314B4A9B9367896A88DA3C232CB42C67843C958666D9B04CC2A09E4FA00
MD5 SHA1 SHA512 TLSH

Submit Download

{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db.WCRY
Size 85KB
SHA256 d44c0a7824bb6113690e41606cd15a4e022102a2fe01de4917514b8be50443ab
MD5 74cb93fc211d858cf14a121e935917db
SHA1 182cb27f156d081907bc6372f37134320e9b940d
SHA512 f8bfdefb5fa4eaf549f04c2df69a78c2799d9e20e0a2c2760874e81dd7fdce10458982e58d753053ae1cd9d06ab5aa61b1ed618f749178dca07b8e974c520c89
SSDEEP 1536:VTXZE1xqQchtH37qjDdaWZKoXfcHfK8V8l+QkkXUXK708k5id9RcyHyFu16hB:BXyqQ4X7qH9Kmf0DoGb8JFKuQhB
TLSH
T1838312A2B83837D71AC1DF6C9DBE14C25955708A8B367B2EF11AF803DF490579726882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_10[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_10[1].txt.WCRY
Size 197KB
SHA256 7048672da9028c43679dc1e618b96bb0d5f5b1676cc34bd1092d45473ccce139
MD5 ca652c746db9fc85ba01727e6e38657e
SHA1 177262fae7f23f16a31043504b4c796d94a2d7f8
SHA512 fabec7ff2a74d9f47827fe99fa4c02c59ef60644e7dd8a40a70d76d50f21f3ba340aa4e1232fb92adb8e9c6605224312971dd530e84002f79a68d95de7e9a6b9
SSDEEP 6144:RWD0N2OxTFYvrlZo20tMQYen6+YoNZk7QNId4grVHLc:kwDYv5gqk6+q7h46VHLc
TLSH
T147141397AE8E009A25E31553F0C47FF699686466F6F3AEDEBC5762DE01330C6F490A04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_11[1].txt.WCRYT

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_11[1].txt.WCRYT
Size 33KB
SHA256 050a0d721ea5602afe7a38b5354fc5aca81f4f5a2bee44a69a991af03815bdbe
MD5 e0f1528c283e58d451c222cc0df1518a
SHA1 6861c45a535d3e65718884d2786556508dc13e7a
SHA512 2250ff3cce870a0e81029158866cc092eeddf91c3f95cea425354e514f41c783d9cd6a250b54e2d0cc0b0123b3f756cf2b3d7ac28fc77795e95ffbadadb31931
SSDEEP 768:XmKj2rFZ59Fen0vveGjJCko1gClLT7CXJ9sfmzjRZTJNUeecTz:WKITFZBJkhlUzZNUeLP
TLSH
T1D0F2F1851223D49AFB7D68B37B6DC0F092330F1E79A3ECCA17999913085E56B933504E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_16[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_16[1].txt.WCRY
Size 92KB
SHA256 0314df8821cb6e53bc0e4e5c43ea4969c7e51b5e2b889f010bdcbb7a5512f0c8
MD5 3297e521e18b3ae45074e70788ff04cb
SHA1 88a6850847c56fef0eb1769efb95cf3be8b13ddd
SHA512 61ed12d161a2e129fffb74aae9f10ead5c74d9902d49ca7619d57ad20ab42ea2740e50cde1120249666867c4f7acc68d3605e509292e162505097c4a4444629b
SSDEEP 1536:n+Y9p5vA++H2/KSD47hNhSkJ/hvKS1TbNoCxF5pUKXW+fxHd86D+87X:tPIdZSEPcknvL1TbNoYuKm+z9DN7X
TLSH
T1239312C83C4AEBE421932B0718FBE9D81BE5797794C083E972DAAAC0D6402757C61F4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_17[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_17[1].txt.WCRY
Size 6KB
SHA256 852f0cb828b4eab5f92d7d1f28d091d66b585a31cecd6882cce180a0e0200683
MD5 bad9cda6ed27ae45f91a1c3d19003031
SHA1 2422a47e5cbabfa84c08aaa937fcb0f7a81000ee
SHA512 1140088a9e878e375fbe070d6d9521d56f47f1ef3d37f794d18055a90c57a6435deaf1363f36ed292149ba2932a7a34162d95dac560307c15dacef2351ab149a
SSDEEP 192:NNvjzZAZR/QbvLhARRtAcuoM1D4XeCBMY:NNbNKR4bvLS3AYmDqBMY
TLSH
T1DCE19EEDA15CE8ADC8D2C35DC2888C764F930449609AC138BB1615F85A54FE0F9CFACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_18[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_18[1].txt.WCRY
Size 119KB
SHA256 3ee9f1f0b47e93a3924fc3406366259bc42f6776c5695492ddd9c666c659c194
MD5 6386d216f720ec6a491a4aa9f0017550
SHA1 a0ba25a3ac287bb289925180e4d3d66ebc9b79c8
SHA512 88c0a1eab9dd54128aac3fa618da287206066fc5eebb513ce1a9050595327db08a5a43dd0ec14d2ca40ba6fcef6ba981c64e08f0e7a1bf60d4e8c9455f653b1d
SSDEEP 3072:XkLk4qqaYBqWfOyhXvx5ZQCMSr/ScFmtVA/Qe8:Uw0aqfjhdvM8/SXtVA/Q5
TLSH
T109C31223ECB5C70B12E6B1723297E3040735181C5E5F9C5CBCBAF72AC5A569C5A9EA01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_19[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_19[1].txt.WCRY
Size 118KB
SHA256 5b1a1de2bc34a3a3c11af4d045564624ef4a77f65ee2f8a5f51f150c71b093e6
MD5 3be1aa79b9933c07375dc03220376eda
SHA1 09166d098f3b9f566da252d86aa64520354f4ff2
SHA512 e0d5c10cc07ad54aa5cb75a6c8f78326c7efd3f03728771906e817ab45b2882815b769dc6eece076c40115242e464474edece82eb99ca7679b576d54de7a7b14
SSDEEP 3072:w96/N5/PK4xGGcPYc4owpsAXgWQVTO/K1XV+UVbY0:w90NB7G7gdsAw11F+UVb9
TLSH
T117C3126DBD127C72103F4A72292E16482637177E537CB4FE82B0A82DF7906DE6904AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_20[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_20[1].txt.WCRY
Size 64KB
SHA256 ff54a2852a29b67169e3500eb3cd37fee86debd754b5461406de5124a9357ad6
MD5 ae3acdeaddc6263736a1fb2efceb2785
SHA1 4ce6e4280686d9c80218724b0ecba07ea8703694
SHA512 c2facddce4253355e0ba671cdfa045513bee9c25eaf3374f011d295575e4d5b452de5e9614c4f4a75efef4c4e0d0d1590444b4ed2498ee2c991a97dcb544ceeb
SSDEEP 1536:nc1C6ItTs5IhZZrFOl7ndZm0SkannPgxzoiys1ve:nc1CVds5Ih/r+JZmr1nIxR8
TLSH
T16B53022AA283864DE9CE40B6F15BDB290F886EE0D68E5F01A0DC8D2DF9740F45C3B355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_9[1].txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\12A95JEV\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_9[1].txt.WCRY
Size 67KB
SHA256 4408c7d110141a0a4699f1317669d5b80226a392c2bebbbd5d33d31625f6bad6
MD5 970f4d0700a4b547269fd68517d623dc
SHA1 60fd0b3a848fc64dc2eb5ca3cc4c3bb4c79098bc
SHA512 b7a622bbc7e47e8a311655774b2e16249c0ba2a2d187e8227edfedbea8a57a1438eb3ed04ecf6ca2a4f1416e3d266ea8d62b641bf96daa9c3647c1a1a783b2d3
SSDEEP 1536:GpgyfGgZCcf6V4/eDZy+FEAt86rQOY2hWasNPx0V5v1JwZLe:6gyftCA6VlQ+FEW86ZWDZavfwZLe
TLSH
T1F56302B0605F04EA7C2C5847C35F4057CAA25F1769E6B3A5C454F01F73BB658E1BB1A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appsglobals.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{3e623085-a474-4d32-addd-e19bf2387dfe}\appsglobals.txt.WCRY
Size 343KB
SHA256 e647c08cfa79d2f6b2342f691ccdc837296180e79b9fe3678922b246a354c0a3
MD5 a9ec6001bbd8a34b431cd650590e4f68
SHA1 2adc661ad2bfffaf2b75cb0f5e969a4ba0867660
SHA512 603a019cf85186f04f506386b8bfbd1f945307e185c7a10df4beb8dd728e97981fad1322000da4f2c30f69744477f6d637137da6cb0c2759f26a191dfc4b2fb0
SSDEEP 6144:mmN7MrvAycjCAxAOqJWprGVcCrTxr+Hv9/h1a+AsZEFAPKfL9yYSQk9s7YNWp1:mYcvA7G0AUGKC3Il/hOsgAsL97AicIp1
TLSH
T183742371F938CFF17035822719EC7FCF9B6122CA2120D02EDDB9991B4621151FAF96A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appssynonyms.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{3e623085-a474-4d32-addd-e19bf2387dfe}\appssynonyms.txt.WCRY
Size 238KB
SHA256 d16b65813b4415d34dfd95cf7701d2704971275da8d0dbcfcd79136b0dd86491
MD5 663efe54eb1027de6bf01ee8731b1098
SHA1 fd82303de9540355086380d498e86785f5c69622
SHA512 64380b462924398ba6bce6f51ab21824ce52de5944cf26cf7d5a77c4600fc38140ca4a94b1e06be60ead5599e927798d360f85bf2155d5c25425c85796faa871
SSDEEP 6144:RIWkPuIm1xWYZcR97XJ8mmNVM2ObbBmOciNDc3+YGmZ:XkmP7OJ8jKdmCNe+YGmZ
TLSH
T1AA3423571ACA849AE3D458495C8F4FDA0497F33DC9B7DEE0258C7A4930CAC1CA9A78DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settingssynonyms.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{3e623085-a474-4d32-addd-e19bf2387dfe}\settingssynonyms.txt.WCRY
Size 101KB
SHA256 dc96d338119ce1efcdef1e261190008a9245a0ef540c54823db58f28d7c942eb
MD5 0f94ecf6e17c255c594ad9c682901c61
SHA1 d335190eae3ba03cea0cc97d423a79a3c353696b
SHA512 36a44637eb1313af6ee8722ad2ae8ab4044b8074daae325af1b8d4dede6b0d51e5b31ea6b6300973ee95e1219ae75e14dd6830e34d7dfd62a7c53adc7bfef7ae
SSDEEP 1536:lNBSXpd/EFo6Pa6JEwOqg76XgBMSf/0ZhUXh6fMXn4ax200Vjek3MidzOIVhuxFi:6d7Ka7jh6XgBXf/HUEX4h04MiYIXS8We
TLSH
T1B2A312E199F058F3D62684905F3591EAA8529437AB4E28F493778E62C83C12DC73A53F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134336129954231495.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336129954231495.txt.WCRY
Size 63KB
SHA256 c301a7f91c303988f59cab45b369a13594cb8a92623b159f07c55ec5137d2f6f
MD5 2b3515671f5095a0a0e0e448b3d00fc2
SHA1 4760f284b23faf2a1e28552e4628afd52b3949a1
SHA512 28bbda279f6fa9ef6097db02405e9edb4c95e8121d8552127075ba3adca27c6b387c96ac1ca232e9d0a58500595d683a55d1c679a847262bf0e13146b4bc2e7c
SSDEEP 768:CRgQiskPRsUOOpBVaxpthBs/MPek9G0PY3Gv25NO9wtKAr3QmSEnmqeEcYxy5y0L:C68GRqMeptgMGUk2Twt9QzEnZiBXw10
TLSH
T14853029A52B9A5FA881D83D9A326CE0241F37127E463D7A1A24F2D1CF0B864FD815BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCache134336140398413107.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336140398413107.txt.WCRY
Size 73KB
SHA256 b421425c3f70df18f00e2c05d7201ad77e5996ace6de65fc8d03ab9f6413e503
MD5 554551194e034fb94f56a1a4216263f6
SHA1 c72d0a03b280a401476d4cc6063bf4520c2459e0
SHA512 b72de1026f7b7b13293d9329a19a63e2bd92cd74304db8763c2dd1ac32210be8d229cf1ec8c6bbc971eee4ca030d3ff02a76bf6e35196dc14b97f2fb247b0ff1
SSDEEP 1536:XyQJbdeVf9pTS2mkCd2TBq+yuTVNE1vsE4MGC3nx+sEtThIu2E:LXUpe2mX+BqNhEMG++DTN
TLSH
T1867302E9E71EF0FFA524E19DFB5D9F0E26D6B448513A02E46107A23EB02162FD54321E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SettingsCache.txt.WCRY

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WCRY
Size 670KB
SHA256 d5f71983162a714f1ca1eae50ba42d21d58b3d5597222ab5d43860b76600c88b
MD5 9430d48d1b82cdc032128b182a42f818
SHA1 390bae34594de8920d47b52cd70ebe1cab7dbaee
SHA512 0b97f42e274ba59a7c824692336b53492996098bf0ca7150b7b2db1d3f0feb4a356641d6950b140b30d2e29e474982be190dcdeb4872a7bfefb73580e6e099bb
SSDEEP 12288:d1ohvakZP+OR8n259250gcZbM4gYXt853qb2TUB4C90BGMNjAVHIYj4gDt6RiaNA:/opZR+q5CBybM4gmS56wUB4C0BGUjEfr
TLSH
T11AE4238086F2A8D1FBB9EA8E23D8164C34A5B809AD9C3D9325B5F13DDF64150FD64E1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredistUI2801.txt.WCRY

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2801.txt.WCRY
Size 11KB
SHA256 ba01350465d38728c9d888c73eae2cc1b1f8d80ab179879eeba6bd3f8e229b65
MD5 9ed4fc6d5919c833a456a9f66c35eb61
SHA1 03769a4c5bbbbcd97c1684d82ccb7e41561022b9
SHA512 198286b5719321b1cd54688b012a727128126b1c8977bd64404a032428649bd7706829c196d830a50a8c81e638ce035320de8f4794dd5ed509b03985bc01ab17
SSDEEP 192:I/bUtfEZ1eimPo2eaZBqfxzP7ls7fa5OE0gvwCUtER+UFiaX8YBQZxggMR:+e81eimwbfxzPhsW/NTEERl0k8Gug9
TLSH
T13232B0DE9D916C81823CA4DD78DD3C59806058640610068F43A6DCAAFFD7CDD357C743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mapping.csv.WCRY

Path C:\Users\Admin\AppData\Local\Temp\mapping.csv.WCRY
Size 121KB
SHA256 1abcce1d56efe68df95dcfbdaadd44dfc1f62f0215ba8e166f1d4144a2a9bf8b
MD5 55a4a320ea6d17323de42cc50535dbf7
SHA1 1aeaa88dd9cf8f8baee1df03edb1b3aa56185a59
SHA512 a8e739bde6bff8a42a9ea3f6b070dfbc0e78b3a53bb4b9bc6ce48c64cf0b5c88289ff68644c08760ca60fdfd4fd886c8b033c4a8061032f81e240d87e30b0a42
SSDEEP 3072:2vHF0/i8L4CR19r0Fl9EQzRLiqsbludx23hek6wZfAq5R:2fCbL4Sr67EQNiqsBu+xbYq5R
TLSH
T1B5C3121EC2417D646D82E1C3E8379E997A99A63437A6720DE91907DB839861C0FE05FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveDisable.wma.WCRY

Path C:\Users\Admin\AppData\Roaming\CloseDisable\MoveDisable.wma.WCRY
Size 371KB
SHA256 c9bb8d9c16a2d608a93f2cc8b4fe5443864384c034e5c1be45e680190762ce99
MD5 14fd7454d9e887c45e2dee93cb99b172
SHA1 10231d7e694766cdf64786b1514e03b4220b44a2
SHA512 69f9cccfd2f574926f99da559278adb59dfb0d07ccf2e4e2f632563b496ba826b326018f3073c2c027452249353abbd1178c1fa92c32a99da7fe0aded1f649f5
SSDEEP 6144:MW0+P4WF5qpF/4bdNCNYs5zqptj+hOkEjPLovJcmeydfeQDofbhHvOO7LB:R00dFspFgbdwNYwzqTjWKPLoemeyGbhX
TLSH
T15E84238764B7C4B57F8A6D358B59678DC1D80E38627A6FCA1E934A2305DF78990F0C0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoInvoke.vsd.WCRY

Path C:\Users\Admin\AppData\Roaming\FindBlock\UndoInvoke.vsd.WCRY
Size 378KB
SHA256 c0907c7c8ea9598e80ecd673d8b5c574af6087732e05537f3559ec4857e72859
MD5 a107baea21b9f1823bd815c9d9629733
SHA1 6c5b5af6aff6b99e46e031a972b716779f894e11
SHA512 f05029167b12616207702c279e21c335ad1df7224c9cc3eeacc43c017c7da279287d1fe6097cb1c37b4d704616903a8dae221a5347033969a39db849f3168cc8
SSDEEP 6144:qgzurc4/pfk0nqs/z410P4vCKXTU1ZNfHperC0KQv69i4edovCoagJNzzMxOYQuC:qXM0nn4GUCKIperCjQmodoaoagzYcH
TLSH
T1898423272BF755D99B63CF813901AB2DC30CBB585BBEC649070331DA9AC92C9E4DCA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user.js.WCRY

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ww62gjg.Admin\user.js.WCRY
Size 536B
SHA256 41f3ab11c733524042a6f73965dab992a3b7d86f006ae1270fcb9aad0eaa7a8a
MD5 c78a3c7a88bcf148c8610ec18473cd1f
SHA1 50dc5d6c2b279202b03e1d793ded60401005279d
SHA512 db2c399ba307a14bec140f3dfbbe7228a23b64b8c20242c164294c60d20d6ac3bc08b3a7425b5a3205cc69b2b6f5e804015e71949cc11d6beb9529d0657dfb42
TLSH
T199F0200A1915959BA32DDE938C9237C219B448B33AE21B572277707C82820AA596B230
MD5 SHA1 SHA512 TLSH

Submit Download

pkcs11.txt.WCRY

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\pkcs11.txt.WCRY
Size 808B
SHA256 cdaf665cebe0d84dcfcb4eecda2bb0326861a5a29d1ffe3d3350ea46f8c5edb5
MD5 b1096933e72d06c8ff5f1220ccbc3e77
SHA1 f0bfc446ebeb8a598248626662b5599e1027bb18
SHA512 b87ebf67635318f1d55d1324fa24615b4fe22b9b1b5ed6c8285459f233d6ae9c0a3454baffc9b9d23892e7f7a87443ba160cd44676f42ddeaa2c5484bf8d5e3c
TLSH
T14B01C583D2DA03827A31C02CA8317C703B0A0CE173E5C083CA01874736B2369978C314
MD5 SHA1 SHA512 TLSH

Submit Download

MeasureMerge.7z.WCRY

Path C:\Users\Admin\AppData\Roaming\RedoMerge\MeasureMerge.7z.WCRY
Size 289KB
SHA256 7598bbe4bd6a41b69194b7a6eb373f67cbc4160cc3fb095e0f5f5e661d330a13
MD5 c8569895f6cbb948340bda2618a36e43
SHA1 02e398f61bd5cf43349cd3cf276796bf93924ce8
SHA512 6dec59adc2eebdfcd563287b614ffc89037b09bbcfa98bdcebad9c3d066eb0ca8e4e938980324b5caeb1b11336caae2ddd7651c857b4142eb762b606af2dc719
SSDEEP 6144:EEfwG3erZH3xbxw6r7jNMWxUU+vlJmxKnl9odFJXrvTsiUtMzIl:EW93uhTw6PjNMWxIoKnAJXrAik
TLSH
T1A054237BB256EEC6845ECC9048CE63BA3C7A946D6479643C0DC9CFC2BC8D1A26361365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearSearch.pdf.WCRY

Path C:\Users\Admin\AppData\Roaming\SwitchMount\ClearSearch.pdf.WCRY
Size 278KB
SHA256 10e282da20a72545264de3c1fe9e6e4964ee3973b99ce15cdd2f0e5fe81bda0a
MD5 fed4319357795364c284751eb20a6c10
SHA1 72baf7bb1d4526798dd4bdfa7ee72a5a792c18ea
SHA512 e517989d77836722adce01423a8e23438fe7ba0da63a4b663b8e7df97d57ed766517f4fa37276f6104c29dcfee30c31cf00a10c77ea42be80403b0d0eb1776c5
SSDEEP 6144:IkBiVzcywbDhgiIaj7JYG6CD1aegj0a8kE97xm7gFWIBRc:IkBiVzsfhgiIav1aeg0jFWGc
TLSH
T1355423F03C36DBF1D7799461FF398830C065345F596E88F6F408CABC355A88193A61A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowUnlock.png.WCRY

Path C:\Users\Admin\AppData\Roaming\SwitchMount\ShowUnlock.png.WCRY
Size 133KB
SHA256 077728b26e4091c55ca112e120f39132cd274f3d617d06b7caa59db299ef3736
MD5 753608388ed862409a52aa6f01bbdc9d
SHA1 4ec53b668867e60384988e2752ad76e43b9defe8
SHA512 b99c7359eb45e981df9027e6752dcd1edd6eee47aa3c5467f692b9cedca61701dd8f450b708c9548b2910e59f77e509f5f2742a8e2bac326328a0002bbb874bb
SSDEEP 3072:DhF7ng3jH6w4CZCDnTTwdtvEyoRfOSm9h3fw5h+Kz2zF3KG:DhF7ng3jACU0dtcyoRmS+h3fqhNRG
TLSH
T1D4D3125A59D17866D90C57F6207ABBAC2C1F123DDEA9F708EDE53A3C69003E12C7480E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupOptimize.potx.WCRY

Path C:\Users\Admin\Desktop\BackupOptimize.potx.WCRY
Size 288KB
SHA256 cdf9f77593422d0f2c3f855bc752ff8c0e768cce70b9b4f502deae45b86995d8
MD5 83ca7ccbe3bf79ae72a608d4c913dce3
SHA1 f15cb0916dc6f67186b020e7188718d58de85809
SHA512 20baedd2b6cf704c69af53edc98a9713ecffd0a52525882ff718747f90579e9358b03670eb77bb529343d0c8b33127279e0fd5d38a9cc711f48054718bfa5236
SSDEEP 6144:isXd/7AHNO7zqBP9JrA+APeYNk9XPDsLKLJszmt+KSWvyoYRYbv:X/70kqC+APeEk9bsLKlscSZRgv
TLSH
T1AB542395840EE748C5EE7EF1B1FEBC8436DB012DD6D402B9E92785A84B3BC6480D7B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectResume.png.WCRY

Path C:\Users\Admin\Desktop\ConnectResume.png.WCRY
Size 113KB
SHA256 63315957ae18010e3ff5c15699289281a30791e53eaabf07e3c6d93724d9d820
MD5 b9789dc9ec265a6f68280344adc923ef
SHA1 a731ffe27ab3d22af8165354481abfee128e823a
SHA512 e2fd2c8d94b7e6b4ac5ed2246be01a78ad0892dac29f3b5a44b273a5aedab421a1743d3e3c2c79ddd1edeb87329f1d22dd4dc38882465791ff2791190f5eb3c0
SSDEEP 3072:+m+ac8frNAIUVOZaNs5t/n37JvgrXt7CfqIHGc:NZ5fRU0cNs5N37JorXofhGc
TLSH
T1FAB31210D3C5140168BAD712D6FF3BC8B13A3182F359FEB0B6594795CF1E2928661DE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToRename.svg.WCRY

Path C:\Users\Admin\Desktop\ConvertToRename.svg.WCRY
Size 252KB
SHA256 8834e69ec18e110a818e33c8c31af1b3c85bd88cd10d7df83efd2b8e6f5c4628
MD5 e71a61d615296e8badb7f5093167253a
SHA1 0efb40a9c2bc94bd255ede5a6d4c71941ba53bd8
SHA512 7db3e32293a652d764271dffccc025f974aa2f27dce6ce2a9c86fbaf0347a2bccb825112667c9dfa87f0a2708b4f54a2fb33e7bbf5f6503835a97592c433c497
SSDEEP 6144:vy38D3xtu9aARSs1OMwc9jOxnx9jKZBt8iX1tu+l6vTHiruPT:vy38DhQxdgMwiK1rjaOG+aY
TLSH
T1884423371BCB82967C616E35149462E8668B70EC1A3A3F9C8E050FFDD0B63427D57A1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyFind.cmd.WCRY

Path C:\Users\Admin\Desktop\CopyFind.cmd.WCRY
Size 150KB
SHA256 d95fa0425f575e3e13c0edd36678068c7d7bd90f3a0d22fc1ec343179addbcc4
MD5 c4a572e72a2ebdbdb7d2c051b2823d09
SHA1 1b50ed13ef944ae8be3b883cfa4735f70966470a
SHA512 c34b747d1a4229a03b6cbe81a6ce43dcb9ea455731612b5fcd6467fa1c658a710611c5efccac243fd07dd3e94c83fbe3fc09c3193d8381eebbafa1ec08d9637b
SSDEEP 3072:JXs7tcRVagACh+M0ddQrtDAw9nYP+OD05V0Ol6g6WJm4m2VQ8Yfut4DZ:u7tCPACh+M0vkaPP4dAGvm2y8p4DZ
TLSH
T15AE313C7B058DDC58B84D3BAA65D741F1CBF991682ECACEEC70140326461BA6777E2E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GroupRepair.xlsm.WCRY

Path C:\Users\Admin\Desktop\GroupRepair.xlsm.WCRY
Size 157KB
SHA256 3dac5bb549d7528059bcfaefd245c524d35c8d68365d9e27d321af8f5bbf726b
MD5 cb6b51d2ec901e78de6f5ba5d30d4529
SHA1 d394b023059bb1cae5b6e13572c7e2eacb7369fa
SHA512 7ff4d4e2b4c4e37ff0a687960fe1d69d6f042420359f7a1c78eb1a72eb1c7a83e04a1ae0a59dd1b34603ef613321487829a972841d332329875417057592d284
SSDEEP 3072:5xUdki1A7hpy4iksEMhwGwluthfuMeNd1waW9j/UFJwBGFL:5xUdl1A77yjvEMKGwlGGz1waW9wF0w
TLSH
T1CBF3125D1791A682CA7F996BFC3B774AC51C2D8E8E6521324064C982193DF0FBDA837C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockResume.zip.WCRY

Path C:\Users\Admin\Desktop\LockResume.zip.WCRY
Size 128KB
SHA256 8c1f8096dfa80f723ff051b79c9f0dae4e6bae5cb724b144a05d6f6ec6f1194e
MD5 20f8d0b1d544d964933e51c2d457f445
SHA1 eed35e13aa1b5001f1fa25bee13f693f61c0b218
SHA512 d730b2a9a39edb300ac9b879128c8abaf01feca16d2b576f89e8879ca3c99c655bcc9ce78458e2566611288b3d68cf7f71e785d681c8dcaf50b9cd3cce4996f0
SSDEEP 1536:ItfJ1HK4xFCp4H9yuXe91qa9GHjjGuLp/SazVl37mZMJsPEj21idxbUZRaSxoIjY:kDHlX9ZXDis/pjzVl37mXvMdQP2iWIRC
TLSH
T117D3126FB246692413762180516AEF75C8F3932DEFB96DC94F6D0BC8D0CD183AB60AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeasureReceive.docx.WCRY

Path C:\Users\Admin\Desktop\MeasureReceive.docx.WCRY
Size 416KB
SHA256 2a5d10315b56f800c144529a0658709ea4e5113dc0e46a17c9dff487f45ec33b
MD5 ac00ceb7f51ec1e96aad845264b3ccc2
SHA1 27c91436e04ebb8567186765becc4f037ab1228a
SHA512 9c9ae6efb01bee8e41f0708087ba7739782d1e2a71e21b0b363a4ddc442324f3f24f4e597c3dac18214f5539d6a270036f4cb8c6c341103873dd0e953602d5a1
SSDEEP 12288:axMRe6WzTzEfTDBW9psHXXTIxKM4M94NLlxmu:amn3ZmyTIp4M9kfn
TLSH
T1D89423D0106DBF905A96307FFE32ED0C60D351734AB22969FF9B20E25969171ACCE92D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeUnpublish.docx.WCRY

Path C:\Users\Admin\Desktop\OptimizeUnpublish.docx.WCRY
Size 12KB
SHA256 b1ec5d1d6f643e4ac36d648705650cd31b1ad955bda962137ebe8b7cc222545c
MD5 9e9e316ca211f45da9900e374aa069db
SHA1 915e8dd9563b2fb9933ba0bc94a7e95969ba358b
SHA512 109eb9a17a0618a2674f018e8f3e88546ebe1514a0e728dc426653f7501c18fc0bf4b7ff3d0d699827a1a0d5e23d06790afad28d1cb5d0fe7c612fa0add55bce
SSDEEP 384:+/SzYoS/C/mz10ehpHNCvyBtxGsWhKDiX1aRN1nU4:+qYQOzaUBsPe4aRN1h
TLSH
T17A42C0421EE9CE942EC3BAF661E00FA4027909317FB65607AB617ED95230A056DC539D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingProtect.m3u.WCRY

Path C:\Users\Admin\Desktop\PingProtect.m3u.WCRY
Size 230KB
SHA256 3beb8f18446a2ac543e271a01a9a391e4a2aa343d4b1738cedb22258da34fc45
MD5 4c196e3a039410e8f6aa6a5cb7f6396c
SHA1 f81e880ca266e94e699567032b4e5ef0289ca94f
SHA512 26796712927d1872baa6fece25d8a6e82a92b37b7ad9c1cc175a5b7938977c6941aab1b17d1e01d91a5be34650459a7d827764be047bf2d72c2a6bc8ae4d7f69
SSDEEP 6144:IzQDks6xsALiudckXhYQ5lejoGu1BE7Z9GKQPDhojtBL2S1:IzQIs6xXr3eUGqg9G/DhoRB5
TLSH
T10934231E3E4BB201130C9478159B35E1824E4D6AEC05D68E41B4BF8EDA7BF6D4E21F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RequestDisable.svg.WCRY

Path C:\Users\Admin\Desktop\RequestDisable.svg.WCRY
Size 296KB
SHA256 bf3f0e853e6270929a9a30db1300168159197460c4ab04f4acd9dc1efa6aa8d3
MD5 8cd06cc95ada2c1cc2f291bafda0d4c0
SHA1 e6162feee1b51c40c0ad7fbaed3254c3a6f1abb9
SHA512 37db55ba17bd02e99b70851fdb0e11a62972c77535066bbfba3a96d15ebebe8baa36c5a4ab053507af6fad2ed971a20008aaac16eb5b25c4057950eb4c93f519
SSDEEP 6144:GJxL9aS7NBuzOBoCnfe2XlC/HcxOmfCDVz4+NlC1tgolLt:G1VuzMJD1C/HcxO6C54+Ngh
TLSH
T1A05423329D91AF299015882C5CF30E1C7A16A9FBBAE42F40B90EDA02DB14BD3D274791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RequestUnlock.docx.WCRY

Path C:\Users\Admin\Desktop\RequestUnlock.docx.WCRY
Size 19KB
SHA256 11f02a1b15ca9a0276c3bea48a52b78ced02ed49da6ba3841b809d87f9058a87
MD5 c61a011bfec9346f1d5f8893f79eb747
SHA1 e550624a23abc0bead6263bfdafeb57dfd9cf199
SHA512 4230118970683299aed3de67499431f1ff02f9c5af2ffe71fd6d3d2f3efa39e3e32a0d152c89c7907329a3bf37b9a63ba335fcb51acb66451bb197691be2b6a4
SSDEEP 384:h/3q8DNwibTPy4rqxo+ROgGSK5v8k7Kt8K73Pi6N2wDsOVwQllX4Tb3bAprEkScV:9qSNwyTqtRogGJDut8KrPi6XD+QLX83o
TLSH
T18092D04F2755CECEE0CD60DAB9C8E02F060BDA1D4E182965932087814BA1069F1EA39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveStep.mpg.WCRY

Path C:\Users\Admin\Desktop\SaveStep.mpg.WCRY
Size 281KB
SHA256 6440a94559c95c0cc3d4cc957b8bb99d7b19ab4289742de3db8487baafb313d7
MD5 1309f1a85859c1678815d9d8211e1bc0
SHA1 9d5888b108564c1661f7bbe46583695e8afdde79
SHA512 12546092aca18bf850b4618ad4d9dba1231e662b9714f3c17ce7bcad49a7fab82cf1dc512f963672aa820e26805cb882423e50bc53b42991ded9b1dc51a3f1e4
SSDEEP 6144:4tZoNG/9wT7Hf/bQ4vwuj9Vg4w6/5Cu8HIaV59bMbEojpBvJ1NPK6TP+aa:5c/9wTDf/1vN9Vxn+I+pOjpBXNna
TLSH
T1AC542396106D410F8061EFEBA1B4E8952C16F16692445902F3B68E6EC1D9F21EF3EF6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkipClear.pot.WCRY

Path C:\Users\Admin\Desktop\SkipClear.pot.WCRY
Size 193KB
SHA256 01b31892cb64dbe40071aebe1b9733f33e2166e4ad79095ae4eb2dbffd3e093e
MD5 183caf4ce322e83fbe12f0f513eaab56
SHA1 60d1725e9f4d21a27b711bb2fe05676edb46a4e9
SHA512 aae1532543ed72d29b24e9ea0b215eb5a705ed73e1867cdcde14f4cdcb844657614e68969b4893786ab9e165c25925edfffc561e45c51932c8d2a36d330e21b8
SSDEEP 6144:UTs3SG/ClXObEP6VtfIOA0tAimzZVoojsHNJR:UGSG/MOgSbltAdVdsPR
TLSH
T1831422FE556D96085F36E680E9C3FCD4EC40A32128775BCE8989A61AA4FBCCC451907E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitDismount.txt.WCRY

Path C:\Users\Admin\Desktop\SubmitDismount.txt.WCRY
Size 245KB
SHA256 d8e8196d352997a906f404c156208b5b76cffe7ae50bfee002962d7acb101306
MD5 0030912ae1570f7945c5f7009c7c4b67
SHA1 1f7399f65cad9b062e38a5cf41291666cfb31471
SHA512 0a666d19a49f01fdb92a3e9c9fdd1f57d8d12842dcf7e8e74c36fcd365272599409e5a5a06ce473044f198957f2e5078a854f42c2185ceb04299db1834a9dbaf
SSDEEP 6144:7UG7+Ul1GU2MVn/HPaZeBKHqFevj9ENa1CetvhAETA:7UGCU+MVn/UeBKKFevZJC4vhAE0
TLSH
T15B3423CC82EB1054671F84E19E10E99A3D718DF7DFBB8ED83D68A93508CD2C36646629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuspendRevoke.zip.WCRY

Path C:\Users\Admin\Desktop\SuspendRevoke.zip.WCRY
Size 201KB
SHA256 26a60edc1a7cb2fa17e2819cf94c754fc2eee629b9b35506e183ddf040a30055
MD5 362299cde6446d4a54dd40a591f9da7b
SHA1 2a97d0f9dbe4ed955be85c14b4599996ed873853
SHA512 297d8e6bbb53e4bc273c3a4f8e48813d29697f2742874ee5ec78fb43ee0c1751c4409bb8d78d83445cede63c6450316651c21197ac3b7912b054c693df2be5ca
SSDEEP 6144:Vg2qaWkdTkbVMYWCHiqe0fCD/4Bp4ubQo:Vg2qaW9VMYWkOD4B6ubv
TLSH
T154142324F22E88DF01132B6E20D9C0DF7F67865E436C095DAD6E69BF7B46709E152078
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestImport.xlsx.WCRY

Path C:\Users\Admin\Desktop\TestImport.xlsx.WCRY
Size 12KB
SHA256 f270976f83c4110ace8bae406594fca24d6ace8db9e89b3a3fb02c720970e99f
MD5 bb66f1ff3b031687c7ab6fb87296d25b
SHA1 63f82d28c10adfad5ba62c95a463dad3b08379f8
SHA512 4b6a8b631c9ec32081434fe7f0fa9c81d7f943135e38689f2079a1322673450965fdaba0f3fd27e4146bd6a6c839277c081037c340144ae23b2e224e89b295ad
SSDEEP 192:loZKaUctJVZbyLol5xNSnLjvwHa0e94zGefNT5XCDzn+YLzZAPUEvRkhCd1JElXt:aBtJVZbyKJSHatT5XCDzXzZyUcd1ad
TLSH
T1FE42D01BD9D589260E03A64E9ED033E745D484B303F8C273CB971976C99FC819AF4AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertRegister.pdf.WCRY

Path C:\Users\Admin\Documents\AssertRegister.pdf.WCRY
Size 886KB
SHA256 dd0d88fbead4b7a245683f9718ffda7b56741492a99cbe333834b03420c744c9
MD5 b5e6e2a2e92f32bbe2f0bdbd66ac5941
SHA1 bd54d0e78b6175b32ac82e9b70e760a88327b4d2
SHA512 cc281e9ff5db6a4d59772a60c38a2c5e07bf0b3ed4bbdad0c6b0d903388f24e9914e0cbf4464427fa798ba8cd185a0e91f9144b3f0438ddab8d769c282c57439
SSDEEP 24576:EQ8oLfYD6eQ+ZVOYh1yVpnDZnFmgZQ0OSMvYi4:Jfjevh1SFFyNvY
TLSH
T14A153374EA6E73A51528EF01E826FD16FC9244C394385EC280ADB02BE770FA547B741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseResolve.ods.WCRY

Path C:\Users\Admin\Documents\CloseResolve.ods.WCRY
Size 518KB
SHA256 feeddff6465e01f924f0c179dd8f97b9ee0b649d9f99eaa997f892ffc61bd4a3
MD5 b6c0566da68b71371a5a4a97f7ce075b
SHA1 29d501f1a67f4cdab10429d904ab3c7b8917babf
SHA512 8482e7a5053267a38737b1a6bbb6492dfa7ff9e4abc547e90153dadad09796b81dd97836bdd83b0d9c06641525915f286bca8d232d1942872ef39c30478ab09d
SSDEEP 12288:WK+M5KTcKmeyPC5tNpOfXme1PPixIyN4n65PaCF6:r5Ktpc0qlPPixT5PaCF6
TLSH
T115B4238BB29AFA9D15BC8F015120E682EB79769C23F6989488C5DFCC447D15C8D0A3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressDeny.docx.WCRY

Path C:\Users\Admin\Documents\CompressDeny.docx.WCRY
Size 816KB
SHA256 7f67e814ff00e2e0e76bf3d39e9325f7d5c1dee5873add302ddc51df7b734a1c
MD5 27478ac3a10542173be65e9a918339d1
SHA1 906b4846c61fb66cbb0e7ff06bc03f7949daf523
SHA512 9fb3bf0ca1de40c9214a095e5ad1b869397512b107abe638f3177d2b2ffcec0b6c0f8534f7dc0c11110120c9c0ef0b2e12348caea55f773aeac56b576f495ea5
SSDEEP 24576:u/8u3BbW25LGeq8o2l050BlT7KwQ6zREeg:uEu3BaMLJ0Wmr6dEeg
TLSH
T121052303346219C9072B396A4164BAAE4A1037E57AA77D63CB34D103DA3BD13BEEDB45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressPing.xlsx.WCRY

Path C:\Users\Admin\Documents\CompressPing.xlsx.WCRY
Size 781KB
SHA256 7099f1544f3be791da0454ad2cba112c111c62949ab8c8675a3085d014caa0e2
MD5 4c6fb50ebd3afbb4c5b2cc65f7cc337c
SHA1 cf0d0bcaba4e02c9c6388896dbfedc198b44aaa0
SHA512 ffae9edf0311c1fd4982835bba804552445f855267f4234befc118b2dd912dab1a67b392977fe9752547644a667653addded8e8f2dc2acbe2b0638da1d6e4e99
SSDEEP 12288:MwNfZOxqnpPl6muNGqki4jLkRA6/hHHQfK7VXQrntDbrwN2qo83q1A1:MwpZO8ZwbUqkiS1OhQfIGrtDTlkoA1
TLSH
T1C60533FB14C35E0381E564AD58FD6155EBB56378BCB769924C18C836680FEA63FB8038
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromCopy.xlt.WCRY

Path C:\Users\Admin\Documents\ConvertFromCopy.xlt.WCRY
Size 535KB
SHA256 9e2a483b56a03f070b203a8aa85a4811a56f86e47b2edc7a55ed7573cde48312
MD5 2476ba561e6cf9d406c2cb7b8d6043c3
SHA1 e88982cde004bfcd6c45454cf2893033b433ce1d
SHA512 58ca72cb05c4a5d6a8152628014ca5b61cbb1253ff89f6a5071295cb9f03592b2f2329cd9f7a9e148764a0c81bd1a8273149e0100f16c72915341ed40ddaa523
SSDEEP 12288:KXPvyvzQIktTcEFoqIscG7UwMgyKt6Y4HxI3dp:KfvyvPOc5qjvwXYUYyxI7
TLSH
T165C43349177FB7ADB90C3F2E747FF2B472DA5B91BB7646E3D120C509821081A89E04E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToGet.pptx.WCRY

Path C:\Users\Admin\Documents\ConvertToGet.pptx.WCRY
Size 465KB
SHA256 e00121bdb66d4808922641c284e1b5f5360850278e90c9db903c077baaa5fa90
MD5 46a9c3096873c8af1236a41509e12bea
SHA1 e2877c673941b7b455f686f1278ae28fa731e301
SHA512 3fba6c9f08bd122c2ccea8d42241627dd83fef6859d9ad6329c3b055724d7b0a12788eba7954bbc11103b296ddcb6449c839a43f9ac6c33abdd43bf34212e5bb
SSDEEP 12288:XaOZ55WCS/UErPm49uUoKS5MApYHoTbOyhaxTi:Xf5+UErPmsuUoKEMeaUbPAdi
TLSH
T144A423EC5461F99376003CF69A8858177BBE70C9E0D1096A23F602E6BD8C8DAD754F68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisableSkip.odt.WCRY

Path C:\Users\Admin\Documents\DisableSkip.odt.WCRY
Size 430KB
SHA256 505e80642af4434e1927bc2fa38cf29108f04790151a02253fd84763ee597017
MD5 be23af118d7435ce90f7e498cedfbf4b
SHA1 3fb12de384a603ea6bd79d22dfbd02487a6f8154
SHA512 f93b93179dc2cded0f4243bbb249431cae2e37024a5279ffbec2a96a328bafaf9f6b7805ca7a7fb8d552060adbfca0744bf4bce10c899c572f6251c0a4884265
SSDEEP 6144:NZf6o97J0NFplMimF3XuzD2CINNLM0TzCEoszP3JtKObbBsWABK4CsV07fO/cgfV:NZfR9FmFprDyZNtTWE548bBDuLQmUccq
TLSH
T16294233296CDE5DB799700C905AEDE0D3A1BCA95E8356C33C05711027DA4F3EBEA18A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportUnblock.ppt.WCRY

Path C:\Users\Admin\Documents\ExportUnblock.ppt.WCRY
Size 342KB
SHA256 38d24ee3d03f39a97d8fd16a915dfd8450f9d6ed7229e86ebdd7255bf095d393
MD5 e002162621fdbab8c77c19ababb2eb1a
SHA1 3db7a47c4c0651d287f601230659ce913b0feafd
SHA512 74f3add6619a3f0d8e582bcc0222f18f7ed726451a1dd94f17d83dc87d5a377b69b558c6262a3a84b4b900a44e7e0a542c1ce9d5c9b09ff38ba6f3cc612b6d2a
SSDEEP 6144:hyHXvDCUlQ77FfQQCCq1D5dZLCzHqShZ6MP/39s6ifo:g3vDCUlE7ZwCqNSHqSuMs6X
TLSH
T1D574233CADD19494A22766D28781337F68E77A7593030FBDE01AD358A39C1BBE04375A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetComplete.pptx.WCRY

Path C:\Users\Admin\Documents\GetComplete.pptx.WCRY
Size 307KB
SHA256 dd40f0aa7071b2f6b8325aef6bccd441159fca15119a159858f5fdc74e52abd0
MD5 4614cbe86a59cb79af5ef8c17e69a991
SHA1 bb9965955a196fce952202e0163efe6b8d951d2a
SHA512 888b508d65f03cc0f3e916231b20f763a972f0a2547ec03bdc3706ff77142e5d75c63089bcfdba26bc8e8b8f4d884666e318fe7bc9bb39c492e0670aa52d18d6
SSDEEP 6144:ote6qIgt52tVoccYjBm5oAK+T7dsqifPYAVHioLtmc6RtrbR+Ryb/e8:ote6hVo/S1+ribVHFLtQbr96yLe8
TLSH
T19564238E8F4C51C9B63C025E6B5171909B6A1CE2A7CF5A9FA7C34F10DA8C3918EF581D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportConnect.docx.WCRY

Path C:\Users\Admin\Documents\ImportConnect.docx.WCRY
Size 15KB
SHA256 83b8d3aa215730b337a3935807657c33e044927d432f9619bd17fac0569f226f
MD5 144b68ac42995c557bb8ba4b8335cea8
SHA1 a1f6e2e348202b1d4fa8e9183b2c7e1391ecbab3
SHA512 c42c59b63f29cf121bcf0eea1ef12e4013b63dbf09ec6a3de13e94217635b0ca6897a7f12baf0ab19bdcf5f846a4accf740b08e8b45ad83b04f73b21b8577087
SSDEEP 384:O1KTaMLXPKQvX/7SD7LgtJKoPRBMquQqXpmX:OUTa4XF7S89P3F8p0
TLSH
T17262D00796ABB0C40E069262FEF40EDA346692C0D92DC34092BADDDD2D5CF16ECC47B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InitializeGrant.vsd.WCRY

Path C:\Users\Admin\Documents\InitializeGrant.vsd.WCRY
Size 483KB
SHA256 88177564cc07ce4cb6b4a82d3c074b8951e5f5f3442c7f0138db6375f08b8208
MD5 df40ff26c0649863d4d69348bfd2f291
SHA1 d9452c9e827bd18bbc73ceec16344c25d205f2c0
SHA512 04f90295baeff823db3a81ac98612b1dd846d82613bd79f41018e23952d5d369daff02fe9810e1c1bc5e11ba5db9d5d057946ee5032512296981a529a3307a1e
SSDEEP 12288:FDTLWur3w5qgzzOaNz6Gm2MfHl/C8rtxSpp2IRyXVhpkKqtCRtN:Yur3NsOaFmJBCrx0XVzQt+
TLSH
T17EB423256A9D1D45146F9060B5371B3C279226CE6ECBE8927FB30889B74D6FE8BC3143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallDismount.docm.WCRY

Path C:\Users\Admin\Documents\InstallDismount.docm.WCRY
Size 763KB
SHA256 045553c17ba0a417a2b00b2812b95e1cd0c51d0d3349466a58e140853cec810b
MD5 95a29b612153745d24c6e3e861e62770
SHA1 8a28dbe238d97cb583879ecb527e4b4c519bf87b
SHA512 554ad957ef7f4949ac0e78516881c21dd0e520d0fb3b5b540461ba11349bd54e657726d4fbdd56211ba55098a49e89d200a833487b9f57ba526207337d4f4f91
SSDEEP 12288:1HHSlC8CfKAr/hIB9knEe4v5xye6mk0O1C/Oh2kYM5T7xNuwMIu0N4Sv04n+cSXZ:pS+iArZA9MEe40m5oCmhiOf89g9v0LXZ
TLSH
T1EEF4330F7B752B8966830567384705193CB792EC2BD3395AB0A4BA2F7843DF468F7285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Open Notebook.onetoc2.WCRY

Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.WCRY
Size 6KB
SHA256 3d835dc1b82396e980d7605aa0a6bbada231ac130b0bae3d29223a9d09ce4cce
MD5 b52e6d046c449f3516ae827cdf8493ad
SHA1 4708a71f4335b993c7047f1286896639d573fcc8
SHA512 edbb35ab8aeaec2838622f9316b9115a0ad52d899ec5ea47e3097d9b503122ebc8f5b37ce4c10d77e98f8a7a94837c4f590e2b0faecabae43c2fd86dbe75c581
SSDEEP 192:H8t9VVpW6h6NiXN3a2fP99N3Hi+oDrZ868OG:cfUnNiXN3acLNcDCz
TLSH
T1A4D1A000F7BD8BD903BCD0E4B0BC42843AEB8C02F2A6CB455B81D865609709DF2758C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeCopy.dotx.WCRY

Path C:\Users\Admin\Documents\OptimizeCopy.dotx.WCRY
Size 711KB
SHA256 3c02340137fad61b84d3420298f691aeb1c9a0100d72633a6d2fdf326ca37889
MD5 12cbaf803e26c99fbb7430219e76e733
SHA1 8d9deb77fbc2d2b9e4dab1100534f54b4439b745
SHA512 da97b2efdc259662d37729f3e690b6766c827b2aa91ffc5881f5da8dfd01a7940971aa77422892f62d5ca60e60a889c0e78b753fe607d2369419889703553ab0
SSDEEP 12288:MAkk4P7Q81zLdxLB8nr1EdE1+KTxUolmAuUeV0eQ1r57xPsroOe1n:ikWQ81zpH8pEdmKolm7UeV0pR57xPsrI
TLSH
T1AFF423AB52004FEFD42D94918160FCB7F8C3616322E222B18B77E3EE5A27155B7958CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Outlook Data File - rcamhngqtd.pst.WCRY

Path C:\Users\Admin\Documents\Outlook Files\Outlook Data File - rcamhngqtd.pst.WCRY
Size 265KB
SHA256 ceb423a991492586746937844912803b3e5670d81571aa1e23f509052d230830
MD5 17428c5fc4a7f19161707c8daa09ef9d
SHA1 4d67d6a3560b4fb4c1518537ef20cdc4d93c0bd5
SHA512 201e21bb4f7ab3490f21dc32f465fd3ba266dffb916a04fbbb29475cddcf4b69836e5902f0337b2a5d98f906e8cc6c340f01e5cf14a005a5b80f01330e6b2cc7
SSDEEP 6144:byuNuw1ITq2tUtc3N8TXETjbyP3Y+yEiSCUunWgUMrna75zXrSAf83Ip6:mcN9cyvY+yVSCk6nO5z7Ssw
TLSH
T1374423FE96804B3057854EB1052AAF783F9E7B1EB16D44AA6F48DDF5F60D60CC2242E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProtectConvertFrom.xlsx.WCRY

Path C:\Users\Admin\Documents\ProtectConvertFrom.xlsx.WCRY
Size 605KB
SHA256 085caca114a8dc3617364237ac1a99daed4b5ddf4c6f3d1ce50cdaa985fd7620
MD5 d490e2ed19e2645e2b69ed7f1101d389
SHA1 72bb99a3dd543080e4e62c56676c705bc7992b59
SHA512 f0007db1f9e6fabc48590a0c0cbd97b2822823aefc9236a645f6011277d869bbc8519ec2d8921b70a4eceb876e7858d5f6950bc73030da6bc1f62037d5218edb
SSDEEP 12288:0ncWzxK2g1e2V7Vhhby2+qip1b2+SWVQ30w40VWYo/bUdHK:0dWfVpjiBl2TWC0KV1KbUdq
TLSH
T1C8D4235BAC3CEC6D7C428818B37B2268772906D0C526A94B14DDB8B1CDE3D6D948FCE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PushUnblock.potx.WCRY

Path C:\Users\Admin\Documents\PushUnblock.potx.WCRY
Size 377KB
SHA256 91fb7bcc24948f39338db8d1465f72079a943fe473b17b467cb2eab713ac93b8
MD5 b5696c84e90ad9fdbd263403ad649545
SHA1 a33109609ef06def7095fad8a6f540b3fb638f43
SHA512 00a355d0b7e6f825fcb81ceb5474e2eb71329af51806d24bf47bdafbb414e41e6cef759fc1356afc135d446d4147225fb5b73dd08c7b31c6562d43a7db6fcb77
SSDEEP 6144:ghLfxTr9hOR9FCQqvfMRgFQbNzItTczLtp5cS/sN2hz+e6uOiyKBnhbRi+3/o:Oxr9hs9WnM6FEN8MZ/VkKjnhbQq/o
TLSH
T1F78423D662E27BB52939DF3D447BBCCE99FD6340C84C5CEE495B090A2D8DC4210626AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReceiveInvoke.pptx.WCRY

Path C:\Users\Admin\Documents\ReceiveInvoke.pptx.WCRY
Size 851KB
SHA256 fe7b0763edc9de7ab974a76d91b874c039539d6d11137913a4947f6b4cb9ba11
MD5 f0b6fe169af03da6dc22442f6593165d
SHA1 00278903d74999c5fec50852bbbbf43f9541f793
SHA512 8098fa52ae5688f802515840d165905f04addf67a5bdba8a0851251c53920e25bb511940be77c686cf74507ae7b9df2ff1958a8afbfd491bd123b5806d32ed38
SSDEEP 24576:FnurjIzxFESl6yMXyay56mp6aR5UtfGgByfGZ6yP:5OIl60a8z1Rism2GZ6yP
TLSH
T1B1053353ED87283DD152203A4F5826E2409AE82F71DD563D429D0394B7DFEE428AEDEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairUnblock.docm.WCRY

Path C:\Users\Admin\Documents\RepairUnblock.docm.WCRY
Size 553KB
SHA256 c28bd071a46207546578d14508b61d29bbe7d421ad5ec513f9996bb47f16e9e9
MD5 750f6aebc5a9e64be6048b68d507cbf1
SHA1 0566ba4bc091994ca2cb77e8a564d3ea0037d4af
SHA512 2d7fe39edbb9d023a9d0fe0aa57a8ac309c01c615ebeab6d2376385b35070bd20e8ebff40305946436ec9e73233f81d4d0e2bc44cc4dd647cffde5d912567cd2
SSDEEP 12288:Glfui2zms8LwuNxeT7zukjFnozxKJgsfvBLi6psDX332p5soRvmS/K:Gp2z/8LrNxe3zukhxJBnBWYa3cscvmr
TLSH
T151C423854A855ECE2CAE112F1C9A72920F00F4CEB5B3CB489FE7579818AE7344F55B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartStop.docx.WCRY

Path C:\Users\Admin\Documents\RestartStop.docx.WCRY
Size 17KB
SHA256 793f9ee09102ff54a24e027e4ae793062898f6b9f77a38dc6aa2363da2d2306d
MD5 a60fb3f1609d402b75a3c59081202d77
SHA1 765916dbfe2c1ff3aec4b5edc252ace77d768317
SHA512 03ec8b6c43ff186dbc401dc2d83bffb3e82f0f18d8cc5540b0530e60bb02966bbfbd6812acded12cc4019a1088b3ea5a2d5b2ae1b39ec00a7865e1756e495c6f
SSDEEP 384:u8xt2X3LW6uZWXg5IcIRtcfBOwHCo/ftAXiuDdk1aZio2lxE1H:u8xQnalpEqBOU3uSuDS1aIxq
TLSH
T12882D17B5019C1BA448E6F2C34E34D01D1154DD14BFD674A1AFB06653C8FCA28E39E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevokeEnter.doc.WCRY

Path C:\Users\Admin\Documents\RevokeEnter.doc.WCRY
Size 746KB
SHA256 2bc30bbce60ee0c337ecb098c1736094f3274b69c4e866d3dd478880ebeda329
MD5 257856cbbcb06404da4dbb7ca5506a4d
SHA1 c2bb15cf681917c98864fb0645476b2bae86ef29
SHA512 fdb5010e68edcf24dc102d993f9e89047fc4764995b40b1a513ff1713c7e42b8263ae77b5fb7274d2ee3855e680a3e75f0a183d619371f5d4d97db237916f1c2
SSDEEP 12288:ZjFJSpkZ7U3lxR+nQivdhPULbKDQ9T4kmAotR+xqCxXPEAEsPV85SLAPRKkw44:Zjj1VU3svcL2uT+Aof+xqCxXPEAEsP6g
TLSH
T152F433D723B7DCA33D877EBA52D9DA019689478AFBC9CD21605CE41680BC17D98FAC10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchTrace.xlsm.WCRY

Path C:\Users\Admin\Documents\SearchTrace.xlsm.WCRY
Size 641KB
SHA256 6996f2cd184e2d3808695cf126960319e27ebb75491ef0d7a27df2ceb219b250
MD5 b1fde81a96ae3d196d794f2f51b86c1a
SHA1 89d35f18fe9849d671050134670e9243c3126b99
SHA512 0bcf20981585791b967df24bed1707408f283626837f314f981da00208be71a0919cd6ad8626a03001d0e4a60b1d2bcc851437d80b9326ecb8e2f26c8becc301
SSDEEP 12288:0Ei4ccFY2TeaHjSp8SgzmKT98o8nLVgSrelJDbF1K3IB6xmIhJ:0EIcFFTeKjcgy2pKLNrcJPnK34KmIL
TLSH
T1C9D42310892039D7B7B6D2B2E4F46E92BBB04D197F48DE778E52400F3ADC9291D5E89C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectOpen.pptm.WCRY

Path C:\Users\Admin\Documents\SelectOpen.pptm.WCRY
Size 799KB
SHA256 e747104829e3ed2a24aed8cedda43c8db1ce21ce5c92de0f819dc44a7413a3ed
MD5 e6ee59a9cbbe0aed315914e5410eeab1
SHA1 5a8b7832c551dda6470c88e2f350b493754bca53
SHA512 6e7dc3cc87e9e55233b54fe855e28f2e272b34577d4c785f46e0464ca516b8355d29dcb3de2949b38685547ee7d9a88c57c68ef7bfe01fe0bcb92aa77c6e4fe1
SSDEEP 12288:5DgN0XFzsXZjGQvMRebjT7E4ZgF/XnyjlnMXLtBneM2ohQ9fL4D7lV:xgaXFzQZjGSjfE4ghYl0nWHslV
TLSH
T1E5052300332DD983366D1652524E7633A472CBC67D80AF570AE47F6CE5589D08EEB2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StepCompare.vsdx.WCRY

Path C:\Users\Admin\Documents\StepCompare.vsdx.WCRY
Size 658KB
SHA256 b93e7fd2fc8bd452cdc4c69c73d83970bd1114e3ab295365cf3fc6ef14d26d49
MD5 4784ef5a74e771a0223e5a7443d2efe7
SHA1 374dedf1e95cbf39bfc58ad58e26e6a633c957dd
SHA512 200999bdd805d67fe6102726424a7aaf21a6a62bcd89d303cfe0c08bd88efe16febd2321f4fe25d4d5d43d37c316cbd7983e89f82fdb4ca54c18756a37d1e03d
SSDEEP 12288:wA5G4oClfM0Ms6bVaXfRs2IjCBO0KEk8bAtSLa9xxC9:D9fMBs6sfC2IhEk8EtKaZY
TLSH
T105E43318A895656A43787AFFB187E8A8319D92EF7E181EF9C722C6D5419FFC0204172C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceLimit.xlsx.WCRY

Path C:\Users\Admin\Documents\TraceLimit.xlsx.WCRY
Size 13KB
SHA256 e3ddf91d836461163f5c9435714d757cf7068920d2eaa3cb5459399bc43a7951
MD5 37642009f891694568f12042031472ca
SHA1 2d461de1c09669ae4bebb4d718e1a13226787c76
SHA512 bf017769cd4f3b4f46d47b71f96f36be5d86070f35e07b66236451a1e2944006d0486249352e570349868bf7e9cfe9deae964d095971121e550b0c0135aa67f2
SSDEEP 384:R6sqfaFwF0+pnImj8ONAOWcB0z2BQNr2DULH:csYX0+pImj9AOWcB06BM2Do
TLSH
T11052C06CD7CD4125936ECEBE11C4004299B55AB23AE65DD37F344AA80CEC210BCA34AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UninstallSuspend.docx.WCRY

Path C:\Users\Admin\Documents\UninstallSuspend.docx.WCRY
Size 19KB
SHA256 ea6c17e00d0135f9cd85f3d7feeffe8125201a14a554f09b584692cc939b74d7
MD5 370e25de1b035e5039fe9ae13250942a
SHA1 914917a6b6d56a5bb712dd93989c1867a7e363c1
SHA512 9ce4a39d8f2fb37cbff9f480d85bafa2b6ca582435e0268d8c2f74d34b525acb82cf1bf43debe8a4a22bc5fa76ef15bcd66d649fa76cc38f4b660f8444034d21
SSDEEP 384:6Z8EQFYZlDDltOcpxpsnT3en4Ai0v6eeiHrqbueytUxmGNtex6YVLR8jk:fEQFgdDOupWunRnFVHebcsVNkxV5Wjk
TLSH
T12092D0EA23B20CCE19A1F14E0F1593F24E4204F8F58A04A8F5F78651BAB81B0668DF75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

!WannaDecryptor!.exe

Path C:\Users\Admin\Downloads\!WannaDecryptor!.exe
Size 236KB
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5
SSDEEP 3072:KeJJ0eIVAnbWOECR+uJ/0EJzBelG4t1nXFnQamKNQHFZde5tHEGaa:bqrVOEgZJcYelG4tQamKN2ex
TLSH
T16A34A416ACD3812DF3D736B88001C7BCA8A72E1095261B7BB694F8DC18367E5CE6651E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

292181792816591.bat

Path C:\Users\Admin\Downloads\292181792816591.bat
Size 318B
SHA256 4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44
MD5 a261428b490a45438c0d55781a9c6e75
SHA1 e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e
SHA512 304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40
TLSH
T16CE0861D7588F57512435242C93EA1EC91D55C925702AE18DFB7ED54A6005BC096E003
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 895420.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 895420.crdownload
Size 224KB
SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
MD5 5c7fb0927db37372da25f270708103a2
SHA1 120ed9279d85cbfa56e5b7779ffa7162074f7a29
SHA512 a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
SSDEEP 3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ
TLSH
T1A024015A7A61877FD0B20532746194FB4EFE0DD3F5A89A4FE74D0A501F048884BE3A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c.vbs

Path C:\Users\Admin\Downloads\c.vbs
Size 201B
SHA256 5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1
MD5 02b937ceef5da308c5689fcdb3fb12e9
SHA1 fa5490ea513c1b0ee01038c18cb641a51f459507
SHA512 843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653
TLSH
T1DED0122EA4D9E9675263A153463AD64CC5E258607B21B7119F92EE08736043C0E7E043
MD5 SHA1 SHA512 TLSH

Submit Download

c.wry

Path C:\Users\Admin\Downloads\c.wry
Size 628B
SHA256 bf22e8e18db1638673f47591a13d18ee58d8c6019314bab5a90be82ae3dc9538
MD5 663e55df21852bc8870b86bc38e58262
SHA1 1c691bf030ecfce78a9476fbdef3afe61724e6a9
SHA512 6a54be1fa549633a2fd888c559207437b8f6efda98bb18d491c8749f39e9754f1e680fa8e2d623777b5f665b2c04d19385c75ce4e61fb251db16018963a9a6f9
TLSH
T155F012046281190CDD18023D001045538530CB4412008B8244204042827C1F36844134
MD5 SHA1 SHA512 TLSH

Submit Download

m.wry

Path C:\Users\Admin\Downloads\m.wry
Size 42KB
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496
SSDEEP 384:S9sLTK3SWTsPzy3EFejoJQBO21z4oCTeo75Y3kmA31dv61QyU:S9s3mjoJb21zZrS14I
TLSH
T12D1320B800425795D26323E4FB27F0497B2BF41464E584D876EBC2BD717FDACE660A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r.wry

Path C:\Users\Admin\Downloads\r.wry
Size 729B
SHA256 c9e9dc06f500ae39bfeb4671233cc97bb6dab58d97bb94aba4a2e0e509418d35
MD5 880e6a619106b3def7e1255f67cb8099
SHA1 8b3a90b2103a92d9facbfb1f64cb0841d97b4de7
SHA512 c35ca30e0131ae4ee3429610ce4914a36b681d2c406f67816f725aa336969c2996347268cb3d19c22abaa4e2740ae86f4210b872610a38b4fa09ee80fcf36243
TLSH
T10001106EAE5576110BB1C972317EA157FA06419F022D0262BC0A913D17BC17620FB4F1
MD5 SHA1 SHA512 TLSH

Submit Download

t.wry

Path C:\Users\Admin\Downloads\t.wry
Size 68KB
SHA256 a7dd727b4e0707026186fcab24ff922da50368e1a4825350bd9c4828c739a825
MD5 5557ee73699322602d9ae8294e64ce10
SHA1 1759643cf8bfd0fb8447fd31c5b616397c27be96
SHA512 77740de21603fe5dbb0d9971e18ec438a9df7aaa5cea6bd6ef5410e0ab38a06ce77fbaeb8fc68e0177323e6f21d0cee9410e21b7e77e8d60cc17f7d93fdb3d5e
SSDEEP 1536:L/MNGh1blJ3aMfSSPz/chKRb7Z3DK1YwVp2sQ6plKRPNV0BCg:L/sQES7b/jZ3AYgp+Na
TLSH
T1376302D7EBB42A9F7E210D483894BEAC3325834644F3515FE091DF061A68BBCA39529D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitStep.dwg.WCRY

Path C:\Users\Admin\Pictures\SubmitStep.dwg.WCRY
Size 576KB
SHA256 335e367542517455f5661ffe9a96c9460df4f4ffa81a57869acfd5f3271078f7
MD5 c6fc23ed6c6803b14f73a286bed05485
SHA1 d3f4868b73c05d7dfe9c10739eedeb6fc6437588
SHA512 3463aad7cd3f3431a32eedee0095b8b4c041fead93a856cb39552a42b6e664e621550b7d0518c002e66d99a62b44d6519c0ca5d1a5dd5d07b31c5155739320fd
SSDEEP 12288:Snpaiw4jE9hcLDQvmKnCLgzWZMl0s1KdhbE8mElz/oqbFEtQwf+pGTt:SnpxQULDDKnCHZ0cFo+cIFWT+pGTt
TLSH
T1C1C423AB0DE09C069E966D34CCE1BDDD19ABB677C368589E2BC45F51C4884CB39AC702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateUnprotect.jpg.WCRY

Path C:\Users\Admin\Pictures\UpdateUnprotect.jpg.WCRY
Size 576KB
SHA256 40f75158453c5bbbac438b92797cf7c5e006529f3e9252d00c8a709007553d04
MD5 304984c8477375117a99ed5a048801ca
SHA1 bbb73a1e864eb43514ae54213b9a45bd49395651
SHA512 46ac07116c8f81e382d8215314cc1b8dfa44d08b8bcd35bb0659e4dc6c9fcd260b5de570013fd043c513b4176ba591d65675bf58d7c28e139102e97f726206a3
SSDEEP 12288:6FnP8UUiIANqnBlWyfqOMng12d3MOMk5/95+VjhLHsw1/Aa2DW:QP8UbIAEnWyfqOMniq3t5/+Vjh9Fz2y
TLSH
T1D7C423F62719F88D08BD685438191161D582CEE67DC320DE39E9BEF6096F021B89D6FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2284-405-0x0000000010000000-0x0000000010012000-memory.dmp

Download